Merge staging-next into staging

2024-04-04 00:02:46 +00:00 · 2024-04-04 00:02:46 +00:00 · 8845a6f1c9
commit 8845a6f1c9
parent 243a3db9c9 88714eefa3
93 changed files with 3457 additions and 12862 deletions
--- a/.github/workflows/check-nix-format.yml
+++ b/.github/workflows/check-nix-format.yml
@ -23,8 +23,11 @@ jobs:
        with:
          # explicitly enable sandbox
          extra_nix_config: sandbox = true
+          # fix a commit from nixpkgs-unstable to avoid e.g. building nixfmt
+          # from staging
+          nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/4b455dc2048f73a79eb3713f342369ff58f93e0b.tar.gz
      - name: Install nixfmt
-        run: nix-env -f default.nix -iAP nixfmt-rfc-style
+        run: "nix-env -f '<nixpkgs>' -iAP nixfmt-rfc-style"
      - name: Check that Nix files are formatted according to the RFC style
        # Each environment variable beginning with NIX_FMT_PATHS_ is a list of
        # paths to check with nixfmt.
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@ -177,8 +177,12 @@ in
        # services.printing.enable = true;

        # Enable sound.
-        # sound.enable = true;
        # hardware.pulseaudio.enable = true;
+        # OR
+        # services.pipewire = {
+        #   enable = true;
+        #   pulse.enable = true;
+        # };

        # Enable touchpad support (enabled default in most desktopManager).
        # services.xserver.libinput.enable = true;
--- a/nixos/modules/services/games/archisteamfarm.nix
+++ b/nixos/modules/services/games/archisteamfarm.nix
@ -255,7 +255,7 @@ in
              ln -fs ${ipc-config} config/IPC.config
            ''}

-            ${lib.optionalString (cfg.ipcSettings != {}) ''
+            ${lib.optionalString (cfg.bots != {}) ''
              ln -fs ${createBotsScript}/* config/
            ''}

--- a/nixos/modules/services/games/terraria.nix
+++ b/nixos/modules/services/games/terraria.nix
@ -148,16 +148,13 @@ in

      serviceConfig = {
        User    = "terraria";
+        Group = "terraria";
        Type = "forking";
        GuessMainPID = true;
+        UMask = 007;
        ExecStart = "${getBin pkgs.tmux}/bin/tmux -S ${cfg.dataDir}/terraria.sock new -d ${pkgs.terraria-server}/bin/TerrariaServer ${concatStringsSep " " flags}";
        ExecStop = "${stopScript} $MAINPID";
      };
-
-      postStart = ''
-        ${pkgs.coreutils}/bin/chmod 660 ${cfg.dataDir}/terraria.sock
-        ${pkgs.coreutils}/bin/chgrp terraria ${cfg.dataDir}/terraria.sock
-      '';
    };

    networking.firewall = mkIf cfg.openFirewall {
--- a/nixos/modules/services/security/vaultwarden/default.nix
+++ b/nixos/modules/services/security/vaultwarden/default.nix
@ -1,7 +1,5 @@
 { config, lib, pkgs, ... }:

-with lib;
-
 let
  cfg = config.services.vaultwarden;
  user = config.users.users.vaultwarden.name;
@ -11,60 +9,60 @@ let
  nameToEnvVar = name:
    let
      parts = builtins.split "([A-Z0-9]+)" name;
-      partsToEnvVar = parts: foldl' (key: x: let last = stringLength key - 1; in
-        if isList x then key + optionalString (key != "" && substring last 1 key != "_") "_" + head x
-        else if key != "" && elem (substring 0 1 x) lowerChars then # to handle e.g. [ "disable" [ "2FAR" ] "emember" ]
-          substring 0 last key + optionalString (substring (last - 1) 1 key != "_") "_" + substring last 1 key + toUpper x
-        else key + toUpper x) "" parts;
+      partsToEnvVar = parts: lib.foldl' (key: x: let last = lib.stringLength key - 1; in
+        if lib.isList x then key + lib.optionalString (key != "" && lib.substring last 1 key != "_") "_" + lib.head x
+        else if key != "" && lib.elem (lib.substring 0 1 x) lib.lowerChars then # to handle e.g. [ "disable" [ "2FAR" ] "emember" ]
+          lib.substring 0 last key + lib.optionalString (lib.substring (last - 1) 1 key != "_") "_" + lib.substring last 1 key + lib.toUpper x
+        else key + lib.toUpper x) "" parts;
    in if builtins.match "[A-Z0-9_]+" name != null then name else partsToEnvVar parts;

  # Due to the different naming schemes allowed for config keys,
  # we can only check for values consistently after converting them to their corresponding environment variable name.
  configEnv =
    let
-      configEnv = concatMapAttrs (name: value: optionalAttrs (value != null) {
-        ${nameToEnvVar name} = if isBool value then boolToString value else toString value;
+      configEnv = lib.concatMapAttrs (name: value: lib.optionalAttrs (value != null) {
+        ${nameToEnvVar name} = if lib.isBool value then lib.boolToString value else toString value;
      }) cfg.config;
-    in { DATA_FOLDER = "/var/lib/bitwarden_rs"; } // optionalAttrs (!(configEnv ? WEB_VAULT_ENABLED) || configEnv.WEB_VAULT_ENABLED == "true") {
+    in { DATA_FOLDER = "/var/lib/bitwarden_rs"; } // lib.optionalAttrs (!(configEnv ? WEB_VAULT_ENABLED) || configEnv.WEB_VAULT_ENABLED == "true") {
      WEB_VAULT_FOLDER = "${cfg.webVaultPackage}/share/vaultwarden/vault";
    } // configEnv;

-  configFile = pkgs.writeText "vaultwarden.env" (concatStrings (mapAttrsToList (name: value: "${name}=${value}\n") configEnv));
+  configFile = pkgs.writeText "vaultwarden.env" (lib.concatStrings (lib.mapAttrsToList (name: value: "${name}=${value}\n") configEnv));

  vaultwarden = cfg.package.override { inherit (cfg) dbBackend; };

 in {
  imports = [
-    (mkRenamedOptionModule [ "services" "bitwarden_rs" ] [ "services" "vaultwarden" ])
+    (lib.mkRenamedOptionModule [ "services" "bitwarden_rs" ] [ "services" "vaultwarden" ])
  ];

-  options.services.vaultwarden = with types; {
-    enable = mkEnableOption (lib.mdDoc "vaultwarden");
+  options.services.vaultwarden = {
+    enable = lib.mkEnableOption "vaultwarden";

