Merge master into haskell-updates

2024-09-28 00:15:51 +00:00 · 2024-09-28 00:15:51 +00:00 · 73a431e775
commit 73a431e775
parent b341506a8d efabdd83aa
119 changed files with 1769 additions and 881 deletions
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -92,6 +92,11 @@ lib.mapAttrs mkLicense ({
    free = false;
  };

+  ampas = {
+    spdxId = "AMPAS";
+    fullName = "Academy of Motion Picture Arts and Sciences BSD";
+  };
+
  aom = {
    fullName = "Alliance for Open Media Patent License 1.0";
    url = "https://aomedia.org/license/patent-license/";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -18703,6 +18703,13 @@
    githubId = 34161949;
    keys = [ { fingerprint = "155C F413 0129 C058 9A5F  5524 3658 73F2 F0C6 153B"; } ];
  };
+  sanana = {
+    email = "asya@waifu.club";
+    github = "AsyaTheAbove";
+    githubId = 40492846;
+    keys = [ { fingerprint = "B766 7717 1644 5ABC DE82  94AA 4679 BF7D CC04 4783"; } ];
+    name = "sanana the skenana";
+  };
  sander = {
    email = "s.vanderburg@tudelft.nl";
    github = "svanderburg";
--- a/nixos/modules/services/continuous-integration/jenkins/slave.nix
+++ b/nixos/modules/services/continuous-integration/jenkins/slave.nix
@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
-with lib;
+
 let
+  inherit (lib) mkIf mkOption types;
  cfg = config.services.jenkinsSlave;
  masterCfg = config.services.jenkins;
 in {
@ -47,16 +48,16 @@ in {
        '';
      };

-      javaPackage = mkPackageOption pkgs "jdk" { };
+      javaPackage = lib.mkPackageOption pkgs "jdk" { };
    };
  };

  config = mkIf (cfg.enable && !masterCfg.enable) {
-    users.groups = optionalAttrs (cfg.group == "jenkins") {
+    users.groups = lib.optionalAttrs (cfg.group == "jenkins") {
      jenkins.gid = config.ids.gids.jenkins;
    };

-    users.users = optionalAttrs (cfg.user == "jenkins") {
+    users.users = lib.optionalAttrs (cfg.user == "jenkins") {
      jenkins = {
        description = "jenkins user";
        createHome = true;
--- a/nixos/modules/services/misc/gotenberg.nix
+++ b/nixos/modules/services/misc/gotenberg.nix
@ -244,7 +244,6 @@ in

        SystemCallFilter = [
          "@system-service"
-          "~@resources"
          "~@privileged"
        ];
        SystemCallArchitectures = "native";
--- a/nixos/modules/services/networking/i2pd.nix
+++ b/nixos/modules/services/networking/i2pd.nix
@ -1,17 +1,17 @@
 { config, lib, pkgs, ... }:

-with lib;
-
 let
+  inherit (lib) mkIf mkOption mkEnableOption types optional optionals;
+  inherit (lib.types) nullOr bool listOf str;

  cfg = config.services.i2pd;

  homeDir = "/var/lib/i2pd";

  strOpt = k: v: k + " = " + v;
-  boolOpt = k: v: k + " = " + boolToString v;
+  boolOpt = k: v: k + " = " + lib.boolToString v;
  intOpt = k: v: k + " = " + toString v;
-  lstOpt = k: xs: k + " = " + concatStringsSep "," xs;
+  lstOpt = k: xs: k + " = " + lib.concatStringsSep "," xs;
  optionalNullString = o: s: optional (s != null) (strOpt o s);
  optionalNullBool = o: b: optional (b != null) (boolOpt o b);
  optionalNullInt = o: i: optional (i != null) (intOpt o i);
@ -54,7 +54,7 @@ let
  mkKeyedEndpointOpt = name: addr: port: keyloc:
    (mkEndpointOpt name addr port) // {
      keys = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
        default = keyloc;
        description = ''
          File to persist ${lib.toUpper name} keys.
@ -162,8 +162,8 @@ let
      (sec "meshnets")
      (boolOpt "yggdrasil" cfg.yggdrasil.enable)
    ] ++ (optionalNullString "yggaddress" cfg.yggdrasil.address)
-      ++ (flip map
-      (collect (proto: proto ? port && proto ? address) cfg.proto)
+      ++ (lib.flip map
+      (lib.collect (proto: proto ? port && proto ? address) cfg.proto)
      (proto: let protoOpts = [
        (sec proto.name)
        (boolOpt "enabled" proto.enable)
@ -178,10 +178,10 @@ let
        ++ (optionals (proto ? outproxy) (optionalNullString "outproxy" proto.outproxy))
        ++ (optionals (proto ? outproxyPort) (optionalNullInt "outproxyport" proto.outproxyPort))
        ++ (optionals (proto ? outproxyEnable) (optionalNullBool "outproxy.enabled" proto.outproxyEnable));
-        in (concatStringsSep "\n" protoOpts)
+        in (lib.concatStringsSep "\n" protoOpts)
      ));
  in
-    pkgs.writeText "i2pd.conf" (concatStringsSep "\n" opts);
+    pkgs.writeText "i2pd.conf" (lib.concatStringsSep "\n" opts);

  tunnelConf = let
    mkOutTunnel = tun:
@ -200,7 +200,7 @@ let
          ++ (optionals (tun ? outbound.quantity) (optionalNullInt "outbound.quantity" tun.outbound.quantity))
          ++ (optionals (tun ? crypto.tagsToSend) (optionalNullInt "crypto.tagstosend" tun.crypto.tagsToSend));
      in
-        concatStringsSep "\n" outTunOpts;
+        lib.concatStringsSep "\n" outTunOpts;

    mkInTunnel = tun:
      let
@ -214,16 +214,16 @@ let
          ++ (optionals (tun ? inPort) (optionalNullInt "inport" tun.inPort))
          ++ (optionals (tun ? accessList) (optionalEmptyList "accesslist" tun.accessList));
      in
-        concatStringsSep "\n" inTunOpts;
+        lib.concatStringsSep "\n" inTunOpts;

-    allOutTunnels = collect (tun: tun ? port && tun ? destination) cfg.outTunnels;
-    allInTunnels = collect (tun: tun ? port && tun ? address) cfg.inTunnels;
+    allOutTunnels = lib.collect (tun: tun ? port && tun ? destination) cfg.outTunnels;
+    allInTunnels = lib.collect (tun: tun ? port && tun ? address) cfg.inTunnels;

    opts = [ notice ] ++ (map mkOutTunnel allOutTunnels) ++ (map mkInTunnel allInTunnels);
  in
-    pkgs.writeText "i2pd-tunnels.conf" (concatStringsSep "\n" opts);
+    pkgs.writeText "i2pd-tunnels.conf" (lib.concatStringsSep "\n" opts);

-  i2pdFlags = concatStringsSep " " (
+  i2pdFlags = lib.concatStringsSep " " (
    optional (cfg.address != null) ("--host=" + cfg.address) ++ [
    "--service"
    ("--conf=" + i2pdConf)
@ -235,7 +235,7 @@ in
 {

  imports = [
-    (mkRenamedOptionModule [ "services" "i2pd" "extIp" ] [ "services" "i2pd" "address" ])
+    (lib.mkRenamedOptionModule [ "services" "i2pd" "extIp" ] [ "services" "i2pd" "address" ])
  ];

  ###### interface
@ -252,7 +252,7 @@ in
        '';
      };

-      package = mkPackageOption pkgs "i2pd" { };
+      package = lib.mkPackageOption pkgs "i2pd" { };

      logLevel = mkOption {
        type = types.enum ["debug" "info" "warn" "error"];
@ -269,7 +269,7 @@ in
      logCLFTime = mkEnableOption "full CLF-formatted date and time to log";

      address = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
        default = null;
        description = ''
          Your external IP or hostname.
@ -277,7 +277,7 @@ in
      };

      family = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
        default = null;
        description = ''
          Specify a family the router belongs to.
@ -285,7 +285,7 @@ in
      };

      dataDir = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
        default = null;
        description = ''
          Alternative path to storage of i2pd data (RI, keys, peer profiles, ...)
@ -301,7 +301,7 @@ in
      };

      ifname = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
        default = null;
        description = ''
          Network interface to bind to.
@ -309,7 +309,7 @@ in
      };

      ifname4 = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
        default = null;
        description = ''
          IPv4 interface to bind to.
@ -317,7 +317,7 @@ in
      };

      ifname6 = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
        default = null;
        description = ''
          IPv6 interface to bind to.
@ -325,7 +325,7 @@ in
      };

      ntcpProxy = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
        default = null;
        description = ''
          Proxy URL for NTCP transport.
@ -399,7 +399,7 @@ in
      reseed.verify = mkEnableOption "SU3 signature verification";

      reseed.file = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
        default = null;
        description = ''
          Full path to SU3 file to reseed from.
@ -407,7 +407,7 @@ in
      };

      reseed.urls = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
        default = [];
        description = ''
          Reseed URLs.
@ -415,7 +415,7 @@ in
      };

      reseed.floodfill = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
        default = null;
        description = ''
          Path to router info of floodfill to reseed from.
@ -423,7 +423,7 @@ in
      };

      reseed.zipfile = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
        default = null;
        description = ''
          Path to local .zip file to reseed from.
@ -431,7 +431,7 @@ in
      };

      reseed.proxy = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
        default = null;
        description = ''
          URL for reseed proxy, supports http/socks.
@ -446,7 +446,7 @@ in
        '';
      };
     addressbook.subscriptions = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
        default = [
          "http://inr.i2p/export/alive-hosts.txt"
          "http://i2p-projekt.i2p/hosts.txt"
@ -460,7 +460,7 @@ in
      trust.enable = mkEnableOption "explicit trust options";

      trust.family = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
        default = null;
        description = ''
          Router Family to trust for first hops.
@ -468,7 +468,7 @@ in
      };

      trust.routers = mkOption {
-        type = with types; listOf str;
+        type = listOf str;
        default = [];
        description = ''
          Only connect to the listed routers.
@ -543,7 +543,7 @@ in
      yggdrasil.enable = mkEnableOption "Yggdrasil";

      yggdrasil.address = mkOption {
-        type = with types; nullOr str;
+        type = nullOr str;
        default = null;
        description = ''
          Your local yggdrasil address. Specify it if you want to bind your router to a
@ -572,7 +572,7 @@ in
        };

        strictHeaders = mkOption {
-          type = with types; nullOr bool;
+          type = nullOr bool;
          default = null;
          description = ''
            Enable strict host checking on WebUI.
@ -580,7 +580,7 @@ in
        };

        hostname = mkOption {
-          type = with types; nullOr str;
+          type = nullOr str;
          default = null;
          description = ''
            Expected hostname for WebUI.
@ -591,7 +591,7 @@ in
      proto.httpProxy = (mkKeyedEndpointOpt "httpproxy" "127.0.0.1" 4444 "httpproxy-keys.dat")
      // {
        outproxy = mkOption {
-          type = with types; nullOr str;
+          type = nullOr str;
          default = null;
          description = "Upstream outproxy bind address.";
        };
@ -648,7 +648,7 @@ in
                description = "Service port. Default to the tunnel's listen port.";
              };
              accessList = mkOption {
-                type = with types; listOf str;
+                type = listOf str;
                default = [];
                description = "I2P nodes that are allowed to connect to this service.";
              };
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -741,6 +741,7 @@ in {
  image-contents = handleTest ./image-contents.nix {};
  openvscode-server = handleTest ./openvscode-server.nix {};
  open-webui = runTest ./open-webui.nix;
+  openvswitch = runTest ./openvswitch.nix;
  orangefs = handleTest ./orangefs.nix {};
  os-prober = handleTestOn ["x86_64-linux"] ./os-prober.nix {};
  osquery = handleTestOn ["x86_64-linux"] ./osquery.nix {};
@ -871,6 +872,7 @@ in {
  rshim = handleTest ./rshim.nix {};
  rspamd = handleTest ./rspamd.nix {};
  rspamd-trainer = handleTest ./rspamd-trainer.nix {};
+  rss-bridge = handleTest ./web-apps/rss-bridge.nix {};
  rss2email = handleTest ./rss2email.nix {};
  rstudio-server = handleTest ./rstudio-server.nix {};
  rsyncd = handleTest ./rsyncd.nix {};
--- a/nixos/tests/openvswitch.nix
+++ b/nixos/tests/openvswitch.nix
@ -0,0 +1,62 @@
+{
+  name = "openvswitch";
+
+  nodes = {
+    node1 = {
+      virtualisation.vlans = [ 1 ];
+
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        firewall.enable = false;
+
+        vswitches.vs0 = {
+          interfaces = {
+            eth1 = { };
+          };
+        };
+
+      };
+
+      systemd.network.networks."40-vs0" = {
+        name = "vs0";
+        networkConfig.Address = "10.0.0.1/24";
+      };
+
+    };
+
+    node2 = {
+      virtualisation.vlans = [ 1 ];
+
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+        firewall.enable = false;
+
+        vswitches.vs0 = {
+          interfaces = {
+            eth1 = { };
+          };
+        };
+
+      };
+
+      systemd.network.networks."40-vs0" = {
+        name = "vs0";
+        networkConfig.Address = "10.0.0.2/24";
+      };
+    };
+  };
+
+  testScript = # python
+    ''
+      start_all()
+      node1.wait_for_unit("ovsdb.service")
+      node1.wait_for_unit("ovs-vswitchd.service")
+      node2.wait_for_unit("ovsdb.service")
+      node2.wait_for_unit("ovs-vswitchd.service")
+
+      node1.succeed("ping -c3 10.0.0.2")
+      node2.succeed("ping -c3 10.0.0.1")
+    '';
+}
--- a/nixos/tests/web-apps/rss-bridge.nix
+++ b/nixos/tests/web-apps/rss-bridge.nix
@ -0,0 +1,22 @@
+{ pkgs, ... }:
+{
+  name = "rss-bridge";
+  meta.maintainers = with pkgs.lib.maintainers; [ mynacol ];
+
+  nodes.machine =
+    { ... }:
+    {
+      services.rss-bridge = {
+        enable = true;
+      };
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_unit("phpfpm-rss-bridge.service")
+
+    # check for successful feed download
+    machine.succeed("curl -sS -f 'http://localhost/?action=display&bridge=DemoBridge&context=testCheckbox&format=Atom'")
+  '';
+}
--- a/pkgs/applications/editors/bless/default.nix
+++ b/pkgs/applications/editors/bless/default.nix
@ -1,71 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, pkg-config
-, mono
-, meson
-, ninja
-, gtk-sharp-2_0
-, gettext
-, makeWrapper
-, glib
-, gtk2-x11
-, libxslt
-, docbook_xsl
-, python3
-, itstool
-}:
-
-stdenv.mkDerivation rec {
-  pname = "bless";
-  version = "0.6.3";
-
-  src = fetchFromGitHub {
-    owner = "afrantzis";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-rS+vJX0y9v1TiPsRfABroHiTuENQKEOxNsyKwagRuHM=";
-  };
-
-  buildInputs = [
-    gtk-sharp-2_0
-    mono
-    # runtime only deps
-    glib
-    gtk2-x11
-  ];
-
-  nativeBuildInputs = [
-    pkg-config
-    meson
-    ninja
-    gettext
-    makeWrapper
-    libxslt
-    docbook_xsl
-    python3
-    itstool
-  ];
-
-  mesonFlags = [
-    "-Dtests=false" # requires NUnit
-  ];
-
-  postPatch = ''
-    patchShebangs .
-  '';
-
-  preFixup = ''
-    MPATH="${gtk-sharp-2_0}/lib/mono/gtk-sharp-2.0:${glib.out}/lib:${gtk2-x11}/lib:${gtk-sharp-2_0}/lib"
-    wrapProgram $out/bin/bless --prefix MONO_PATH : "$MPATH" --prefix LD_LIBRARY_PATH : "$MPATH" --prefix PATH : ${lib.makeBinPath [ mono ]}
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/afrantzis/bless";
-    description = "Gtk# Hex Editor";
-    maintainers = [ maintainers.mkg20001 ];
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    mainProgram = "bless";
-  };
-}
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@ -167,7 +167,8 @@ in
    asar
    copyDesktopItems
    # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
-    (buildPackages.wrapGAppsHook3.override { inherit (buildPackages) makeWrapper; })
+    # Has to use `makeShellWrapper` from `buildPackages` even though `makeShellWrapper` from the inputs is spliced because `propagatedBuildInputs` would pick the wrong one because of a different offset.
+    (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
  ];

