Merge master into staging-next

2024-06-05 18:00:54 +00:00 · 2024-06-05 18:00:54 +00:00 · 7c106be2e0
commit 7c106be2e0
parent 1e2373c22a 63f559ca65
60 changed files with 908 additions and 371 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -12825,6 +12825,12 @@
    githubId = 952712;
    name = "Matt Christ";
  };
+  matteopacini = {
+    email = "m@matteopacini.me";
+    github = "matteo-pacini";
+    githubId = 3139724;
+    name = "Matteo Pacini";
+  };
  matthewbauer = {
    email = "mjbauer95@gmail.com";
    github = "matthewbauer";
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -23,6 +23,11 @@
  nvimpager settings: user commands in `-c` and `--cmd` now override the
  respective default settings because they are executed later.

+- `services.forgejo.mailerPasswordFile` has been deprecated by the drop-in replacement `services.forgejo.secrets.mailer.PASSWD`,
+  which is part of the new free-form `services.forgejo.secrets` option.
+  `services.forgejo.secrets` is a small wrapper over systemd's `LoadCredential=`. It has the same structure (sections/keys) as
+  `services.forgejo.settings` but takes file paths that will be read before service startup instead of some plaintext value.
+
 - The Invoiceplane module now only accepts the structured `settings` option.
  `extraConfig` is now removed.

--- a/nixos/modules/services/misc/forgejo.nix
+++ b/nixos/modules/services/misc/forgejo.nix
@ -12,6 +12,15 @@ let
  usePostgresql = cfg.database.type == "postgres";
  useSqlite = cfg.database.type == "sqlite3";

+  secrets = let
+    mkSecret = section: values: lib.mapAttrsToList (key: value: {
+      env = envEscape "FORGEJO__${section}__${key}__FILE";
+      path = value;
+    }) values;
+    # https://codeberg.org/forgejo/forgejo/src/tag/v7.0.2/contrib/environment-to-ini/environment-to-ini.go
+    envEscape = string: lib.replaceStrings [ "." "-" ] [ "_0X2E_" "_0X2D_" ] (lib.strings.toUpper string);
+  in lib.flatten (lib.mapAttrsToList mkSecret cfg.secrets);
+
  inherit (lib)
    literalExpression
    mkChangedOptionModule
@ -34,6 +43,7 @@ in
    (mkRenamedOptionModule [ "services" "forgejo" "appName" ] [ "services" "forgejo" "settings" "DEFAULT" "APP_NAME" ])
    (mkRemovedOptionModule [ "services" "forgejo" "extraConfig" ] "services.forgejo.extraConfig has been removed. Please use the freeform services.forgejo.settings option instead")
    (mkRemovedOptionModule [ "services" "forgejo" "database" "password" ] "services.forgejo.database.password has been removed. Please use services.forgejo.database.passwordFile instead")
+    (mkRenamedOptionModule [ "services" "forgejo" "mailerPasswordFile" ] [ "services" "forgejo" "secrets" "mailer" "PASSWD" ])

    # copied from services.gitea; remove at some point
    (mkRenamedOptionModule [ "services" "forgejo" "cookieSecure" ] [ "services" "forgejo" "settings" "session" "COOKIE_SECURE" ])
@ -224,13 +234,6 @@ in
        description = "Path to the git repositories.";
      };

-      mailerPasswordFile = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "/run/keys/forgejo-mailpw";
-        description = "Path to a file containing the SMTP password.";
-      };
-
      settings = mkOption {
        default = { };
        description = ''
@ -347,6 +350,44 @@ in
          };
        };
      };
+
+      secrets = mkOption {
+        default = { };
+        description = ''
+          This is a small wrapper over systemd's `LoadCredential`.
+
+          It takes the same sections and keys as {option}`services.forgejo.settings`,
+          but the value of each key is a path instead of a string or bool.
+
+          The path is then loaded as credential, exported as environment variable
+          and then feed through
+          <https://codeberg.org/forgejo/forgejo/src/branch/forgejo/contrib/environment-to-ini/environment-to-ini.go>.
+
+          It does the required environment variable escaping for you.
+
+          ::: {.note}
+          Keys specified here take priority over the ones in {option}`services.forgejo.settings`!
+          :::
+        '';
+        example = literalExpression ''
+        {
+          metrics = {
+            TOKEN = "/run/keys/forgejo-metrics-token";
+          };
+          camo = {
+            HMAC_KEY = "/run/keys/forgejo-camo-hmac";
+          };
+          service = {
+            HCAPTCHA_SECRET = "/run/keys/forgejo-hcaptcha-secret";
+            HCAPTCHA_SITEKEY = "/run/keys/forgejo-hcaptcha-sitekey";
+          };
+        }
+        '';
+        type = types.submodule {
+          freeformType = with types; attrsOf (attrsOf path);
+          options = { };
+        };
+      };
    };
  };

@ -381,7 +422,6 @@ in
          HOST = if cfg.database.socket != null then cfg.database.socket else cfg.database.host + ":" + toString cfg.database.port;
          NAME = cfg.database.name;
          USER = cfg.database.user;
-          PASSWD = "#dbpass#";
        })
        (mkIf useSqlite {
          PATH = cfg.database.path;
@ -397,7 +437,6 @@ in

      server = mkIf cfg.lfs.enable {
        LFS_START_SERVER = true;
-        LFS_JWT_SECRET = "#lfsjwtsecret#";
      };

      session = {
@ -405,24 +444,33 @@ in
      };

      security = {
-        SECRET_KEY = "#secretkey#";
-        INTERNAL_TOKEN = "#internaltoken#";
        INSTALL_LOCK = true;
      };

-      mailer = mkIf (cfg.mailerPasswordFile != null) {
-        PASSWD = "#mailerpass#";
-      };
-
-      oauth2 = {
-        JWT_SECRET = "#oauth2jwtsecret#";
-      };
-
      lfs = mkIf cfg.lfs.enable {
        PATH = cfg.lfs.contentDir;
      };
    };

+    services.forgejo.secrets = {
+      security = {
+        SECRET_KEY = "${cfg.customDir}/conf/secret_key";
+        INTERNAL_TOKEN = "${cfg.customDir}/conf/internal_token";
+      };
+
+      oauth2 = {
+        JWT_SECRET = "${cfg.customDir}/conf/oauth2_jwt_secret";
+      };
+
+      database = mkIf (cfg.database.passwordFile != null) {
+        PASSWD = cfg.database.passwordFile;
+      };
+
+      server = mkIf cfg.lfs.enable {
+        LFS_JWT_SECRET = "${cfg.customDir}/conf/lfs_jwt_secret";
+      };
+    };
+
    services.postgresql = optionalAttrs (usePostgresql && cfg.database.createDatabase) {
      enable = mkDefault true;

@ -476,6 +524,37 @@ in
      "z '${cfg.lfs.contentDir}' 0750 ${cfg.user} ${cfg.group} - -"
    ];

+    systemd.services.forgejo-secrets = mkIf (!cfg.useWizard) {
+      description = "Forgejo secret bootstrap helper";
+      script = ''
+        if [ ! -s '${cfg.secrets.security.SECRET_KEY}' ]; then
+            ${exe} generate secret SECRET_KEY > '${cfg.secrets.security.SECRET_KEY}'
+        fi
+
+        if [ ! -s '${cfg.secrets.oauth2.JWT_SECRET}' ]; then
+            ${exe} generate secret JWT_SECRET > '${cfg.secrets.oauth2.JWT_SECRET}'
+        fi
+
+        ${optionalString cfg.lfs.enable ''
+        if [ ! -s '${cfg.secrets.server.LFS_JWT_SECRET}' ]; then
+            ${exe} generate secret LFS_JWT_SECRET > '${cfg.secrets.server.LFS_JWT_SECRET}'
+        fi
+        ''}
+
+        if [ ! -s '${cfg.secrets.security.INTERNAL_TOKEN}' ]; then
+            ${exe} generate secret INTERNAL_TOKEN > '${cfg.secrets.security.INTERNAL_TOKEN}'
+        fi
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        User = cfg.user;
+        Group = cfg.group;
+        ReadWritePaths = [ cfg.customDir ];
+        UMask = "0077";
+      };
+    };
+
    systemd.services.forgejo = {
      description = "Forgejo (Beyond coding. We forge.)";
      after = [
@ -484,11 +563,15 @@ in
        "postgresql.service"
      ] ++ optionals useMysql [
        "mysql.service"
+      ] ++ optionals (!cfg.useWizard) [
+        "forgejo-secrets.service"
      ];
      requires = optionals (cfg.database.createDatabase && usePostgresql) [
        "postgresql.service"
      ] ++ optionals (cfg.database.createDatabase && useMysql) [
        "mysql.service"
+      ] ++ optionals (!cfg.useWizard) [
+        "forgejo-secrets.service"
      ];
      wantedBy = [ "multi-user.target" ];
      path = [ cfg.package pkgs.git pkgs.gnupg ];
@ -501,61 +584,15 @@ in
      # lfs_jwt_secret.
      # We have to consider this to stay compatible with older installations.
      preStart =
-        let
-          runConfig = "${cfg.customDir}/conf/app.ini";
-          secretKey = "${cfg.customDir}/conf/secret_key";
-          oauth2JwtSecret = "${cfg.customDir}/conf/oauth2_jwt_secret";
-          oldLfsJwtSecret = "${cfg.customDir}/conf/jwt_secret"; # old file for LFS_JWT_SECRET
-          lfsJwtSecret = "${cfg.customDir}/conf/lfs_jwt_secret"; # new file for LFS_JWT_SECRET
-          internalToken = "${cfg.customDir}/conf/internal_token";
-          replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
-        in
        ''
-          # copy custom configuration and generate random secrets if needed
-          ${lib.optionalString (!cfg.useWizard) ''
+          ${optionalString (!cfg.useWizard) ''
            function forgejo_setup {
-              cp -f '${format.generate "app.ini" cfg.settings}' '${runConfig}'
+              config='${cfg.customDir}/conf/app.ini'
+              cp -f '${format.generate "app.ini" cfg.settings}' "$config"

-              if [ ! -s '${secretKey}' ]; then
-                  ${exe} generate secret SECRET_KEY > '${secretKey}'
-              fi
-
-              # Migrate LFS_JWT_SECRET filename
-              if [[ -s '${oldLfsJwtSecret}' && ! -s '${lfsJwtSecret}' ]]; then
-                  mv '${oldLfsJwtSecret}' '${lfsJwtSecret}'
-              fi
-
-              if [ ! -s '${oauth2JwtSecret}' ]; then
-                  ${exe} generate secret JWT_SECRET > '${oauth2JwtSecret}'
-              fi
-
-              ${optionalString cfg.lfs.enable ''
-              if [ ! -s '${lfsJwtSecret}' ]; then
-                  ${exe} generate secret LFS_JWT_SECRET > '${lfsJwtSecret}'
-              fi
-              ''}
-
-              if [ ! -s '${internalToken}' ]; then
-                  ${exe} generate secret INTERNAL_TOKEN > '${internalToken}'
-              fi
-
-              chmod u+w '${runConfig}'
-              ${replaceSecretBin} '#secretkey#' '${secretKey}' '${runConfig}'
-              ${replaceSecretBin} '#oauth2jwtsecret#' '${oauth2JwtSecret}' '${runConfig}'
-              ${replaceSecretBin} '#internaltoken#' '${internalToken}' '${runConfig}'
-
-              ${optionalString cfg.lfs.enable ''
-                ${replaceSecretBin} '#lfsjwtsecret#' '${lfsJwtSecret}' '${runConfig}'
-              ''}
-
-              ${optionalString (cfg.database.passwordFile != null) ''
-                ${replaceSecretBin} '#dbpass#' '${cfg.database.passwordFile}' '${runConfig}'
-              ''}
-
-              ${optionalString (cfg.mailerPasswordFile != null) ''
-                ${replaceSecretBin} '#mailerpass#' '${cfg.mailerPasswordFile}' '${runConfig}'
-              ''}
-              chmod u-w '${runConfig}'
+              chmod u+w "$config"
+              ${lib.getExe' cfg.package "environment-to-ini"} --config "$config"
+              chmod u-w "$config"
            }
            (umask 027; forgejo_setup)
          ''}
@ -616,6 +653,8 @@ in
        # System Call Filtering
        SystemCallArchitectures = "native";
        SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" "setrlimit" ];
+        # cfg.secrets
+        LoadCredential = map (e: "${e.env}:${e.path}") secrets;
      };

      environment = {
@ -625,7 +664,7 @@ in
        # is resolved.
        GITEA_WORK_DIR = cfg.stateDir;
        GITEA_CUSTOM = cfg.customDir;
-      };
+      } // lib.listToAttrs (map (e: lib.nameValuePair e.env "%d/${e.env}") secrets);
    };

    services.openssh.settings.AcceptEnv = mkIf (!cfg.settings.START_SSH_SERVER or false) "GIT_PROTOCOL";
--- a/nixos/modules/virtualisation/virtualbox-host.nix
+++ b/nixos/modules/virtualisation/virtualbox-host.nix
@ -134,7 +134,7 @@ in
    assertions = [
      {
        assertion = !cfg.addNetworkInterface;
-        message = "VirtualBox KVM only supports standard NAT networking for VMs. Please turn off virtualisation.virtualbox.host.addNetworkInferface.";
+        message = "VirtualBox KVM only supports standard NAT networking for VMs. Please turn off virtualisation.virtualbox.host.addNetworkInterface.";
      }

      {
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@ -113,7 +113,7 @@ in rec {
        (onFullSupported "nixos.tests.latestKernel.login")
        (onFullSupported "nixos.tests.lightdm")
        (onFullSupported "nixos.tests.login")
-        (onFullSupported "nixos.tests.misc.default")
+        (onFullSupported "nixos.tests.misc")
        (onFullSupported "nixos.tests.mutableUsers")
        (onFullSupported "nixos.tests.nat.firewall")
        (onFullSupported "nixos.tests.nat.standalone")
--- a/nixos/tests/forgejo.nix
+++ b/nixos/tests/forgejo.nix
@ -41,6 +41,8 @@ let
    hash = "sha256-h2/UIp8IjPo3eE4Gzx52Fb7pcgG/Ww7u31w5fdKVMos=";
  };

+  metricSecret = "fakesecret";
+
  supportedDbTypes = [ "mysql" "postgres" "sqlite3" ];
  makeForgejoTest = type: nameValuePair type (makeTest {
    name = "forgejo-${type}";
@ -59,6 +61,8 @@ let
            ENABLE_PUSH_CREATE_USER = true;
            DEFAULT_PUSH_CREATE_PRIVATE = false;
          };
+          settings.metrics.ENABLED = true;
+          secrets.metrics.TOKEN = pkgs.writeText "metrics_secret" metricSecret;
        };
        environment.systemPackages = [ config.services.forgejo.package pkgs.gnupg pkgs.jq pkgs.file pkgs.htmlq ];
        services.openssh.enable = true;
@ -192,6 +196,10 @@ let
            timeout=10
        )