-    dbBackend = mkOption {
-      type = enum [ "sqlite" "mysql" "postgresql" ];
+    dbBackend = lib.mkOption {
+      type = lib.types.enum [ "sqlite" "mysql" "postgresql" ];
      default = "sqlite";
-      description = lib.mdDoc ''
+      description = ''
        Which database backend vaultwarden will be using.
      '';
    };

-    backupDir = mkOption {
-      type = nullOr str;
+    backupDir = lib.mkOption {
+      type = with lib.types; nullOr str;
      default = null;
-      description = lib.mdDoc ''
+      description = ''
        The directory under which vaultwarden will backup its persistent data.
      '';
      example = "/var/backup/vaultwarden";
    };

-    config = mkOption {
-      type = attrsOf (nullOr (oneOf [ bool int str ]));
+    config = lib.mkOption {
+      type = with lib.types; attrsOf (nullOr (oneOf [ bool int str ]));
      default = {
        ROCKET_ADDRESS = "::1"; # default to localhost
        ROCKET_PORT = 8222;
      };
-      example = literalExpression ''
+      example = lib.literalExpression ''
        {
          DOMAIN = "https://bitwarden.example.com";
          SIGNUPS_ALLOWED = false;
@ -101,7 +99,7 @@ in {
          SMTP_FROM_NAME = "example.com Bitwarden server";
        }
      '';
-      description = lib.mdDoc ''
+      description = ''
        The configuration of vaultwarden is done through environment variables,
        therefore it is recommended to use upper snake case (e.g. {env}`DISABLE_2FA_REMEMBER`).

@ -125,11 +123,11 @@ in {
      '';
    };

-    environmentFile = mkOption {
-      type = with types; nullOr path;
+    environmentFile = lib.mkOption {
+      type = with lib.types; nullOr path;
      default = null;
      example = "/var/lib/vaultwarden.env";
-      description = lib.mdDoc ''
+      description = ''
        Additional environment file as defined in {manpage}`systemd.exec(5)`.

        Secrets like {env}`ADMIN_TOKEN` and {env}`SMTP_PASSWORD`
@ -157,17 +155,17 @@ in {
      '';
    };

-    package = mkPackageOption pkgs "vaultwarden" { };
+    package = lib.mkPackageOption pkgs "vaultwarden" { };

-    webVaultPackage = mkOption {
-      type = package;
+    webVaultPackage = lib.mkOption {
+      type = lib.types.package;
      default = pkgs.vaultwarden.webvault;
-      defaultText = literalExpression "pkgs.vaultwarden.webvault";
-      description = lib.mdDoc "Web vault package to use.";
+      defaultText = lib.literalExpression "pkgs.vaultwarden.webvault";
+      description = "Web vault package to use.";
    };
  };

-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
    assertions = [ {
      assertion = cfg.backupDir != null -> cfg.dbBackend == "sqlite";
      message = "Backups for database backends other than sqlite will need customization";
@ -185,7 +183,7 @@ in {
      serviceConfig = {
        User = user;
        Group = group;
-        EnvironmentFile = [ configFile ] ++ optional (cfg.environmentFile != null) cfg.environmentFile;
+        EnvironmentFile = [ configFile ] ++ lib.optional (cfg.environmentFile != null) cfg.environmentFile;
        ExecStart = "${vaultwarden}/bin/vaultwarden";
        LimitNOFILE = "1048576";
        PrivateTmp = "true";
@ -200,7 +198,7 @@ in {
      wantedBy = [ "multi-user.target" ];
    };

-    systemd.services.backup-vaultwarden = mkIf (cfg.backupDir != null) {
+    systemd.services.backup-vaultwarden = lib.mkIf (cfg.backupDir != null) {
      description = "Backup vaultwarden";
      environment = {
        DATA_FOLDER = "/var/lib/bitwarden_rs";
@ -212,24 +210,24 @@ in {
      serviceConfig = {
        SyslogIdentifier = "backup-vaultwarden";
        Type = "oneshot";
-        User = mkDefault user;
-        Group = mkDefault group;
+        User = lib.mkDefault user;
+        Group = lib.mkDefault group;
        ExecStart = "${pkgs.bash}/bin/bash ${./backup.sh}";
      };
      wantedBy = [ "multi-user.target" ];
    };

-    systemd.timers.backup-vaultwarden = mkIf (cfg.backupDir != null) {
+    systemd.timers.backup-vaultwarden = lib.mkIf (cfg.backupDir != null) {
      description = "Backup vaultwarden on time";
      timerConfig = {
-        OnCalendar = mkDefault "23:00";
+        OnCalendar = lib.mkDefault "23:00";
        Persistent = "true";
        Unit = "backup-vaultwarden.service";
      };
      wantedBy = [ "multi-user.target" ];
    };

-    systemd.tmpfiles.settings = mkIf (cfg.backupDir != null) {
+    systemd.tmpfiles.settings = lib.mkIf (cfg.backupDir != null) {
      "10-vaultwarden".${cfg.backupDir}.d = {
        inherit user group;
        mode = "0770";
--- a/nixos/modules/services/web-apps/davis.nix
+++ b/nixos/modules/services/web-apps/davis.nix
@ -315,10 +315,10 @@ in
      services.davis.config =
        {
          APP_ENV = "prod";
-          CACHE_DIR = "${cfg.dataDir}/var/cache";
+          APP_CACHE_DIR = "${cfg.dataDir}/var/cache";
          # note: we do not need the log dir (we log to stdout/journald), by davis/symfony will try to create it, and the default value is one in the nix-store
          #       so we set it to a path under dataDir to avoid something like: Unable to create the "logs" directory (/nix/store/5cfskz0ybbx37s1161gjn5klwb5si1zg-davis-4.4.1/var/log).
-          LOG_DIR = "${cfg.dataDir}/var/log";
+          APP_LOG_DIR = "${cfg.dataDir}/var/log";
          LOG_FILE_PATH = "/dev/stdout";
          DATABASE_DRIVER = db.driver;
          INVITE_FROM_ADDRESS = mail.inviteFromAddress;
@ -340,9 +340,9 @@ in
                else if
                  pgsqlLocal
                # note: davis expects a non-standard postgres uri (due to the underlying doctrine library)
-                # specifically the charset query parameter, and the dummy hostname which is overriden by the host query parameter
+                # specifically the dummy hostname which is overriden by the host query parameter
                then
-                  "postgres://${user}@localhost/${db.name}?host=/run/postgresql&charset=UTF-8"
+                  "postgres://${user}@localhost/${db.name}?host=/run/postgresql"
                else if mysqlLocal then
                  "mysql://${user}@localhost/${db.name}?socket=/run/mysqld/mysqld.sock"
                else
@ -378,8 +378,8 @@ in
        '';
        phpEnv = {
          ENV_DIR = "${cfg.dataDir}";
-          CACHE_DIR = "${cfg.dataDir}/var/cache";
-          #LOG_DIR = "${cfg.dataDir}/var/log";
+          APP_CACHE_DIR = "${cfg.dataDir}/var/cache";
+          APP_LOG_DIR = "${cfg.dataDir}/var/log";
        };
        settings =
          {
@ -447,8 +447,8 @@ in
          RemainAfterExit = true;
          Environment = [
            "ENV_DIR=${cfg.dataDir}"
-            "CACHE_DIR=${cfg.dataDir}/var/cache"
-            "LOG_DIR=${cfg.dataDir}/var/log"
+            "APP_CACHE_DIR=${cfg.dataDir}/var/cache"
+            "APP_LOG_DIR=${cfg.dataDir}/var/log"
          ];
          EnvironmentFile = "${cfg.dataDir}/.env.local";
        };
--- a/nixos/modules/services/web-apps/rss-bridge.nix
+++ b/nixos/modules/services/web-apps/rss-bridge.nix
@ -5,10 +5,23 @@ let