  dontBuild = true;
--- a/pkgs/applications/graphics/gcolor2/default.nix
+++ b/pkgs/applications/graphics/gcolor2/default.nix
@ -1,44 +0,0 @@
-{lib, stdenv, fetchurl, fetchpatch, gtk2, perlPackages, pkg-config } :
-
-let version = "0.4"; in
-stdenv.mkDerivation {
-  pname = "gcolor2";
-  inherit version;
-  arch = if stdenv.hostPlatform.system == "x86_64-linux" then "amd64" else "386";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/project/gcolor2/gcolor2/${version}/gcolor2-${version}.tar.bz2";
-    sha256 = "1siv54vwx9dbfcflklvf7pkp5lk6h3nn63flg6jzifz9wp0c84q6";
-  };
-
-  preConfigure = ''
-    sed -i 's/\[:space:\]/[&]/g' configure
-  '';
-
-  # from https://github.com/PhantomX/slackbuilds/tree/master/gcolor2/patches
-  patches = (if stdenv.hostPlatform.system == "x86_64-linux" then
-        [ ./gcolor2-amd64.patch ] else
-        [ ])
-   ++ [
-     # Pull patch pending upstream inclusion for -fno-common toolchains:
-     #   https://sourceforge.net/p/gcolor2/patches/8/
-     (fetchpatch {
-       name = "fno-common.patch";
-       url = "https://sourceforge.net/p/gcolor2/patches/8/attachment/0001-gcolor2-fix-build-on-gcc-10-fno-common.patch";
-       sha256 = "0187zc8as9g3d6mpm3isg87jfpryj0hajb4inwvii8gxrzbi5l5f";
-     })
-  ];
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ gtk2 ]
-    ++ (with perlPackages; [ perl XMLParser ]);
-
-  meta = {
-    description = "Simple GTK 2 color selector";
-    homepage = "https://gcolor2.sourceforge.net/";
-    license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ notthemessiah ];
-    platforms = with lib.platforms; unix;
-    mainProgram = "gcolor2";
-  };
-}
--- a/pkgs/applications/graphics/gcolor2/gcolor2-amd64.patch
+++ b/pkgs/applications/graphics/gcolor2/gcolor2-amd64.patch
@ -1,46 +0,0 @@
-diff --exclude-from=/home/dang/bin/scripts/diffrc -up -ruN gcolor2-0.4.orig/src/callbacks.c gcolor2-0.4/src/callbacks.c
--- gcolor2-0.4.orig/src/callbacks.c	2005-07-12 14:06:12.000000000 -0400
-+++ gcolor2-0.4/src/callbacks.c	2007-02-17 19:19:38.000000000 -0500
-@@ -4,6 +4,9 @@
- 
- #include <gtk/gtk.h>
- #include <stdio.h>
-+#include <string.h>
-+#include <glib.h>
-+#include <glib/gprintf.h>
- 
- #include "callbacks.h"
- #include "interface.h"
-@@ -172,6 +175,9 @@ void on_copy_color_to_clipboard_activate
- 	gtk_clipboard_set_text (cb, hex, strlen (hex));
- }
- 
-+void add_rgb_file (gchar *filename, gchar *type);
-+gchar* get_system_file (void);
-+
- void on_show_system_colors_activate (GtkMenuItem *menuitem, gpointer user_data)
- {
- 	if (gtk_check_menu_item_get_active (GTK_CHECK_MENU_ITEM (menuitem)))
-@@ -266,6 +272,8 @@ void on_save_button_clicked (GtkButton *
- 	gtk_widget_destroy (savedialog);
- }
- 
-+void add_list_color (gchar *spec, gchar *name, gchar *type, gboolean is_new_color);
-+
- void add_color_to_treeview ()
- {
- 	GtkTreeView      *treeview;
-diff --exclude-from=/home/dang/bin/scripts/diffrc -up -ruN gcolor2-0.4.orig/src/main.c gcolor2-0.4/src/main.c
--- gcolor2-0.4.orig/src/main.c	2005-07-11 10:55:49.000000000 -0400
-+++ gcolor2-0.4/src/main.c	2007-02-17 19:18:23.000000000 -0500
-@@ -4,6 +4,10 @@
- 
- #include <gtk/gtk.h>
- #include <stdio.h>
-+#include <stdlib.h>
-+#include <string.h>
-+#include <glib.h>
-+#include <glib/gprintf.h>
- 
- #include "interface.h"
- #include "support.h"
--- a/pkgs/applications/graphics/gpicview/default.nix
+++ b/pkgs/applications/graphics/gpicview/default.nix
@ -1,31 +0,0 @@
-{ lib, stdenv, fetchurl, intltool, pkg-config, gtk2, fetchpatch }:
-
-stdenv.mkDerivation rec {
-  pname = "gpicview";
-  version = "0.2.4";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/lxde/gpicview-${version}.tar.gz";
-    sha256 = "1svcy1c8bgk0pl12yhyv16h2fl52x5vzzcv57z6qdcv5czgvgglr";
-  };
-
-  patches = [
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/nonas/debian-clang/master/buildlogs/gpicview/gpicview-0.2.4/debian/patches/clang_FTBFS_Wreturn-type.patch";
-      sha256 = "02dm966bplnv10knpdx7rlpjipk884156ggd9ij05zhza0jl8xcs";
-    })
-  ];
-
-  nativeBuildInputs = [ pkg-config intltool ];
-
-  buildInputs = [ gtk2 ];
-
-  meta = with lib; {
-    description = "Simple and fast image viewer for X";
-    homepage = "https://lxde.sourceforge.net/gpicview/";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ lovek323 ];
-    platforms = platforms.unix;
-    mainProgram = "gpicview";
-  };
-}
--- a/pkgs/applications/graphics/gqview/default.nix
+++ b/pkgs/applications/graphics/gqview/default.nix
@ -1,29 +0,0 @@
-{ lib, stdenv, fetchurl, pkg-config, gtk2, libpng }:
-
-stdenv.mkDerivation rec {
-  pname = "gqview";
-  version = "2.1.5";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/gqview/gqview-${version}.tar.gz";
-    sha256 = "0ilm5s7ps9kg4f5hzgjhg0xhn6zg0v9i7jnd67zrx9h7wsaa9zhj";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [ gtk2 libpng ];
-
-  hardeningDisable = [ "format" ];
-
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-  NIX_LDFLAGS = "-lm";
-
-  meta = with lib; {
-    description = "Fast image viewer";
-    homepage = "https://gqview.sourceforge.net";
-    license = licenses.gpl2;
-    platforms = platforms.unix;
-    maintainers = [ ];
-    mainProgram = "gqview";
-  };
-}
--- a/pkgs/applications/networking/browsers/brave/make-brave.nix
+++ b/pkgs/applications/networking/browsers/brave/make-brave.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, wrapGAppsHook3, makeWrapper
+{ lib, stdenv, fetchurl, buildPackages
 , alsa-lib
 , at-spi2-atk
 , at-spi2-core
@ -112,7 +112,9 @@ stdenv.mkDerivation {

  nativeBuildInputs = [
    dpkg
-    (wrapGAppsHook3.override { inherit makeWrapper; })
+    # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
+    # Has to use `makeShellWrapper` from `buildPackages` even though `makeShellWrapper` from the inputs is spliced because `propagatedBuildInputs` would pick the wrong one because of a different offset.
+    (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
  ];

  buildInputs = [
--- a/pkgs/applications/networking/cluster/kubedb-cli/default.nix
+++ b/pkgs/applications/networking/cluster/kubedb-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubedb-cli";
-  version = "0.47.0";
+  version = "0.48.0";

  src = fetchFromGitHub {
    owner = "kubedb";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-C106krMg4vtRe78hh6emAGBxEApfc5ZorRgTtH+QZ9g=";
+    sha256 = "sha256-xqupDfcjCSP7uomBCuFlhCAOetZrvSiKehOgCqZKLLg=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/kubevela/default.nix
+++ b/pkgs/applications/networking/cluster/kubevela/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "kubevela";
-  version = "1.9.11";
+  version = "1.9.12";

  src = fetchFromGitHub {
    owner = "kubevela";
    repo = "kubevela";
    rev = "v${version}";
-    hash = "sha256-u9UGV1UwZoj4eSqqMLf8BvsfTFIYagoslN5pflDKm8c=";
+    hash = "sha256-AltyaV4tFW/3nOzEgWwlIqFXVaEtcpN5IxdFScZ7Nes=";
  };

-  vendorHash = "sha256-NnUZnlvVb2VmNx4HM8lkbTNcQA3/pctkg1UVpOY8Acs=";
+  vendorHash = "sha256-Ethbor1nZRYuemBL03QdnExNJtdOJ4w76sjLrBDW9Aw=";

  ldflags = [
    "-s" "-w"
--- a/pkgs/applications/networking/cluster/pachyderm/default.nix
+++ b/pkgs/applications/networking/cluster/pachyderm/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "pachyderm";
-  version = "2.11.2";
+  version = "2.11.3";

  src = fetchFromGitHub {
    owner = "pachyderm";
    repo = "pachyderm";
    rev = "v${version}";
-    hash = "sha256-CNYFaUZBUwa+RF4JFXSmsdHalCPeowM4FYeWBojOOjA=";
+    hash = "sha256-tn+wOd01zClMcANYTolXHTEMGohXGNnKbsZ5NA4kELc=";
  };

  vendorHash = "sha256-d2MSMucGMGGPLE0wh8Y27AUVPkeyOCkCa0JSPawYQmc=";
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@ -31,6 +31,12 @@ in
 buildFHSEnv {
  name = "dropbox";

+  # The dropbox-cli command `dropbox start` starts the dropbox daemon in a
+  # separate session, and wants the daemon to outlive the launcher.  Enabling
+  # `--die-with-parent` defeats this and causes the daemon to exit when
+  # dropbox-cli exits.
+  dieWithParent = false;
+
  # dropbox-cli (i.e. nautilus-dropbox) needs the PID to confirm dropbox is running.
  # Dropbox's internal limit-to-one-instance check also relies on the PID.
  unsharePid = false;
--- a/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
@ -4,11 +4,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "rocketchat-desktop";
-  version = "4.1.0";
+  version = "4.1.1";

  src = fetchurl {
    url = "https://github.com/RocketChat/Rocket.Chat.Electron/releases/download/${version}/rocketchat-${version}-linux-amd64.deb";
-    hash = "sha256-SMpcsRKxx51O7cagDFIrp70QiAHaoAU5NhLHtog647g=";
+    hash = "sha256-6NvQtc+IUWqixFwWUHvl+SkSl0pk3SK4VmQXoZYyqqg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
@ -8,8 +8,7 @@
 , asar
 , rsync
 , python3
-, wrapGAppsHook3
-, makeWrapper
+, buildPackages
 , nixosTests
 , gtk3
 , atk
@ -127,7 +126,9 @@ stdenv.mkDerivation rec {
    asar
    python3
    autoPatchelfHook
-    (wrapGAppsHook3.override { inherit makeWrapper; })
+    # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
+    # Has to use `makeShellWrapper` from `buildPackages` even though `makeShellWrapper` from the inputs is spliced because `propagatedBuildInputs` would pick the wrong one because of a different offset.
+    (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
  ];

  buildInputs = [
--- a/pkgs/applications/networking/ktailctl/default.nix
+++ b/pkgs/applications/networking/ktailctl/default.nix
@ -1,11 +1,11 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, buildGoModule
+, buildGo123Module
 , cmake
 , extra-cmake-modules
 , git
-, go
+, go_1_23
 , wrapQtAppsHook
 , qtbase
 , qtdeclarative
@ -23,20 +23,20 @@
 }:

 let
-  version = "0.17.2";
+  version = "0.18.0";

  src = fetchFromGitHub {
    owner = "f-koehler";
    repo = "KTailctl";
    rev = "v${version}";
-    hash = "sha256-jACcTRIdzYiSLy7zw5QuDu9tZfee9ufhlEecbTbSr+4=";
+    hash = "sha256-tZnwn94qZyQ8JAC6Y1dDTmc7Cob+kMZnEaP7+EytbH8=";
  };

-  goDeps = (buildGoModule {
+  goDeps = (buildGo123Module {
    pname = "ktailctl-go-wrapper";
    inherit src version;
    modRoot = "src/wrapper";
-    vendorHash = "sha256-V4Bn5/VaoFOZlNGBedA4Ly8Kocw0BWyfIHv8IU6Eay4=";
+    vendorHash = "sha256-KdkvAPLnoC7DccRVIz7t/Ns71dnG59DpO5qwOhJk7qc=";
  }).goModules;
 in
 stdenv.mkDerivation {
@ -61,7 +61,7 @@ stdenv.mkDerivation {
    cmake
    extra-cmake-modules
    git
-    go
+    go_1_23
    wrapQtAppsHook
  ];

--- a/pkgs/applications/networking/remote/anydesk/default.nix
+++ b/pkgs/applications/networking/remote/anydesk/default.nix
@ -7,14 +7,14 @@ let
  description = "Desktop sharing application, providing remote support and online meetings";
 in stdenv.mkDerivation (finalAttrs: {
  pname = "anydesk";
-  version = "6.3.2";
+  version = "6.3.3";

  src = fetchurl {
    urls = [
      "https://download.anydesk.com/linux/anydesk-${finalAttrs.version}-amd64.tar.gz"
      "https://download.anydesk.com/linux/generic-linux/anydesk-${finalAttrs.version}-amd64.tar.gz"
    ];
-    hash = "sha256-nSY4qHRsEvQk4M3JDHalAk3C6Y21WlfDQ2Gpp6/jjMs=";
+    hash = "sha256-uSotkFOpuC2a2sRTagY9KFx3F2VJmgrsn+dBa5ycdck=";
  };

  buildInputs = [
--- a/pkgs/applications/office/appflowy/default.nix
+++ b/pkgs/applications/office/appflowy/default.nix
@ -25,7 +25,8 @@ let
      };
      aarch64-darwin = x86_64-darwin;
    }
-    ."${stdenvNoCC.hostPlatform.system}";
+    ."${stdenvNoCC.hostPlatform.system}"
+      or (throw "appflowy: No source for system: ${stdenvNoCC.hostPlatform.system}");
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "appflowy";
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -20,14 +20,14 @@
 let
  pname = "qownnotes";
  appname = "QOwnNotes";
-  version = "24.9.6";
+  version = "24.9.7";
 in
 stdenv.mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-r5X8/BObkDlhB0LkfMSdrYWaU8mwquQhSiPUDJjV1qM=";
+    hash = "sha256-n5Il8DnEK6emZANv6IMUpaEsHZ/hoPl4jNaXCuo7X5g=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/radio/abracadabra/default.nix
+++ b/pkgs/applications/radio/abracadabra/default.nix
@ -1,18 +1,32 @@
-{ lib, stdenv, fetchFromGitHub, cmake, wrapQtAppsHook
-, qtbase, qtmultimedia, qttools
-, faad2, mpg123, portaudio
-, libusb1, rtl-sdr, airspy, soapysdr-with-plugins
-} :
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  wrapQtAppsHook,
+  qtbase,
+  qtmultimedia,
+  qttools,
+  qtpositioning,
+  qtlocation,
+  faad2,
+  mpg123,
+  portaudio,
+  libusb1,
+  rtl-sdr,
+  airspy,
+  soapysdr-with-plugins,
+}:

 stdenv.mkDerivation rec {
  pname = "abracadabra";
-  version = "2.5.1";
+  version = "2.6.0";

  src = fetchFromGitHub {
    owner = "KejPi";
    repo = "AbracaDABra";
    rev = "v${version}";
-    hash = "sha256-EaHVHfyhQTxxLtb3wsJV7Fea2jyENnfn6Lv/3GwAKdk=";
+    hash = "sha256-oO8ef2VTw/gVNNU2JRXtEHEkJm7X7dypjZr0vZXCfH8=";
  };

  nativeBuildInputs = [
@ -24,6 +38,8 @@ stdenv.mkDerivation rec {
  buildInputs = [
    qtbase
    qtmultimedia
+    qtlocation
+    qtpositioning
    faad2
    mpg123
    portaudio
@ -47,4 +63,3 @@ stdenv.mkDerivation rec {
    mainProgram = "AbracaDABra";
  };
 }
-
--- a/pkgs/applications/version-management/git-annex-remote-googledrive/default.nix
+++ b/pkgs/applications/version-management/git-annex-remote-googledrive/default.nix
@ -6,24 +6,29 @@
 , gitpython
 , humanfriendly
 , tenacity
+, setuptools
+, distutils
 }:

 buildPythonApplication rec {
  pname = "git-annex-remote-googledrive";
  version = "1.3.2";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
    sha256 = "0rwjcdvfgzdlfgrn1rrqwwwiqqzyh114qddrbfwd46ld5spry6r1";
  };

+  build-system = [ setuptools ];
+
  propagatedBuildInputs = [
    annexremote
    drivelib
    gitpython
    tenacity
    humanfriendly
+    distutils
  ];