+        with subtest("Testing /metrics endpoint with token from cfg.secrets"):
+            server.fail("curl --fail http://localhost:3000/metrics")
+            server.succeed('curl --fail http://localhost:3000/metrics -H "Authorization: Bearer ${metricSecret}"')
+
        with subtest("Testing runner registration and action workflow"):
            server.succeed(
                "su -l forgejo -c 'GITEA_WORK_DIR=/var/lib/forgejo gitea actions generate-runner-token' | sed 's/^/TOKEN=/' | tee /var/lib/forgejo/runner_token"
--- a/pkgs/applications/audio/easyaudiosync/0001-fix-project-name.patch
+++ b/pkgs/applications/audio/easyaudiosync/0001-fix-project-name.patch
@ -0,0 +1,13 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 7065538..b2716e1 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -4,7 +4,7 @@ if (VCPKG)
+   include("${CMAKE_SOURCE_DIR}/cmake/vcpkg.cmake")
+ endif ()
+ 
+-project("Easy Audio Sync"
+project("easyaudiosync"
+   VERSION 1.1.1
+   DESCRIPTION "Audio library syncing and conversion utility"
+   HOMEPAGE_URL "https://github.com/complexlogic/EasyAudioSync"
--- a/pkgs/applications/audio/easyaudiosync/0002-fix-qt67-deprecated-methods.patch
+++ b/pkgs/applications/audio/easyaudiosync/0002-fix-qt67-deprecated-methods.patch
@ -0,0 +1,21 @@
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index e7befae..8689f13 100644
+--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
+@@ -43,11 +43,14 @@ configure_file("${PROJECT_SOURCE_DIR}/translations/languages.hpp.in" "${PROJECT_
+ 
+ # Make lupdate target for Qt 6
+ if (${QT_VERSION} VERSION_GREATER_EQUAL "6")
+-  qt_add_lupdate(${EXECUTABLE_NAME}
+  qt_add_lupdate(
+     TS_FILES ${TS_FILES} "${PROJECT_SOURCE_DIR}/translations/source.ts"
+    SOURCE_TARGETS ${EXECUTABLE_NAME}
+   )
+ endif ()
+-qt_add_translation(QM_FILES "${TS_FILES}")
+qt_add_translations(
+  ${EXECUTABLE_NAME} 
+)
+ foreach (FILE ${QM_FILES})
+   get_filename_component(BASENAME ${FILE} NAME)
+   string(APPEND TRANSLATION_FILES "    <file>${BASENAME}</file>\n")
--- a/pkgs/applications/audio/easyaudiosync/0003-fix-darwin-app.patch
+++ b/pkgs/applications/audio/easyaudiosync/0003-fix-darwin-app.patch
@ -0,0 +1,35 @@
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index e7befae..e7dc255 100644
+--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
+@@ -86,7 +86,6 @@ if (UNIX)
+     )
+   endif ()
+   if (APPLE)
+-    if (DMG)
+       set_target_properties(${EXECUTABLE_NAME} PROPERTIES 
+                             MACOSX_BUNDLE ON
+                             MACOSX_BUNDLE_EXECUTABLE_NAME "${EXECUTABLE_NAME}"
+@@ -94,21 +93,12 @@ if (UNIX)
+                             MACOSX_BUNDLE_ICON_FILE "${EXECUTABLE_NAME}.icns"
+                             MACOSX_BUNDLE_GUI_IDENTIFIER "${RDNS_NAME}"
+                             MACOSX_BUNDLE_LONG_VERSION_STRING "${PROJECT_VERSION}"
+-                            MACOSX_BUNDLE_BUNDLE_NAME "${PROJECT_NAME}"
+                            MACOSX_BUNDLE_BUNDLE_NAME "Easy Audio Sync"
+                             MACOSX_BUNDLE_SHORT_VERSION_STRING "${PROJECT_VERSION}"
+                             MACOSX_BUNDLE_BUNDLE_VERSION "${PROJECT_VERSION}"
+                             MACOSX_BUNDLE_COPYRIGHT "Public Domain"
+ 
+       )
+-      install(CODE "include(BundleUtilities)\nfixup_bundle(\"${PROJECT_BINARY_DIR}/${EXECUTABLE_NAME}.app\" \"\" \"\")")
+-      add_custom_target(my_install COMMAND ${CMAKE_COMMAND} --build . --target install WORKING_DIRECTORY "${PROJECT_BINARY_DIR}")
+-      add_custom_target(dmg
+-        COMMAND mv "${EXECUTABLE_NAME}.app" "${PROJECT_NAME}.app" # fixup_bundle won't accept app names with spaces so need to manually rename
+-        COMMAND "${MACDEPLOYQT}" "${PROJECT_NAME}.app" -dmg
+-        COMMAND mv "${PROJECT_NAME}.dmg" "${EXECUTABLE_NAME}-${PROJECT_VERSION}-${CMAKE_OSX_ARCHITECTURES}.dmg"
+-        WORKING_DIRECTORY "${PROJECT_BINARY_DIR}")
+-      add_dependencies(dmg my_install)
+-    endif ()
+   else ()
+     install(TARGETS ${EXECUTABLE_NAME} DESTINATION "${CMAKE_INSTALL_PREFIX}/bin")
+     set (DATA_DIR "${CMAKE_INSTALL_PREFIX}/share")
--- a/pkgs/applications/audio/easyaudiosync/0004-force-qt6.patch
+++ b/pkgs/applications/audio/easyaudiosync/0004-force-qt6.patch
@ -0,0 +1,21 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 7065538..1946574 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -19,14 +19,8 @@ set(EXECUTABLE_OUTPUT_PATH "${PROJECT_BINARY_DIR}")
+ set(VS_STARTUP_PROJECT ${EXECUTABLE_NAME})
+ 
+ # Configure options
+-if (WIN32 OR APPLE)
+-  set(QT_VERSION "6")
+-else ()
+-  set(QT_VERSION "5" CACHE STRING "Qt major version to use (5 or 6).")
+-  if (NOT (QT_VERSION STREQUAL "5" OR QT_VERSION STREQUAL "6"))
+-    message(FATAL_ERROR "Unsupported Qt version '${QT_VERSION}'. Only 5 and 6 are supported")
+-  endif ()
+-endif ()
+set(QT_VERSION "6")
+
+ if (APPLE)
+   option(DMG "Make deployable DMG" OFF)
+ endif ()
--- a/pkgs/applications/audio/easyaudiosync/default.nix
+++ b/pkgs/applications/audio/easyaudiosync/default.nix
@ -0,0 +1,98 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, cmake
+, qtbase
+, qttools
+, spdlog
+, ffmpeg
+, taglib
+, wrapQtAppsHook
+, makeDesktopItem
+, copyDesktopItems
+}:
+
+stdenv.mkDerivation rec {
+  pname = "easyaudiosync";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "complexlogic";
+    repo = "EasyAudioSync";
+    rev = "v${version}";
+    hash = "sha256-w98tj9BuixPhuDgwn74EYY0gvKH6kbfQmtg030RWRU0=";
+  };
+
+  patches = [
+    ./0001-fix-project-name.patch
+    ./0002-fix-qt67-deprecated-methods.patch
+    ./0003-fix-darwin-app.patch
+    ./0004-force-qt6.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapQtAppsHook
+  ] ++ lib.optional stdenv.isLinux copyDesktopItems;
+
+  buildInputs = [
+    qtbase
+    qttools
+    ffmpeg
+    spdlog
+    taglib
+  ];
+
+  installPhase =
+    ''
+      runHook preInstall
+    '' + lib.optionalString stdenv.isDarwin ''
+      mkdir -p $out/Applications
+      mv "easyaudiosync.app" "Easy Audio Sync.app"
+      cp -r "Easy Audio Sync.app" $out/Applications
+    '' + lib.optionalString stdenv.isLinux ''
+      install -Dm755 easyaudiosync $out/bin/easyaudiosync
+
+      for RES in 48 64 128 256; do
+        install -Dm755 "$src/assets/icons/easyaudiosync''${RES}.png" "$out/share/icons/hicolor/''${RES}x''${RES}/apps/easyaudiosync.png"
+      done
+
+      install -Dm755 "$src/assets/icons/easyaudiosync.svg" "$out/share/icons/hicolor/scalable/apps/easyaudiosync.svg"
+    '' + ''
+      runHook postInstall
+    '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "easyaudiosync";
+      exec = "easyaudiosync";
+      icon = "easyaudiosync";
+      desktopName = "Easy Audio Sync";
+      categories = [
+        "Qt"
+        "Audio"
+        "AudioVideo"
+      ];
+      comment = "Audio library syncing and conversion utility";
+    })
+  ];
+
+  meta = with lib; {
+    description = "Audio library syncing and conversion utility";
+    longDescription = ''
+      Easy Audio Sync is an audio library syncing and conversion utility.
+      The intended use is syncing an audio library with many lossless files to a mobile device
+      with limited storage.
+
+      The program's design is inspired by the rsync utility. It supports folder-based
+      source to destination syncing, with added audio transcoding capability, and is
+      GUI-based instead of CLI-based.
+    '';
+    homepage = "https://github.com/complexlogic/EasyAudioSync";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ matteopacini ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}
--- a/pkgs/applications/audio/mousai/paths.patch
+++ b/pkgs/applications/audio/mousai/paths.patch
@ -1,13 +0,0 @@
-diff --git a/src/backend/utils.py b/src/backend/utils.py
-index cebc009..0087c09 100644
--- a/src/backend/utils.py
-+++ b/src/backend/utils.py
-@@ -79,7 +79,7 @@ class Utils:
-     @staticmethod
-     def get_default_audio_sources():
-         pactl_output = subprocess.run(
-            ['/usr/bin/pactl', 'info'],
-+            ['@pactl@', 'info'],
-             stdout=subprocess.PIPE,
-             text=True
-         ).stdout.splitlines()
--- a/pkgs/applications/gis/whitebox-tools/default.nix
+++ b/pkgs/applications/gis/whitebox-tools/default.nix
@ -1,31 +1,51 @@
-{ lib
-, stdenv
-, rustPlatform
-, fetchFromGitHub
-, Security
+{
+  lib,
+  stdenv,
+  cmake,
+  rustPlatform,
+  pkg-config,
+  fetchFromGitHub,
+  atk,
+  gtk3,
+  glib,
+  openssl,
+  Security,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage rec {
  pname = "whitebox_tools";
-  version = "2.2.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "jblindsay";
    repo = "whitebox-tools";
    rev = "v${version}";
-    hash = "sha256-DQ7BPRd90GNQVfD5NoVcxoyd2L3WZvIkecmRJVUY1R4=";
+    hash = "sha256-kvtfEEydwonoDux1VbAxqrF/Hf8Qh8mhprYnROGOC6g=";
  };

-  cargoHash = "sha256-BounjGGhbU5dxNV8WjVDQtV7YONNVRldc/t+wet1Gh8=";
+  cargoHash = "sha256-6v/3b6BHh/n7M2ZhLVKRvv0Va2xbLUSsxUb5paOStbQ=";

-  buildInputs = lib.optional stdenv.isDarwin Security;
+  buildInputs = [
+    atk
+    glib
+    gtk3
+    openssl
+  ] ++ lib.optional stdenv.isDarwin Security;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];

  doCheck = false;

-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
    homepage = "https://jblindsay.github.io/ghrg/WhiteboxTools/index.html";
    description = "An advanced geospatial data analysis platform";
-    license = licenses.mit;
-    maintainers = [ maintainers.mpickering ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ mpickering ];
  };
 }
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@ -1,32 +1,29 @@
-{ lib, buildPythonApplication, fetchPypi, fetchpatch, requests, yt-dlp, pytestCheckHook }:
+{
+  lib,
+  buildPythonApplication,
+  fetchPypi,
+  requests,
+  yt-dlp,
+  pytestCheckHook,
+}:

 buildPythonApplication rec {
  pname = "gallery-dl";
-  version = "1.26.9";
+  version = "1.27.0";
  format = "setuptools";

  src = fetchPypi {
    inherit version;
    pname = "gallery_dl";
-    sha256 = "sha256-PgbfppyJCpgFupBQng8MUPihbDmit4C+xWnSzCJyu5k=";
+    hash = "sha256-zMimHjaXgwOSt8HbSec4o0y3e9Xf6tFFiI4KzsrP850=";
  };

-  patches = [
-    # catch general Exceptions. Remove with the next release.
-    (fetchpatch {
-      url = "https://github.com/mikf/gallery-dl/commit/5227bb6b1d62ecef5b281592b0d001e7f9c101e3.patch";
-      hash = "sha256-rVsd764siP/07XBPVDnpxMm/4kLiH3fp9+NtpHHH23U=";
-    })
-  ];
-
  propagatedBuildInputs = [
    requests
    yt-dlp
  ];

-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];

  pytestFlagsArray = [
    # requires network access
@ -37,16 +34,14 @@ buildPythonApplication rec {
    "--ignore=test/test_ytdl.py"
  ];

-  pythonImportsCheck = [
-    "gallery_dl"
-  ];
+  pythonImportsCheck = [ "gallery_dl" ];

-  meta = with lib; {
+  meta = {
    description = "Command-line program to download image-galleries and -collections from several image hosting sites";
    homepage = "https://github.com/mikf/gallery-dl";
    changelog = "https://github.com/mikf/gallery-dl/blob/v${version}/CHANGELOG.md";
-    license = licenses.gpl2Only;
+    license = lib.licenses.gpl2Only;
    mainProgram = "gallery-dl";
-    maintainers = with maintainers; [ dawidsowa ];
+    maintainers = with lib.maintainers; [ dawidsowa ];
  };
 }
--- a/pkgs/applications/misc/inochi2d/creator-dub-lock.json
+++ b/pkgs/applications/misc/inochi2d/creator-dub-lock.json
@ -37,8 +37,8 @@
      "sha256": "0p5vmkw29ksh5wdxz1ijms1wblq288pv15vnbl93z7q2vgnq995w"
    },
    "eventcore": {
-      "version": "0.9.29",
-      "sha256": "1993mibxqb4v7lbsq3kbfwxfpi0d1gzzmzvx6y01907aqz933isa"
+      "version": "0.9.30",
+      "sha256": "1n8wdcjhas0y99pf9fvwwsydkmy9g7gvfjhlwpjh158c7pfjwlaq"
    },
    "facetrack-d": {
      "version": "0.7.8",
@ -69,8 +69,8 @@
      "sha256": "0kzk55ilbnl6qypjk60zwd5ibys5n47128hbbr0mbc7bpj9ppfg4"
    },
    "inochi2d": {
-      "version": "0.8.3",
-      "sha256": "1m9dalm6sb518yi9mbphq1fdax90fc5rmskah19l7slnplbhli4l"
+      "version": "0.8.4",
+      "sha256": "1bj0c6i9kcw1vfm6lf8lyxpf1lhhslg3f182jycdmzms15i3jb3y"
    },
    "kra-d": {
      "version": "0.5.5",
@ -85,12 +85,12 @@
      "sha256": "0hm31birbw59sw1bi9syjhbcdgwwwyyx6r9jg7ar9i6a74cjr52c"
    },
    "mir-algorithm": {
-      "version": "3.22.0",
-      "sha256": "0pl1vwyyhr2hrxlj060khzhg33dkgyrzi3f5qqxz6xj3hcp7axxq"
+      "version": "3.22.1",
+      "sha256": "1bvvf3dm26x1h10pg1s4kyhxiyrmd96kk2lmchyady39crpjj5cf"
    },
    "mir-core": {
-      "version": "1.7.0",
-      "sha256": "14k7y2r06pwzf29shymyjrk7l582bh181rc07bnwgjn3f84ayn62"
+      "version": "1.7.1",
+      "sha256": "15m1n48fcmh5pw3w4ww5qfzwkdglflpzc3xmxmrlvd30swyyr85j"
    },
    "mir-linux-kernel": {
      "version": "1.0.1",
@ -105,8 +105,8 @@
      "sha256": "1fwhd5fkvgbqf3y8gwmrnd42kzi4k3mibpxijw5j82jxgfp1rzsf"
    },
    "openssl-static": {
-      "version": "1.0.3+3.0.8",
-      "sha256": "1z977ghlnczxky2q2gislfi68jnbp2zf4pifv8rzrcs0nx3va2jr"
+      "version": "1.0.5+3.0.8",
+      "sha256": "0wpqz29yrbbh39g3cwlgd6h6hh1msws7w5baw1kywdkgj761gx2k"
    },
    "psd-d": {
      "version": "0.6.3",
@ -121,20 +121,20 @@
      "sha256": "1g8382wr49sjyar0jay8j7y2if7h1i87dhapkgxphnizp24d7kaj"
    },
    "taggedalgebraic": {
-      "version": "0.11.22",
-      "sha256": "1kc39sdnk2ybhrwxiwyw1mqcw0qzjr0vr54yvyp3gkkaad373k4r"
+      "version": "0.11.23",
+      "sha256": "1bialmbdwjpqhgs95inkwzin7xbhx7sngjf7viq90vzma497l59k"
    },
    "tinyfiledialogs": {
      "version": "0.10.1",
      "sha256": "1k3gq9y7912x5b30h60nvlfdr61as1f187b8rsilkxliizcmbhfi"
    },
    "vibe-container": {
-      "version": "1.3.0",
-      "sha256": "02gdw7ma93fdvgx3fngmfjd074jh2rzm9qsxakr3zn81p6qnzair"
+      "version": "1.3.1",
+      "sha256": "12mfm49bjnh2pvm51dzna625kzgwznm9kcv6qhazc4il9j0224wd"
    },
    "vibe-core": {
-      "version": "2.8.2",
-      "sha256": "1g9l8hmjx4dzzwh7pqasc9s16zzbdfvciswbv0gnrvmjsb0pi9xr"
+      "version": "2.8.4",
+      "sha256": "1pik6vympgwxpyxb75g1f8409cd6hw952gbflqvwaj18shz6dwjm"
    },
    "vibe-d": {
      "version": "0.9.8",
--- a/pkgs/applications/misc/inochi2d/default.nix
+++ b/pkgs/applications/misc/inochi2d/default.nix
@ -22,13 +22,13 @@ in
  inochi-creator = mkGeneric rec {
    pname = "inochi-creator";
    appname = "Inochi Creator";
-    version = "0.8.4";
+    version = "0.8.5";