  poolName = "rss-bridge";

-  whitelist = pkgs.writeText "rss-bridge_whitelist.txt"
-    (concatStringsSep "\n" cfg.whitelist);
+  configAttr = lib.recursiveUpdate { FileCache.path = "${cfg.dataDir}/cache/"; } cfg.config;
+  cfgHalf = lib.mapAttrsRecursive (path: value: let
+    envName = lib.toUpper ("RSSBRIDGE_" + lib.concatStringsSep "_" path);
+    envValue = if lib.isList value then
+      lib.concatStringsSep "," value
+    else if lib.isBool value then
+      lib.boolToString value
+    else
+      toString value;
+  in "fastcgi_param \"${envName}\" \"${envValue}\";") configAttr;
+  cfgEnv = lib.concatStringsSep "\n" (lib.collect lib.isString cfgHalf);
 in
 {
+  imports = [
+    (mkRenamedOptionModule [ "services" "rss-bridge" "whitelist" ] [ "services" "rss-bridge" "config" "system" "enabled_bridges" ])
+  ];
+
  options = {
    services.rss-bridge = {
      enable = mkEnableOption (lib.mdDoc "rss-bridge");
@ -56,20 +69,26 @@ in
        '';
      };

-      whitelist = mkOption {
-        type = types.listOf types.str;
-        default = [];
+      config = mkOption {
+        type = with types; attrsOf (attrsOf (oneOf [ bool int str (listOf str) ]));
+        default = {};
+        defaultText = options.literalExpression "FileCache.path = \"\${config.services.rss-bridge.dataDir}/cache/\"";
        example = options.literalExpression ''
-          [
-            "Facebook"
-            "Instagram"
-            "Twitter"
-          ]
+          {
+            system.enabled_bridges = [ "*" ];
+            error = {
+              output = "http";
+              report_limit = 5;
+            };
+            FileCache = {
+              enable_purge = true;
+            };
+          }
        '';
        description = lib.mdDoc ''
-          List of bridges to be whitelisted.
-          If the list is empty, rss-bridge will use whitelist.default.txt.
-          Use `[ "*" ]` to whitelist all.
+          Attribute set of arbitrary config options.
+          Please consult the documentation at the [wiki](https://rss-bridge.github.io/rss-bridge/For_Hosts/Custom_Configuration.html)
+          and [sample config](https://github.com/RSS-Bridge/rss-bridge/blob/master/config.default.ini.php) to see a list of available options.
        '';
      };
    };
@ -93,11 +112,16 @@ in
        };
      };
    };
-    systemd.tmpfiles.rules = [
-      "d '${cfg.dataDir}/cache' 0750 ${cfg.user} ${cfg.group} - -"
-      (mkIf (cfg.whitelist != []) "L+ ${cfg.dataDir}/whitelist.txt - - - - ${whitelist}")
-      "z '${cfg.dataDir}/config.ini.php' 0750 ${cfg.user} ${cfg.group} - -"
-    ];
+    systemd.tmpfiles.settings.rss-bridge = let
+      perm = {
+        mode = "0750";
+        user = cfg.user;
+        group = cfg.group;
+      };
+    in {
+      "${configAttr.FileCache.path}".d = perm;
+      "${cfg.dataDir}/config.ini.php".z = perm;
+    };

    services.nginx = mkIf (cfg.virtualHost != null) {
      enable = true;
@ -116,6 +140,7 @@ in
              fastcgi_pass unix:${config.services.phpfpm.pools.${cfg.pool}.socket};
              fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
              fastcgi_param RSSBRIDGE_DATA ${cfg.dataDir};
+              ${cfgEnv}
            '';
          };
        };
--- a/nixos/modules/virtualisation/lxd.nix
+++ b/nixos/modules/virtualisation/lxd.nix
@ -33,7 +33,7 @@ in {
        '';
      };

-      package = lib.mkPackageOption pkgs "lxd" { };
+      package = lib.mkPackageOption pkgs "lxd-lts" { };

      lxcPackage = lib.mkPackageOption pkgs "lxc" {
        extraDescription = ''
@ -139,7 +139,7 @@ in {
      ui = {
        enable = lib.mkEnableOption (lib.mdDoc "(experimental) LXD UI");

-        package = lib.mkPackageOption pkgs [ "lxd-unwrapped" "ui" ] { };
+        package = lib.mkPackageOption pkgs [ "lxd-ui" ] { };
      };
    };
  };
--- a/nixos/tests/hydra/common.nix
+++ b/nixos/tests/hydra/common.nix
@ -36,13 +36,6 @@
      '';
    };
    services.postfix.enable = true;
-    nix = {
-      distributedBuilds = true;
-      buildMachines = [{
-        hostName = "localhost";
-        systems = [ system ];
-      }];
-      settings.substituters = [];
-    };
+    nix.settings.substituters = [];
  };
 }
--- a/nixos/tests/systemd-machinectl.nix
+++ b/nixos/tests/systemd-machinectl.nix
@ -1,149 +1,177 @@
 import ./make-test-python.nix ({ pkgs, ... }:
-  let
+let