  # while git-annex does come with a testremote command that *could* be used,
@ -36,7 +41,7 @@ buildPythonApplication rec {

  meta = with lib; {
    description = "Git-annex special remote for Google Drive";
-    homepage = "https://pypi.org/project/git-annex-remote-googledrive/";
+    homepage = "https://github.com/Lykos153/git-annex-remote-googledrive";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ gravndal ];
    mainProgram = "git-annex-remote-googledrive";
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -37,7 +37,7 @@
  makeDesktopItem,
  openssl,
  wrapGAppsHook3,
-  makeShellWrapper,
+  buildPackages,
  at-spi2-atk,
  at-spi2-core,
  libuuid,
@ -166,7 +166,9 @@ let

    nativeBuildInputs = [
      copyDesktopItems
-      (wrapGAppsHook3.override { makeWrapper = makeShellWrapper; })
+      # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
+      # Has to use `makeShellWrapper` from `buildPackages` even though `makeShellWrapper` from the inputs is spliced because `propagatedBuildInputs` would pick the wrong one because of a different offset.
+      (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
    ];
    buildInputs = [
      gtk3
--- a/pkgs/applications/video/anilibria-winmaclinux/default.nix
+++ b/pkgs/applications/video/anilibria-winmaclinux/default.nix
@ -18,13 +18,13 @@

 mkDerivation rec {
  pname = "anilibria-winmaclinux";
-  version = "2.2.18";
+  version = "2.2.19";

  src = fetchFromGitHub {
    owner = "anilibria";
    repo = "anilibria-winmaclinux";
    rev = version;
-    hash = "sha256-gFIz2tkuBaC4DoN/oVNra5pQi23MAuhFJRGxEcZgvAo=";
+    hash = "sha256-f4AlTfLTn0GvBj3ztpkNPc6BDlLsEtz/yE5F2WfjU8U=";
  };

  sourceRoot = "${src.name}/src";
--- a/pkgs/by-name/ac/aces-container/package.nix
+++ b/pkgs/by-name/ac/aces-container/package.nix
@ -0,0 +1,31 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "aces-container";
+  version = "1.0.2";
+
+  src = fetchFromGitHub {
+    owner = "ampas";
+    repo = "aces_container";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-luMqXqlJ6UzoawEDmbK38lm3GHosaZm/mFJntBF54Y4=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  meta = {
+    description = "Reference Implementation of SMPTE ST2065-4";
+    homepage = "https://github.com/ampas/aces_container";
+    license = lib.licenses.ampas;
+    maintainers = with lib.maintainers; [ paperdigits ];
+    mainProgram = "aces-container";
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/am/amber-lang/package.nix
+++ b/pkgs/by-name/am/amber-lang/package.nix
@ -7,20 +7,21 @@
  makeWrapper,
  runCommand,
  amber-lang,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage rec {
  pname = "amber-lang";
-  version = "0.3.3-alpha";
+  version = "0.3.5-alpha";

  src = fetchFromGitHub {
-    owner = "Ph0enixKM";
-    repo = "Amber";
+    owner = "amber-lang";
+    repo = "amber";
    rev = version;
-    hash = "sha256-Al1zTwQufuVGSlttf02s5uI3cyCNDShhzMT3l9Ctv3Y=";
+    hash = "sha256-wf0JNWNliDGNvlbWoatPqDKmVaBzHeCKOvJWuE9PnpQ=";
  };

-  cargoHash = "sha256-HbkIkCVy2YI+nP5t01frXBhlp/rCsB6DwLL53AHJ4vE=";
+  cargoHash = "sha256-6T4WcQkCMR8W67w0uhhN8W0FlLsrTUMa3/xRXDtW4Es=";

  preConfigure = ''
    substituteInPlace src/compiler.rs \
@ -36,14 +37,22 @@ rustPlatform.buildRustPackage rec {
    util-linux
  ];

+  checkFlags = [
+    "--skip=tests::extra::download"
+    "--skip=tests::formatter::all_exist"
+  ];
+
  postInstall = ''
    wrapProgram "$out/bin/amber" --prefix PATH : "${lib.makeBinPath [ bc ]}"
  '';

-  passthru.tests.run = runCommand "amber-lang-eval-test" { nativeBuildInputs = [ amber-lang ]; } ''
-    diff -U3 --color=auto <(amber -e 'echo "Hello, World"') <(echo 'Hello, World')
-    touch $out
-  '';
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.run = runCommand "amber-lang-eval-test" { nativeBuildInputs = [ amber-lang ]; } ''
+      diff -U3 --color=auto <(amber -e 'echo "Hello, World"') <(echo 'Hello, World')
+      touch $out
+    '';
+  };

  meta = with lib; {
    description = "Programming language compiled to bash";
--- a/pkgs/by-name/ar/art/package.nix
+++ b/pkgs/by-name/ar/art/package.nix
@ -3,6 +3,15 @@
 , fetchFromBitbucket
 , cmake
 , pkg-config
+, util-linux
+, libselinux
+, libsepol
+, libthai
+, libdatrie
+, lerc
+, libxkbcommon
+, libepoxy
+, libXtst
 , wrapGAppsHook3
 , pixman
 , libpthreadstubs
@ -10,10 +19,11 @@
 , libXau
 , libXdmcp
 , lcms2
+, libraw
 , libiptcdata
 , fftw
 , expat
-, pcre
+, pcre2
 , libsigcxx
 , lensfun
 , librsvg
@ -21,6 +31,10 @@
 , exiv2
 , exiftool
 , mimalloc
+, openexr_3
+, ilmbase
+, opencolorio
+, color-transformation-language
 }:

 stdenv.mkDerivation rec {
@ -41,16 +55,26 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
+    util-linux
+    libselinux
+    libsepol
+    libthai
+    libdatrie
+    lerc
+    libxkbcommon
+    libepoxy
+    libXtst
    pixman
    libpthreadstubs
    gtkmm3
    libXau
    libXdmcp
    lcms2
+    libraw
    libiptcdata
    fftw
    expat
-    pcre
+    pcre2
    libsigcxx
    lensfun
    librsvg
@ -58,11 +82,18 @@ stdenv.mkDerivation rec {
    exiftool
    libcanberra-gtk3
    mimalloc
+    openexr_3
+    ilmbase
+    opencolorio
+    color-transformation-language
  ];

  cmakeFlags = [
    "-DPROC_TARGET_NUMBER=2"
    "-DCACHE_NAME_SUFFIX=\"\""
+    "-DENABLE_OCIO=True"
+    "-DENABLE_CTL=1"
+    "-DCTL_INCLUDE_DIR=${color-transformation-language}/include/CTL"
  ];

  CMAKE_CXX_FLAGS = toString [
--- a/pkgs/by-name/bo/boxed-cpp/package.nix
+++ b/pkgs/by-name/bo/boxed-cpp/package.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation (final: {
  pname = "boxed-cpp";
-  version = "1.4.2";
+  version = "1.4.3";

  src = fetchFromGitHub {
    owner = "contour-terminal";
    repo = "boxed-cpp";
    rev = "v${final.version}";
-    hash = "sha256-Z/dfSa/6SnzLWnFCXjJUbTBNa5dFZna099Crbcya/Dw=";
+    hash = "sha256-uZ/wT159UuEcTUtoQyt0D59z2wnLT5KpeeCpjyij198=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/co/color-transformation-language/package.nix
+++ b/pkgs/by-name/co/color-transformation-language/package.nix
@ -0,0 +1,40 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  ilmbase,
+  openexr_3,
+  libtiff,
+  aces-container,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ctl";
+  version = "1.5.3";
+
+  src = fetchFromGitHub {
+    owner = "ampas";
+    repo = "CTL";
+    rev = "ctl-${finalAttrs.version}";
+    hash = "sha256-jG+38jsPw+4CEAbOG+hudfPBPbZLG+Om7PszkFa6DuI=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    ilmbase
+    openexr_3
+    libtiff
+    aces-container
+  ];
+
+  meta = {
+    description = "Programming language for digital color management";
+    homepage = "https://github.com/ampas/CTL";
+    changelog = "https://github.com/ampas/CTL/blob/${finalAttrs.src.rev}/CHANGELOG";
+    license = lib.licenses.ampas;
+    maintainers = with lib.maintainers; [ paperdigits ];
+    mainProgram = "ctl";
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/applications/science/chemistry/cp2k/default.nix
+++ b/pkgs/applications/science/chemistry/cp2k/default.nix
@ -1,55 +1,61 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, mpiCheckPhaseHook
-, python3
-, gfortran
-, blas
-, lapack
-, fftw
-, libint
-, libvori
-, libxc
-, dftd4
-, mctc-lib
-, mstore
-, multicharge
-, mpi
-, gsl
-, scalapack
-, openssh
-, makeWrapper
-, libxsmm
-, spglib
-, which
-, pkg-config
-, plumed
-, zlib
-, hdf5-fortran
-, sirius
-, libvdwxc
-, spla
-, spfft
-, enableElpa ? false
-, elpa
-, cudaPackages
-, rocmPackages
-, config
-, gpuBackend ? (
-  if config.cudaSupport
-  then "cuda"
-  else if config.rocmSupport
-  then "rocm"
-  else "none"
-)
-# Change to a value suitable for your target GPU.
-# For AMD values see https://github.com/cp2k/cp2k/blob/master/INSTALL.md#2v-rocmhip-support-for-amd-gpu
-# and for Nvidia see https://github.com/cp2k/cp2k/blob/master/INSTALL.md#2i-cuda-optional-improved-performance-on-gpu-systems
-, gpuVersion ? ( if gpuBackend == "cuda" then "A100" else "Mi100" )
-, gpuArch ? ( if gpuBackend == "cuda" then "sm_80" else "gfx908" )
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  mpiCheckPhaseHook,
+  python3,
+  gfortran,
+  blas,
+  lapack,
+  fftw,
+  libint,
+  libvori,
+  libxc,
+  dftd4,
+  mctc-lib,
+  mstore,
+  multicharge,
+  mpi,
+  gsl,
+  scalapack,
+  openssh,
+  makeWrapper,
+  libxsmm,
+  spglib,
+  which,
+  pkg-config,
+  plumed,
+  zlib,
+  hdf5-fortran,
+  sirius,
+  libvdwxc,
+  spla,
+  spfft,
+  enableElpa ? false,
+  elpa,
+  cudaPackages,
+  rocmPackages,
+  config,
+  gpuBackend ? (
+    if config.cudaSupport then
+      "cuda"
+    else if config.rocmSupport then
+      "rocm"
+    else
+      "none"
+  ),
+  # Change to a value suitable for your target GPU.
+  # For AMD values see https://github.com/cp2k/cp2k/blob/master/INSTALL.md#2v-rocmhip-support-for-amd-gpu
+  # and for Nvidia see https://github.com/cp2k/cp2k/blob/master/INSTALL.md#2i-cuda-optional-improved-performance-on-gpu-systems
+  gpuVersion ? (if gpuBackend == "cuda" then "A100" else "Mi100"),
+  gpuArch ? (if gpuBackend == "cuda" then "sm_80" else "gfx908"),
 }:

-assert builtins.elem gpuBackend [ "none" "cuda" "rocm" ];
+assert builtins.elem gpuBackend [
+  "none"
+  "cuda"
+  "rocm"
+];

 let
  cp2kVersion = "psmp";
@ -74,47 +80,53 @@ stdenv.mkDerivation rec {
    ./remove-compiler-options.patch
  ];

-  nativeBuildInputs = [ python3 which openssh makeWrapper pkg-config ]
-    ++ lib.optional (gpuBackend == "cuda") cudaPackages.cuda_nvcc;
+  nativeBuildInputs = [
+    python3
+    which
+    openssh
+    makeWrapper
+    pkg-config
+  ] ++ lib.optional (gpuBackend == "cuda") cudaPackages.cuda_nvcc;

-  buildInputs = [
-    gfortran
-    fftw
-    gsl
-    libint
-    libvori
-    libxc
-    dftd4
-    mctc-lib
-    mstore
-    multicharge
-    libxsmm
-    mpi
-    spglib
-    scalapack
-    blas
-    lapack
-    plumed
-    zlib
-    hdf5-fortran
-    sirius
-    spla
-    spfft
-    libvdwxc
-  ]
-  ++ lib.optional enableElpa elpa
-  ++ lib.optionals (gpuBackend == "cuda") [
-    cudaPackages.cuda_cudart
-    cudaPackages.libcublas
-    cudaPackages.cuda_nvrtc
-  ] ++ lib.optionals (gpuBackend == "rocm") [
-    rocmPackages.clr
-    rocmPackages.rocm-core
-    rocmPackages.hipblas
-    rocmPackages.hipfft
-    rocmPackages.rocblas
-  ]
-  ;
+  buildInputs =
+    [
+      gfortran
+      fftw
+      gsl
+      libint
+      libvori
+      libxc
+      dftd4
+      mctc-lib
+      mstore
+      multicharge
+      libxsmm
+      mpi
+      spglib
+      scalapack
+      blas
+      lapack
+      plumed
+      zlib
+      hdf5-fortran
+      sirius
+      spla
+      spfft
+      libvdwxc
+    ]
+    ++ lib.optional enableElpa elpa
+    ++ lib.optionals (gpuBackend == "cuda") [
+      cudaPackages.cuda_cudart
+      cudaPackages.libcublas
+      cudaPackages.cuda_nvrtc
+    ]
+    ++ lib.optionals (gpuBackend == "rocm") [
+      rocmPackages.clr
+      rocmPackages.rocm-core
+      rocmPackages.hipblas
+      rocmPackages.hipfft
+      rocmPackages.rocblas
+    ];

  propagatedBuildInputs = [ (lib.getBin mpi) ];
  propagatedUserEnvPkgs = [ mpi ];
@ -136,6 +148,8 @@ stdenv.mkDerivation rec {
  '';

  configurePhase = ''
+    runHook preConfigure
+
    cat > arch/${arch}.${cp2kVersion} << EOF
    CC         = mpicc
    CPP        =
@ -143,28 +157,34 @@ stdenv.mkDerivation rec {
    LD         = mpif90
    AR         = ar -r
    ${lib.strings.optionalString (gpuBackend == "cuda") ''
-    OFFLOAD_CC = nvcc
-    OFFLOAD_FLAGS = -O3 -g -w --std=c++11 -arch ${gpuArch}
-    OFFLOAD_TARGET = cuda
-    GPUVER = ${gpuVersion}
-    CXX = mpicxx
-    CXXFLAGS = -std=c++11 -fopenmp
+      OFFLOAD_CC = nvcc
+      OFFLOAD_FLAGS = -O3 -g -w --std=c++11 -arch ${gpuArch}
+      OFFLOAD_TARGET = cuda
+      GPUVER = ${gpuVersion}
+      CXX = mpicxx
+      CXXFLAGS = -std=c++11 -fopenmp
    ''}
    ${lib.strings.optionalString (gpuBackend == "rocm") ''
-    GPUVER = ${gpuVersion}
-    OFFLOAD_CC = hipcc
-    OFFLOAD_FLAGS = -fopenmp -m64 -pthread -fPIC -D__GRID_HIP -O2 --offload-arch=${gpuArch} --rocm-path=${rocmPackages.rocm-core}
-    OFFLOAD_TARGET = hip
-    CXX = mpicxx
-    CXXFLAGS = -std=c++11 -fopenmp -D__HIP_PLATFORM_AMD__
+      GPUVER = ${gpuVersion}
+      OFFLOAD_CC = hipcc
+      OFFLOAD_FLAGS = -fopenmp -m64 -pthread -fPIC -D__GRID_HIP -O2 --offload-arch=${gpuArch} --rocm-path=${rocmPackages.rocm-core}
+      OFFLOAD_TARGET = hip
+      CXX = mpicxx
+      CXXFLAGS = -std=c++11 -fopenmp -D__HIP_PLATFORM_AMD__
    ''}
    DFLAGS     = -D__FFTW3 -D__LIBXC -D__LIBINT -D__parallel -D__SCALAPACK \
                 -D__MPI_VERSION=3 -D__F2008 -D__LIBXSMM -D__SPGLIB \
                 -D__MAX_CONTR=4 -D__LIBVORI ${lib.optionalString enableElpa "-D__ELPA"} \
                 -D__PLUMED2 -D__HDF5 -D__GSL -D__SIRIUS -D__LIBVDWXC -D__SPFFT -D__SPLA \
                 -D__DFTD4 \
-                 ${lib.strings.optionalString (gpuBackend == "cuda") "-D__OFFLOAD_CUDA -D__ACC -D__DBCSR_ACC -D__NO_OFFLOAD_PW"} \
-                 ${lib.strings.optionalString (gpuBackend == "rocm") "-D__OFFLOAD_HIP -D__DBCSR_ACC -D__NO_OFFLOAD_PW"}
+                 ${
+                   lib.strings.optionalString (
+                     gpuBackend == "cuda"
+                   ) "-D__OFFLOAD_CUDA -D__ACC -D__DBCSR_ACC -D__NO_OFFLOAD_PW"
+                 } \
+                 ${
+                   lib.strings.optionalString (gpuBackend == "rocm") "-D__OFFLOAD_HIP -D__DBCSR_ACC -D__NO_OFFLOAD_PW"
+                 }
    CFLAGS    = -fopenmp
    FCFLAGS    = \$(DFLAGS) -O2 -ffree-form -ffree-line-length-none \
                 -ftree-vectorize -funroll-loops -msse2 \
@ -187,15 +207,20 @@ stdenv.mkDerivation rec {
                 -lz -ldl ${lib.optionalString (mpi.pname == "openmpi") "$(mpicxx --showme:link)"} \
                 -lplumed -lhdf5_fortran -lhdf5_hl -lhdf5 -lgsl -lsirius -lspla -lspfft -lvdwxc \
                 -ldftd4 -lmstore -lmulticharge -lmctc-lib \
-                 ${lib.strings.optionalString (gpuBackend == "cuda") ''
-                   -L${cudaPackages.cuda_cudart}/lib/stubs/ \
-                   -lcudart -lnvrtc -lcuda -lcublas
+                 ${
+                   lib.strings.optionalString (gpuBackend == "cuda") ''
+                     -L${cudaPackages.cuda_cudart}/lib/stubs/ \
+                     -lcudart -lnvrtc -lcuda -lcublas
                   ''
                 } \
-                 ${lib.strings.optionalString (gpuBackend == "rocm") "-lamdhip64 -lhipfft -lhipblas -lrocblas"}
+                 ${
+                   lib.strings.optionalString (gpuBackend == "rocm") "-lamdhip64 -lhipfft -lhipblas -lrocblas"
+                 }
    LDFLAGS    = \$(FCFLAGS) \$(LIBS)
    include ${plumed}/lib/plumed/src/lib/Plumed.inc
    EOF
+
+    runHook postConfigure
  '';

  nativeCheckInputs = [
@ -213,6 +238,8 @@ stdenv.mkDerivation rec {
  '';

  installPhase = ''
+    runHook preInstall
+
    mkdir -p $out/bin $out/share/cp2k

    cp exe/${arch}/* $out/bin
@ -228,15 +255,19 @@ stdenv.mkDerivation rec {
      --set OMP_NUM_THREADS 1

    cp -r data/* $out/share/cp2k
+
+    runHook postInstall
  '';