    src = fetchFromGitHub {
      owner = "Inochi2D";
      repo = "inochi-creator";
      rev = "v${version}";
-      hash = "sha256-wsB9KIZyot2Y+6QpQlIXRzv3cPCdwp2Q/ZfDizAKJc4=";
+      hash = "sha256-qrSHyvFE55xRbcA79lngOHJOdv54rNlUTHlxT9jjPEY=";
    };

    dubLock = ./creator-dub-lock.json;
@ -54,13 +54,13 @@ in
  inochi-session = mkGeneric rec {
    pname = "inochi-session";
    appname = "Inochi Session";
-    version = "0.8.3";
+    version = "0.8.4";

    src = fetchFromGitHub {
      owner = "Inochi2D";
      repo = "inochi-session";
      rev = "v${version}";
-      hash = "sha256-yq/uMWEeydZun07/7hgUaAw3IruRqrDuGgbe5NzNYxw=";
+      hash = "sha256-BRA5qODHhyHBeZYT5MQwcFmr/zVokfO5SrbcbQa6w7w=";
    };

    dubLock = ./session-dub-lock.json;
--- a/pkgs/applications/misc/inochi2d/session-dub-lock.json
+++ b/pkgs/applications/misc/inochi2d/session-dub-lock.json
@ -33,8 +33,8 @@
      "sha256": "0p9g4h5qanbg6281x1068mdl5p7zvqig4zmmi72a2cay6dxnbvxb"
    },
    "eventcore": {
-      "version": "0.9.29",
-      "sha256": "1993mibxqb4v7lbsq3kbfwxfpi0d1gzzmzvx6y01907aqz933isa"
+      "version": "0.9.30",
+      "sha256": "1n8wdcjhas0y99pf9fvwwsydkmy9g7gvfjhlwpjh158c7pfjwlaq"
    },
    "facetrack-d": {
      "version": "0.7.8",
@ -65,8 +65,8 @@
      "sha256": "0kzk55ilbnl6qypjk60zwd5ibys5n47128hbbr0mbc7bpj9ppfg4"
    },
    "inochi2d": {
-      "version": "0.8.3",
-      "sha256": "1m9dalm6sb518yi9mbphq1fdax90fc5rmskah19l7slnplbhli4l"
+      "version": "0.8.4",
+      "sha256": "1bj0c6i9kcw1vfm6lf8lyxpf1lhhslg3f182jycdmzms15i3jb3y"
    },
    "inui": {
      "version": "1.2.1",
@ -85,12 +85,12 @@
      "sha256": "0hm31birbw59sw1bi9syjhbcdgwwwyyx6r9jg7ar9i6a74cjr52c"
    },
    "mir-algorithm": {
-      "version": "3.22.0",
-      "sha256": "0pl1vwyyhr2hrxlj060khzhg33dkgyrzi3f5qqxz6xj3hcp7axxq"
+      "version": "3.22.1",
+      "sha256": "1bvvf3dm26x1h10pg1s4kyhxiyrmd96kk2lmchyady39crpjj5cf"
    },
    "mir-core": {
-      "version": "1.7.0",
-      "sha256": "14k7y2r06pwzf29shymyjrk7l582bh181rc07bnwgjn3f84ayn62"
+      "version": "1.7.1",
+      "sha256": "15m1n48fcmh5pw3w4ww5qfzwkdglflpzc3xmxmrlvd30swyyr85j"
    },
    "mir-linux-kernel": {
      "version": "1.0.1",
@ -101,8 +101,8 @@
      "sha256": "1fwhd5fkvgbqf3y8gwmrnd42kzi4k3mibpxijw5j82jxgfp1rzsf"
    },
    "openssl-static": {
-      "version": "1.0.3+3.0.8",
-      "sha256": "1z977ghlnczxky2q2gislfi68jnbp2zf4pifv8rzrcs0nx3va2jr"
+      "version": "1.0.5+3.0.8",
+      "sha256": "0wpqz29yrbbh39g3cwlgd6h6hh1msws7w5baw1kywdkgj761gx2k"
    },
    "silly": {
      "version": "1.1.1",
@ -113,20 +113,20 @@
      "sha256": "1g8382wr49sjyar0jay8j7y2if7h1i87dhapkgxphnizp24d7kaj"
    },
    "taggedalgebraic": {
-      "version": "0.11.22",
-      "sha256": "1kc39sdnk2ybhrwxiwyw1mqcw0qzjr0vr54yvyp3gkkaad373k4r"
+      "version": "0.11.23",
+      "sha256": "1bialmbdwjpqhgs95inkwzin7xbhx7sngjf7viq90vzma497l59k"
    },
    "tinyfiledialogs": {
      "version": "0.10.1",
      "sha256": "1k3gq9y7912x5b30h60nvlfdr61as1f187b8rsilkxliizcmbhfi"
    },
    "vibe-container": {
-      "version": "1.3.0",
-      "sha256": "02gdw7ma93fdvgx3fngmfjd074jh2rzm9qsxakr3zn81p6qnzair"
+      "version": "1.3.1",
+      "sha256": "12mfm49bjnh2pvm51dzna625kzgwznm9kcv6qhazc4il9j0224wd"
    },
    "vibe-core": {
-      "version": "2.8.2",
-      "sha256": "1g9l8hmjx4dzzwh7pqasc9s16zzbdfvciswbv0gnrvmjsb0pi9xr"
+      "version": "2.8.4",
+      "sha256": "1pik6vympgwxpyxb75g1f8409cd6hw952gbflqvwaj18shz6dwjm"
    },
    "vibe-d": {
      "version": "0.9.8",
--- a/pkgs/applications/misc/mainsail/default.nix
+++ b/pkgs/applications/misc/mainsail/default.nix
@ -1,26 +1,34 @@
 { lib
-, stdenvNoCC
-, fetchzip
+, buildNpmPackage
+, fetchFromGitHub
 }:

-stdenvNoCC.mkDerivation rec {
+ buildNpmPackage rec {
  pname = "mainsail";
  version = "2.11.2";

-  src = fetchzip {
-    url = "https://github.com/mainsail-crew/mainsail/releases/download/v${version}/mainsail.zip";
-    hash = "sha256-RdBgGE/EUzb1/6PjQ34UjXjxt686s9May7npFtRocXE=";
-    stripRoot = false;
+  src = fetchFromGitHub {
+      owner = "mainsail-crew";
+      repo = "mainsail";
+      rev = "v${version}";
+      hash = "sha256-N0tm36YMRRrkyuIwzcYbDo1DHesAnJ2s2g0KCms3h5I=";
  };

-  dontConfigure = true;
-  dontBuild = true;
+  npmDepsHash = "sha256-z6Fo0XAds/F0Ig+nUE3O16gmH0EVcpML3K8cdKhkJzg=";
+
+  # Prevent Cypress binary download.
+  CYPRESS_INSTALL_BINARY = 0;
+
+  preConfigure = ''
+    # Make the build.zip target do nothing, since we will just copy these files later.
+    sed -e 's/"build.zip":.*,$/"build.zip": "",/g' -i package.json
+  '';

  installPhase = ''
    runHook preInstall

-    mkdir -p $out/share/mainsail
-    cp -r ./* $out/share/mainsail
+    mkdir -p $out/share
+    cp -r ./dist $out/share/mainsail

    runHook postInstall
  '';
@ -31,6 +39,6 @@ stdenvNoCC.mkDerivation rec {
    changelog = "https://github.com/mainsail-crew/mainsail/releases/tag/v${version}";
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ shhht lovesegfault ];
+    maintainers = with maintainers; [ shhht lovesegfault wulfsta ];
  };
 }
--- a/pkgs/applications/misc/syncthingtray/default.nix
+++ b/pkgs/applications/misc/syncthingtray/default.nix
@ -34,14 +34,14 @@ https://github.com/NixOS/nixpkgs/issues/199596#issuecomment-1310136382 */
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.5.3";
+  version = "1.5.4";
  pname = "syncthingtray";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = "syncthingtray";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-wE6N0GSdcLDQOO+M3Ahlv3Z2S+PqdvZAnueCKB9+R08=";
+    hash = "sha256-3Z9heiQiuYzWtReKs/XeA+ENRKgxHR74ANzrDcdyjh4=";
  };

  buildInputs = [
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, testers, dnscontrol }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles, testers, dnscontrol }:

 buildGoModule rec {
  pname = "dnscontrol";
@ -13,10 +13,18 @@ buildGoModule rec {

  vendorHash = "sha256-kmnV1W0HGlxFZYYUeUd9D/zOabUhM5kDoTZTnRYJ2sM=";

+  nativeBuildInputs = [ installShellFiles ];
+
  subPackages = [ "." ];

  ldflags = [ "-s" "-w" "-X=main.version=${version}" ];

+  postInstall = ''
+    installShellCompletion --cmd dnscontrol \
+      --bash <($out/bin/dnscontrol shell-completion bash) \
+      --zsh <($out/bin/dnscontrol shell-completion zsh)
+  '';
+
  preCheck = ''
    # requires network
    rm pkg/spflib/flatten_test.go pkg/spflib/parse_test.go
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
  pname = "signal-desktop";
  dir = "Signal";
-  version = "7.10.0";
+  version = "7.11.1";
  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-CAofRnG9BWaNtP8zL5YfE9+ofc5+sgniTbPGsnEtlVY=";
+  hash = "sha256-ROJ2aQY0NPZD2GcjdQ1OxbeXKC+60n791Nxs93CyJ/Y=";
 }
--- a/pkgs/applications/science/misc/cwltool/default.nix
+++ b/pkgs/applications/science/misc/cwltool/default.nix
@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "cwltool";
-  version = "3.1.20240404144621";
+  version = "3.1.20240508115724";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "common-workflow-language";
    repo = "cwltool";
    rev = "refs/tags/${version}";
-    hash = "sha256-atpXkMIQ60POuUk99uiiuCoRXt4Seg11g/eHCeTDe+Q=";
+    hash = "sha256-hBP/8PIqvs820UsxrRuyMVIWgQGFVcMHCUToxhcupTk=";
  };

  postPatch = ''
@ -24,7 +24,6 @@ python3.pkgs.buildPythonApplication rec {
      --replace '"schema-salad >= 8.4.20230426093816, < 9",' "" \
      --replace "PYTEST_RUNNER + " ""
    substituteInPlace pyproject.toml \
-      --replace "mypy==1.8.0" "mypy" \
      --replace "ruamel.yaml>=0.16.0,<0.18" "ruamel.yaml"
  '';

--- a/pkgs/by-name/fl/flarectl/package.nix
+++ b/pkgs/by-name/fl/flarectl/package.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "flarectl";
-  version = "0.96.0";
+  version = "0.97.0";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = "cloudflare-go";
    rev = "v${version}";
-    hash = "sha256-iqR+9qgHYCk7DGX64f50ANUYxTn0h4+AoBHE6yGAvtU=";
+    hash = "sha256-FeUZYOa35WOxSagCwN0Cq4cbvrEgRr1xjfHGqGvZSxY=";
  };

-  vendorHash = "sha256-SkJTLOJ6518MQ0pAPM3TR8T5dOSwEbyQNZHr1jq936A=";
+  vendorHash = "sha256-Ae3KC7D5PrIGd29pGPVTu56DIlJS0CLViLnK6FY7KU0=";

  subPackages = [ "cmd/flarectl" ];

--- a/pkgs/by-name/fo/forgejo/package.nix
+++ b/pkgs/by-name/fo/forgejo/package.nix
@ -51,7 +51,7 @@ buildGoModule rec {

  vendorHash = "sha256-8qMpnGL5GXJuxOpxh9a1Bcxd7tVweUKwbun8UBxCfQA=";

-  subPackages = [ "." ];
+  subPackages = [ "." "contrib/environment-to-ini" ];

  outputs = [ "out" "data" ];

--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@ -12,7 +12,7 @@
 }:

 let
-  version = "7.5.3";
+  version = "7.7.0";
 in
 # The output of the derivation is a tool to create bootable images using Limine
 # as bootloader for various platforms and corresponding binary and helper files.
@ -24,7 +24,7 @@ stdenv.mkDerivation {
  # Packaging that in Nix is very cumbersome.
  src = fetchurl {
    url = "https://github.com/limine-bootloader/limine/releases/download/v${version}/limine-${version}.tar.gz";
-    sha256 = "sha256-zuBHPuS+vdtSDfoRm6J0VdIYV3MtZtwW5qzCjDNmQKk=";
+    sha256 = "sha256-GD66BuplRyIDCy6J9Lys8z7GDshaz50O1Lu//lO+nf0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/me/meli/package.nix
+++ b/pkgs/by-name/me/meli/package.nix
@ -17,6 +17,7 @@
 , sqlite

 # runtime deps
+, gpgme
 , gnum4
 }:

@ -60,6 +61,7 @@ rustPlatform.buildRustPackage rec {
    installManPage meli/docs/*.{1,5,7}

    wrapProgram $out/bin/meli \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ gpgme ]} \
      --prefix PATH : ${lib.makeBinPath [ gnum4 ]}
  '';