-    container = {
-      # We re-use the NixOS container option ...
-      boot.isContainer = true;
-      # ... and revert unwanted defaults
-      networking.useHostResolvConf = false;
+  container = { config, ... }: {
+    # We re-use the NixOS container option ...
+    boot.isContainer = true;
+    # ... and revert unwanted defaults
+    networking.useHostResolvConf = false;

-      # use networkd to obtain systemd network setup
-      networking.useNetworkd = true;
-      networking.useDHCP = false;
+    # use networkd to obtain systemd network setup
+    networking.useNetworkd = true;
+    networking.useDHCP = false;

-      # systemd-nspawn expects /sbin/init
-      boot.loader.initScript.enable = true;
+    # systemd-nspawn expects /sbin/init
+    boot.loader.initScript.enable = true;

-      imports = [ ../modules/profiles/minimal.nix ];
+    imports = [ ../modules/profiles/minimal.nix ];
+
+    system.stateVersion = config.system.nixos.version;
+  };
+
+  containerSystem = (import ../lib/eval-config.nix {
+    inherit (pkgs) system;
+    modules = [ container ];
+  }).config.system.build.toplevel;
+
+  containerName = "container";
+  containerRoot = "/var/lib/machines/${containerName}";
+
+  containerTarball = pkgs.callPackage ../lib/make-system-tarball.nix {
+    storeContents = [
+      {
+        object = containerSystem;
+        symlink = "/nix/var/nix/profiles/system";
+      }
+    ];
+
+    contents = [
+      {
+        source = containerSystem + "/etc/os-release";
+        target = "/etc/os-release";
+      }
+      {
+        source = containerSystem + "/init";
+        target = "/sbin/init";
+      }
+    ];
+  };
+in
+{
+  name = "systemd-machinectl";
+
+  nodes.machine = { lib, ... }: {
+    # use networkd to obtain systemd network setup
+    networking.useNetworkd = true;
+    networking.useDHCP = false;
+
+    # do not try to access cache.nixos.org
+    nix.settings.substituters = lib.mkForce [ ];
+
+    # auto-start container
+    systemd.targets.machines.wants = [ "systemd-nspawn@${containerName}.service" ];
+
+    virtualisation.additionalPaths = [ containerSystem containerTarball ];
+
+    systemd.tmpfiles.rules = [
+      "d /var/lib/machines/shared-decl 0755 root root - -"
+    ];
+    systemd.nspawn.shared-decl = {
+      execConfig = {
+        Boot = false;
+        Parameters = "${containerSystem}/init";
+      };
+      filesConfig = {
+        BindReadOnly = "/nix/store";
+      };
    };

-    containerSystem = (import ../lib/eval-config.nix {
-      inherit (pkgs) system;
-      modules = [ container ];
-    }).config.system.build.toplevel;
-
-    containerName = "container";
-    containerRoot = "/var/lib/machines/${containerName}";
-
-  in
-  {
-    name = "systemd-machinectl";
-
-    nodes.machine = { lib, ... }: {
-      # use networkd to obtain systemd network setup
-      networking.useNetworkd = true;
-      networking.useDHCP = false;
-
-      # do not try to access cache.nixos.org
-      nix.settings.substituters = lib.mkForce [ ];
-
-      # auto-start container
-      systemd.targets.machines.wants = [ "systemd-nspawn@${containerName}.service" ];
-
-      virtualisation.additionalPaths = [ containerSystem ];
-
-      systemd.tmpfiles.rules = [
-        "d /var/lib/machines/shared-decl 0755 root root - -"
+    systemd.services."systemd-nspawn@${containerName}" = {
+      serviceConfig.Environment = [
+        # Disable tmpfs for /tmp
+        "SYSTEMD_NSPAWN_TMPFS_TMP=0"
      ];
-      systemd.nspawn.shared-decl = {
-        execConfig = {
-          Boot = false;
-          Parameters = "${containerSystem}/init";
-        };
-        filesConfig = {
-          BindReadOnly = "/nix/store";
-        };
-      };
-
-      systemd.services."systemd-nspawn@${containerName}" = {
-        serviceConfig.Environment = [
-          # Disable tmpfs for /tmp
-          "SYSTEMD_NSPAWN_TMPFS_TMP=0"
-        ];
-        overrideStrategy = "asDropin";
-      };
-
-      # open DHCP for container
-      networking.firewall.extraCommands = ''
-        ${pkgs.iptables}/bin/iptables -A nixos-fw -i ve-+ -p udp -m udp --dport 67 -j nixos-fw-accept
-      '';
+      overrideStrategy = "asDropin";
    };