-  passthru = { inherit mpi; };
+  passthru = {
+    inherit mpi;
+  };

-  meta = with lib; {
+  meta = {
    description = "Quantum chemistry and solid state physics program";
    homepage = "https://www.cp2k.org";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.sheepforce ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ lib.maintainers.sheepforce ];
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/science/chemistry/cp2k/remove-compiler-options.patch
+++ b/pkgs/applications/science/chemistry/cp2k/remove-compiler-options.patch
--- a/pkgs/by-name/cu/cups-idprt-barcode/package.nix
+++ b/pkgs/by-name/cu/cups-idprt-barcode/package.nix
@ -25,10 +25,13 @@ stdenvNoCC.mkDerivation {

  installPhase =
    let
-      arch = builtins.getAttr stdenvNoCC.hostPlatform.system {
-        x86_64-linux = "x64";
-        x86-linux = "x86";
-      };
+      arch =
+        {
+          x86_64-linux = "x64";
+          x86-linux = "x86";
+        }
+        ."${stdenvNoCC.hostPlatform.system}"
+          or (throw "cups-idprt-barcode: No prebuilt filters for system: ${stdenvNoCC.hostPlatform.system}");
    in
    ''
      runHook preInstall
--- a/pkgs/by-name/cu/cups-idprt-mt888/package.nix
+++ b/pkgs/by-name/cu/cups-idprt-mt888/package.nix
@ -25,10 +25,13 @@ stdenvNoCC.mkDerivation {

  installPhase =
    let
-      arch = builtins.getAttr stdenvNoCC.hostPlatform.system {
-        x86_64-linux = "x64";
-        x86-linux = "x86";
-      };
+      arch =
+        {
+          x86_64-linux = "x64";
+          x86-linux = "x86";
+        }
+        ."${stdenvNoCC.hostPlatform.system}"
+          or (throw "cups-idprt-mt888: No prebuilt filters for system: ${stdenvNoCC.hostPlatform.system}");
    in
    ''
      runHook preInstall
--- a/pkgs/by-name/cu/cups-idprt-mt890/package.nix
+++ b/pkgs/by-name/cu/cups-idprt-mt890/package.nix
@ -25,10 +25,13 @@ stdenvNoCC.mkDerivation {

  installPhase =
    let
-      arch = builtins.getAttr stdenvNoCC.hostPlatform.system {
-        x86_64-linux = "x64";
-        x86-linux = "x86";
-      };
+      arch =
+        {
+          x86_64-linux = "x64";
+          x86-linux = "x86";
+        }
+        ."${stdenvNoCC.hostPlatform.system}"
+          or (throw "cups-idprt-mt890: No prebuilt filters for system: ${stdenvNoCC.hostPlatform.system}");
    in
    ''
      runHook preInstall
--- a/pkgs/by-name/cu/cups-idprt-sp900/package.nix
+++ b/pkgs/by-name/cu/cups-idprt-sp900/package.nix
@ -34,10 +34,13 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  installPhase =
    let
-      arch = builtins.getAttr stdenvNoCC.hostPlatform.system {
-        x86_64-linux = "x64";
-        x86-linux = "x86";
-      };
+      arch =
+        {
+          x86_64-linux = "x64";
+          x86-linux = "x86";
+        }
+        ."${stdenvNoCC.hostPlatform.system}"
+          or (throw "cups-idprt-sp900: No prebuilt filters for system: ${stdenvNoCC.hostPlatform.system}");
    in
    ''
      runHook preInstall
--- a/pkgs/by-name/cu/cups-idprt-tspl/package.nix
+++ b/pkgs/by-name/cu/cups-idprt-tspl/package.nix
@ -33,10 +33,13 @@ stdenvNoCC.mkDerivation {

  installPhase =
    let
-      arch = builtins.getAttr stdenvNoCC.hostPlatform.system {
-        x86_64-linux = "x64";
-        x86-linux = "x86";
-      };
+      arch =
+        {
+          x86_64-linux = "x64";
+          x86-linux = "x86";
+        }
+        ."${stdenvNoCC.hostPlatform.system}"
+          or (throw "cups-idprt-tspl: No prebuilt filters for system: ${stdenvNoCC.hostPlatform.system}");
    in
    ''
      runHook preInstall
--- a/pkgs/by-name/de/deck/package.nix
+++ b/pkgs/by-name/de/deck/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "deck";
-  version = "1.40.1";
+  version = "1.40.2";

  src = fetchFromGitHub {
    owner = "Kong";
    repo = "deck";
    rev = "v${version}";
-    hash = "sha256-wb7/g1g7gxKhZyK7GW+6aGwuD+Dkcdg2Zpc0JCxVPjM=";
+    hash = "sha256-qLWDZEYO/0as2+4OM6/FAJcN+vnRBrcx59uHRkougLQ=";
  };

  nativeBuildInputs = [ installShellFiles ];
@ -21,7 +21,7 @@ buildGoModule rec {
  ];

  proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-8o3jXkhfRIGGPtw8ow+NyAYAuCJNrBlSyfdSI0pjvDQ=";
+  vendorHash = "sha256-RkhpR9sKWaO1jceCU4sS4TmxS5giq2uUIkiHNnahQZw=";

  postInstall = ''
    installShellCompletion --cmd deck \
@ -34,6 +34,7 @@ buildGoModule rec {
    description = "Configuration management and drift detection tool for Kong";
    homepage = "https://github.com/Kong/deck";
    license = licenses.asl20;
+    mainProgram = "deck";
    maintainers = with maintainers; [ liyangau ];
  };
 }
--- a/pkgs/by-name/de/dethrace/package.nix
+++ b/pkgs/by-name/de/dethrace/package.nix
@ -0,0 +1,40 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  SDL2,
+  perl,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "dethrace";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "dethrace-labs";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Bt2wwF5cquXZwFpFyJ0TDmbFdTHbboQ93W/DvP9bsMo=";
+    fetchSubmodules = true;
+  };
+
+  buildInputs = [ SDL2 ];
+  nativeBuildInputs = [
+    cmake
+    perl
+  ];
+
+  installPhase = ''
+    install -Dm755 dethrace $out/bin/dethrace
+  '';
+
+  meta = with lib; {
+    homepage = "https://twitter.com/dethrace_labs";
+    description = "Reverse engineering the 1997 game Carmageddon";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ astro ];
+    mainProgram = "dethrace";
+  };
+}
--- a/pkgs/by-name/do/dokieli/package.json
+++ b/pkgs/by-name/do/dokieli/package.json
@ -0,0 +1,104 @@
+{
+  "name": "dokieli",
+  "version": "0.3.1417",
+  "description": "dokieli is a clientside editor for decentralised article publishing, annotations, and social interactions.",
+  "main": "./src/dokieli.js",
+  "type": "module",
+  "scripts": {
+    "build-dist": "webpack --progress --color",
+    "build": "yarn build-dist",
+    "test": "TZ=UTC node --experimental-vm-modules node_modules/jest/bin/jest.js --silent",
+    "test:e2e": "playwright test",
+    "watch": "webpack --progress --color --watch",
+    "minify": "webpack --progress --color --env minimize",
+    "postinstall": "patch-package",
+    "lint": "eslint ."
+  },
+  "repository": "https://github.com/linkeddata/dokieli",
+  "keywords": [
+    "activitystreams",
+    "activitypub",
+    "annotations",
+    "authoring",
+    "decentralized",
+    "editor",
+    "knowledge graph",
+    "linked data",
+    "notifications",
+    "publishing",
+    "social web",
+    "web standards"
+  ],
+  "author": "dokieli team",
+  "license": "Apache-2.0",
+  "bugs": {
+    "url": "https://github.com/linkeddata/dokieli/issues"
+  },
+  "homepage": "https://dokie.li/",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "buffer": "^6.0.3",
+    "d3-force": "^3.0.0",
+    "d3-selection": "^3.0.0",
+    "diff": "^5.2.0",
+    "dompurify": "^3.1.5",
+    "fs": "^0.0.1-security",
+    "http-link-header": "^1.1.3",
+    "leaflet": "^1.9.4",
+    "leaflet-gpx": "^1.7.0",
+    "medium-editor": "^5.23.3",
+    "medium-editor-tables": "^0.6.1",
+    "micromark": "^4.0.0",
+    "micromark-extension-gfm": "^3.0.0",
+    "micromark-extension-gfm-tagfilter": "^2.0.0",
+    "rdf-parser-rdfa": "https://github.com/rdf-ext/rdf-parser-rdfa.git#master",
+    "rdf-store-ldp": "^0.3.1",
+    "shower": "https://github.com/shower/core.git#main",
+    "simplerdf": "^0.2.14",
+    "simplerdf-parse": "^0.1.3",
+    "solid-auth-client": "^2.5.6"
+  },
+  "devDependencies": {
+    "@axe-core/playwright": "^4.9.1",
+    "@playwright/test": "^1.44.1",
+    "babel-eslint": "^10.1.0",
+    "dotenv": "^16.4.5",
+    "eslint": "^9.10.0",
+    "eslint-plugin-jest": "^27.9.0",
+    "husky": "^9.0.11",
+    "jest": "^29.0.3",
+    "jest-environment-jsdom": "^29.0.3",
+    "patch-package": "^8.0.0",
+    "process": "^0.11.10",
+    "terser-webpack-plugin": "^5.3.3",
+    "webpack": "5.94.0",
+    "webpack-cli": "^5.0.1"
+  },
+  "resolutions": {
+    "ansi-regex": "^5.0.0",
+    "xmldom": "https://github.com/xmldom/xmldom.git#master",
+    "green-turtle": "https://github.com/csarven/green-turtle#master",
+    "json5": "^1.0.2",
+    "http-cache-semantics": "^4.1.1",
+    "jsonld": "^5.0.0",
+    "xml2js": "^0.6.2",
+    "semver": "^7.6.2",
+    "lru-cache": "^8.0.0",
+    "micromatch": "^4.0.8"
+  },
+  "standard": {
+    "globals": [
+      "DO",
+      "SimpleRDF",
+      "ld",
+      "describe",
+      "it",
+      "before",
+      "beforeEach",
+      "after",
+      "afterEach"
+    ]
+  }
+}
--- a/pkgs/by-name/do/dokieli/package.nix
+++ b/pkgs/by-name/do/dokieli/package.nix
@ -0,0 +1,58 @@
+{
+  lib,
+  mkYarnPackage,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  makeWrapper,
+  nodejs,
+  xsel,
+}:
+
+mkYarnPackage rec {
+  pname = "dokieli";
+  version = "0-unstable-2024-09-23";
+
+  src = fetchFromGitHub {
+    owner = "linkeddata";
+    repo = "dokieli";
+    rev = "40ebbc60ba48d8b08f763b07befba96382c5f027";
+    hash = "sha256-lc96jOR8uXLcZFhN3wpSd9O5cUdKxllB8WWCh2oWuEw=";
+  };
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = src + "/yarn.lock";
+    hash = "sha256-TEXCCLFhpwHZJ8zRGsC7J6EwNaFpIi+CZ3L5uilebK4=";
+  };
+
+  packageJSON = ./package.json;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -r * $out
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postFixup = ''
+    makeWrapper ${nodejs}/bin/npx $out/bin/dokieli           \
+      --prefix PATH : ${
+        lib.makeBinPath ([
+          nodejs
+          xsel
+        ])
+      }   \
+      --add-flags serve                                      \
+      --chdir $out/deps/dokieli
+  '';
+
+  doDist = false;
+
+  meta = {
+    description = "dokieli is a clientside editor for decentralised article publishing, annotations and social interactions";
+    homepage = "https://github.com/linkeddata/dokieli";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ shogo ];
+    mainProgram = "dokieli";
+  };
+}
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@ -2,8 +2,7 @@
 , lib
 , fetchurl
 , autoPatchelfHook
-, wrapGAppsHook3
-, makeWrapper
+, buildPackages
 , gnome-keyring
 , libsecret
 , git
@ -44,7 +43,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    autoPatchelfHook
-    (wrapGAppsHook3.override { inherit makeWrapper; })
+    # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
+    # Has to use `makeShellWrapper` from `buildPackages` even though `makeShellWrapper` from the inputs is spliced because `propagatedBuildInputs` would pick the wrong one because of a different offset.
+    (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
  ];

  buildInputs = [
--- a/pkgs/by-name/gr/grafana-alloy/package.nix
+++ b/pkgs/by-name/gr/grafana-alloy/package.nix
@ -16,17 +16,17 @@

 buildGoModule rec {
  pname = "grafana-alloy";
-  version = "1.3.1";
+  version = "1.4.1";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "grafana";
    repo = "alloy";
-    hash = "sha256-6YjQUIHZmuguzqTeaLgkrM/WdBPZu/KUXUDOmEB7rNQ=";
+    hash = "sha256-/LCp4PUt85HR+ig0/v7KlS1cFcFGpI8TXHk3IlcEkvk=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-eMtwmADYbvpIm4FHTHieQ1i4xCty5xCwsZ/JD9r94/8=";
+  vendorHash = "sha256-fhUoQGNRoWNbU5U21X45s+eJ8XjCkvYULTRShyq0f3E=";

  nativeBuildInputs = [ fixup-yarn-lock yarn nodejs installShellFiles ];

@ -55,9 +55,14 @@ buildGoModule rec {
    "."
  ];

+  # Skip building the frontend in the goModules FOD
+  overrideModAttrs = (_: {
+    preBuild = null;
+  });
+
  yarnOfflineCache = fetchYarnDeps {
    yarnLock = "${src}/internal/web/ui/yarn.lock";
-    hash = "sha256-Jk+zqR/+NBde9ywncIEJM4kgavqiDvcIAjxJCSMrZDc=";
+    hash = "sha256-Y0WcmjFtiNXue2kcJGlvHVBGmMLewGICISoRHnBPHGw=";
  };

  preBuild = ''
--- a/pkgs/tools/graphics/grim/default.nix
+++ b/pkgs/tools/graphics/grim/default.nix
@ -1,33 +1,30 @@
-{ lib
-, stdenv
-, fetchFromSourcehut
-, pixman
-, libpng
-, libjpeg
-, meson
-, ninja
-, pkg-config
-, scdoc
-, wayland
-, wayland-protocols
-, wayland-scanner
+{
+  lib,
+  fetchFromSourcehut,
+  libjpeg,
+  libpng,
+  meson,
+  ninja,
+  pixman,
+  pkg-config,
+  scdoc,
+  stdenv,
+  wayland,
+  wayland-protocols,
+  wayland-scanner,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "grim";
  version = "1.4.1";

  src = fetchFromSourcehut {
    owner = "~emersion";
-    repo = pname;
-    rev = "v${version}";
+    repo = "grim";
+    rev = "v${finalAttrs.version}";
    hash = "sha256-5csJqRLNqhyeXR4dEQtnPUSwuZ8oY+BIt6AVICkm1+o=";
  };

-  mesonFlags = [
-    "-Dwerror=false"
-  ];
-
  nativeBuildInputs = [
    meson
    ninja
@ -44,12 +41,16 @@ stdenv.mkDerivation rec {
    wayland-protocols
  ];

-  meta = with lib; {
-    description = "Grab images from a Wayland compositor";
+  mesonFlags = [ (lib.mesonBool "werror" false) ];
+
+  strictDeps = true;
+
+  meta = {
    homepage = "https://github.com/emersion/grim";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    description = "Grab images from a Wayland compositor";
+    license = lib.licenses.mit;
    mainProgram = "grim";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (wayland.meta) platforms;
  };
-}
+})
--- a/pkgs/by-name/ip/ipxe/package.nix
+++ b/pkgs/by-name/ip/ipxe/package.nix
@ -48,7 +48,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "ipxe";
-  version = "1.21.1-unstable-2024-09-13";
+  version = "1.21.1-unstable-2024-09-27";

  nativeBuildInputs = [
    gnu-efi
@ -66,8 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "ipxe";
    repo = "ipxe";
-    rev = "c85ad1246890cf3c0c5f2ac6de06ab046ddd0043";
-    hash = "sha256-Py0mXcCj/NhVW3crngR9ZLHvH9N0QJeVmykc3k+yi6Y=";
+    rev = "3f4f843920afdc1d808a8b20354cf3eca481401a";
+    hash = "sha256-+Zpl8xhiWrnkFVL+DLuV0N9pn6hjw5JxDMxeDmfcNS4=";
  };