--- a/pkgs/applications/audio/mousai/default.nix
+++ b/pkgs/applications/audio/mousai/default.nix
@ -23,19 +23,19 @@

 stdenv.mkDerivation rec {
  pname = "mousai";
-  version = "0.7.6";
+  version = "0.7.7";

  src = fetchFromGitHub {
    owner = "SeaDve";
    repo = "Mousai";
    rev = "v${version}";
-    hash = "sha256-QInnKjGYaWlIj+F3upQ8CJ6RqCM72Y+BGrrezndqfOg=";
+    hash = "sha256-8N/31WhE79qLzhWxa0EJXJ4k/rg7HUqXZkidbgwNHo4=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-/AwTNuDdhAhj/kbc6EdC3FKGO1LfZIY68utPjcrw0S0=";
+    hash = "sha256-FjnRI1vHA9YF/Uw2+hDtMJmeJVa5RcxaYoG4XgXa9Ds=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/ols/default.nix
+++ b/pkgs/development/tools/ols/default.nix
@ -1,4 +1,11 @@
-{ stdenv, fetchFromGitHub, makeBinaryWrapper, unstableGitUpdater, odin, lib }:
+{
+  fetchFromGitHub,
+  lib,
+  makeBinaryWrapper,
+  odin,
+  stdenv,
+  unstableGitUpdater,
+}:

 stdenv.mkDerivation {
  pname = "ols";
@ -11,22 +18,14 @@ stdenv.mkDerivation {
    hash = "sha256-zvojGIxMGawddWx5vnBQMTybz+jL9LXfaShbof7wwq0=";
  };

-  passthru.updateScript = unstableGitUpdater {
-    hardcodeZeroVersion = true;
-  };
-
-  nativeBuildInputs = [
-    makeBinaryWrapper
-  ];
-
-  buildInputs = [
-    odin
-  ];
-
  postPatch = ''
    patchShebangs build.sh
  '';

+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  buildInputs = [ odin ];
+
  buildPhase = ''
    runHook preBuild

@ -44,12 +43,17 @@ stdenv.mkDerivation {
    runHook postInstall
  '';

-  meta = with lib; {
+  passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
+
+  meta = {
    inherit (odin.meta) platforms;
    description = "Language server for the Odin programming language";
-    mainProgram = "ols";
    homepage = "https://github.com/DanielGavin/ols";
-    license = licenses.mit;
-    maintainers = with maintainers; [ astavie znaniye ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      astavie
+      znaniye
+    ];
+    mainProgram = "ols";
  };
 }
--- a/pkgs/by-name/op/opencomposite/package.nix
+++ b/pkgs/by-name/op/opencomposite/package.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation {
  pname = "opencomposite";
-  version = "0-unstable-2024-05-08";
+  version = "0-unstable-2024-05-24";

  src = fetchFromGitLab {
    owner = "znixian";
    repo = "OpenOVR";
-    rev = "5ddd6024efafa82c7a432c9dd8a67e3d5c3f9b38";
-    hash = "sha256-m6Xhi6xlDWiVqtYyxpQP2vp5JsB2EKsoXkmd0IYtPQ8=";
+    rev = "762f93d91f4c23ad70c81c81486b6bcd7e9bbb5e";
+    hash = "sha256-Z1Is+yjyAG8X5+FWaxtCkF7paRGV9ZlNVubuVkeO7yg=";
  };

  nativeBuildInputs = [
@ -41,8 +41,10 @@ stdenv.mkDerivation {
  ];

  cmakeFlags = [
-    "-DUSE_SYSTEM_OPENXR=ON"
-    "-DUSE_SYSTEM_GLM=ON"
+    (lib.cmakeBool "USE_SYSTEM_OPENXR" true)
+    (lib.cmakeBool "USE_SYSTEM_GLM" true)
+    # debug logging macros cause format-security warnings
+    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-Wno-error=format-security")
  ];