-    testScript = ''
-      start_all()
-      machine.wait_for_unit("default.target");
-
-      # Test machinectl start stop of shared-decl
-      machine.succeed("machinectl start shared-decl");
-      machine.wait_until_succeeds("systemctl -M shared-decl is-active default.target");
-      machine.succeed("machinectl stop shared-decl");
-
-      # create containers root
-      machine.succeed("mkdir -p ${containerRoot}");
-
-      # start container with shared nix store by using same arguments as for systemd-nspawn@.service
-      machine.succeed("systemd-run systemd-nspawn --machine=${containerName} --network-veth -U --bind-ro=/nix/store ${containerSystem}/init")
-      machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
-
-      # Test machinectl stop
-      machine.succeed("machinectl stop ${containerName}");
-
-      # Install container
-      # Workaround for nixos-install
-      machine.succeed("chmod o+rx /var/lib/machines");
-      machine.succeed("nixos-install --root ${containerRoot} --system ${containerSystem} --no-channel-copy --no-root-passwd");
-
-      # Allow systemd-nspawn to apply user namespace on immutable files
-      machine.succeed("chattr -i ${containerRoot}/var/empty");
-
-      # Test machinectl start
-      machine.succeed("machinectl start ${containerName}");
-      machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
-
-      # Test nss_mymachines without nscd
-      machine.succeed('LD_LIBRARY_PATH="/run/current-system/sw/lib" getent -s hosts:mymachines hosts ${containerName}');
-
-      # Test nss_mymachines via nscd
-      machine.succeed("getent hosts ${containerName}");
-
-      # Test systemd-nspawn network configuration to container
-      machine.succeed("networkctl --json=short status ve-${containerName} | ${pkgs.jq}/bin/jq -e '.OperationalState == \"routable\"'");
-
-      # Test systemd-nspawn network configuration to host
-      machine.succeed("machinectl shell ${containerName} /run/current-system/sw/bin/networkctl --json=short status host0 | ${pkgs.jq}/bin/jq -r '.OperationalState == \"routable\"'");
-
-      # Test systemd-nspawn network configuration
-      machine.succeed("ping -n -c 1 ${containerName}");
-
-      # Test systemd-nspawn uses a user namespace
-      machine.succeed("test $(machinectl status ${containerName} | grep 'UID Shift: ' | wc -l) = 1")
-
-      # Test systemd-nspawn reboot
-      machine.succeed("machinectl shell ${containerName} /run/current-system/sw/bin/reboot");
-      machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
-
-      # Test machinectl reboot
-      machine.succeed("machinectl reboot ${containerName}");
-      machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
-
-      # Restart machine
-      machine.shutdown()
-      machine.start()
-      machine.wait_for_unit("default.target");
-
-      # Test auto-start
-      machine.succeed("machinectl show ${containerName}")
-
-      # Test machinectl stop
-      machine.succeed("machinectl stop ${containerName}");
-      machine.wait_until_succeeds("test $(systemctl is-active systemd-nspawn@${containerName}) = inactive");
-
-      # Test tmpfs for /tmp
-      machine.fail("mountpoint /tmp");
-
-      # Show to to delete the container
-      machine.succeed("chattr -i ${containerRoot}/var/empty");
-      machine.succeed("rm -rf ${containerRoot}");
+    # open DHCP for container
+    networking.firewall.extraCommands = ''
+      ${pkgs.iptables}/bin/iptables -A nixos-fw -i ve-+ -p udp -m udp --dport 67 -j nixos-fw-accept
    '';
-  }
-)
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("default.target");
+
+    # Test machinectl start stop of shared-decl
+    machine.succeed("machinectl start shared-decl");
+    machine.wait_until_succeeds("systemctl -M shared-decl is-active default.target");
+    machine.succeed("machinectl stop shared-decl");
+
+    # create containers root
+    machine.succeed("mkdir -p ${containerRoot}");
+
+    # start container with shared nix store by using same arguments as for systemd-nspawn@.service
+    machine.succeed("systemd-run systemd-nspawn --machine=${containerName} --network-veth -U --bind-ro=/nix/store ${containerSystem}/init")
+    machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
+
+    # Test machinectl stop
+    machine.succeed("machinectl stop ${containerName}");
+
+    # Install container
+    # Workaround for nixos-install
+    machine.succeed("chmod o+rx /var/lib/machines");
+    machine.succeed("nixos-install --root ${containerRoot} --system ${containerSystem} --no-channel-copy --no-root-passwd");
+
+    # Allow systemd-nspawn to apply user namespace on immutable files
+    machine.succeed("chattr -i ${containerRoot}/var/empty");
+
+    # Test machinectl start
+    machine.succeed("machinectl start ${containerName}");
+    machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
+
+    # Test nss_mymachines without nscd
+    machine.succeed('LD_LIBRARY_PATH="/run/current-system/sw/lib" getent -s hosts:mymachines hosts ${containerName}');
+
+    # Test nss_mymachines via nscd
+    machine.succeed("getent hosts ${containerName}");
+
+    # Test systemd-nspawn network configuration to container
+    machine.succeed("networkctl --json=short status ve-${containerName} | ${pkgs.jq}/bin/jq -e '.OperationalState == \"routable\"'");
+
+    # Test systemd-nspawn network configuration to host
+    machine.succeed("machinectl shell ${containerName} /run/current-system/sw/bin/networkctl --json=short status host0 | ${pkgs.jq}/bin/jq -r '.OperationalState == \"routable\"'");
+
+    # Test systemd-nspawn network configuration
+    machine.succeed("ping -n -c 1 ${containerName}");
+
+    # Test systemd-nspawn uses a user namespace
+    machine.succeed("test $(machinectl status ${containerName} | grep 'UID Shift: ' | wc -l) = 1")
+
+    # Test systemd-nspawn reboot
+    machine.succeed("machinectl shell ${containerName} /run/current-system/sw/bin/reboot");
+    machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
+
+    # Test machinectl reboot
+    machine.succeed("machinectl reboot ${containerName}");
+    machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
+
+    # Restart machine
+    machine.shutdown()
+    machine.start()
+    machine.wait_for_unit("default.target");
+
+    # Test auto-start
+    machine.succeed("machinectl show ${containerName}")
+
+    # Test machinectl stop
+    machine.succeed("machinectl stop ${containerName}");
+    machine.wait_until_succeeds("test $(systemctl is-active systemd-nspawn@${containerName}) = inactive");
+
+    # Test tmpfs for /tmp
+    machine.fail("mountpoint /tmp");
+
+    # Show to to delete the container
+    machine.succeed("chattr -i ${containerRoot}/var/empty");
+    machine.succeed("rm -rf ${containerRoot}");
+
+    # Test import tarball, start, stop and remove
+    machine.succeed("machinectl import-tar ${containerTarball}/tarball/*.tar* ${containerName}");
+    machine.succeed("machinectl start ${containerName}");
+    machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
+    machine.succeed("machinectl stop ${containerName}");
+    machine.wait_until_succeeds("test $(systemctl is-active systemd-nspawn@${containerName}) = inactive");
+    machine.succeed("machinectl remove ${containerName}");
+  '';
+})
--- a/pkgs/applications/audio/easyeffects/default.nix
+++ b/pkgs/applications/audio/easyeffects/default.nix
@ -41,13 +41,13 @@

 stdenv.mkDerivation rec {
  pname = "easyeffects";
-  version = "7.1.5";
+  version = "7.1.6";

  src = fetchFromGitHub {
    owner = "wwmm";
    repo = "easyeffects";
    rev = "v${version}";
-    hash = "sha256-QoH1dOzBtQHQQKA0+eZFX6yOvjRUmUZVxcdpISIpLLk=";
+    hash = "sha256-NViRZHNgsweoD1YbyWYrRTZPKTCkKk3fGDLLYDD7JfA=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/qpwgraph/default.nix
+++ b/pkgs/applications/audio/qpwgraph/default.nix
@ -13,14 +13,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "qpwgraph";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "rncbc";
    repo = "qpwgraph";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-GlXUQz7tj7dfxVikvu0idzhQaq7raFC9jxJ2zFeHBQU=";
+    sha256 = "sha256-mTWmXHC9KkXgUIO5CIcGOoYYLx+5si/LETSmHFhmrRE=";
  };