  # Calling syslinux on a FAT image isn't going to work on Aarch64.
--- a/pkgs/by-name/ji/jikken/package.nix
+++ b/pkgs/by-name/ji/jikken/package.nix
@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "jikken";
-  version = "0.7.2";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "jikkenio";
    repo = "jikken";
    rev = "v${version}";
-    hash = "sha256-bV9NjwTcX1euk8zRJMGkAULegQmiT8z4jxngOwOPr+M=";
+    hash = "sha256-e1n5Q1bF/n9ELA93ucdaIeXx3LPhd7cWkLxWRRdGlo4=";
  };

-  cargoHash = "sha256-gJg/l7L19qk6DELqo4fYc2ZWTHqKeUFEF3YU3+uyFjQ=";
+  cargoHash = "sha256-DALY88q5xsjnoaGJxnVWx/5v4yE80+HNGT/vdFdzkXk=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/li/libvmi/package.nix
+++ b/pkgs/by-name/li/libvmi/package.nix
@ -24,14 +24,14 @@

 let
  pname = "libvmi";
-  version = "0.14.0-unstable-2024-09-04";
+  version = "0.14.0-unstable-2024-09-18";
  libVersion = "0.0.15";

  src = fetchFromGitHub {
    owner = "libvmi";
    repo = "libvmi";
-    rev = "033a0ec5468c29a93888385fd722798a2ca639b7";
-    hash = "sha256-NPcOqmTO4EligGsOTfyO6Bc1duyAoMuX85ICVIOWFE8=";
+    rev = "60ddb31abee62e9bf323c62d4af6ee59b7e2436a";
+    hash = "sha256-IOMfOzp9o2M//GlwOg770aNzPG5IBdc6Omw9O1SEyD4=";
  };
 in

--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@ -1,67 +1,115 @@
-# Builds limine with all available features.
-
+# Derivation containing the Limine host tool and the compiled bootloader
 {
-  # Helpers
-  stdenv
-, fetchurl
-, lib
-, # Dependencies
-  llvmPackages
-, mtools
-, nasm
+  fetchurl,
+  lib,
+  llvmPackages_18,
+  mtools,
+  nasm,
+  # The following options map to configure flags.
+  enableAll ? false,
+  buildCDs ? false,
+  targets ? [ ],
+  # x86 specific flags
+  biosSupport ? false,
+  pxeSupport ? false,
 }:

 let
-  version = "7.9.1";
+  llvmPackages = llvmPackages_18;
+  stdenv = llvmPackages.stdenv;
+
+  version = "8.0.13";
+
+  hasI686 =
+    (if targets == [ ] then stdenv.hostPlatform.isx86_32 else (builtins.elem "i686" targets))
+    || enableAll;
+
+  hasX86_64 =
+    (if targets == [ ] then stdenv.hostPlatform.isx86_64 else (builtins.elem "x86_64" targets))
+    || enableAll;
+
+  uefiFlags =
+    target:
+    {
+      aarch64 = [ "--enable-uefi-aarch64" ];
+      i686 = [ "--enable-uefi-ia32" ];
+      loongarch64 = [ "--enable-uefi-loongarch64" ];
+      riscv64 = [ "--enable-uefi-riscv64" ];
+      x86_64 = [ "--enable-uefi-x86-64" ];
+    }
+    .${target} or (throw "Unsupported target ${target}");
+
+  configureFlags =
+    lib.optionals enableAll [ "--enable-all" ]
+    ++ lib.optionals biosSupport [ "--enable-bios" ]
+    ++ lib.optionals (buildCDs && biosSupport) [ "--enable-bios-cd" ]
+    ++ lib.optionals buildCDs [ "--enable-uefi-cd" ]
+    ++ lib.optionals pxeSupport [ "--enable-bios-pxe" ]
+    ++ lib.concatMap uefiFlags (
+      if targets == [ ] then [ stdenv.hostPlatform.parsed.cpu.name ] else targets
+    );
 in
+
+assert lib.assertMsg (!(biosSupport && !hasI686)) "BIOS builds are possible only for x86";
+
+assert lib.assertMsg (!(pxeSupport && !hasI686)) "PXE builds are possible only for x86";
+
 # The output of the derivation is a tool to create bootable images using Limine
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation {
-  inherit version;
+  inherit version configureFlags;
  pname = "limine";
  # We don't use the Git source but the release tarball, as the source has a
  # `./bootstrap` script performing network access to download resources.
  # Packaging that in Nix is very cumbersome.
  src = fetchurl {
    url = "https://github.com/limine-bootloader/limine/releases/download/v${version}/limine-${version}.tar.gz";
-    hash = "sha256-cR6ilV5giwvbqUoOGbnXQnqZzUz/oL7OGZPYNoFKvy0=";
+    hash = "sha256-pg0tAn4YlfEzpyxb9QAAR0PApYmtnafMbIXfhHw+w3k=";
  };

-  nativeBuildInputs = [
-    llvmPackages.bintools
-    # gcc is used for the host tool, while clang is used for the bootloader.
-    llvmPackages.clang
-    llvmPackages.lld
-    mtools
-    nasm
+  hardeningDisable = [
+    # clang doesn't support this for RISC-V target
+    "zerocallusedregs"
  ];

-  configureFlags = [
-    "--enable-all"
+  nativeBuildInputs =
+    [
+      llvmPackages.libllvm
+      llvmPackages.lld
+    ]
+    ++ lib.optionals (enableAll || buildCDs) [
+      mtools
+    ]
+    ++ lib.optionals (hasI686 || hasX86_64) [ nasm ];
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+    "man"
  ];

-  installFlags = [ "destdir=$out" "manprefix=/share" ];
-
-  outputs = [ "out" "doc" "dev" "man" ];
-
  meta = with lib; {
    homepage = "https://limine-bootloader.org/";
    description = "Limine Bootloader";
-    # Caution. Some submodules have different licenses.
-    license = [
-      licenses.bsd2 # limine, flanterm
-      licenses.bsd0 # freestanding-toolchain, freestanding-headers
-      licenses.asl20 # cc-runtime
-      licenses.mit # limine-efi, stb
-      licenses.zlib # tinf
-    ];
-    # The platforms on that the Liminine binary and helper tools can run, not
+    mainProgram = "limine";
+    # The platforms on that the Limine binary and helper tools can run, not
    # necessarily the platforms for that bootable images can be created.
    platforms = platforms.unix;
    badPlatforms = platforms.darwin;
+    # Caution. Some submodules have different licenses.
+    license = [
+      licenses.asl20 # cc-runtime
+      licenses.bsd0 # freestanding-toolchain, freestanding-headers
+      licenses.bsd2 # limine, flanterm
+      licenses.mit # limine-efi, stb
+      licenses.zlib # tinf
+    ];
    maintainers = [
      maintainers._48cf
      maintainers.phip1611
+      maintainers.sanana
+      maintainers.surfaceflinger
    ];
  };
 }
--- a/pkgs/by-name/lu/lubelogger/package.nix
+++ b/pkgs/by-name/lu/lubelogger/package.nix
@ -6,13 +6,13 @@

 buildDotnetModule rec {
  pname = "lubelogger";
-  version = "1.3.7";
+  version = "1.3.8";

  src = fetchFromGitHub {
    owner = "hargata";
    repo = "lubelog";
    rev = "v${version}";
-    hash = "sha256-Rs+aB6H5FzeADpJjK68srjI2JE2QDV0sCIKQwbnFTMg=";
+    hash = "sha256-f9lj2Er0gQpptzmLpZsxR8hSU6kJlJkwHwpZ7wAq6bk=";
  };

  projectFile = "CarCareTracker.sln";
--- a/pkgs/by-name/ma/maa-assistant-arknights/pin.json
+++ b/pkgs/by-name/ma/maa-assistant-arknights/pin.json
@ -1,10 +1,10 @@
 {
  "stable": {
-    "version": "5.6.1",
-    "hash": "sha256-g2xa1xFzGtbzwECw9tXKeq0izuPwRr+a8+AUvBGq+xc="
+    "version": "5.6.2",
+    "hash": "sha256-vnCHIKYMvMJPGjQdtGsVwZCEb1eId83yIemSnSuG0DU="
  },
  "beta": {
-    "version": "5.6.1",
-    "hash": "sha256-g2xa1xFzGtbzwECw9tXKeq0izuPwRr+a8+AUvBGq+xc="
+    "version": "5.7.0-beta.1",
+    "hash": "sha256-FFIL4HZtZaao90SefWeGWr016lqMoDVfRSaFt91q4Zk="
  }
 }
--- a/pkgs/by-name/ma/marwaita/package.nix
+++ b/pkgs/by-name/ma/marwaita/package.nix
@ -10,13 +10,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "marwaita";
-  version = "21";
+  version = "22";

  src = fetchFromGitHub {
    owner = "darkomarko42";
    repo = pname;
    rev = version;
-    hash = "sha256-5igOzHfkW+HJtll2wLT5qWtLavoPCo170M8v4ID0Wf8=";
+    hash = "sha256-Aa6qJGLQ+MLn/QeZzjMj/O5vEp/Cr/g7n8JFFlSgfOc=";
  };

  buildInputs = [
--- a/pkgs/by-name/mc/mcdreforged/package.nix
+++ b/pkgs/by-name/mc/mcdreforged/package.nix
@ -8,14 +8,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "mcdreforged";
-  version = "2.13.1";
+  version = "2.13.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "MCDReforged";
    repo = "MCDReforged";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Um4XSpkpJupBy5h/hUuHNyXnaDvjL1IIcmSqBHKycEM=";
+    hash = "sha256-4podJ3InBnNc+t4BpCQrg2QbJ9ZJr5fmroXyzo7JrZw=";
  };

  build-system = [ python3.pkgs.setuptools ];
--- a/pkgs/by-name/ng/ngrok/versions.json
+++ b/pkgs/by-name/ng/ngrok/versions.json
@ -1,38 +1,38 @@
 {
  "linux-386": {
    "sys": "linux-386",
-    "url": "https://bin.equinox.io/a/bCqkEJHChUv/ngrok-v3-3.14.0-linux-386",
-    "sha256": "0fc0fcb097ae9caa47b8887e4aca71ce3850bc97343cea93b8cf13d48d5d7c5a",
-    "version": "3.14.0"
+    "url": "https://bin.equinox.io/a/2pDJvg1WeN6/ngrok-v3-3.16.0-linux-386",
+    "sha256": "225ea2210a068f977a608352dd22fd20be619473cf3501df271c39c63905a521",
+    "version": "3.16.0"
  },
  "linux-amd64": {
    "sys": "linux-amd64",
-    "url": "https://bin.equinox.io/a/8oZyZn8Sh2k/ngrok-v3-3.14.0-linux-amd64",
-    "sha256": "80d5ea4de774ad7f579d7381a492b6531c1d83c2a0476d236bd87b1aaaac3c7e",
-    "version": "3.14.0"
+    "url": "https://bin.equinox.io/a/kxzmCLDbo6M/ngrok-v3-3.16.0-linux-amd64",
+    "sha256": "fc1973917b056ac11d74687b0ba513a0fbab41f923e648875b8882d3e6cf07e0",
+    "version": "3.16.0"
  },
  "linux-arm": {
    "sys": "linux-arm",
-    "url": "https://bin.equinox.io/a/cMuwPWbrN4a/ngrok-v3-3.14.0-linux-arm",
-    "sha256": "8baeb05eab0bf3c4adde0a3aba63ec21cdd53f2ade8d1b556dea716597242fb1",
-    "version": "3.14.0"
+    "url": "https://bin.equinox.io/a/iE6KPEx6SuX/ngrok-v3-3.16.0-linux-arm",
+    "sha256": "3cb21e33be918ad4e547db5f0401d0c6fea61876ae46c14daf39f1038f80a1af",
+    "version": "3.16.0"
  },
  "linux-arm64": {
    "sys": "linux-arm64",
-    "url": "https://bin.equinox.io/a/3H9YcER9Em2/ngrok-v3-3.14.0-linux-arm64",
-    "sha256": "021e698af6ccff051184e72bf02de4a5ce45b8e4ace28e000f004e8af841db23",
-    "version": "3.14.0"
+    "url": "https://bin.equinox.io/a/3gbE6TuMrs4/ngrok-v3-3.16.0-linux-arm64",
+    "sha256": "e9cb9a3e65f92fa095101884291f9e5ed0989633cff480353a65877cf710399e",
+    "version": "3.16.0"
  },
  "darwin-amd64": {
    "sys": "darwin-amd64",
-    "url": "https://bin.equinox.io/a/25F8KjXtZLM/ngrok-v3-3.14.0-darwin-amd64",
-    "sha256": "f82d9521e8cb4d8e08b0a2b7d7f6ff4c4db2123c64d9e02ed59de71b8c6f98c5",
-    "version": "3.14.0"
+    "url": "https://bin.equinox.io/a/aWAe4Kvgqei/ngrok-v3-3.16.0-darwin-amd64",
+    "sha256": "5c2fb13ab825876f183bcff82f98b0979f9f5250638a8cb88e5f987f2b109b6c",
+    "version": "3.16.0"
  },
  "darwin-arm64": {
    "sys": "darwin-arm64",
-    "url": "https://bin.equinox.io/a/3bTR91HsBHY/ngrok-v3-3.14.0-darwin-arm64",
-    "sha256": "da5112d50a4b4d27163373effff66a09acaa966a733be4197cc96ca5776432fa",
-    "version": "3.14.0"
+    "url": "https://bin.equinox.io/a/4wpGQDJrfrm/ngrok-v3-3.16.0-darwin-arm64",
+    "sha256": "3fe7cc8f0d6b1978487c502cd6b832a1963287ad0f7c171904ac2c27d81bf9be",
+    "version": "3.16.0"
  }
 }
--- a/pkgs/by-name/no/normcap/package.nix
+++ b/pkgs/by-name/no/normcap/package.nix
@ -7,6 +7,8 @@
 , wl-clipboard
 , libnotify
 , xorg
+, makeDesktopItem
+, copyDesktopItems
 }:

 let
@ -37,12 +39,6 @@ ps.buildPythonApplication rec {
    hash = "sha256-iMlW8oEt4OSipJaQ2XzBZeBVqiZP/C1sM0f5LYjv7/A=";
  };

-  postPatch = ''
-    # disable coverage testing
-    substituteInPlace pyproject.toml \
-      --replace-fail "addopts = [" "addopts_ = ["
-  '';
-
  pythonRemoveDeps = [
    "pyside6-essentials"
  ];
@ -51,9 +47,15 @@ ps.buildPythonApplication rec {
    "shiboken6"
  ];

-  nativeBuildInputs = [
+  build-system = [
    ps.hatchling
    ps.babel
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    ps.toml
+  ];
+
+  nativeBuildInputs = [
+    copyDesktopItems
  ];

  dependencies = [
@ -69,8 +71,15 @@ ps.buildPythonApplication rec {
    )
  '';

+  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
+    mkdir -p $out/share/pixmaps
+    ln -s $out/${python3.sitePackages}/normcap/resources/icons/normcap.png $out/share/pixmaps/
+  '';
+
  nativeCheckInputs = wrapperDeps ++ [
    ps.pytestCheckHook
+    ps.pytest-cov-stub
+    ps.pytest-instafail
    ps.pytest-qt
    ps.toml
  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
@ -107,10 +116,15 @@ ps.buildPythonApplication rec {
    # flaky
    "test_normcap_ocr_testcases"
  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # requires display
+    "test_send_via_qt_tray"
+    "test_screens"
    # requires impure pbcopy
    "test_get_copy_func_with_pbcopy"
    "test_get_copy_func_without_pbcopy"
    "test_perform_pbcopy"
+    "test_pbcopy"
+    "test_copy"
    # NSXPCSharedListener endpointForReply:withListenerName:replyErrorCode:
    # while obtaining endpoint 'ClientCallsAuxiliary': Connection interrupted
    # since v5.0.0
@ -132,8 +146,30 @@ ps.buildPythonApplication rec {
    # requires a display
    "tests/integration/test_normcap.py"
    "tests/integration/test_tray_menu.py"
+    "tests/integration/test_settings_menu.py"
+    "tests/tests_clipboard/test_handlers/test_qtclipboard.py"
+    "tests/tests_gui/test_tray.py"
+    "tests/tests_gui/test_window.py"
+    "tests/tests_screengrab/"
    # failure unknown, crashes in first test with `.show()`
    "tests/tests_gui/test_loading_indicator.py"
+    "tests/tests_gui/test_menu_button.py"
+    "tests/tests_gui/test_resources.py"
+    "tests/tests_gui/test_update_check.py"
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "com.github.dynobo.normcap";
+      desktopName = "NormCap";
+      genericName = "OCR powered screen-capture tool";
+      comment = "Extract text from an image directly into clipboard";
+      exec = "normcap";
+      icon = "normcap";
+      terminal = false;
+      categories = ["Utility" "Office"];
+      keywords = ["Text" "Extraction" "OCR"];
+    })
  ];

  meta = with lib; {
@ -142,6 +178,5 @@ ps.buildPythonApplication rec {
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ cafkafk pbsds ];
    mainProgram = "normcap";
-    broken = stdenv.hostPlatform.isDarwin;
  };
 }
--- a/pkgs/by-name/on/onedrive/package.nix
+++ b/pkgs/by-name/on/onedrive/package.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "onedrive";
-  version = "2.5.0";
+  version = "2.5.1";

  src = fetchFromGitHub {
    owner = "abraunegg";
    repo = "onedrive";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Kxva4gTF45arU3o/jcA5pKT7XhFY89sc6Y862FKE3BE=";
+    hash = "sha256-up7o1myrQutDOEX98rkMlxJZs+Wzaf9HkOYNsX/JC4s=";
  };

  outputs = [
--- a/pkgs/by-name/op/openvswitch/package.nix
+++ b/pkgs/by-name/op/openvswitch/package.nix
@ -1,40 +1,37 @@
 {
+  withDPDK ? false,
+
  lib,
  stdenv,
-  fetchFromGitHub,
+
  autoconf,
  automake,
+  dpdk,
+  fetchFromGitHub,
  installShellFiles,
  iproute2,
-  kernel ? null,
  libcap_ng,
+  libpcap,
  libtool,
+  makeWrapper,
  nix-update-script,
+  nixosTests,
+  numactl,
  openssl,
  perl,
  pkg-config,
  procps,
  python3,
-  tcpdump,
  sphinxHook,
+  tcpdump,
  util-linux,
  which,
-  makeWrapper,
-  withDPDK ? false,
-  dpdk,
-  numactl,
-  libpcap,
 }:

-let
-  _kernel = kernel;
-in
 stdenv.mkDerivation rec {
  pname = if withDPDK then "openvswitch-dpdk" else "openvswitch";
  version = "3.4.0";

-  kernel = lib.optional (_kernel != null) _kernel.dev;
-
  src = fetchFromGitHub {
    owner = "openvswitch";
    repo = "ovs";
@ -84,14 +81,11 @@ stdenv.mkDerivation rec {

  preConfigure = "./boot.sh";

-  configureFlags =
-    [
-      "--localstatedir=/var"
-      "--sharedstatedir=/var"
-      "--sbindir=$(out)/bin"
-    ]
-    ++ (lib.optionals (_kernel != null) [ "--with-linux" ])
-    ++ (lib.optionals withDPDK [ "--with-dpdk=shared" ]);
+  configureFlags = [
+    "--localstatedir=/var"
+    "--sharedstatedir=/var"
+    "--sbindir=$(out)/bin"
+  ] ++ (lib.optionals withDPDK [ "--with-dpdk=shared" ]);

  # Leave /var out of this!
  installFlags = [
@ -131,7 +125,14 @@ stdenv.mkDerivation rec {
      setuptools
    ]);

-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    tests = {
+      default = nixosTests.openvswitch;
+      incus = nixosTests.incus-lts.openvswitch;
+    };
+
+    updateScript = nix-update-script { };
+  };

  meta = with lib; {
    changelog = "https://www.openvswitch.org/releases/NEWS-${version}.txt";
--- a/pkgs/by-name/pa/paper-plane/package.nix
+++ b/pkgs/by-name/pa/paper-plane/package.nix
@ -1,7 +1,6 @@
 { lib
 , fetchFromGitHub
 , gtk4
-, wrapGAppsHook3
 , libadwaita
 , tdlib
 , rlottie
@ -18,6 +17,7 @@
 , libshumate
 , gst_all_1
 , darwin
+, buildPackages
 }:

 let
@ -36,7 +36,7 @@ let
  gtk4-paperplane = gtk4.overrideAttrs (prev: {
    patches = (prev.patches or []) ++ [ "${src}/build-aux/gtk-reversed-list.patch" ];
  });
-  wrapPaperPlaneHook = wrapGAppsHook3.override {
+  wrapPaperPlaneHook = buildPackages.wrapGAppsHook3.override {
    gtk3 = gtk4-paperplane;
  };
  # libadwaita has gtk4 in propagatedBuildInputs so it must be overrided
--- a/pkgs/by-name/pe/peergos/package.nix
+++ b/pkgs/by-name/pe/peergos/package.nix
@ -9,10 +9,10 @@

 stdenv.mkDerivation rec {
  pname = "peergos";
-  version = "0.19.0";
+  version = "0.20.0";
  src = fetchurl {
    url = "https://github.com/Peergos/web-ui/releases/download/v${version}/Peergos.jar";
-    hash = "sha256-GxJI33EVNSZfmrj5H70kwW9RE8YuJKt36qYmdWKtEJ8=";
+    hash = "sha256-Kk0ahAsvfTYkmVZTDE+QhyDFHQFY6lpWhmIOYBeJ1xk=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/pi/pipet/package.nix
+++ b/pkgs/by-name/pi/pipet/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "pipet";
-  version = "0.2.1";
+  version = "0.2.2";

  src = fetchFromGitHub {
    owner = "bjesus";
    repo = "pipet";
    rev = version;
-    hash = "sha256-PqOx/aFI5gHt78th1nkSKlTGw/r1eU7Ggz5kvtjMCmI=";
+    hash = "sha256-NhqrNehmL6LLLEOVT/s2PdQ7HtSCfoM4MST1IHVrJXE=";
  };

  vendorHash = "sha256-jNIjF5jxcpNLAjuWo7OG/Ac4l6NpQNCKzYUgdAoL+C4=";
--- a/pkgs/by-name/po/podman-tui/package.nix
+++ b/pkgs/by-name/po/podman-tui/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "podman-tui";
-  version = "1.2.1";
+  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman-tui";
    rev = "v${version}";
-    hash = "sha256-Is4qpN6i8zBK0WNYbb/YhtzsrgOth9sQdUT81sx7i7g=";
+    hash = "sha256-ldFlW0QNjOvuJGyd2SzmMWA3ofS2ZW5krvCJRU83NXs=";
  };

  vendorHash = null;
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@ -51,13 +51,13 @@ let
  };

  pname = "pretix";
-  version = "2024.8.0";
+  version = "2024.9.0";

  src = fetchFromGitHub {
    owner = "pretix";
    repo = "pretix";
    rev = "refs/tags/v${version}";
-    hash = "sha256-3flZoDzS3SI7nAi1skEqVPXJM9vSBrGN+F0esbYKQDw=";
+    hash = "sha256-L6mTfLIx8kD/5s0Dfp24TEATmjxBXERQjynB0szH3DM=";
  };

  npmDeps = buildNpmPackage {
@ -65,7 +65,7 @@ let
    inherit version src;

    sourceRoot = "${src.name}/src/pretix/static/npm_dir";
-    npmDepsHash = "sha256-ZS+80LLyS2UBnVGRclYhwVwF1BR17D/79F2moQtqh80=";
+    npmDepsHash = "sha256-zUui5tYINTDKA91WgRV51ilIPFBJpZ+S2fJwW85KJ9k=";

    dontBuild = true;

--- a/pkgs/by-name/rp/rpcs3/package.nix
+++ b/pkgs/by-name/rp/rpcs3/package.nix
@ -33,10 +33,10 @@

 let
  # Keep these separate so the update script can regex them
-  rpcs3GitVersion = "16930-d1648dd70";
-  rpcs3Version = "0.0.33-16930-d1648dd70";
-  rpcs3Revision = "d1648dd707687c336dff1397daf8a657881c230e";
-  rpcs3Hash = "sha256-Kw5Kui0jnSRZwu7wRMCPj5RgQQHbTp5O0alLNus2Jvg=";
+  rpcs3GitVersion = "16959-60b5adab6";
+  rpcs3Version = "0.0.33-16959-60b5adab6";
+  rpcs3Revision = "60b5adab636f0cef6987165b38b42cbd7b2a9768";
+  rpcs3Hash = "sha256-0/cNiPUnjuik6YyiNeZ5ZAZBExex5WVW56PCzm80Xx8=";

  inherit (qt6Packages) qtbase qtmultimedia wrapQtAppsHook qtwayland;
 in
--- a/pkgs/by-name/sa/sasquatch-v4be/package.nix
+++ b/pkgs/by-name/sa/sasquatch-v4be/package.nix
@ -0,0 +1,3 @@
+{ sasquatch }:
+
+sasquatch.override { bigEndian = true; }
--- a/pkgs/by-name/sa/sasquatch/darwin.patch
+++ b/pkgs/by-name/sa/sasquatch/darwin.patch
@ -0,0 +1,357 @@
+Patch based on commits by Dave Vasilevsky <dave@vasilevsky.ca> and
+Blake Riley <blake.riley@gmail.com>, squashed into a single patch,
+with BSD-specific changes omitted.
+
+See also https://github.com/plougher/squashfs-tools/pull/69.
+
+diff --git a/squashfs-tools/action.c b/squashfs-tools/action.c
+index ea2f604..9c979f8 100644
+--- a/squashfs-tools/action.c
+++ b/squashfs-tools/action.c
+@@ -39,6 +39,10 @@
+ #include <errno.h>
+ #include <ctype.h>
+ 
+#ifndef FNM_EXTMATCH /* glibc extension */
+	#define FNM_EXTMATCH 0
+#endif
+
+ #include "squashfs_fs.h"
+ #include "mksquashfs.h"
+ #include "action.h"
+@@ -2415,9 +2419,12 @@ static char *get_start(char *s, int n)
+ 
+ static int subpathname_fn(struct atom *atom, struct action_data *action_data)
+ {
+-	return fnmatch(atom->argv[0], get_start(strdupa(action_data->subpath),
+	char *path = strdup(action_data->subpath);
+	int is_match = fnmatch(atom->argv[0], get_start(path,
+ 		count_components(atom->argv[0])),
+ 		FNM_PATHNAME|FNM_EXTMATCH) == 0;
+	free(path);
+	return is_match;
+ }
+ 
+ /*
+diff --git a/squashfs-tools/info.c b/squashfs-tools/info.c
+index 216b979..eea2ec9 100644
+--- a/squashfs-tools/info.c
+++ b/squashfs-tools/info.c
+@@ -144,31 +144,22 @@ void dump_state()
+ void *info_thrd(void *arg)
+ {
+ 	sigset_t sigmask;
+-	struct timespec timespec = { .tv_sec = 1, .tv_nsec = 0 };
+-	int sig, waiting = 0;
+	int sig, err, waiting = 0;
+ 
+ 	sigemptyset(&sigmask);
+ 	sigaddset(&sigmask, SIGQUIT);
+ 	sigaddset(&sigmask, SIGHUP);
+	sigaddset(&sigmask, SIGALRM);
+ 
+ 	while(1) {
+-		if(waiting)
+-			sig = sigtimedwait(&sigmask, NULL, &timespec);
+-		else
+-			sig = sigwaitinfo(&sigmask, NULL);
+		err = sigwait(&sigmask, &sig);
+ 
+-		if(sig == -1) {
+		if(err == -1) {
+ 			switch(errno) {
+-			case EAGAIN:
+-				/* interval timed out */
+-				waiting = 0;
+-				/* FALLTHROUGH */
+ 			case EINTR:
+-				/* if waiting, the wait will be longer, but
+-				   that's OK */
+ 				continue;
+ 			default:
+-				BAD_ERROR("sigtimedwait/sigwaitinfo failed "
+				BAD_ERROR("sigwait failed "
+ 					"because %s\n", strerror(errno));
+ 			}
+ 		}
+@@ -179,8 +170,12 @@ void *info_thrd(void *arg)
+ 			/* set one second interval period, if ^\ received
+ 			   within then, dump queue and cache status */
+ 			waiting = 1;
+-		} else
+			alarm(1);
+		} else if (sig == SIGQUIT) {
+ 			dump_state();
+		} else if (sig == SIGALRM) {
+			waiting = 0;
+		}
+ 	}
+ }
+ 
+diff --git a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
+index 843f9f4..ed2c3a6 100644
+--- a/squashfs-tools/mksquashfs.c
+++ b/squashfs-tools/mksquashfs.c
+@@ -35,7 +35,12 @@
+ #include <stddef.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
+#ifndef linux
+#include <sys/sysctl.h>
+#else
+#include <sys/sysinfo.h>
+ #include <sys/sysmacros.h>
+#endif
+ #include <fcntl.h>
+ #include <errno.h>
+ #include <dirent.h>
+@@ -50,7 +55,10 @@
+ #include <sys/wait.h>
+ #include <limits.h>
+ #include <ctype.h>
+-#include <sys/sysinfo.h>
+
+#ifndef FNM_EXTMATCH /* glibc extension */
+	#define FNM_EXTMATCH 0
+#endif
+ 
+ #ifndef linux
+ #include <sys/sysctl.h>
+@@ -5064,6 +5072,7 @@ static void initialise_threads(int readq, int fragq, int bwriteq, int fwriteq,
+ 	sigemptyset(&sigmask);
+ 	sigaddset(&sigmask, SIGQUIT);
+ 	sigaddset(&sigmask, SIGHUP);
+	sigaddset(&sigmask, SIGALRM);
+ 	if(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) != 0)
+ 		BAD_ERROR("Failed to set signal mask in intialise_threads\n");
+ 
+@@ -5802,6 +5811,35 @@ static int get_physical_memory()
+ 	long long page_size = sysconf(_SC_PAGESIZE);
+ 	int phys_mem;
+ 
+#ifndef linux
+	#ifdef HW_MEMSIZE
+		#define SYSCTL_PHYSMEM HW_MEMSIZE
+	#elif defined(HW_PHYSMEM64)
+		#define SYSCTL_PHYSMEM HW_PHYSMEM64
+	#else
+		#define SYSCTL_PHYSMEM HW_PHYSMEM
+	#endif
+
+	int mib[2];
+	uint64_t sysctl_physmem = 0;
+	size_t sysctl_len = sizeof(sysctl_physmem);
+
+	mib[0] = CTL_HW;
+	mib[1] = SYSCTL_PHYSMEM;
+
+	if(sysctl(mib, 2, &sysctl_physmem, &sysctl_len, NULL, 0) == 0) {
+		/* some systems use 32-bit values, work with what we're given */
+		if (sysctl_len == 4)
+			sysctl_physmem = *(uint32_t*)&sysctl_physmem;
+		phys_mem = sysctl_physmem >> 20;
+	} else {
+		ERROR_START("Failed to get amount of available "
+			"memory.");
+		ERROR_EXIT("  Defaulting to least viable amount\n");
+		phys_mem = SQUASHFS_LOWMEM;
+	}
+  #undef SYSCTL_PHYSMEM
+#else
+ 	if(num_pages == -1 || page_size == -1) {
+ 		struct sysinfo sys;
+ 		int res = sysinfo(&sys);
+@@ -5814,6 +5852,7 @@ static int get_physical_memory()
+ 	}
+ 
+ 	phys_mem = num_pages * page_size >> 20;
+#endif
+ 
+ 	if(phys_mem < SQUASHFS_LOWMEM)
+ 		BAD_ERROR("Mksquashfs requires more physical memory than is "
+diff --git a/squashfs-tools/read_xattrs.c b/squashfs-tools/read_xattrs.c
+index 2067f80..ca8b7f4 100644
+--- a/squashfs-tools/read_xattrs.c
+++ b/squashfs-tools/read_xattrs.c
+@@ -31,13 +31,13 @@
+ #include <stdio.h>
+ #include <string.h>
+ 
+#include <stdlib.h>
+
+ #include "squashfs_fs.h"
+ #include "squashfs_swap.h"
+ #include "xattr.h"
+ #include "error.h"
+ 
+-#include <stdlib.h>
+-
+ extern int read_fs_bytes(int, long long, long long, void *);
+ extern int read_block(int, long long, long long *, int, void *);
+ 
+diff --git a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c
+index d434b42..1208e45 100644
+--- a/squashfs-tools/unsquashfs.c
+++ b/squashfs-tools/unsquashfs.c
+@@ -32,8 +32,12 @@
+ #include "stdarg.h"
+ #include "fnmatch_compat.h"
+ 
+#ifndef linux
+#include <sys/sysctl.h>
+#else
+ #include <sys/sysinfo.h>
+ #include <sys/sysmacros.h>
+#endif
+ #include <sys/types.h>
+ #include <sys/time.h>
+ #include <sys/resource.h>
+@@ -1182,7 +1186,7 @@ int create_inode(char *pathname, struct inode *i)
+ 			break;
+ 		case SQUASHFS_SYMLINK_TYPE:
+ 		case SQUASHFS_LSYMLINK_TYPE: {
+-			struct timespec times[2] = {
+			struct timeval times[2] = {
+ 				{ i->time, 0 },
+ 				{ i->time, 0 }
+ 			};
+@@ -1201,8 +1205,7 @@ int create_inode(char *pathname, struct inode *i)
+ 				goto failed;
+ 			}
+ 
+-			res = utimensat(AT_FDCWD, pathname, times,
+-					AT_SYMLINK_NOFOLLOW);
+			res = lutimes(pathname, times);
+ 			if(res == -1) {
+ 				EXIT_UNSQUASH_STRICT("create_inode: failed to"
+ 					" set time on %s, because %s\n",
+@@ -2687,6 +2690,7 @@ void initialise_threads(int fragment_buffer_size, int data_buffer_size, int cat_
+ 		sigemptyset(&sigmask);
+ 		sigaddset(&sigmask, SIGQUIT);
+ 		sigaddset(&sigmask, SIGHUP);
+		sigaddset(&sigmask, SIGALRM);
+ 		if(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) != 0)
+ 			EXIT_UNSQUASH("Failed to set signal mask in initialise_threads\n");
+ 
+diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h
+index 1099678..5b6a038 100644
+--- a/squashfs-tools/unsquashfs.h
+++ b/squashfs-tools/unsquashfs.h
+@@ -46,6 +46,10 @@
+ #include <sys/ioctl.h>
+ #include <sys/time.h>
+ 
+#ifndef FNM_EXTMATCH /* glibc extension */
+	#define FNM_EXTMATCH 0
+#endif
+
+ #include "endian_compat.h"
+ #include "squashfs_fs.h"
+ #include "unsquashfs_error.h"
+diff --git a/squashfs-tools/unsquashfs_info.c b/squashfs-tools/unsquashfs_info.c
+index e906eaf..f1e68c2 100644
+--- a/squashfs-tools/unsquashfs_info.c
+++ b/squashfs-tools/unsquashfs_info.c
+@@ -96,31 +96,22 @@ void dump_state()
+ void *info_thrd(void *arg)
+ {
+ 	sigset_t sigmask;
+-	struct timespec timespec = { .tv_sec = 1, .tv_nsec = 0 };
+-	int sig, waiting = 0;
+	int sig, err, waiting = 0;
+ 
+ 	sigemptyset(&sigmask);
+ 	sigaddset(&sigmask, SIGQUIT);
+ 	sigaddset(&sigmask, SIGHUP);
+	sigaddset(&sigmask, SIGALRM);
+ 
+ 	while(1) {
+-		if(waiting)
+-			sig = sigtimedwait(&sigmask, NULL, &timespec);
+-		else
+-			sig = sigwaitinfo(&sigmask, NULL);
+		err = sigwait(&sigmask, &sig);
+ 
+-		if(sig == -1) {
+		if(err == -1) {
+ 			switch(errno) {
+-			case EAGAIN:
+-				/* interval timed out */
+-				waiting = 0;
+-				/* FALLTHROUGH */
+ 			case EINTR:
+-				/* if waiting, the wait will be longer, but
+-				   that's OK */
+ 				continue;
+ 			default:
+-				BAD_ERROR("sigtimedwait/sigwaitinfo failed "
+				BAD_ERROR("sigwait failed "
+ 					"because %s\n", strerror(errno));
+ 			}
+ 		}
+@@ -132,8 +123,12 @@ void *info_thrd(void *arg)
+ 			/* set one second interval period, if ^\ received
+ 			   within then, dump queue and cache status */
+ 			waiting = 1;
+-		} else
+			alarm(1);
+		} else if (sig == SIGQUIT) {
+ 			dump_state();
+		} else if (sig == SIGALRM) {
+			waiting = 0;
+		}
+ 	}
+ }
+ 
+diff --git a/squashfs-tools/unsquashfs_xattr.c b/squashfs-tools/unsquashfs_xattr.c
+index 61910e1..73e0090 100644
+--- a/squashfs-tools/unsquashfs_xattr.c
+++ b/squashfs-tools/unsquashfs_xattr.c
+@@ -27,6 +27,11 @@
+ 
+ #include <sys/xattr.h>
+ 
+#ifdef XATTR_NOFOLLOW /* Apple's xattrs */
+	#define lsetxattr(path_, name_, val_, sz_, flags_) \
+		setxattr(path_, name_, val_, sz_, 0, flags_ | XATTR_NOFOLLOW)
+#endif
+
+ #define NOSPACE_MAX 10
+ 
+ extern int root_process;
+diff --git a/squashfs-tools/xattr.c b/squashfs-tools/xattr.c
+index b1c0089..6d7ed98 100644
+--- a/squashfs-tools/xattr.c
+++ b/squashfs-tools/xattr.c
+@@ -22,6 +22,14 @@
+  * xattr.c
+  */
+ 
+#ifndef linux
+#define __BYTE_ORDER BYTE_ORDER
+#define __BIG_ENDIAN BIG_ENDIAN
+#define __LITTLE_ENDIAN LITTLE_ENDIAN
+#else
+#include <endian.h>
+#endif
+
+ #define TRUE 1
+ #define FALSE 0
+ 
+@@ -36,6 +44,13 @@
+ #include <stdlib.h>
+ #include <sys/xattr.h>
+ 
+#ifdef XATTR_NOFOLLOW /* Apple's xattrs */
+	#define llistxattr(path_, buf_, sz_) \
+		listxattr(path_, buf_, sz_, XATTR_NOFOLLOW)
+	#define lgetxattr(path_, name_, val_, sz_) \
+		getxattr(path_, name_, val_, sz_, 0, XATTR_NOFOLLOW)
+#endif
+
+ #include "squashfs_fs.h"
+ #include "squashfs_swap.h"
+ #include "mksquashfs.h"
+-- 
+2.35.1
+
--- a/pkgs/by-name/sa/sasquatch/package.nix
+++ b/pkgs/by-name/sa/sasquatch/package.nix
@ -0,0 +1,72 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  lz4,
+  lzo,
+  which,
+  xz,
+  zlib,
+  zstd,
+  bigEndian ? false,
+}:
+
+let
+  drv = stdenv.mkDerivation (finalAttrs: {
+    pname = "sasquatch";
+    version = "4.5.1-4";
+
+    src = fetchFromGitHub {
+      owner = "onekey-sec";
+      repo = "sasquatch";
+      rev = "sasquatch-v${finalAttrs.version}";
+      hash = "sha256-0itva+j5WMKvueiUaO253UQ1S6W29xgtFvV4i3yvMtU=";
+    };
+
+    patches = lib.optional stdenv.isDarwin ./darwin.patch;
+
+    strictDeps = true;
+    nativeBuildInputs = [ which ];
+    buildInputs = [
+      zlib
+      xz
+      zstd
+      lz4
+      lzo
+    ];
+
+    preBuild = ''
+      cd squashfs-tools
+    '';
+
+    installFlags = [
+      "INSTALL_DIR=${placeholder "out"}/bin"
+      "INSTALL_MANPAGES_DIR=${placeholder "out"}/share/man/man1"
+    ];
+
+    makeFlags = [
+      "GZIP_SUPPORT=1"
+      "LZ4_SUPPORT=1"
+      "LZMA_SUPPORT=1"
+      "LZO_SUPPORT=1"
+      "XZ_SUPPORT=1"
+      "ZSTD_SUPPORT=1"
+    ];
+
+    env.NIX_CFLAGS_COMPILE = lib.optionalString bigEndian "-DFIX_BE";
+
+    postInstall = lib.optionalString bigEndian ''
+      mv $out/bin/sasquatch{,-v4be}
+    '';
+
+    meta = {
+      homepage = "https://github.com/onekey-sec/sasquatch";
+      description = "Set of patches to the standard unsquashfs utility (part of squashfs-tools) that attempts to add support for as many hacked-up vendor-specific SquashFS implementations as possible";
+      license = lib.licenses.gpl2Plus;
+      maintainers = with lib.maintainers; [ vlaci ];
+      platforms = lib.platforms.unix;
+      mainProgram = if bigEndian then "sasquatch-v4be" else "sasquatch";
+    };
+  });
+in
+drv
--- a/pkgs/by-name/sk/skypeforlinux/package.nix
+++ b/pkgs/by-name/sk/skypeforlinux/package.nix
@ -42,8 +42,8 @@ let