  installPhase = ''
--- a/pkgs/by-name/ry/ryujinx/deps.nix
+++ b/pkgs/by-name/ry/ryujinx/deps.nix
@ -19,13 +19,13 @@
  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.0"; sha256 = "1ra1kd0kkblppr5zy7rzdbwllggrzvp9lkxblf9mg3y8rnp6fk83"; })
  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.10"; sha256 = "0w45j4ypqnwmsh3byzaghn43ycfkfnn8415i5lw2q5ip7vp3a9fm"; })
  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.4"; sha256 = "1ysmq4f8bxabpq3nhcrrvgwvxb9z7gx9565bvdyksdhsq16wyxym"; })
-  (fetchNuGet { pname = "Avalonia.Svg"; version = "11.0.0.16"; sha256 = "12bk984wylqyyl3fcgxg640pqf6bjbqfkgp1fldrprncca0fx80k"; })
-  (fetchNuGet { pname = "Avalonia.Svg.Skia"; version = "11.0.0.16"; sha256 = "1yd9zf1vbfci52f6yyig8ar2w8wpwiafbf65ah11qqrm32rwd7z6"; })
+  (fetchNuGet { pname = "Avalonia.Svg"; version = "11.0.0.18"; sha256 = "1mcvjwzc7z2kij1wx567nhb6irqzn45wd5b258nls53i3izxm1jk"; })
+  (fetchNuGet { pname = "Avalonia.Svg.Skia"; version = "11.0.0.18"; sha256 = "1915rg60p5bkigqmjchg6538hxnnqbz2sf69967gly9nps81101k"; })
  (fetchNuGet { pname = "Avalonia.Themes.Simple"; version = "11.0.10"; sha256 = "0vssdz6rng0k85qsv2xn6x0dldaalnnx718n7plwxg3j1pddr1z7"; })
  (fetchNuGet { pname = "Avalonia.Win32"; version = "11.0.10"; sha256 = "1gh3fad9ya56qwzhk7590bdzkky76yx1jjj60rqr013b97qbd3gs"; })
  (fetchNuGet { pname = "Avalonia.X11"; version = "11.0.10"; sha256 = "1x09mp8q3mrj5fijqk7qp5qivrysqnbc2bkj2ssvawb9rjy6497w"; })
  (fetchNuGet { pname = "CommandLineParser"; version = "2.9.1"; sha256 = "1sldkj8lakggn4hnyabjj1fppqh50fkdrr1k99d4gswpbk5kv582"; })
-  (fetchNuGet { pname = "Concentus"; version = "1.1.7"; sha256 = "0y5z444wrbhlmsqpy2sxmajl1fbf74843lvgj3y6vz260dn2q0l0"; })
+  (fetchNuGet { pname = "Concentus"; version = "2.2.0"; sha256 = "00x2ch3y57wi661xmla84ypwh8qjcrl0q3i2461dskd8lppw21pg"; })
  (fetchNuGet { pname = "DiscordRichPresence"; version = "1.2.1.24"; sha256 = "0maw0yd6xgwy0cgk593z3zva0r5j267zpdmmpq8avj3zbna6n4x1"; })
  (fetchNuGet { pname = "DynamicData"; version = "8.4.1"; sha256 = "03mdxfrwgfprpn9g17sxhzxg09k3dkkm2xs29i4r36b5jlgmms5g"; })
  (fetchNuGet { pname = "ExCSS"; version = "4.2.3"; sha256 = "1likxhccg4l4g4i65z4dfzp9059hij6h1q7prx2sgakvk8zzmw9k"; })
@ -58,26 +58,22 @@
  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.7.0"; sha256 = "0gd67zlw554j098kabg887b5a6pq9kzavpa3jjy5w53ccjzjfy8j"; })
  (fetchNuGet { pname = "Microsoft.DotNet.PlatformAbstractions"; version = "3.1.6"; sha256 = "0b9myd7gqbpaw9pkd2bx45jhik9mwj0f1ss57sk2cxmag2lkdws5"; })
  (fetchNuGet { pname = "Microsoft.Extensions.DependencyModel"; version = "6.0.0"; sha256 = "08c4fh1n8vsish1vh7h73mva34g0as4ph29s4lvps7kmjb4z64nl"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.5.1"; sha256 = "0kdxb47rafvk6mx0xkf2pik7b638b2d847jlhzi3fvj6swg3v15b"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.5.1"; sha256 = "1ny97mhld7vzn5xwxvcy1jhfq4mw15wrk9c77z6cg2fydkgawyzx"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.5.1"; sha256 = "1zharnx3vhrfdn761w16ygxyj9ig5zn71346aqkk0nmzlll3gfjf"; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.5.1"; sha256 = "14fjr679hwal35mdwdv4w40mnxzfnnx65yc16807zzkyri011zc1"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.6.0"; sha256 = "18g4j9n47387k4ym3kl2dzhhhs6fs5rq96757fc4lcdql2rpkmp0"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.6.0"; sha256 = "11znwbbg44hhz3ly6j6q81qz83yqf97jj5zhpldng5zq0h791srl"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.6.0"; sha256 = "1slkzygcn4abpqip4rmi73h9096ihjkkaiwgmkaiba9pidn9lzlx"; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.6.0"; sha256 = "1blj1ayw9qpjpsnb4k95s03pdkin0032mxgznfaw1z1qhhiqdnsi"; })
  (fetchNuGet { pname = "Microsoft.IO.RecyclableMemoryStream"; version = "3.0.0"; sha256 = "1zl39k27r4zq75r1x1zr1yl4nzxpkxdnnv6dwd4qp0xr22my85aq"; })
  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.9.0"; sha256 = "1lls1fly2gr1n9n1xyl9k33l2v4pwfmylyzkq8v4v5ldnwkl1zdb"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.0.0"; sha256 = "1fk2fk2639i7nzy58m9dvpdnzql4vb8yl8vr19r2fp8lmj9w2jr0"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.1.2"; sha256 = "1507hnpr9my3z4w1r6xk5n0s1j3y6a2c2cnynj76za7cphxi1141"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "5.0.0"; sha256 = "0mwpwdflidzgzfx2dlpkvvnkgkr2ayaf0s80737h4wa35gaj11rc"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; sha256 = "0ppdkwy6s9p7x9jix3v4402wb171cdiibq7js7i13nxpdky7074p"; })
  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.9.0"; sha256 = "1kgsl9w9fganbm9wvlkqgk0ag9hfi58z88rkfybc6kvg78bx89ca"; })
  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.9.0"; sha256 = "19ffh31a1jxzn8j69m1vnk5hyfz3dbxmflq77b8x82zybiilh5nl"; })
-  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.0.1"; sha256 = "1n8ap0cmljbqskxpf8fjzn7kh1vvlndsa75k01qig26mbw97k2q7"; })
  (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "4.5.0"; sha256 = "1zapbz161ji8h82xiajgriq6zgzmb1f3ar517p2h63plhsq5gh2q"; })
  (fetchNuGet { pname = "MsgPack.Cli"; version = "1.0.1"; sha256 = "1dk2bs3g16lsxcjjm7gfx6jxa4667wccw94jlh2ql7y7smvh9z8r"; })
  (fetchNuGet { pname = "NetCoreServer"; version = "8.0.7"; sha256 = "171mn5b56ikkjvsx3hvgmh3lga9c2ja31as0hnfr3040rdrj4ij5"; })
-  (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.0"; sha256 = "0nmmv4yw7gw04ik8ialj3ak0j6pxa9spih67hnn1h2c38ba8h58k"; })
  (fetchNuGet { pname = "NETStandard.Library"; version = "2.0.0"; sha256 = "1bc4ba8ahgk15m8k4nd7x406nhi0kwqzbgjk2dmw52ss553xz7iy"; })
  (fetchNuGet { pname = "NETStandard.Library"; version = "2.0.3"; sha256 = "1fn9fxppfcg4jgypp2pmrpr6awl3qz1xmnri0cygpkwvyx27df1y"; })
  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; sha256 = "0fijg0w6iwap8gvzyjnndds0q4b8anwxxvik7y8vgq97dram4srb"; })
@ -90,10 +86,7 @@
  (fetchNuGet { pname = "OpenTK.redist.glfw"; version = "3.3.8.39"; sha256 = "05z0hcignvzk8ffg6mn8m10sv5wppicibjz7zncsj3h3z8cin3vf"; })
  (fetchNuGet { pname = "OpenTK.Windowing.GraphicsLibraryFramework"; version = "4.8.2"; sha256 = "11jc154j5r1jvcxa7by42xkyj5dkiv4q6yffkr6r1vmn9yshclvb"; })
  (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; sha256 = "0bv5qgm6vr47ynxqbnkc7i797fdi8gbjjxii173syrx14nmrkwg0"; })
-  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tools"; version = "4.3.0"; sha256 = "1wl76vk12zhdh66vmagni66h5xbhgqq7zkdpgw21jhxhvlbcl8pk"; })
-  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "00j6nv2xgmd3bi347k00m7wr542wjlig53rmj28pmw7ddcn97jbn"; })
  (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.3.0"; sha256 = "1daqf33hssad94lamzg01y49xwndy2q97i2lrb7mgn28656qia1x"; })
-  (fetchNuGet { pname = "runtime.any.System.Globalization.Calendars"; version = "4.3.0"; sha256 = "1ghhhk5psqxcg6w88sxkqrc35bxcz27zbqm2y5p5298pv3v7g201"; })
  (fetchNuGet { pname = "runtime.any.System.IO"; version = "4.3.0"; sha256 = "0l8xz8zn46w4d10bcn3l4yyn4vhb3lrj2zw8llvz7jk14k4zps5x"; })
  (fetchNuGet { pname = "runtime.any.System.Reflection"; version = "4.3.0"; sha256 = "02c9h3y35pylc0zfq3wcsvc5nqci95nrkq0mszifc0sjx7xrzkly"; })
  (fetchNuGet { pname = "runtime.any.System.Reflection.Extensions"; version = "4.3.0"; sha256 = "0zyri97dfc5vyaz9ba65hjj1zbcrzaffhsdlpxc9bh09wy22fq33"; })
@ -103,17 +96,11 @@
  (fetchNuGet { pname = "runtime.any.System.Runtime.Handles"; version = "4.3.0"; sha256 = "0bh5bi25nk9w9xi8z23ws45q5yia6k7dg3i4axhfqlnj145l011x"; })
  (fetchNuGet { pname = "runtime.any.System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "0c3g3g3jmhlhw4klrc86ka9fjbl7i59ds1fadsb2l8nqf8z3kb19"; })
  (fetchNuGet { pname = "runtime.any.System.Text.Encoding"; version = "4.3.0"; sha256 = "0aqqi1v4wx51h51mk956y783wzags13wa7mgqyclacmsmpv02ps3"; })
-  (fetchNuGet { pname = "runtime.any.System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "0lqhgqi0i8194ryqq6v2gqx0fb86db2gqknbm0aq31wb378j7ip8"; })
  (fetchNuGet { pname = "runtime.any.System.Threading.Tasks"; version = "4.3.0"; sha256 = "03mnvkhskbzxddz4hm113zsch1jyzh2cs450dk3rgfjp8crlw1va"; })
-  (fetchNuGet { pname = "runtime.any.System.Threading.Timer"; version = "4.3.0"; sha256 = "0aw4phrhwqz9m61r79vyfl5la64bjxj8l34qnrcwb28v49fg2086"; })
  (fetchNuGet { pname = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "16rnxzpk5dpbbl1x354yrlsbvwylrq456xzpsha1n9y3glnhyx9d"; })
  (fetchNuGet { pname = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0hkg03sgm2wyq8nqk6dbm9jh5vcq57ry42lkqdmfklrw89lsmr59"; })
  (fetchNuGet { pname = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0c2p354hjx58xhhz7wv6div8xpi90sc6ibdm40qin21bvi7ymcaa"; })
-  (fetchNuGet { pname = "runtime.native.System"; version = "4.0.0"; sha256 = "1ppk69xk59ggacj9n7g6fyxvzmk1g5p4fkijm0d7xqfkig98qrkf"; })
  (fetchNuGet { pname = "runtime.native.System"; version = "4.3.0"; sha256 = "15hgf6zaq9b8br2wi1i3x0zvmk410nlmsmva9p0bbg73v6hml5k4"; })
-  (fetchNuGet { pname = "runtime.native.System.IO.Compression"; version = "4.1.0"; sha256 = "0d720z4lzyfcabmmnvh0bnj76ll7djhji2hmfh3h44sdkjnlkknk"; })
-  (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.0.1"; sha256 = "1hgv2bmbaskx77v8glh7waxws973jn4ah35zysnkxmf0196sfxg6"; })
-  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography"; version = "4.0.0"; sha256 = "0k57aa2c3b10wl3hfqbgrl7xq7g8hh3a3ir44b31dn5p61iiw3z9"; })
  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "18pzfdlwsg2nb1jjjjzyb5qlgy6xjxzmhnfaijq5s2jw3cm3ab97"; })
  (fetchNuGet { pname = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0qyynf9nz5i7pc26cwhgi8j62ps27sqmf78ijcfgzab50z9g8ay3"; })
  (fetchNuGet { pname = "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1klrs545awhayryma6l7g2pvnp9xy4z0r1i40r80zb45q3i9nbyf"; })
@ -122,12 +109,7 @@
  (fetchNuGet { pname = "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "160p68l2c7cqmyqjwxydcvgw7lvl1cr0znkw8fp24d1by9mqc8p3"; })
  (fetchNuGet { pname = "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "15zrc8fgd8zx28hdghcj5f5i34wf3l6bq5177075m2bc2j34jrqy"; })
  (fetchNuGet { pname = "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1p4dgxax6p7rlgj4q73k73rslcnz4wdcv8q2flg1s8ygwcm58ld5"; })
-  (fetchNuGet { pname = "runtime.unix.Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0y61k9zbxhdi0glg154v30kkq7f8646nif8lnnxbvkjpakggd5id"; })
-  (fetchNuGet { pname = "runtime.unix.System.Console"; version = "4.3.0"; sha256 = "1pfpkvc6x2if8zbdzg9rnc5fx51yllprl8zkm5npni2k50lisy80"; })
  (fetchNuGet { pname = "runtime.unix.System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "1lps7fbnw34bnh3lm31gs5c0g0dh7548wfmb8zz62v0zqz71msj5"; })
-  (fetchNuGet { pname = "runtime.unix.System.IO.FileSystem"; version = "4.3.0"; sha256 = "14nbkhvs7sji5r1saj2x8daz82rnf9kx28d3v2qss34qbr32dzix"; })
-  (fetchNuGet { pname = "runtime.unix.System.Net.Primitives"; version = "4.3.0"; sha256 = "0bdnglg59pzx9394sy4ic66kmxhqp8q8bvmykdxcbs5mm0ipwwm4"; })
-  (fetchNuGet { pname = "runtime.unix.System.Net.Sockets"; version = "4.3.0"; sha256 = "03npdxzy8gfv035bv1b9rz7c7hv0rxl5904wjz51if491mw0xy12"; })
  (fetchNuGet { pname = "runtime.unix.System.Private.Uri"; version = "4.3.0"; sha256 = "1jx02q6kiwlvfksq1q9qr17fj78y5v6mwsszav4qcz9z25d5g6vk"; })
  (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "0pnxxmm8whx38dp6yvwgmh22smknxmqs5n513fc7m4wxvs1bvi4p"; })
  (fetchNuGet { pname = "Ryujinx.AtkSharp"; version = "3.24.24.59-ryujinx"; sha256 = "0497v1himb77qfir5crgx25fgi7h12vzx9m3c8xxlvbs8xg77bcq"; })
@ -145,7 +127,7 @@
  (fetchNuGet { pname = "securifybv.ShellLink"; version = "0.1.0"; sha256 = "1v52d01590m8y06bybis6hlg296wk3y7ilqyh01ram62v5wrjvq2"; })
  (fetchNuGet { pname = "shaderc.net"; version = "0.1.0"; sha256 = "0f35s9h0vj9f1rx9bssj66hibc3j9bzrb4wgb5q2jwkf5xncxbpq"; })
  (fetchNuGet { pname = "SharpZipLib"; version = "1.4.2"; sha256 = "0ijrzz2szxjmv2cipk7rpmg14dfaigdkg7xabjvb38ih56m9a27y"; })
-  (fetchNuGet { pname = "ShimSkiaSharp"; version = "1.0.0.16"; sha256 = "0af7qhv5mxmynh08snqb345n0ykc9mywqgqlb6lng1f001n9038z"; })
+  (fetchNuGet { pname = "ShimSkiaSharp"; version = "1.0.0.18"; sha256 = "1vxsw5kkw3z4c59v5678k4nmxng92845y3pi4fgv1wcnxgw5aqzg"; })
  (fetchNuGet { pname = "Silk.NET.Core"; version = "2.16.0"; sha256 = "1mkqc2aicvknmpyfry2v7jjxh3apaxa6dmk1vfbwxnkysl417x0k"; })
  (fetchNuGet { pname = "Silk.NET.Vulkan"; version = "2.16.0"; sha256 = "0sg5mxv7ga5pq6wc0lz52j07fxrcfmb0an30r4cxsxk66298z2wy"; })
  (fetchNuGet { pname = "Silk.NET.Vulkan.Extensions.EXT"; version = "2.16.0"; sha256 = "05918f6fl8byla2m7qjp7dvxww2rbpj2sqd4xq26rl885fmddfvf"; })
@ -168,121 +150,62 @@
  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.6"; sha256 = "1w2mwcwkqvrg4x4ybc4674xnkqwh1n2ihg520gqgpnqfc11ghc4n"; })
  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.7"; sha256 = "119mlbh5hmlis7vb111s95dwg5p1anm2hmv7cm6fz7gy18473d7v"; })
  (fetchNuGet { pname = "SPB"; version = "0.0.4-build32"; sha256 = "0fk803f4llcc7g111g7wdn6fwqjrlyr64p97lv9xannbk9bxnk0r"; })
-  (fetchNuGet { pname = "Svg.Custom"; version = "1.0.0.16"; sha256 = "1xm30503b8921dn1mvpbhfx4g88hk0mq20zrp41bykhwcfmircqg"; })
-  (fetchNuGet { pname = "Svg.Model"; version = "1.0.0.16"; sha256 = "0nd0ibjc2l50rd9xx2lh1zsfva6qp97zk6gl5iv2ds72dm669smz"; })
-  (fetchNuGet { pname = "Svg.Skia"; version = "1.0.0.16"; sha256 = "1msyivfdkjdiiw1ngfmplk1wwcv1glkfsx7qvfn4wsgahc775wzr"; })
-  (fetchNuGet { pname = "System.AppContext"; version = "4.1.0"; sha256 = "0fv3cma1jp4vgj7a8hqc9n7hr1f1kjp541s6z0q1r6nazb4iz9mz"; })
-  (fetchNuGet { pname = "System.Buffers"; version = "4.0.0"; sha256 = "13s659bcmg9nwb6z78971z1lr6bmh2wghxi1ayqyzl4jijd351gr"; })
-  (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
+  (fetchNuGet { pname = "Svg.Custom"; version = "1.0.0.18"; sha256 = "0186sxdcz7c30g3vvygbahvsmywn1cqq53m8h6la1z2c00zr22s6"; })
+  (fetchNuGet { pname = "Svg.Model"; version = "1.0.0.18"; sha256 = "03vjk6pmxpff6q7saqgq9qdfbs6sf11hqrp469ycfzbikgil4xh9"; })
+  (fetchNuGet { pname = "Svg.Skia"; version = "1.0.0.18"; sha256 = "0vnjy0gc8qfv626rn3z4sy03ds186h1yv9fwq3p84pq6l04ng5d3"; })
  (fetchNuGet { pname = "System.Buffers"; version = "4.5.1"; sha256 = "04kb1mdrlcixj9zh1xdi5as0k0qi8byr5mi3p3jcxx72qz93s2y3"; })
  (fetchNuGet { pname = "System.CodeDom"; version = "4.4.0"; sha256 = "1zgbafm5p380r50ap5iddp11kzhr9khrf2pnai6k593wjar74p1g"; })
  (fetchNuGet { pname = "System.CodeDom"; version = "8.0.0"; sha256 = "0zyzd15v0nf8gla7nz243m1kff8ia6vqp471i3g7xgawgj5n21dv"; })
-  (fetchNuGet { pname = "System.Collections"; version = "4.0.11"; sha256 = "1ga40f5lrwldiyw6vy67d0sg7jd7ww6kgwbksm19wrvq9hr0bsm6"; })
  (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
-  (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.0.12"; sha256 = "07y08kvrzpak873pmyxs129g1ch8l27zmg51pcyj2jvq03n0r0fc"; })
  (fetchNuGet { pname = "System.Collections.Immutable"; version = "5.0.0"; sha256 = "1kvcllagxz2q92g81zkz81djkn2lid25ayjfgjalncyc68i15p0r"; })
  (fetchNuGet { pname = "System.Collections.Immutable"; version = "8.0.0"; sha256 = "0z53a42zjd59zdkszcm7pvij4ri5xbb8jly9hzaad9khlf69bcqp"; })
  (fetchNuGet { pname = "System.ComponentModel.Annotations"; version = "4.5.0"; sha256 = "1jj6f6g87k0iwsgmg3xmnn67a14mq88np0l1ys5zkxhkvbc8976p"; })
-  (fetchNuGet { pname = "System.Console"; version = "4.0.0"; sha256 = "0ynxqbc3z1nwbrc11hkkpw9skw116z4y9wjzn7id49p9yi7mzmlf"; })
-  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.0.11"; sha256 = "0gmjghrqmlgzxivd2xl50ncbglb7ljzb66rlx8ws6dv8jm0d5siz"; })
  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y"; })
-  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.0.0"; sha256 = "1n6c3fbz7v8d3pn77h4v5wvsfrfg7v1c57lg3nff3cjyh597v23m"; })
-  (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.0.1"; sha256 = "19cknvg07yhakcvpxg3cxa0bwadplin6kyxd8mpjjpwnp56nl85x"; })
-  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.1.0"; sha256 = "1d2r76v1x610x61ahfpigda89gd13qydz6vbwzhpqlyvq8jj6394"; })
  (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.3.0"; sha256 = "1d951hrvrpndk7insiag80qxjbf2y0y39y8h5hnq9612ws661glk"; })
-  (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; sha256 = "070c5jbas2v7smm660zaf1gh0489xanjqymkvafcs4f8cdrs1d5d"; })
  (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
-  (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.0.1"; sha256 = "0bv0alrm2ck2zk3rz25lfyk9h42f3ywq77mx1syl6vvyncnpg4qh"; })
-  (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.0.1"; sha256 = "0hjhdb5ri8z9l93bw04s7ynwrjrhx2n0p34sf33a9hl9phz69fyc"; })
-  (fetchNuGet { pname = "System.IO"; version = "4.1.0"; sha256 = "1g0yb8p11vfd0kbkyzlfsbsp5z44lwsvyc0h3dpw6vqnbi035ajp"; })
  (fetchNuGet { pname = "System.IO"; version = "4.3.0"; sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"; })
-  (fetchNuGet { pname = "System.IO.Compression"; version = "4.1.0"; sha256 = "0iym7s3jkl8n0vzm3jd6xqg9zjjjqni05x45dwxyjr2dy88hlgji"; })
-  (fetchNuGet { pname = "System.IO.Compression.ZipFile"; version = "4.0.1"; sha256 = "0h72znbagmgvswzr46mihn7xm7chfk2fhrp5krzkjf29pz0i6z82"; })
-  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.0.1"; sha256 = "0kgfpw6w4djqra3w5crrg8xivbanh1w9dh3qapb28q060wb9flp1"; })
-  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.0.1"; sha256 = "1s0mniajj3lvbyf7vfb5shp4ink5yibsx945k6lvxa96r8la1612"; })
  (fetchNuGet { pname = "System.IO.Hashing"; version = "8.0.0"; sha256 = "1hg5i9hiihj9x4d0mlvhfddmivzrhzz83dyh26fqw1nd8jvqccxk"; })
  (fetchNuGet { pname = "System.IO.Pipelines"; version = "6.0.0"; sha256 = "08211lvckdsdbd67xz4f6cyk76cli565j0dby1grlc4k9bhwby65"; })
-  (fetchNuGet { pname = "System.Linq"; version = "4.1.0"; sha256 = "1ppg83svb39hj4hpp5k7kcryzrf3sfnm08vxd5sm2drrijsla2k5"; })
  (fetchNuGet { pname = "System.Linq"; version = "4.3.0"; sha256 = "1w0gmba695rbr80l1k2h4mrwzbzsyfl2z4klmpbsvsg5pm4a56s7"; })
-  (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.1.0"; sha256 = "1gpdxl6ip06cnab7n3zlcg6mqp7kknf73s8wjinzi4p0apw82fpg"; })
  (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.3.0"; sha256 = "0ky2nrcvh70rqq88m9a5yqabsl4fyd17bpr63iy2mbivjs2nyypv"; })
  (fetchNuGet { pname = "System.Management"; version = "8.0.0"; sha256 = "1zbwj6ii8axa4w8ymjzi9d9pj28nhswygahyqppvzaxypw6my2hz"; })
  (fetchNuGet { pname = "System.Memory"; version = "4.5.4"; sha256 = "14gbbs22mcxwggn0fcfs1b062521azb9fbb7c113x0mq6dzq9h6y"; })
  (fetchNuGet { pname = "System.Memory"; version = "4.5.5"; sha256 = "08jsfwimcarfzrhlyvjjid61j02irx6xsklf32rv57x2aaikvx0h"; })
-  (fetchNuGet { pname = "System.Net.Http"; version = "4.1.0"; sha256 = "1i5rqij1icg05j8rrkw4gd4pgia1978mqhjzhsjg69lvwcdfg8yb"; })
-  (fetchNuGet { pname = "System.Net.NameResolution"; version = "4.3.0"; sha256 = "15r75pwc0rm3vvwsn8rvm2krf929mjfwliv0mpicjnii24470rkq"; })
-  (fetchNuGet { pname = "System.Net.Primitives"; version = "4.0.11"; sha256 = "10xzzaynkzkakp7jai1ik3r805zrqjxiz7vcagchyxs2v26a516r"; })
-  (fetchNuGet { pname = "System.Net.Sockets"; version = "4.1.0"; sha256 = "1385fvh8h29da5hh58jm1v78fzi9fi5vj93vhlm2kvqpfahvpqls"; })
  (fetchNuGet { pname = "System.Numerics.Vectors"; version = "4.3.0"; sha256 = "05kji1mv4sl75iwmc613p873145nynm02xiajx8pn0h2kx53d23s"; })
  (fetchNuGet { pname = "System.Numerics.Vectors"; version = "4.4.0"; sha256 = "0rdvma399070b0i46c4qq1h2yvjj3k013sqzkilz4bz5cwmx1rba"; })
  (fetchNuGet { pname = "System.Numerics.Vectors"; version = "4.5.0"; sha256 = "1kzrj37yzawf1b19jq0253rcs8hsq1l2q8g69d7ipnhzb0h97m59"; })
-  (fetchNuGet { pname = "System.ObjectModel"; version = "4.0.12"; sha256 = "1sybkfi60a4588xn34nd9a58png36i0xr4y4v4kqpg8wlvy5krrj"; })
  (fetchNuGet { pname = "System.ObjectModel"; version = "4.3.0"; sha256 = "191p63zy5rpqx7dnrb3h7prvgixmk168fhvvkkvhlazncf8r3nc2"; })
  (fetchNuGet { pname = "System.Private.Uri"; version = "4.3.0"; sha256 = "04r1lkdnsznin0fj4ya1zikxiqr0h6r6a1ww2dsm60gqhdrf0mvx"; })
  (fetchNuGet { pname = "System.Reactive"; version = "6.0.0"; sha256 = "1mkvx1fwychpczksy6svfmniqhbm3xqblxqik6178l12xgq7aw45"; })
-  (fetchNuGet { pname = "System.Reflection"; version = "4.1.0"; sha256 = "1js89429pfw79mxvbzp8p3q93il6rdff332hddhzi5wqglc4gml9"; })
  (fetchNuGet { pname = "System.Reflection"; version = "4.3.0"; sha256 = "0xl55k0mw8cd8ra6dxzh974nxif58s3k1rjv1vbd7gjbjr39j11m"; })
-  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.0.1"; sha256 = "0ydqcsvh6smi41gyaakglnv252625hf29f7kywy2c70nhii2ylqp"; })
  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.3.0"; sha256 = "11f8y3qfysfcrscjpjym9msk7lsfxkk4fmz9qq95kn3jd0769f74"; })
-  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.0.1"; sha256 = "1pcd2ig6bg144y10w7yxgc9d22r7c7ww7qn1frdfwgxr24j9wvv0"; })
  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.3.0"; sha256 = "0w1n67glpv8241vnpz1kl14sy7zlnw414aqwj4hcx5nd86f6994q"; })
-  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.0.1"; sha256 = "1s4b043zdbx9k39lfhvsk68msv1nxbidhkq6nbm27q7sf8xcsnxr"; })
  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.3.0"; sha256 = "0ql7lcakycrvzgi9kxz1b3lljd990az1x6c4jsiwcacrvimpib5c"; })
-  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.0.1"; sha256 = "0m7wqwq0zqq9gbpiqvgk3sr92cbrw7cp3xn53xvw7zj6rz6fdirn"; })
  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.3.0"; sha256 = "02bly8bdc98gs22lqsfx9xicblszr2yan7v2mmw3g7hy6miq5hwq"; })
  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "1.6.0"; sha256 = "1wdbavrrkajy7qbdblpbpbalbdl48q3h34cchz24gvdgyrlf15r4"; })
  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "5.0.0"; sha256 = "17qsl5nanlqk9iz0l5wijdn6ka632fs1m1fvx18dfgswm258r3ss"; })
  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "8.0.0"; sha256 = "10a8vm0c3n5cili5nix6bdmiaxr69qisvk356pb81f2s8bgq40bm"; })
-  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.0.1"; sha256 = "1bangaabhsl4k9fg8khn83wm6yial8ik1sza7401621jc6jrym28"; })
  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.3.0"; sha256 = "04xqa33bld78yv5r93a8n76shvc8wwcdgr1qvvjh959g3rc31276"; })
-  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.1.0"; sha256 = "1bjli8a7sc7jlxqgcagl9nh8axzfl11f4ld3rjqsyxc516iijij7"; })
  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.3.0"; sha256 = "0y2ssg08d817p0vdag98vn238gyrrynjdj4181hdg780sif3ykp1"; })
-  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.0.1"; sha256 = "0b4i7mncaf8cnai85jv3wnw6hps140cxz8vylv2bik6wyzgvz7bi"; })
  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "0sjqlzsryb0mg4y4xzf35xi523s4is4hz9q4qgdvlvgivl7qxn49"; })
-  (fetchNuGet { pname = "System.Runtime"; version = "4.1.0"; sha256 = "02hdkgk13rvsd6r9yafbwzss8kr55wnj8d5c7xjnp8gqrwc8sn0m"; })
  (fetchNuGet { pname = "System.Runtime"; version = "4.3.0"; sha256 = "066ixvgbf2c929kgknshcxqj6539ax7b9m570cp8n179cpfkapz7"; })
  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.7.1"; sha256 = "119br3pd85lq8zcgh4f60jzmv1g976q1kdgi3hvqdlhfbw6siz2j"; })
  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "5.0.0"; sha256 = "02k25ivn50dmqx5jn8hawwmz24yf0454fjd823qk6lygj9513q4x"; })
  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc"; })
-  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.1.0"; sha256 = "0rw4rm4vsm3h3szxp9iijc3ksyviwsv6f63dng3vhqyg4vjdkc2z"; })
  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.3.0"; sha256 = "1ykp3dnhwvm48nap8q23893hagf665k0kn3cbgsqpwzbijdcgc60"; })
-  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.0.1"; sha256 = "1g0zrdi5508v49pfm3iii2hn6nm00bgvfpjq1zxknfjrxxa20r4g"; })
  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; sha256 = "0sw2gfj2xr7sw9qjn0j3l9yw07x73lcs97p8xfc9w1x9h5g5m7i8"; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.1.0"; sha256 = "01kxqppx3dr3b6b286xafqilv4s2n0gqvfgzfd4z943ga9i81is1"; })
  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "00hywrn4g7hva1b2qri2s6rabzwgxnbpw9zfxmz28z09cpwwgh7j"; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.0.0"; sha256 = "0glmvarf3jz5xh22iy3w9v3wyragcm4hfdr17v90vs7vcrm7fgp6"; })
-  (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.0.1"; sha256 = "1y308zfvy0l5nrn46mqqr4wb4z1xk758pkk8svbz8b5ij7jnv4nn"; })
  (fetchNuGet { pname = "System.Security.AccessControl"; version = "4.5.0"; sha256 = "1wvwanz33fzzbnd2jalar0p0z3x0ba53vzx1kazlskp7pwyhlnq0"; })
-  (fetchNuGet { pname = "System.Security.Claims"; version = "4.3.0"; sha256 = "0jvfn7j22l3mm28qjy3rcw287y9h65ha4m940waaxah07jnbzrhn"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.2.0"; sha256 = "148s9g5dgm33ri7dnh19s4lgnlxbpwvrw2jnzllq2kijj4i4vs85"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.2.0"; sha256 = "118jijz446kix20blxip0f0q8mhsh9bz118mwc2ch1p6g7facpzc"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.0.0"; sha256 = "1cwv8lqj8r15q81d2pz2jwzzbaji0l28xfrpw29kdpsaypm92z2q"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.0.0"; sha256 = "0a8y1a5wkmpawc787gfmnrnbzdgxmx1a14ax43jf3rj9gxmy3vk4"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.0.0"; sha256 = "16sx3cig3d0ilvzl8xxgffmxbiqx87zdi8fc73i3i7zjih1a7f4q"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.0.0"; sha256 = "0i7cfnwph9a10bm26m538h5xcr8b36jscp9sy1zhgifksxz4yixh"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.1.0"; sha256 = "0clg1bv55mfv5dq00m19cp634zx6inm31kf8ppbq1jgyjf2185dh"; })
-  (fetchNuGet { pname = "System.Security.Principal"; version = "4.3.0"; sha256 = "12cm2zws06z4lfc4dn31iqv7072zyi4m910d4r6wm8yx85arsfxf"; })
-  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.3.0"; sha256 = "00a0a7c40i3v4cb20s2cmh9csb5jv2l0frvnlzyfxh848xalpdwr"; })
  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.5.0"; sha256 = "0rmj89wsl5yzwh0kqjgx45vzf694v9p92r4x4q6yxldk1cv1hi86"; })
-  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.0.11"; sha256 = "1dyqv0hijg265dwxg6l7aiv74102d6xjiwplh2ar1ly6xfaa4iiw"; })
  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "4.5.1"; sha256 = "1z21qyfs6sg76rp68qdx0c9iy57naan89pg7p6i3qpj8kyzn921w"; })
  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "5.0.0"; sha256 = "1bn2pzaaq4wx9ixirr8151vm5hynn3lmrljcgjx9yghmm4k677k0"; })
  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "8.0.0"; sha256 = "1lgdd78cik4qyvp2fggaa0kzxasw6kc9a6cjqw46siagrm0qnc3y"; })
-  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.0.11"; sha256 = "08nsfrpiwsg9x5ml4xyl3zyvjfdi4mvbqf93kjdh11j4fwkznizs"; })
  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "6.0.0"; sha256 = "06n9ql3fmhpjl32g3492sj181zjml5dlcc5l76xq2h38c4f87sai"; })
  (fetchNuGet { pname = "System.Text.Json"; version = "6.0.0"; sha256 = "1si2my1g0q0qv1hiqnji4xh9wd05qavxnzj9dwgs23iqvgjky0gl"; })
-  (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.1.0"; sha256 = "1mw7vfkkyd04yn2fbhm38msk7dz2xwvib14ygjsb8dq2lcvr18y7"; })
-  (fetchNuGet { pname = "System.Threading"; version = "4.0.11"; sha256 = "19x946h926bzvbsgj28csn46gak2crv2skpwsx80hbgazmkgb1ls"; })
  (fetchNuGet { pname = "System.Threading"; version = "4.3.0"; sha256 = "0rw9wfamvhayp5zh3j7p1yfmx9b5khbf4q50d8k5rk993rskfd34"; })
-  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.0.11"; sha256 = "0nr1r41rak82qfa5m0lhk9mp0k93bvfd7bbd9sdzwx9mb36g28p5"; })
  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.3.0"; sha256 = "134z3v9abw3a6jsw17xl3f6hqjpak5l682k2vz39spj4kmydg6k7"; })
-  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.0.0"; sha256 = "1cb51z062mvc2i8blpzmpn9d9mm4y307xrwi65di8ri18cz5r1zr"; })
  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.4"; sha256 = "0y6ncasgfcgnjrhynaf0lwpkpkmv4a07sswwkwbwb5h7riisj153"; })
-  (fetchNuGet { pname = "System.Threading.ThreadPool"; version = "4.3.0"; sha256 = "027s1f4sbx0y1xqw2irqn6x161lzj8qwvnh2gn78ciiczdv10vf1"; })
-  (fetchNuGet { pname = "System.Threading.Timer"; version = "4.0.1"; sha256 = "15n54f1f8nn3mjcjrlzdg6q3520571y012mx7v991x2fvp73lmg6"; })
-  (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.0.11"; sha256 = "0c6ky1jk5ada9m94wcadih98l6k1fvf6vi7vhn1msjixaha419l5"; })
-  (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.0.11"; sha256 = "0n4lvpqzy9kc7qy1a4acwwd7b7pnvygv895az5640idl2y9zbz18"; })
  (fetchNuGet { pname = "Tmds.DBus.Protocol"; version = "0.15.0"; sha256 = "0d99kcs7r9cp6gpyc7z230czkkyx4164x86dhy0mca73f2ykc2g2"; })
  (fetchNuGet { pname = "UnicornEngine.Unicorn"; version = "2.0.2-rc1-fb78016"; sha256 = "1r43b5fd5q8xq8b5nk11jsz2gnm96dh7sxc0rrv2p605ivz7icin"; })
 ]
--- a/pkgs/by-name/ry/ryujinx/package.nix
+++ b/pkgs/by-name/ry/ryujinx/package.nix
@ -26,13 +26,13 @@