  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
--- a/pkgs/applications/blockchains/solana/Cargo.lock
+++ b/pkgs/applications/blockchains/solana/Cargo.lock
--- a/pkgs/applications/blockchains/solana/account-info.patch
+++ b/pkgs/applications/blockchains/solana/account-info.patch
@ -1,12 +0,0 @@
-diff --git a/sdk/program/src/account_info.rs b/sdk/program/src/account_info.rs
-index 372370d0e15a0f2877b02ad29586e5b352438b24..3db3e9839b6535786e60be5602c03d0c909bf937 100644
--- a/sdk/program/src/account_info.rs
-+++ b/sdk/program/src/account_info.rs
-@@ -182,6 +182,7 @@ impl<'a> AccountInfo<'a> {
-         Ok(())
-     }
-
-+    #[rustversion::attr(since(1.72), allow(invalid_reference_casting))]
-     pub fn assign(&self, new_owner: &Pubkey) {
-         // Set the non-mut owner field
-         unsafe {
--- a/pkgs/applications/blockchains/solana/default.nix
+++ b/pkgs/applications/blockchains/solana/default.nix
@ -22,6 +22,7 @@
    "solana-log-analyzer"
    "solana-net-shaper"
    "solana-validator"
+    "solana-test-validator"
 ] ++ [
    # XXX: Ensure `solana-genesis` is built LAST!
    # See https://github.com/solana-labs/solana/issues/5826
@ -29,8 +30,8 @@
  ]
 }:
 let
-  version = "1.16.27";
-  sha256 = "sha256-xd0FCSlpPJDVWOlt9rIlnSbjksmvlXJWHkvlZONd2dM=";
+  version = "1.17.28";
+  sha256 = "y79zsUfYsX377ofsFSg9a2il99uJsA+qdCu3J+EU5nQ=";

  inherit (darwin.apple_sdk_11_0) Libsystem;
  inherit (darwin.apple_sdk_11_0.frameworks) System IOKit AppKit Security;
@ -51,16 +52,10 @@ rustPlatform.buildRustPackage rec {

    outputHashes = {
      "crossbeam-epoch-0.9.5" = "sha256-Jf0RarsgJiXiZ+ddy0vp4jQ59J9m0k3sgXhWhCdhgws=";
-      "ntapi-0.3.7" = "sha256-G6ZCsa3GWiI/FeGKiK9TWkmTxen7nwpXvm5FtjNtjWU=";
+      "tokio-1.29.1" = "sha256-Z/kewMCqkPVTXdoBcSaFKG5GSQAdkdpj3mAzLLCjjGk=";
    };
  };

-  patches = [
-    # Fix: https://github.com/solana-labs/solana/issues/34203
-    # From https://github.com/Homebrew/homebrew-core/pull/156930/files#diff-f27c55b86df31cd4935c956efee1be743eae0958e3850f3f9891d51bfea50b1cR76
-    ./account-info.patch
-  ];
-
  strictDeps = true;
  cargoBuildFlags = builtins.map (n: "--bin=${n}") solanaPkgs;

--- a/pkgs/applications/misc/bambu-studio/default.nix
+++ b/pkgs/applications/misc/bambu-studio/default.nix
@ -166,6 +166,16 @@ stdenv.mkDerivation rec {
    )
  '';

+  # needed to prevent collisions between the LICENSE.txt files of
+  # bambu-studio and orca-slicer.
+  postInstall = ''
+    mkdir -p $out/share/doc
+    mv $out/LICENSE.txt $out/share/doc/LICENSE.txt
+    if [ -f $out/README.md ]; then
+      mv $out/README.md $out/share/doc/README.md
+    fi
+  '';
+
  meta = with lib; {
    description = "PC Software for BambuLab's 3D printers";
    homepage = "https://github.com/bambulab/BambuStudio";
--- a/pkgs/applications/misc/nwg-menu/default.nix
+++ b/pkgs/applications/misc/nwg-menu/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "nwg-menu";
-  version = "0.1.2";
+  version = "0.1.3";

  src = fetchFromGitHub {
    owner = "nwg-piotr";
    repo = "nwg-menu";
    rev = "v${version}";
-    sha256 = "sha256-UFyC0gpKn0Ei5aOPC28iG4YI2BM5lrnl/J7RM4GjInc=";
+    sha256 = "sha256-PMW5QUUZcdWNOMexJVy0hYXx+y2AopT3WL29iWb9MbM=";
  };

-  vendorHash = "sha256-/kqhZcIuoN/XA0i1ua3lzVGn4ghkekFYScL1o3kgBX4=";
+  vendorHash = "sha256-PJvHDmyqE+eIELGRD8QHsZgZ7L0DKc2FYOvfvurzlhs=";

  doCheck = false;

--- a/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-gadget/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubectl-gadget";
-  version = "0.26.0";
+  version = "0.27.0";

  src = fetchFromGitHub {
    owner = "inspektor-gadget";
    repo = "inspektor-gadget";
    rev = "v${version}";
-    hash = "sha256-G2FvKnO+YuLlRlzfB1YMRhCHWa6v4sMFLyDqp12bzn4=";
+    hash = "sha256-u5lzCIbSIOrhI2OE2PprvNZv7KetYGntyADVftSJrkY=";
  };

-  vendorHash = "sha256-IrSx1iCOd95CWyLo6WuEtTFm6p62se/t8dcBmH5eOP4=";
+  vendorHash = "sha256-ZsSzLIVVoKZZEZOIYJTNl0DGere3sKfXsjXbRVmeYC4=";

  CGO_ENABLED = 0;

--- a/pkgs/applications/networking/mullvad-vpn/default.nix
+++ b/pkgs/applications/networking/mullvad-vpn/default.nix
@ -64,7 +64,7 @@ let
    systemd
  ];

-  version = "2023.6";
+  version = "2024.1";

  selectSystem = attrs: attrs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

@ -74,8 +74,8 @@ let
  };

  hash = selectSystem {
-    x86_64-linux = "sha256-IhE93NXX8iwlvso+ei9wbVyJJLtkjrZf8qB43AZre+4=";
-    aarch64-linux = "sha256-HRAGDps0Cf7qOWTS7die9uouxMpAaM83t1Ixz7ElF6g=";
+    x86_64-linux = "sha256-io6ROUHoSBij1ah6yi1Gbni6yWVVoYZKUd7BR+GXKLg=";
+    aarch64-linux = "sha256-bzKTASfqjmjyKZecr8MGaChd6g48aQhfpuc+gUqwoPI=";
  };
 in