  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
  # source of the latter disappears much faster.
-  version = "8.127.0.200";
-  revision = "359";
+  version = "8.129.0.201";
+  revision = "364";

  rpath =
    lib.makeLibraryPath [
@ -103,7 +103,7 @@ let
      fetchurl {
        name = "skypeforlinux-${version}-${revision}.snap";
        url = "https://api.snapcraft.io/api/v1/snaps/download/QRDEfjn4WJYnm0FzDKwqqRZZI77awQEV_${revision}.snap";
-        hash = "sha512-C0UQ9mUhrt3CXBPG1BEz4CjjYfy/mRkgrBpjTxhYpeACJq0rNwTUMacicF7BHDgllQmfAdr2/feLyqbsr9HTBQ==";
+        hash = "sha512-b1tA6Su7Ij89/SdEY1WCBu6IeKuSlEH5OpD5qE+w1B8xEX2Bj9axe4s/YYDb2FvuDhWJn86oZpFf7N6ATt16tg==";
      }
    else
      throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/by-name/st/stackql/package.nix
+++ b/pkgs/by-name/st/stackql/package.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "stackql";
-  version = "0.5.740";
+  version = "0.5.742";

  src = fetchFromGitHub {
    owner = "stackql";
    repo = "stackql";
    rev = "v${version}";
-    hash = "sha256-XwNz+O0FSNzWFiZvOUQCvcjg6L0f53c2ZaNiT8T0ikU=";
+    hash = "sha256-GMc22n0y4lKv4DlG9069p/TrMJLyw0Zdiykuo41Tgys=";
  };

  vendorHash = "sha256-dssGqcS9l3VipEypKErlCeRs087Tb5Kx4VXvkErZar4=";
--- a/pkgs/by-name/tu/turtle/package.nix
+++ b/pkgs/by-name/tu/turtle/package.nix
@ -9,7 +9,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "turtle";
-  version = "0.9";
+  version = "0.10";
  pyproject = true;

  src = fetchFromGitLab {
@ -17,7 +17,7 @@ python3Packages.buildPythonApplication rec {
    owner = "philippun1";
    repo = "turtle";
    rev = version;
-    hash = "sha256-jTO0xUh4VKhjCrmzcRSvxfGPw2j8WKD6uF4mg6nG16g=";
+    hash = "sha256-hWjxNAf0qy/aJ4Y7nLA5m69k3mEn3/1XaJ58aHQrWug=";
  };

  postPatch = ''
@ -38,6 +38,7 @@ python3Packages.buildPythonApplication rec {
  dependencies = with python3Packages; [
    pygobject3
    pygit2
+    secretstorage
    dbus-python
  ];

--- a/pkgs/by-name/va/vale/package.nix
+++ b/pkgs/by-name/va/vale/package.nix
@ -1,11 +1,11 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, makeBinaryWrapper
-, runCommand
-, symlinkJoin
-, vale
-, valeStyles
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  symlinkJoin,
+  vale,
+  valeStyles,
 }:

 buildGoModule rec {
@ -23,36 +23,43 @@ buildGoModule rec {

  vendorHash = "sha256-0AeG0/ALU/mkXxVKzqGhxXLqq2XYmnF/ZRaZkJ5eQxU=";

-  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
+  ldflags = [
+    "-s"
+    "-X main.version=${version}"
+  ];

  # Tests require network access
  doCheck = false;

-  passthru.withStyles = selector: symlinkJoin {
-    name = "vale-with-styles-${vale.version}";
-    paths = [ vale ] ++ selector valeStyles;
-    nativeBuildInputs = [ makeBinaryWrapper ];
-    postBuild = ''
-      wrapProgram "$out/bin/vale" \
-        --set VALE_STYLES_PATH "$out/share/vale/styles/"
-    '';
-    meta = {
-      inherit (vale.meta) mainProgram;
+  passthru.withStyles =
+    selector:
+    symlinkJoin {
+      name = "vale-with-styles-${vale.version}";
+      paths = [ vale ] ++ selector valeStyles;
+      nativeBuildInputs = [ makeBinaryWrapper ];
+      postBuild = ''
+        wrapProgram "$out/bin/vale" \
+          --set VALE_STYLES_PATH "$out/share/vale/styles/"
+      '';
+      meta = {
+        inherit (vale.meta) mainProgram;
+      };
    };
-  };

-  meta = with lib; {
+  meta = {
    description = "Syntax-aware linter for prose built with speed and extensibility in mind";
    longDescription = ''
      Vale in Nixpkgs offers the helper `.withStyles` allow you to install it
      predefined styles:

-          vale.withStyles (s: [ s.alex s.google ])
+      ```nix
+      vale.withStyles (s: [ s.alex s.google ])
+      ```
    '';
    homepage = "https://vale.sh/";
    changelog = "https://github.com/errata-ai/vale/releases/tag/v${version}";
    mainProgram = "vale";
-    license = licenses.mit;
-    maintainers = [ maintainers.pbsds ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pbsds ];
  };
 }
--- a/pkgs/by-name/va/vale/styles.nix
+++ b/pkgs/by-name/va/vale/styles.nix
@ -1,34 +1,47 @@
-{ lib, stdenvNoCC, fetchFromGitHub, fetchzip, nix-update-script }:
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  nix-update-script,
+}:

 let
  buildStyle =
-    { name
-    , stylePath ? name
-    , ...
+    {
+      name,
+      stylePath ? name,
+      ...
    }@args:
-    stdenvNoCC.mkDerivation ({
-      pname = "vale-style-${lib.toLower name}";
+    stdenvNoCC.mkDerivation (
+      {
+        pname = "vale-style-${lib.toLower name}";

-      dontConfigure = true;
-      dontBuild = true;
-      doCheck = false;
-      dontFixup = true;
+        dontConfigure = true;
+        dontBuild = true;
+        doCheck = false;
+        dontFixup = true;

-      installPhase = ''
-        runHook preInstall
-        mkdir -p $out/share/vale/styles
-        cp -R ${stylePath} "$out/share/vale/styles/${name}"
-        runHook postInstall
-      '';
+        installPhase = ''
+          runHook preInstall
+          mkdir -p $out/share/vale/styles
+          cp -R ${stylePath} "$out/share/vale/styles/${name}"
+          runHook postInstall
+        '';

-      passthru.updateScript = nix-update-script { };
+        passthru.updateScript = nix-update-script { };

-      meta = {
-        platforms = lib.platforms.all;
-        maintainers = with lib.maintainers; [ katexochen ];
-      } // (args.meta or { });
-    } // removeAttrs args [ "meta" "name" ]);
+        meta = {
+          platforms = lib.platforms.all;
+          maintainers = with lib.maintainers; [ katexochen ];
+        } // (args.meta or { });
+      }
+      // removeAttrs args [
+        "meta"
+        "name"
+      ]
+    );
 in
+
 {
  alex = buildStyle rec {
    name = "alex";
--- a/pkgs/by-name/ya/yamlscript/package.nix
+++ b/pkgs/by-name/ya/yamlscript/package.nix
@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "yamlscript";
-  version = "0.1.75";
+  version = "0.1.76";

  src = fetchurl {
    url = "https://github.com/yaml/yamlscript/releases/download/${version}/yamlscript.cli-${version}-standalone.jar";
-    hash = "sha256-GdnrEHVdJmwcs6l1Fw3pXJ8hS+spcNpDQ346d6F0OTM=";
+    hash = "sha256-+3UKOHfiY5GUkvvciNNFXBiAX1QQV4BUIFN+EhbjSEs=";
  };

  executable = "ys";
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/onlineaccounts/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/onlineaccounts/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "switchboard-plug-onlineaccounts";
-  version = "8.0.0";
+  version = "8.0.1";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "sha256-OlivtKz3kE81CZ6KJgvVvqf0BSVJbh6C0F7O+/+4xZU=";
+    sha256 = "sha256-E4UAhrs+YQ47VEHMFY8PbSFvBqhqrTf4aPezeqEjdLo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/flix/default.nix
+++ b/pkgs/development/compilers/flix/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "flix";
-  version = "0.50.0";
+  version = "0.51.0";

  src = fetchurl {
    url = "https://github.com/flix/flix/releases/download/v${version}/flix.jar";
-    sha256 = "sha256-fAEt7JsljnEXubYgiF8uEOuoOXHjv9AHgQbPunaEMw4=";
+    sha256 = "sha256-JeOw9mdmFAG0mMe8G/yanKCLPbCUPJxUBluNFFqjfbA=";
  };

  dontUnpack = true;
--- a/pkgs/development/cuda-modules/tensorrt/fixup.nix
+++ b/pkgs/development/cuda-modules/tensorrt/fixup.nix
@ -65,7 +65,7 @@ finalAttrs: prevAttrs: {
  # We need to look inside the extracted output to get the files we need.
  sourceRoot = "TensorRT-${finalAttrs.version}";