 buildDotnetModule rec {
  pname = "ryujinx";
-  version = "1.1.1298"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
+  version = "1.1.1330"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml

  src = fetchFromGitHub {
    owner = "Ryujinx";
    repo = "Ryujinx";
-    rev = "a23d8cb92f3f1bb8dc144f4d9fb3fddee749feae";
-    sha256 = "1vf4xwn1z7bfm7c49r2yydx3dqqzqwp0qgzq12m9yskqsj898d63";
+    rev = "c0f2491eaee7eb1088605f5bda8055b941a14f99";
+    sha256 = "0h6gkcgixxfrlcvwsfq6yrnscpqr00iyqc5pb1pyzjrxy6z5yb2v";
  };

  dotnet-sdk = dotnetCorePackages.sdk_8_0;
--- a/pkgs/by-name/tu/tuxmux/package.nix
+++ b/pkgs/by-name/tu/tuxmux/package.nix
@ -9,23 +9,23 @@

 rustPlatform.buildRustPackage rec {
  pname = "tuxmux";
-  version = "0.1.1";
+  version = "0.2.1";

  src = fetchFromGitHub {
    owner = "edeneast";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-BZ1Vo1NIpzUBGyvd/UbxLaFbrLzoaP8kn/8GoAYBmlo=";
+    hash = "sha256-HujdIT55NmXpHDa0a4EmB30va8bNdZ/MHu7+SwF9Nvc=";
  };

-  cargoHash = "sha256-HIYQPHLMhQtpCIkl5EzjJGHXzBtw7mY85l5bqapw3rg=";
+  cargoHash = "sha256-ceXeYa8MGGc0I8Q/r4GVsR71St/hlNc75a20BN0Haas=";

  buildInputs = [ libiconv ];
  nativeBuildInputs = [ pkg-config installShellFiles ];

  postInstall = ''
-    installShellCompletion $releaseDir/../completions/tm.{bash,fish}
-    installShellCompletion --zsh $releaseDir/../completions/_tm
+    installShellCompletion $releaseDir/../completions/tux.{bash,fish}
+    installShellCompletion --zsh $releaseDir/../completions/_tux

    installManPage $releaseDir/../man/*
  '';
@ -35,6 +35,6 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/edeneast/tuxmux";
    license = licenses.asl20;
    maintainers = with maintainers; [ edeneast ];
-    mainProgram = "tm";
+    mainProgram = "tux";
  };
 }
--- a/pkgs/development/libraries/cpp-utilities/default.nix
+++ b/pkgs/development/libraries/cpp-utilities/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cpp-utilities";
-  version = "5.24.8";
+  version = "5.24.9";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = "cpp-utilities";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-Bo7XYArkJOK/dsX+K+xadz8SCh736ZMaB29jX4X+RGw=";
+    sha256 = "sha256-L0F9CkA/yWl7YfJtSBvSGSLTh2g7loIlpZMiC/ACU2k=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/itk/5.x.nix
+++ b/pkgs/development/libraries/itk/5.x.nix
@ -1,5 +1,5 @@
 import ./generic.nix rec {
-  version = "5.3.0";
-  rev = "v${version}";
-  sourceSha256 = "sha256-+qCd8Jzpl5fEPTUpLyjjFBkfgCn3+Lf4pi8QnjCwofs=";
+  version = "5.4.0";
+  rev = "refs/tags/v${version}";
+  sourceSha256 = "sha256-1RSWgH0iQ2NQNsieW2m37udXWQlqYslJNM3TXC9xeP4=";
 }
--- a/pkgs/development/libraries/itk/generic.nix
+++ b/pkgs/development/libraries/itk/generic.nix
@ -38,7 +38,7 @@ stdenv.mkDerivation {
    sha256 = sourceSha256;
  };