--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@ -51,7 +51,7 @@ let
      mainProgram = "mumble-server";
      homepage = "https://mumble.info";
      license = licenses.bsd3;
-      maintainers = with maintainers; [ infinisil felixsinger ];
+      maintainers = with maintainers; [ infinisil felixsinger lilacious ];
      platforms = platforms.linux;
    };
  });
--- a/pkgs/applications/science/electronics/librepcb/default.nix
+++ b/pkgs/applications/science/electronics/librepcb/default.nix
@ -1,22 +1,21 @@
 { stdenv, lib, fetchFromGitHub
-, qtbase, qttools, qtquickcontrols2, opencascade-occt, libGLU, libSM, freeimage, cmake, wrapQtAppsHook
+, qtbase, qttools, qtquickcontrols2, opencascade-occt, libGLU, cmake, wrapQtAppsHook
 }:

 stdenv.mkDerivation rec {
  pname = "librepcb";
-  version = "1.0.0";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner  = pname;
    repo   = pname;
    rev    = version;
-    sha256 = "sha256-2o2Gue/RnDWxe8jk/Ehx9CM+B3ac5rEQn0H7yodUEZ8=";
+    sha256 = "sha256-Vyp7asVqvKFkkEb67LXapMkT1AQSburN3+B2dXIPcEU=";
    fetchSubmodules = true;
  };

  nativeBuildInputs = [ cmake qttools wrapQtAppsHook qtquickcontrols2 opencascade-occt libGLU ];
  buildInputs = [ qtbase ];
-  propagatedBuildInputs = [ libSM freeimage ];

  meta = with lib; {
    description = "A free EDA software to develop printed circuit boards";
--- a/pkgs/applications/window-managers/wayfire/focus-request.nix
+++ b/pkgs/applications/window-managers/wayfire/focus-request.nix
@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "wayfireplugins";
    repo = "focus-request";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-v0kGT+KrtfFJ/hp1Dr8izKVj6UHhuW6udHFjWt1y9TY=";
+    hash = "sha256-kUYvLC28IPrvnMT/wKFRlOVkc2ohF3k0T/Qrm/zVkpE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/da/davis/composer.lock
+++ b/pkgs/by-name/da/davis/composer.lock
--- a/pkgs/by-name/da/davis/davis-data.patch
+++ b/pkgs/by-name/da/davis/davis-data.patch
@ -1,78 +0,0 @@
-diff --git a/bin/console b/bin/console
-index 8fe9d49..3af9662 100755
--- a/bin/console
-+++ b/bin/console
-@@ -1,5 +1,8 @@
- #!/usr/bin/env php
- <?php
-+if (getenv('ENV_DIR') !== false) {
-+    $_SERVER['APP_RUNTIME_OPTIONS']['dotenv_path'] = getenv('ENV_DIR').'/.env';
-+}
- 
- use App\Kernel;
- use Symfony\Bundle\FrameworkBundle\Console\Application;
-@@ -28,7 +31,11 @@ if ($input->hasParameterOption('--no-debug', true)) {
-     putenv('APP_DEBUG='.$_SERVER['APP_DEBUG'] = $_ENV['APP_DEBUG'] = '0');
- }
- 
-(new Dotenv())->bootEnv(dirname(__DIR__).'/.env');
-+if (getenv('ENV_DIR') !== false) {
-+    (new Dotenv())->bootEnv(getenv('ENV_DIR').'/.env');
-+} else {
-+    (new Dotenv())->bootEnv(dirname(__DIR__).'/.env');
-+}
- 
- if ($_SERVER['APP_DEBUG']) {
-     umask(0000);
-diff --git a/public/index.php b/public/index.php
-index 3f8b90e..c57ec21 100644
--- a/public/index.php
-+++ b/public/index.php
-@@ -1,5 +1,9 @@
- <?php
- 
-+if (getenv('ENV_DIR') !== false) {
-+    $_SERVER['APP_RUNTIME_OPTIONS']['dotenv_path'] = getenv('ENV_DIR').'/.env';
-+}
-+
- use App\Kernel;
- use Symfony\Component\Dotenv\Dotenv;
- use Symfony\Component\ErrorHandler\Debug;
-@@ -7,7 +11,11 @@ use Symfony\Component\HttpFoundation\Request;
- 
- require dirname(__DIR__).'/vendor/autoload.php';
- 
-(new Dotenv())->bootEnv(dirname(__DIR__).'/.env');
-+if (getenv('ENV_DIR') !== false) {
-+    (new Dotenv())->bootEnv(getenv('ENV_DIR').'/.env');
-+} else {
-+    (new Dotenv())->bootEnv(dirname(__DIR__).'/.env');
-+}
- 
- if ($_SERVER['APP_DEBUG']) {
-     umask(0000);
-diff --git a/src/Kernel.php b/src/Kernel.php
-index 0f43d2f..8863f2c 100644
--- a/src/Kernel.php
-+++ b/src/Kernel.php
-@@ -49,4 +49,20 @@ class Kernel extends BaseKernel
-             (require $path)($routes->withPath($path), $this);
-         }
-     }
-+
-+    public function getCacheDir(): string
-+    {
-+        if (getenv('CACHE_DIR') !== false) {
-+            return getenv('CACHE_DIR') . '/' . $this->getEnvironment();
-+        }
-+        return parent::getCacheDir();
-+    }
-+
-+    public function getLogDir(): string
-+    {
-+        if (getenv('LOG_DIR') !== false) {
-+            return getenv('LOG_DIR') . '/' . $this->getEnvironment();
-+        }
-+        return parent::getLogDir();
-+    }
- }
--- a/pkgs/by-name/da/davis/package.nix
+++ b/pkgs/by-name/da/davis/package.nix
@ -1,27 +1,21 @@
-{ lib, fetchFromGitHub, php, }:
+{
+  lib,
+  fetchFromGitHub,
+  php,
+}:

 php.buildComposerProject (finalAttrs: {
  pname = "davis";
-  version = "4.4.1";
+  version = "4.4.2";

  src = fetchFromGitHub {
    owner = "tchapi";
    repo = "davis";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-UBekmxKs4dveHh866Ix8UzY2NL6ygb8CKor+V3Cblns=";
+    hash = "sha256-oPzMBCOcAJoHni9SO74RuJDEOcVYc4MtO5rGq1E9g3Q=";
  };