-  buildInputs = prevAttrs.buildInputs ++ [ finalAttrs.passthru.cudnn.lib ];
+  buildInputs = prevAttrs.buildInputs ++ [ (finalAttrs.passthru.cudnn.lib or null) ];

  preInstall =
    (prevAttrs.preInstall or "")
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@ -29,11 +29,14 @@
 , libepoxy
 , libjxl
 , at-spi2-core
+, cairo
 , libxml2
 , libsoup
 , libsecret
 , libxslt
 , harfbuzz
+, hyphen
+, libsysprof-capture
 , libpthreadstubs
 , nettle
 , libtasn1
@ -50,6 +53,8 @@
 , libmanette
 , geoclue2
 , flite
+, fontconfig
+, freetype
 , openssl
 , sqlite
 , gst-plugins-base
@ -73,7 +78,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "webkitgtk";
-  version = "2.44.3";
+  version = "2.46.0";
  name = "${finalAttrs.pname}-${finalAttrs.version}+abi=${if lib.versionAtLeast gtk3.version "4.0" then "6.0" else "4.${if lib.versions.major libsoup.version == "2" then "0" else "1"}"}";

  outputs = [ "out" "dev" "devdoc" ];
@ -84,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://webkitgtk.org/releases/webkitgtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3ILQQuysqYGkhSNXwG5SNXQzGc8QqUzTatQbl4g6C1Q=";
+    hash = "sha256-1NQzBA8ZAVFWDFC96ECFAIn4e61P76nr20quhWo99Do=";
  };

  patches = lib.optionals stdenv.hostPlatform.isLinux [
@ -124,6 +129,7 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    at-spi2-core
+    cairo # required even when using skia
    enchant2
    libavif
    libepoxy
@ -132,6 +138,7 @@ stdenv.mkDerivation (finalAttrs: {
    gst-plugins-bad
    gst-plugins-base
    harfbuzz
+    hyphen
    libGL
    libGLU
    mesa # for libEGL headers
@ -141,6 +148,7 @@ stdenv.mkDerivation (finalAttrs: {
    libintl
    lcms2
    libpthreadstubs
+    libsysprof-capture
    libtasn1
    libwebp
    libxkbcommon
@ -151,6 +159,10 @@ stdenv.mkDerivation (finalAttrs: {
    p11-kit
    sqlite
    woff2
+  ] ++ lib.optionals stdenv.hostPlatform.isBigEndian [
+    # https://bugs.webkit.org/show_bug.cgi?id=274032
+    fontconfig
+    freetype
  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
    libedit
    readline
@ -196,7 +208,6 @@ stdenv.mkDerivation (finalAttrs: {
    [
      "-DENABLE_INTROSPECTION=ON"
      "-DPORT=GTK"
-      "-DUSE_LIBHYPHEN=OFF"
      "-DUSE_SOUP2=${cmakeBool (lib.versions.major libsoup.version == "2")}"
      "-DUSE_LIBSECRET=${cmakeBool withLibsecret}"
      "-DENABLE_EXPERIMENTAL_FEATURES=${cmakeBool enableExperimental}"
--- a/pkgs/development/ocaml-modules/cfstream/default.nix
+++ b/pkgs/development/ocaml-modules/cfstream/default.nix
@ -1,10 +1,10 @@
-{ lib, buildDunePackage, fetchFromGitHub, ocaml, m4, camlp-streams, core_kernel, ounit }:
+{ lib, buildDunePackage, fetchFromGitHub, m4, camlp-streams, core_kernel, ounit }:

 buildDunePackage rec {
  pname = "cfstream";
  version = "1.3.2";

-  minimalOCamlVersion = "4.07";
+  minimalOCamlVersion = "4.08";

  src = fetchFromGitHub {
    owner = "biocaml";
@ -15,13 +15,11 @@ buildDunePackage rec {

  patches = [ ./git_commit.patch ./janestreet-0.17.patch ];

-  strictDeps = true;
-
  nativeBuildInputs = [ m4 ];
  checkInputs = [ ounit ];
  propagatedBuildInputs = [ camlp-streams core_kernel ];

-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;

  meta = with lib; {
    inherit (src.meta) homepage;
--- a/pkgs/development/ocaml-modules/ppx_blob/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_blob/default.nix
@ -4,7 +4,7 @@ buildDunePackage rec {
  pname = "ppx_blob";
  version = "0.9.0";

-  duneVersion = "3";
+  minimalOCamlVersion = "4.08";

  src = fetchurl {
    url = "https://github.com/johnwhitington/${pname}/releases/download/${version}/ppx_blob-${version}.tbz";
@ -13,7 +13,7 @@ buildDunePackage rec {

  checkInputs = [ alcotest ];
  propagatedBuildInputs = [ ppxlib ];
-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;

  meta = with lib; {
    homepage = "https://github.com/johnwhitington/ppx_blob";
--- a/pkgs/development/ocaml-modules/printbox/default.nix
+++ b/pkgs/development/ocaml-modules/printbox/default.nix
@ -4,9 +4,7 @@ buildDunePackage rec {
  pname = "printbox";
  version = "0.11";

-  useDune2 = true;
-
-  minimalOCamlVersion = "4.03";
+  minimalOCamlVersion = "4.04";

  src = fetchFromGitHub {
    owner = "c-cube";
--- a/pkgs/development/python-modules/adafruit-io/default.nix
+++ b/pkgs/development/python-modules/adafruit-io/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "adafruit-io";
-  version = "2.7.2";
+  version = "2.8.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "adafruit";
    repo = "Adafruit_IO_Python";
    rev = "refs/tags/${version}";
-    hash = "sha256-JBpF08WGe1pMK1y7HZLH/jSQkJtbWdiTGYHWRd39UIk=";
+    hash = "sha256-OwTHMyc2ePSdYVuY1h3PY+uDBl6/7fTMXiZC3sZm8fU=";
  };

  nativeBuildInputs = [ setuptools-scm ];
--- a/pkgs/development/python-modules/aiohasupervisor/default.nix
+++ b/pkgs/development/python-modules/aiohasupervisor/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "aiohasupervisor";
-  version = "0.1.0b1";
+  version = "0.1.0";
  pyproject = true;

  disabled = pythonOlder "3.12";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-INpyN5jdXOzTC6t18PvbkbDM7n4Y4rejb08UfyJyFSk=";
+    hash = "sha256-Jq9cSdMMXVgRHhQK1LuGwVR6GBTIrw3th7y9huRSQjM=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/aiortsp/default.nix
+++ b/pkgs/development/python-modules/aiortsp/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "aiortsp";
-  version = "1.3.7";
+  version = "1.4.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "marss";
    repo = "aiortsp";
-    rev = version;
-    hash = "sha256-bxfnKAzMYh0lhS3he617eGhO7hmNbiwEYHh8k/PZ6r4=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-/ydsu+53WOocdWk3AW0/cXBEx1qAlhIC0LUDy459pbQ=";
  };

  nativeBuildInputs = [ setuptools ];
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@ -57,14 +57,13 @@ else
        --replace '/usr/include/libffi' '${lib.getDev libffi}/include'
    '';

-    nativeBuildInputs = [
-      pkg-config
-      setuptools
-    ];
+    nativeBuildInputs = [ pkg-config ];
+
+    build-system = [ setuptools ];

    buildInputs = [ libffi ];

-    propagatedBuildInputs = [ pycparser ];
+    dependencies = [ pycparser ];

    # The tests use -Werror but with python3.6 clang detects some unreachable code.
    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument -Wno-unreachable-code -Wno-c++11-narrowing";
--- a/pkgs/development/python-modules/cleanlab/default.nix
+++ b/pkgs/development/python-modules/cleanlab/default.nix
@ -14,6 +14,7 @@
  pandas,

  # test dependencies
+  cleanvision,
  datasets,
  fasttext,
  hypothesis,
@ -58,6 +59,7 @@ buildPythonPackage rec {
  doCheck = true;

  nativeCheckInputs = [
+    cleanvision
    datasets
    fasttext
    hypothesis
--- a/pkgs/development/python-modules/cleanvision/default.nix
+++ b/pkgs/development/python-modules/cleanvision/default.nix
@ -0,0 +1,79 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  fsspec,
+  imagehash,
+  matplotlib,
+  numpy,
+  pandas,
+  pillow,
+  tabulate,
+  tqdm,
+
+  # tests
+  datasets,
+  psutil,
+  pytestCheckHook,
+  torchvision,
+}:
+
+buildPythonPackage rec {
+  pname = "cleanvision";
+  version = "0.3.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "cleanlab";
+    repo = "cleanvision";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-QAydDqLJx/jYKXqxRUElTdM5dOFA6nZag8rNAjPZjRg=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    fsspec
+    imagehash
+    matplotlib
+    numpy
+    pandas
+    pillow
+    tabulate
+    tqdm
+  ];
+
+  pythonImportsCheck = [ "cleanvision" ];
+
+  nativeCheckInputs = [
+    datasets
+    psutil
+    pytestCheckHook
+    torchvision
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  disabledTests = [
+    # Requires accessing s3 (online)
+    "test_s3_dataset"
+  ];
+
+  meta = {
+    description = "Automatically find issues in image datasets and practice data-centric computer vision";
+    homepage = "https://github.com/cleanlab/cleanvision";
+    changelog = "https://github.com/cleanlab/cleanvision/releases/tag/v${version}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    # Fatal Python error: Aborted
+    broken = stdenv.isDarwin;
+  };
+}
--- a/pkgs/development/python-modules/django-bootstrap3/default.nix
+++ b/pkgs/development/python-modules/django-bootstrap3/default.nix
@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "django-bootstrap3";
-  version = "24.2";
+  version = "24.3";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "zostera";
    repo = "django-bootstrap3";
    rev = "refs/tags/v${version}";
-    hash = "sha256-5nBJ5vfsoGoaG1s3K1hCHcSnGf51ZirYYg+uJGsBmG8=";
+    hash = "sha256-7aHGTa98NaHg6C+fxuQsrPk/8XjHB3awp+gAWysOhAw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/dvc-data/default.nix
+++ b/pkgs/development/python-modules/dvc-data/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "dvc-data";
-  version = "3.16.5";
+  version = "3.16.6";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = "dvc-data";
    rev = "refs/tags/${version}";
-    hash = "sha256-QTsKjF7aVUUFi/6WtuLDVaKOOEzkbkQKpT9L2Mg6724=";
+    hash = "sha256-2KYAFNCh6QfGdTzHE5LCumWoi+DM4t857qg6LrFO5x4=";
  };

  build-system = [ setuptools-scm ];
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "fastcore";
-  version = "1.7.9";
+  version = "1.7.10";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "fastai";
    repo = "fastcore";
    rev = "refs/tags/${version}";
-    hash = "sha256-OGqd+pLM3THcPD3JtccjH6sgpVEhcNVnGbIbyMFfqTU=";
+    hash = "sha256-ksHJrgNju2rEVHcKU6jpW6izQPFgrWvDrvDZy0/Cgug=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/mobly/default.nix
+++ b/pkgs/development/python-modules/mobly/default.nix
@ -21,14 +21,14 @@

 buildPythonPackage rec {
  pname = "mobly";
-  version = "1.12.3";
+  version = "1.12.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "google";
    repo = "mobly";
    rev = "refs/tags/${version}";
-    hash = "sha256-hhI1jrHJk4wo49MK8J4VTS2dGmHG2kwzgZeSWBXdXkA=";
+    hash = "sha256-77wZK5dqxXUkOgWE7NBpGJBbbtYYxRCJwPbtwLIX09I=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/neo4j/default.nix
+++ b/pkgs/development/python-modules/neo4j/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "neo4j";
-  version = "5.24.0";
+  version = "5.25.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "neo4j";
    repo = "neo4j-python-driver";
    rev = "refs/tags/${version}";
-    hash = "sha256-bkLz+4eOS+c1qUC2PbPNcn19sJqUqONSgKhAe1Ga1U8=";
+    hash = "sha256-aGUfyfN85JNOQSnnM+zep07cmLqq9YN1bc7UyH3uFWg=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pulsectl/default.nix
+++ b/pkgs/development/python-modules/pulsectl/default.nix
@ -12,12 +12,12 @@

 buildPythonPackage rec {
  pname = "pulsectl";
-  version = "24.4.0";
+  version = "24.8.0";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-aX7VDn1FLnhniuOOKrk1hDAIvsRIlVKDzQ+zYoZ+MWU=";
+    hash = "sha256-sFFQbQ1z08xDV879PeF7uFnX7PAE6ZSw98+oeFG8cVY=";
  };

  patches = [
--- a/pkgs/development/python-modules/pypdf/default.nix
+++ b/pkgs/development/python-modules/pypdf/default.nix
@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  fetchpatch2,
  pythonOlder,

  # build-system
@ -27,7 +28,7 @@

 buildPythonPackage rec {
  pname = "pypdf";
-  version = "4.3.1";
+  version = "5.0.0";
  pyproject = true;

  src = fetchFromGitHub {
@ -36,7 +37,7 @@ buildPythonPackage rec {
    rev = "refs/tags/${version}";
    # fetch sample files used in tests
    fetchSubmodules = true;
-    hash = "sha256-wSF20I5WaxRoN0n0jxB5O3mAAIOxP/TclYBTRAUwYHo=";
+    hash = "sha256-omnNC1mzph59aqrXqLCuCk0LgzfJv/JhbQRrAgRhAIg=";
  };

  outputs = [
@ -53,6 +54,14 @@ buildPythonPackage rec {
    myst-parser
  ];

+  patches = [
+    (fetchpatch2 {
+      # Mark test_increment_writer as enable_socket (https://github.com/py-pdf/pypdf/pull/2867)
+      url = "https://github.com/py-pdf/pypdf/commit/d974d5c755a7b65f3b9c68c5742afdbc0c1693f6.patch";
+      hash = "sha256-4xiCAStP615IktTUgk31JbIxkxx8d6PQdu8Nfmhc1jo=";
+    })
+  ];
+
  postPatch = ''
    substituteInPlace pyproject.toml \
      --replace-fail "--disable-socket" ""
--- a/pkgs/development/python-modules/vdf/default.nix
+++ b/pkgs/development/python-modules/vdf/default.nix
@ -2,8 +2,10 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  fetchpatch2,
  mock,
  pytestCheckHook,
+  nix-update-script,
 }:

 buildPythonPackage rec {
@ -13,17 +15,30 @@ buildPythonPackage rec {

  src = fetchFromGitHub {
    owner = "ValvePython";
-    repo = pname;
-    rev = "v${version}";
+    repo = "vdf";
+    rev = "refs/tags/v${version}";
    hash = "sha256-6ozglzZZNKDtADkHwxX2Zsnkh6BE8WbcRcC9HkTTgPU=";
  };

+  patches = [
+    # Support appinfo.vdf v29 (required by protontricks 1.12.0)
+    (fetchpatch2 {
+      url = "https://github.com/Matoking/vdf/commit/981cad270c2558aeb8eccaf42cfcf9fabbbed199.patch";
+      hash = "sha256-kLAbbB0WHjxq4rokLoGTPx43BU44EshteR59Ey9JnXo=";
+    })
+  ];
+
  nativeCheckInputs = [
    mock
    pytestCheckHook
  ];
+
  pythonImportsCheck = [ "vdf" ];

+  # Use nix-update-script instead of the default python updater
+  # The python updater requires GitHub releases, but vdf only uses tags
+  passthru.updateScript = nix-update-script { };
+
  meta = with lib; {
    description = "Library for working with Valve's VDF text format";
    homepage = "https://github.com/ValvePython/vdf";
--- a/pkgs/development/tools/clj-kondo/default.nix
+++ b/pkgs/development/tools/clj-kondo/default.nix
@ -3,12 +3,12 @@

 buildGraalvmNativeImage rec {
  pname = "clj-kondo";
-  version = "2024.08.29";
+  version = "2024.09.27";

  src = fetchurl {
    url =
      "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-0Mvj8FW6/Q9GudaD3lnRFvTjMkkAGwpAokdNJa/HfsI=";
+    sha256 = "sha256-DrSfL1WazlNd5H0jG6m0S5aED4BLVufr1rGIAyifn6E=";
  };

  graalvmDrv = graalvmCEPackages.graalvm-ce;
--- a/pkgs/development/tools/fblog/default.nix
+++ b/pkgs/development/tools/fblog/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "fblog";
-  version = "4.10.0";
+  version = "4.12.0";

  src = fetchFromGitHub {
    owner = "brocode";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-4Yg7gWVBG9GI1ailEbbcslM+XR8L7yjjjvf4dQq/87I=";
+    hash = "sha256-OZE+jqjsyvHLDJ+6r0txH56afufnl4H9PHcG7XRfxnE=";
  };

-  cargoHash = "sha256-8rnQllCne1q1uDpeJkqAdzNKSkEgVp+v9drXL8TaQmM=";
+  cargoHash = "sha256-zZ/xE7DVX1HSK81xwB4VxCtnOTUwJvSScmJeA/t/ACI=";

  meta = with lib; {
    description = "Small command-line JSON log viewer";
--- a/pkgs/development/tools/gauge/plugins/make-gauge-plugin.nix
+++ b/pkgs/development/tools/gauge/plugins/make-gauge-plugin.nix
@ -17,7 +17,7 @@
 let
  otherArgs = lib.attrsets.removeAttrs args [ "pname" "data" "repo" "releasePrefix" "isMultiArch" ];
  inherit (stdenvNoCC.hostPlatform) system;
-  inherit (if isCrossArch then data else data.${system}) url hash;
+  inherit (if isCrossArch then data else data.${system} or (throw "gaugePlugins.${pname}: No source for system: ${system}")) url hash;
  # Upstream uses a different naming scheme for platforms
  systemMap = {
    "x86_64-darwin" = "darwin.x86_64";
--- a/pkgs/development/tools/gosec/default.nix
+++ b/pkgs/development/tools/gosec/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "gosec";
-  version = "2.21.2";
+  version = "2.21.4";

  src = fetchFromGitHub {
    owner = "securego";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-1lVyIytIorxxipDZAf2AYqtO1Slz9aUw6MpC40ji89w=";
+    hash = "sha256-fu0k+dZyEo2l0PWfN8iryGgUIJsWi7AQD3ku+w1tuGM=";
  };

-  vendorHash = "sha256-jxbGAEvkjvuK878nkl8TGbZmBzS7n9nG4hH9BL3UGwE=";
+  vendorHash = "sha256-LYEAQ/7S31Rv2gmkLReV1lKeAHW5DpKkegKb0Js75q0=";

  subPackages = [
    "cmd/gosec"
--- a/Show More
+++ b/Show More