-  patches = [
+  patches = lib.optionals (lib.versionOlder version "5.4") [
    (fetchpatch {
      name = "fix-gcc13-build";
      url = "https://github.com/InsightSoftwareConsortium/ITK/commit/9a719a0d2f5f489eeb9351b0ef913c3693147a4f.patch";
--- a/pkgs/development/libraries/qtutilities/default.nix
+++ b/pkgs/development/libraries/qtutilities/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "qtutilities";
-  version = "6.14.0";
+  version = "6.14.1";

  src = fetchFromGitHub {
    owner = "Martchus";
    repo = "qtutilities";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-pg2SaFfFkP2v1qHo8CRCn7b9B4XKX+R4UqRNzNG4to4=";
+    hash = "sha256-WUrxBlSS1Z3+tQGmAi+d3wpqutqNjPrVOxmpUy01aqU=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/autotrash/default.nix
+++ b/pkgs/development/python-modules/autotrash/default.nix
@ -0,0 +1,33 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "autotrash";
+  version = "0.4.7";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "bneijt";
+    repo = "autotrash";
+    rev = "refs/tags/${version}";
+    hash = "sha256-qMU3jjBL5+fd9vKX5BIqES5AM8D/54aBOmdHFiBtfEo=";
+  };
+
+  build-system = [ poetry-core ];
+
+  pythonImportsCheck = [ "autotrash" ];
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    description = "Tool to automatically purge old trashed files";
+    license = licenses.gpl3Plus;
+    homepage = "https://bneijt.nl/pr/autotrash";
+    maintainers = with maintainers; [ sigmanificient ];
+    mainProgram = "autotrash";
+  };
+}
--- a/pkgs/development/python-modules/dahlia/default.nix
+++ b/pkgs/development/python-modules/dahlia/default.nix
@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  testers,
+  dahlia
+}:
+
+buildPythonPackage rec {
+  pname = "dahlia";
+  version = "2.3.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "dahlia-lib";
+    repo = "dahlia";
+    rev = "refs/tags/${version}";
+    hash = "sha256-KQOfTTYA/Jt0UbZ1VKqETwYHtMlOuS2lY0755gqFgxg=";
+  };
+
+  build-system = [ poetry-core ];
+  pythonImportsCheck = [ "dahlia" ];
+
+  passthru.tests.version = testers.testVersion {
+    package = dahlia;
+    command = "${lib.getExe dahlia} --version";
+    version = "${version}";
+  };
+
+  meta = with lib; {
+    changelog = "https://github.com/dahlia-lib/dahlia/blob/${src.rev}/CHANGELOG.md";
+    description = "A simple text formatting package, inspired by the game Minecraft";
+    license = licenses.mit;
+    homepage = "https://github.com/dahlia-lib/dahlia";
+    maintainers = with maintainers; [ sigmanificient ];
+    mainProgram = "dahlia";
+  };
+}
--- a/pkgs/development/python-modules/ixia/default.nix
+++ b/pkgs/development/python-modules/ixia/default.nix
@ -0,0 +1,30 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+}:
+
+buildPythonPackage rec {
+  pname = "ixia";
+  version = "1.3.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "trag1c";
+    repo = "ixia";
+    rev = "refs/tags/${version}";
+    hash = "sha256-JGTwctzswItAJsKZzVVl+B2fZnCWpMmq9TnNgYY2Kng=";
+  };
+
+  build-system = [ poetry-core ];
+  pythonImportsCheck = [ "ixia" ];
+
+  meta = with lib; {
+    changelog = "https://github.com/trag1c/ixia/blob/${src.rev}/CHANGELOG.md";
+    description = "Connecting secrets' security with random's versatility";
+    license = licenses.mit;
+    homepage = "https://trag1c.github.io/ixia";
+    maintainers = with maintainers; [ sigmanificient ];
+  };
+}
--- a/pkgs/development/python-modules/mypy/default.nix
+++ b/pkgs/development/python-modules/mypy/default.nix
@ -30,7 +30,7 @@

 buildPythonPackage rec {
  pname = "mypy";
-  version = "1.9.0";
+  version = "1.10.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -38,8 +38,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "python";
    repo = "mypy";
-    rev = "refs/tags/${version}";
-    hash = "sha256-uOOZX8bKRunTOgYVbmetu2m0B7kijxBgWdNiLCAhiQ4=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-NCnc4C/YFKHN/kT7RTFCYs/yC00Kt1E7mWCoQuUjxG8=";
  };

  build-system = [
--- a/pkgs/development/python-modules/outspin/default.nix
+++ b/pkgs/development/python-modules/outspin/default.nix
@ -0,0 +1,32 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "outspin";
+  version = "0.3.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "trag1c";
+    repo = "outspin";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-j+J3n/p+DcfnhGfC4/NDBDl5bF39L5kIPeGJW0Zm7ls=";
+  };
+
+  build-system = [ poetry-core ];
+  pythonImportsCheck = [ "outspin" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    changelog = "https://github.com/trag1c/outspin/blob/${src.rev}/CHANGELOG.md";
+    description = "Conveniently read single char inputs in the console";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sigmanificient ];
+  };
+}
--- a/pkgs/development/python-modules/paperbush/default.nix
+++ b/pkgs/development/python-modules/paperbush/default.nix
@ -0,0 +1,29 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+}:
+
+buildPythonPackage rec {
+  pname = "paperbush";
+  version = "0.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "trag1c";
+    repo = "paperbush";
+    rev = "refs/tags/${version}";
+    hash = "sha256-wJV+2aGK9eSw2iToiHh0I7vYAuND2pRYGhnf7CB1a+0=";
+  };
+
+  build-system = [ poetry-core ];
+  pythonImportsCheck = [ "paperbush" ];
+
+  meta = with lib; {
+    changelog = "https://github.com/trag1c/paperbush/blob/${src.rev}/CHANGELOG.md";
+    description = "A super concise argument parsing tool for Python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sigmanificient ];
+  };
+}
--- a/pkgs/development/python-modules/pyperscan/default.nix
+++ b/pkgs/development/python-modules/pyperscan/default.nix
@ -11,20 +11,20 @@

 buildPythonPackage rec {
  pname = "pyperscan";
-  version = "0.2.2";
+  version = "0.3.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "vlaci";
    repo = "pyperscan";
    rev = "v${version}";
-    hash = "sha256-ioNGEmWy+lEzazF1RzMFS06jYLNYll3QSlWAF0AoU7Y=";
+    hash = "sha256-uGZ0XFxnZHSLEWcwoHVd+xMulDRqEIrQ5Lf7886GdlM=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-2zppyxJ+XaI/JCkp7s27/jgtSbwxnI4Yil5KT8WgrVI=";
+    hash = "sha256-a4jNofPIHoKwsD82y2hG2QPu+eM5D7FSGCm2nDo2cLA=";
  };

  nativeBuildInputs = with rustPlatform; [
@ -37,14 +37,12 @@ buildPythonPackage rec {

  buildInputs = [ vectorscan ] ++ lib.optional stdenv.isDarwin libiconv;

-  # Disable default features to use the system vectorscan library instead of a vendored one.
-  maturinBuildFlags = [ "--no-default-features" ];
-
  pythonImportsCheck = [ "pyperscan" ];

  meta = with lib; {
    description = "a hyperscan binding for Python, which supports vectorscan";
-    homepage = "https://github.com/vlaci/pyperscan";
+    homepage = "https://vlaci.github.io/pyperscan/";
+    changelog = "https://github.com/vlaci/pyperscan/releases/tag/${src.rev}";
    platforms = platforms.unix;
    license = with licenses; [
      asl20 # or
--- a/pkgs/development/python-modules/ray/binary-hashes.nix
+++ b/pkgs/development/python-modules/ray/binary-hashes.nix
@ -1,8 +1,8 @@
 {
  cp310 = {
-    hash = "sha256-y3T30qpaIeX53LMVpPm96CIyjna6lc0Lo3DP2gmKZ/Q=";
+    hash = "sha256-VWEPjq5lzlaGvedaV4LOY+KgESzNImK4rNcHJk2m2+o=";
  };
  cp311 = {
-    hash = "sha256-x9FDjLqHJuyaWclpZOAHtgoHKENmR/SMODIoaSwvLuA=";
+    hash = "sha256-FcEJ/ZlpMmMjyL2wcBzZryHIX0ZQAvdJUGIvmlgOxOU=";
  };
 }
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@ -53,7 +53,7 @@

 let
  pname = "ray";
-  version = "2.10.0";
+  version = "2.23.0";
 in
 buildPythonPackage rec {
  inherit pname version;
--- a/pkgs/development/python-modules/schema-salad/default.nix
+++ b/pkgs/development/python-modules/schema-salad/default.nix
@ -22,7 +22,7 @@

 buildPythonPackage rec {
  pname = "schema-salad";
-  version = "8.5.20240410123758";
+  version = "8.5.20240503091721";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -31,7 +31,7 @@ buildPythonPackage rec {
    owner = "common-workflow-language";
    repo = "schema_salad";
    rev = "refs/tags/${version}";
-    hash = "sha256-AgXqeiA4sP7KBnUpb2uMWq45G0LhJ5uLtORrOG4UuB0=";
+    hash = "sha256-VbEIkWzg6kPnJWqbvlfsD83oS0VQasGQo+pUIPiGjhU=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/torchio/default.nix
+++ b/pkgs/development/python-modules/torchio/default.nix
@ -20,7 +20,7 @@

 buildPythonPackage rec {
  pname = "torchio";
-  version = "0.19.5";
+  version = "0.19.6";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -29,7 +29,7 @@ buildPythonPackage rec {
    owner = "fepegar";
    repo = "torchio";
    rev = "refs/tags/v${version}";
-    hash = "sha256-RqKJStUZhnSmsifn3WjYLfmRkkme+GOe6dp0E0MW9tE=";
+    hash = "sha256-FlsjDgthXDGVjj4L0Yw+8UzBROw9jiM4Z+qi67D5ygU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/tpm2-pytss/default.nix
+++ b/pkgs/development/python-modules/tpm2-pytss/default.nix
@ -40,10 +40,9 @@ buildPythonPackage rec {
    [
      # Fix hardcoded `fapi-config.json` configuration path
      ./fapi-config.patch
-      (fetchurl {
-        url = "https://github.com/tpm2-software/tpm2-pytss/pull/571/commits/b02fdc8e259fe977c1065389c042be69e2985bdf.patch";
-        hash = "sha256-+jZFv+s9p52JxtUcNeJx7ayzKDVtPoQSSGgyZqPDuEc=";
-      })
+      # Backport for https://github.com/tpm2-software/tpm2-pytss/pull/576
+      # This is likely to be dropped with the next major release (>= 2.3)
+      ./pr576-backport.patch
    ]
    ++ lib.optionals isCross [
      # pytss will regenerate files from headers of tpm2-tss.
--- a/pkgs/development/python-modules/tpm2-pytss/pr576-backport.patch
+++ b/pkgs/development/python-modules/tpm2-pytss/pr576-backport.patch
@ -0,0 +1,117 @@
+Backport for https://github.com/tpm2-software/tpm2-pytss/pull/576 on 2.2.1
+
+diff --git a/scripts/prepare_headers.py b/scripts/prepare_headers.py
+index 6ca9b64..a7529b3 100644
+--- a/scripts/prepare_headers.py
+++ b/scripts/prepare_headers.py
+@@ -32,6 +32,7 @@ def remove_common_guards(s):
+ 
+     # Restructure #defines with ...
+     s = re.sub("(#define [A-Za-z0-9_]+) +\(\(.*?\) \(.*?\)\)", "\g<1>...", s)
+    s = re.sub("(#define [A-Za-z0-9_]+) +\(\(\(.*?\) .*\)", "\g<1>...", s)
+     s = re.sub("(#define [A-Za-z0-9_]+) +\(\(.*?\).*?\) ", "\g<1>...", s)
+     s = re.sub(
+         "(#define [A-Za-z0-9_]+) .*\n.*?.*\)\)", "\g<1>...", s, flags=re.MULTILINE
+diff --git a/src/tpm2_pytss/internal/crypto.py b/src/tpm2_pytss/internal/crypto.py
+index 42030c5..f9d8c34 100644
+--- a/src/tpm2_pytss/internal/crypto.py
+++ b/src/tpm2_pytss/internal/crypto.py
+@@ -25,6 +25,7 @@ from cryptography.hazmat.backends import default_backend
+ from cryptography.exceptions import UnsupportedAlgorithm, InvalidSignature
+ from typing import Tuple, Type, Any
+ import secrets
+import inspect
+ import sys
+ 
+ _curvetable = (
+diff --git a/test/test_encoding.py b/test/test_encoding.py
+index 1f58562..8cf4b51 100644
+--- a/test/test_encoding.py
+++ b/test/test_encoding.py
+@@ -1406,7 +1406,7 @@ class ToolsTest(TSS2_BaseTest):
+     def test_tools_decode_tpm2b_name(self):
+         if not self.has_tools:
+             self.skipTest("tools not in path")
+-        key = ec.generate_private_key(ec.SECP256R1).public_key()
+        key = ec.generate_private_key(ec.SECP256R1()).public_key()
+         kb = key.public_bytes(
+             serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo
+         )
+diff --git a/test/test_fapi.py b/test/test_fapi.py
+index f702fc9..6b77c66 100644
+--- a/test/test_fapi.py
+++ b/test/test_fapi.py
+@@ -13,7 +13,7 @@ from cryptography.hazmat.primitives.asymmetric.padding import PSS
+ 
+ from tpm2_pytss import *
+ 
+-from tpm2_pytss.internal.utils import is_bug_fixed, _lib_version_atleast
+from tpm2_pytss.internal.utils import is_bug_fixed
+ 
+ from .TSS2_BaseTest import TpmSimulator
+ from tpm2_pytss.TSS2_Exception import TSS2_Exception
+@@ -614,8 +614,7 @@ class Common:
+         self.fapi.sign(key_path, b"\x22" * 32)
+ 
+     @pytest.mark.skipif(
+-        _lib_version_atleast("tss2-fapi", "4.0.1-170")
+-        or not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
+        not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
+         reason="tpm2-tss bug, see #2084",
+     )
+     def test_write_authorize_nv(self, esys):
+@@ -662,8 +661,7 @@ class Common:
+             self.fapi.quote(path=key_path, pcrs=[7, 9])
+ 
+     @pytest.mark.skipif(
+-        _lib_version_atleast("tss2-fapi", "4.0.1-170")
+-        or not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
+        not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
+         reason="tpm2-tss bug, see #2084",
+     )
+     def test_authorize_policy(self, sign_key):
+@@ -728,9 +726,7 @@ class Common:
+             self.fapi.quote(path=key_path, pcrs=[7, 9])
+ 
+     @pytest.mark.skipif(
+-        _lib_version_atleast("tss2-fapi", "4.0.1-170")
+-        or not is_bug_fixed(fixed_in="3.2"),
+-        reason="tpm2-tss bug, see #2080",
+        not is_bug_fixed(fixed_in="3.2"), reason="tpm2-tss bug, see #2080"
+     )
+     def test_policy_signed(self, cryptography_key):
+         # create external signing key used by the signing authority external to the TPM
+@@ -792,10 +788,6 @@ class Common:
+         with pytest.raises(TSS2_Exception):
+             self.fapi.sign(path=key_path, digest=b"\x11" * 32)
+ 
+-    @pytest.mark.skipif(
+-        _lib_version_atleast("tss2-fapi", "4.0.1-170"),
+-        reason="issue on master branch.",
+-    )
+     def test_policy_branched(self):
+         pcr_index = 15
+         pcr_data = b"ABCDEF"
+@@ -913,8 +905,7 @@ class Common:
+         self.fapi.delete(path=nv_path)
+ 
+     @pytest.mark.skipif(
+-        _lib_version_atleast("tss2-fapi", "4.0.1-170")
+-        or not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
+        not is_bug_fixed(fixed_in="3.2", backports=["2.4.7", "3.0.5", "3.1.1"]),
+         reason="tpm2-tss bug, see #2089",
+     )
+     def test_policy_action(self):
+diff --git a/test/test_policy.py b/test/test_policy.py
+index f18aa8a..5f56e21 100644
+--- a/test/test_policy.py
+++ b/test/test_policy.py
+@@ -47,7 +47,7 @@ class TestPolicy(TSS2_EsapiTest):
+         super().setUp()
+         self._has_secp192r1 = True
+         try:
+-            ec.generate_private_key(ec.SECP192R1)
+            ec.generate_private_key(ec.SECP192R1())
+         except Exception:
+             self._has_secp192r1 = False
+ 
--- a/pkgs/development/python-modules/xapp/default.nix
+++ b/pkgs/development/python-modules/xapp/default.nix
@ -16,15 +16,15 @@

 buildPythonPackage rec {
  pname = "xapp";
-  version = "22";
+  version = "2.4.1";

  format = "other";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "python-xapp";
-    rev = "refs/tags/master.mint${version}";
-    hash = "sha256-2Gx85y0ARu6EfDYAT9ZL154RH0R1HY78tm3rceODnZU=";
+    rev = version;
+    hash = "sha256-Kvhp+biZ+KK9FYma/8cUEaQCHPKMLjOO909kbyMLQ3o=";
  };

  nativeBuildInputs = [
@ -55,7 +55,10 @@ buildPythonPackage rec {
  doCheck = false;
  pythonImportsCheck = [ "xapp" ];

-  passthru.updateScript = gitUpdater { ignoredVersions = "^master.*"; };
+  passthru = {
+    updateScript = gitUpdater { ignoredVersions = "^master.*"; };
+    skipBulkUpdate = true; # This should be bumped as part of Cinnamon update.
+  };

  meta = with lib; {
    homepage = "https://github.com/linuxmint/python-xapp";
--- a/pkgs/development/tools/build-managers/mill/default.nix
+++ b/pkgs/development/tools/build-managers/mill/default.nix
@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, jre, makeWrapper }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "mill";
  version = "0.11.7";

  src = fetchurl {
-    url = "https://github.com/com-lihaoyi/mill/releases/download/${version}/${version}-assembly";
+    url = "https://github.com/com-lihaoyi/mill/releases/download/${finalAttrs.version}/${finalAttrs.version}-assembly";
    hash = "sha256-iijKZlQoiIWos+Kdq9hIgiM5yM7xCf11abrJ71LO9jA=";
  };

@ -50,4 +50,4 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ scalavision zenithal ];
    platforms = lib.platforms.all;
  };
-}
+})
--- a/pkgs/development/tools/continuous-integration/woodpecker/common.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
@ -1,7 +1,7 @@
 { lib, fetchzip }:
 let
-  version = "2.4.1";
-  srcHash = "sha256-03y0xLXgdvw1NAtH2FDW91wp13ohimqjz3kl2mWc11E=";
+  version = "2.5.0";
+  srcHash = "sha256-tR+suOR09folwZ6qmuaQhGml134L8dcK7ZX8/Pl4xfQ=";
  # The tarball contains vendored dependencies
  vendorHash = null;
 in
--- a/pkgs/development/tools/frink/default.nix
+++ b/pkgs/development/tools/frink/default.nix
@ -8,12 +8,12 @@
 }:
 stdenv.mkDerivation rec {
  pname = "frink";
-  version = "2023-07-31";
+  version = "2023-12-02";

  src = fetchurl {
    # Upstream does not provide versioned download links
-    url = "https://web.archive.org/web/20230806114836/https://frinklang.org/frinkjar/frink.jar";
-    sha256 = "sha256-u44g/pM4ie3NcBh6MZpN8+oWZLYz0LN5ozetee1iXNk=";
+    url = "https://web.archive.org/web/20231210094124/https://frinklang.org/frinkjar/frink.jar";
+    sha256 = "sha256-oURRTrgyVMPD4cOdM6g0bDpZ0KMlVsLqa0nzC1UvqIs=";
  };

  dontUnpack = true;
--- a/pkgs/development/tools/nwjs/default.nix
+++ b/pkgs/development/tools/nwjs/default.nix
@ -87,7 +87,7 @@ let
    extraOutputsToInstall = [ "lib" "out" ];
  };

-  version = "0.87.0";
+  version = "0.88.0";
 in
 stdenv.mkDerivation {
  pname = "nwjs";
@ -98,10 +98,10 @@ stdenv.mkDerivation {
    in fetchurl {
      url = "https://dl.nwjs.io/v${version}/nwjs-${flavor}v${version}-linux-${bits}.tar.gz";
      hash = {
-        "sdk-ia32" = "sha256-We4tSI8rQbEIoxNgTP/IkL/sD7GegVQDAtXUSY4AoB0=";
-        "sdk-x64" = "sha256-pWsNVHNm1gVAy9ofZ6g1Im5TpzxM2bmJ6RENa21N4qM=";
-        "ia32" = "sha256-ExxzzErT3GBI1yLYycojDkzKZ2VuvsOjaingQiK1Kww=";
-        "x64" = "sha256-tKm3aTlfPuevdjqFFEVU6nvIixoBDUcnJPFyO1PNRqE=";
+        "sdk-ia32" = "sha256-pk8Fdzw8zBBF4xeU5BlmkF1gbf7HIn8jheSjbdV4hI0=";
+        "sdk-x64" = "sha256-51alZRf/+bpKfVLUQuy1VtLHCgkVuptQaJgupt7zxcU=";
+        "ia32" = "sha256-OLkOJo3xDZ6WKbf6zPeY+KcgzoEjYWMIV7YWWbESjPo=";
+        "x64" = "sha256-KSsaTs0W8m2dI+0ByLqU4H4ai/PXUt6LtroZIBeymgs=";
      }."${flavor + bits}";
    };

--- a/pkgs/os-specific/darwin/raycast/default.nix
+++ b/pkgs/os-specific/darwin/raycast/default.nix
@ -11,12 +11,12 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "raycast";
-  version = "1.75.1";
+  version = "1.75.2";

  src = fetchurl {
    name = "Raycast.dmg";
    url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-lHGKWj4nn0GsviV83MKgCaQ6HW/CfeP8gg4VXlVXaXg=";
+    hash = "sha256-P9lbIU8IBdowy8vkv+PHITBUpRNTI9t0j8Vm1DjYXnQ=";
  };

  dontPatch = true;
@ -45,7 +45,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      common-updater-scripts
    ];
    text = ''
-      set -eo pipefail
      url=$(curl --silent "https://releases.raycast.com/releases/latest?build=universal")
      version=$(echo "$url" | jq -r '.version')
      update-source-version raycast "$version" --file=./pkgs/os-specific/darwin/raycast/default.nix
--- a/pkgs/os-specific/linux/syslinux/default.nix
+++ b/pkgs/os-specific/linux/syslinux/default.nix
@ -1,11 +1,14 @@
 { lib
 , stdenv
-, fetchgit
+, fetchFromRepoOrCz
+, gnu-efi
 , fetchurl
+, fetchpatch
 , libuuid
 , makeWrapper
 , mtools
 , nasm
+, nixosTests
 , perl
 , python3
 }:
@ -16,11 +19,10 @@ stdenv.mkDerivation {

  # This is syslinux-6.04-pre3^1; syslinux-6.04-pre3 fails to run.
  # Same issue here https://www.syslinux.org/archives/2019-February/026330.html
-  src = fetchgit {
-    url = "https://repo.or.cz/syslinux";
+  src = fetchFromRepoOrCz {
+    repo = "syslinux";
    rev = "b40487005223a78c3bb4c300ef6c436b3f6ec1f7";
-    sha256 = "sha256-GqvRTr9mA2yRD0G0CF11x1X0jCgqV4Mh+tvE0/0yjqk=";
-    fetchSubmodules = true;
+    hash = "sha256-XNC+X7UYxdMQQAg4MLACQLxRNnI5/ZCOiCJrEkKgPeM=";
  };

  patches = let
@ -65,19 +67,17 @@ stdenv.mkDerivation {
      "0018-prevent-pow-optimization.patch"
      "26f0e7b2"
      "sha256-dVzXBi/oSV9vYgU85mRFHBKuZdup+1x1BipJX74ED7E=")
+    # Fixes build with "modern" gnu-efi
+    ./import-efisetjmp.patch
  ];

  postPatch = ''
-    substituteInPlace Makefile --replace /bin/pwd $(type -P pwd)
-    substituteInPlace utils/ppmtolss16 --replace /usr/bin/perl $(type -P perl)
+    substituteInPlace Makefile --replace-fail /bin/pwd $(type -P pwd)
+    substituteInPlace utils/ppmtolss16 --replace-fail /usr/bin/perl $(type -P perl)

    # fix tests
    substituteInPlace tests/unittest/include/unittest/unittest.h \
-      --replace /usr/include/ ""
-
-    # Hack to get `gcc -m32' to work without having 32-bit Glibc headers.
-    mkdir gnu-efi/inc/ia32/gnu
-    touch gnu-efi/inc/ia32/gnu/stubs-32.h
+      --replace-fail /usr/include/ ""
  '';

  nativeBuildInputs = [
@ -89,6 +89,7 @@ stdenv.mkDerivation {

  buildInputs = [
    libuuid
+    gnu-efi
  ];

  # Fails very rarely with 'No rule to make target: ...'
@ -111,8 +112,22 @@ stdenv.mkDerivation {
    "MANDIR=$(out)/share/man"
    "PERL=perl"
    "HEXDATE=0x00000000"
+    # Works around confusing (unrelated) error messages when upx is not made available
+    "UPX=false"
+
+    # Configurations needed to make use of external gnu-efi
+    "LIBEFI=${gnu-efi}/lib/libefi.a"
+    "LIBDIR=${gnu-efi}/lib/"
+    "EFIINC=${gnu-efi}/include/efi"
+
+    # Legacy bios boot target is always built
+    "bios"
  ]
-  ++ lib.optionals stdenv.hostPlatform.isi686 [ "bios" "efi32" ];
+  # Build "ia32" EFI for i686
+  ++ lib.optional stdenv.hostPlatform.isi686 "efi32"
+  # Build "x86_64" EFI for x86_64
+  ++ lib.optional stdenv.hostPlatform.isx86_64 "efi64"
+  ;

  # Some tests require qemu, some others fail in a sandboxed environment
  doCheck = false;
@ -125,8 +140,10 @@ stdenv.mkDerivation {
    rm -rf $out/share/syslinux/com32
  '';

+  passthru.tests.biosCdrom = nixosTests.boot.biosCdrom;
+
  meta = with lib; {
-    homepage = "http://www.syslinux.org/";
+    homepage = "https://www.syslinux.org/";
    description = "A lightweight bootloader";
    license = licenses.gpl2Plus;
    maintainers = [ maintainers.samueldr ];
--- a/pkgs/os-specific/linux/syslinux/import-efisetjmp.patch
+++ b/pkgs/os-specific/linux/syslinux/import-efisetjmp.patch
@ -0,0 +1,22 @@
+From 68defee52f4eba82eefaeea17f21c7498448dd6b Mon Sep 17 00:00:00 2001
+From: Samuel Dionne-Riel <samuel@dionne-riel.com>
+Date: Mon, 3 Jun 2024 16:16:25 -0400
+Subject: [PATCH] efi/efi.h: Add efisetjmp.h
+
+See https://github.com/ncroxon/gnu-efi/commit/486ba3c3bdd147b7d98159b9e650be60bce0f027
+---
+ efi/efi.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/efi/efi.h b/efi/efi.h
+index c266532f3..e4497574b 100644
+--- a/efi/efi.h
+++ b/efi/efi.h
+@@ -23,6 +23,7 @@
+ #include <efi.h>
+ #include <efilib.h>
+ #include <efistdarg.h>
+#include <efisetjmp.h>
+ 
+ /* Delay for 100 ms */
+ #define EFI_NOMAP_PRINT_DELAY	100
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -5025,6 +5025,8 @@ with pkgs;

  easyabc = callPackage ../applications/audio/easyabc { };

+  easyaudiosync = qt6Packages.callPackage ../applications/audio/easyaudiosync {};
+
  easycrypt = callPackage ../applications/science/logic/easycrypt {
    why3 = pkgs.why3.override { ideSupport = false; };
  };
@ -27649,8 +27651,6 @@ with pkgs;
    inherit (darwin.apple_sdk.frameworks) Security;
  };

-  ols = callPackage ../development/tools/ols { };
-
  openpam = callPackage ../development/libraries/openpam { };

  openbsm = callPackage ../development/libraries/openbsm { };
@ -32846,8 +32846,6 @@ with pkgs;

  motif = callPackage ../development/libraries/motif { };

-  mousai = callPackage ../applications/audio/mousai { };
-
  mozjpeg = callPackage ../applications/graphics/mozjpeg { };

  edgetx = libsForQt5.callPackage ../applications/misc/edgetx { };
@ -37896,7 +37894,7 @@ with pkgs;

  minia = callPackage ../applications/science/biology/minia { };

-  mirtk = callPackage ../development/libraries/science/biology/mirtk { };
+  mirtk = callPackage ../development/libraries/science/biology/mirtk { itk = itk_5_2; };

  muscle = callPackage ../applications/science/biology/muscle { };

--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -938,6 +938,23 @@ with self; {
    };
  };

+  Apppapersway = buildPerlPackage rec {
+    pname = "App-papersway";
+    version = "1.001";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/S/SP/SPWHITTON/App-papersway-${version}.tar.gz";
+      hash = "sha256-61OMfvEhgwFbNlOFjm9p3QxDOn31jQZdN8i1nIsWlns=";
+    };
+    buildInputs = [ AnyEvent AnyEventI3 GetoptLong JSON ];
+    meta = {
+      description = "PaperWM-like scrollable tiling window management for Sway/i3wm";
+      homepage = "https://spwhitton.name/tech/code/papersway/";
+      license = lib.licenses.gpl3Plus;
+      mainProgram = "papersway";
+      maintainers = with lib.maintainers; [ fgaz ];
+    };
+  };
+
  Appperlbrew = buildPerlModule {
    pname = "App-perlbrew";
    version = "0.98";
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -1007,6 +1007,8 @@ self: super: with self; {

  autoslot = callPackage ../development/python-modules/autoslot { };

+  autotrash = callPackage ../development/python-modules/autotrash { };
+
  avahi = toPythonModule (pkgs.avahi.override {
    inherit python;
    withPython = true;
@ -2702,6 +2704,8 @@ self: super: with self; {

  daff = callPackage ../development/python-modules/daff { };

+  dahlia = callPackage ../development/python-modules/dahlia { };
+
  daiquiri = callPackage ../development/python-modules/daiquiri { };

  dalle-mini = callPackage ../development/python-modules/dalle-mini { };
@ -5987,6 +5991,8 @@ self: super: with self; {

  iwlib = callPackage ../development/python-modules/iwlib { };

+  ixia = callPackage ../development/python-modules/ixia { };
+
  j2cli = callPackage ../development/python-modules/j2cli { };

  jaconv = callPackage ../development/python-modules/jaconv { };
@ -9392,6 +9398,8 @@ self: super: with self; {

  outcome = callPackage ../development/python-modules/outcome { };

+  outspin = callPackage ../development/python-modules/outspin { };
+
  ovh = callPackage ../development/python-modules/ovh { };

  ovmfvartool = callPackage ../development/python-modules/ovmfvartool { };
@ -9454,6 +9462,8 @@ self: super: with self; {

  panphon = callPackage ../development/python-modules/panphon { };

+  paperbush = callPackage ../development/python-modules/paperbush { };
+
  papermill = callPackage ../development/python-modules/papermill { };

  openpaperwork-core = callPackage ../applications/office/paperwork/openpaperwork-core.nix { };