-  composerLock = ./composer.lock;
-  vendorHash = "sha256-WGeNwBRzfUXa7kPIwd7/5dPXDjaBxXirAJcm6lNzueY=";
-
-  patches = [
-    # Symfony loads .env files from the same directory as composer.json
-    # The .env files contain runtime configuration that shouldn't be baked into deriviation for the package
-    # This patch adds a few extension points exposing three environment variables:
-    #    RUNTIME_DIRECTORY (where to load .env from), CACHE_DIRECTORY and LOG_DIRECTORY (symfony cache and log rw directories)
-    # Upstream PR https://github.com/tchapi/davis/issues/154
-    ./davis-data.patch
-  ];
+  vendorHash = "sha256-NOb6rc9jVsf+/RVOW7SLBAJk9SihcRxoepUEGBGLi2w=";

  postInstall = ''
    # Only include the files needed for runtime in the derivation
--- a/pkgs/development/libraries/libmediainfo/default.nix
+++ b/pkgs/development/libraries/libmediainfo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libmediainfo";
-  version = "24.01";
+  version = "24.03";

  src = fetchurl {
    url = "https://mediaarea.net/download/source/libmediainfo/${version}/libmediainfo_${version}.tar.xz";
-    hash = "sha256-oC38Zon0hc7Ab6EqNBTDw6ooU7Td4YrqtLVKVsgxYlk=";
+    hash = "sha256-zCu0TkB8iQq1ZpNMVnY5GFBatYwUE0tT8NHanuokLI0=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/pkgs/by-name/lo/local-ai/package.nix
+++ b/pkgs/by-name/lo/local-ai/package.nix
@ -47,6 +47,17 @@
 , sonic
 , spdlog
 , fmt
+, espeak-ng
+, piper-tts
+
+  # tests
+, fetchzip
+, fetchurl
+, writeText
+, writeTextFile
+, symlinkJoin
+, linkFarmFromDrvs
+, jq
 }:
 let
  BUILD_TYPE =
@ -148,6 +159,55 @@ let
    '';
  };

+  espeak-ng' = espeak-ng.overrideAttrs (self: {
+    name = "espeak-ng'";
+    inherit (go-piper) src;
+    sourceRoot = "source/espeak";
+    patches = [ ];
+    nativeBuildInputs = [ cmake ];
+    cmakeFlags = (self.cmakeFlags or [ ]) ++ [
+      # -DCMAKE_C_FLAGS="-D_FILE_OFFSET_BITS=64"
+      (lib.cmakeBool "BUILD_SHARED_LIBS" true)
+      (lib.cmakeBool "USE_ASYNC" false)
+      (lib.cmakeBool "USE_MBROLA" false)
+      (lib.cmakeBool "USE_LIBPCAUDIO" false)
+      (lib.cmakeBool "USE_KLATT" false)
+      (lib.cmakeBool "USE_SPEECHPLAYER" false)
+      (lib.cmakeBool "USE_LIBSONIC" false)
+      (lib.cmakeBool "CMAKE_POSITION_INDEPENDENT_CODE" true)
+    ];
+    preConfigure = null;
+    postInstall = null;
+  });
+
+  piper-phonemize = stdenv.mkDerivation {
+    name = "piper-phonemize";
+    inherit (go-piper) src;
+    sourceRoot = "source/piper-phonemize";
+    buildInputs = [ espeak-ng' onnxruntime ];
+    nativeBuildInputs = [ cmake pkg-config ];
+    cmakeFlags = [
+      (lib.cmakeFeature "ONNXRUNTIME_DIR" "${onnxruntime.dev}")
+      (lib.cmakeFeature "ESPEAK_NG_DIR" "${espeak-ng'}")
+    ];
+    passthru.espeak-ng = espeak-ng';
+  };
+
+  piper-tts' = (piper-tts.override { inherit piper-phonemize; }).overrideAttrs (self: {
+    name = "piper-tts'";
+    inherit (go-piper) src;
+    sourceRoot = "source/piper";
+    installPhase = null;
+    postInstall = ''
+      cp CMakeFiles/piper.dir/src/cpp/piper.cpp.o $out/piper.o
+      cd $out
+      mkdir bin lib
+      mv lib*so* lib/
+      mv piper piper_phonemize bin/
+      rm -rf cmake pkgconfig espeak-ng-data *.ort
+    '';
+  });
+
  go-piper = stdenv.mkDerivation {
    name = "go-piper";
    src = fetchFromGitHub {
@ -157,25 +217,20 @@ let
      hash = "sha256-Yv9LQkWwGpYdOS0FvtP0vZ0tRyBAx27sdmziBR4U4n8=";
      fetchSubmodules = true;
    };
-    patchPhase = ''
+    postUnpack = ''
+      cp -r --no-preserve=mode ${piper-tts'}/* source
+    '';
+    postPatch = ''
      sed -i Makefile \
-        -e '/cd piper-phonemize/ s;cmake;cmake -DONNXRUNTIME_DIR=${onnxruntime.dev};' \
-        -e '/CXXFLAGS *= / s;$; -DSPDLOG_FMT_EXTERNAL=1;' \
-        -e '/cd piper\/build / s;cmake;cmake -DSPDLOG_DIR=${spdlog.src} -DFMT_DIR=${fmt};'
+        -e '/CXXFLAGS *= / s;$; -DSPDLOG_FMT_EXTERNAL=1;'
    '';
    buildFlags = [ "libpiper_binding.a" ];
-    dontUseCmakeConfigure = true;
-    nativeBuildInputs = [ cmake ];
-    buildInputs = [ sonic spdlog onnxruntime ];
+    buildInputs = [ piper-tts' espeak-ng' piper-phonemize sonic fmt spdlog onnxruntime ];
    installPhase = ''
      cp -r --no-preserve=mode $src $out
-      tar cf - *.a \
-        espeak/ei/lib \
-        piper/src/cpp \
-        piper-phonemize/pi/lib \
-        piper-phonemize/pi/include \
-        piper-phonemize/pi/share \
-        | tar xf - -C $out
+      mkdir -p $out/piper-phonemize/pi
+      cp -r --no-preserve=mode ${piper-phonemize}/share $out/piper-phonemize/pi
+      cp *.a $out
    '';
  };

@ -418,6 +473,8 @@ let
      --prefix LD_LIBRARY_PATH : "${clblast}/lib:${ocl-icd}/lib" \
    '' + lib.optionalString with_openblas ''
      --prefix LD_LIBRARY_PATH : "${openblas}/lib" \
+    '' + lib.optionalString with_tts ''
+      --prefix LD_LIBRARY_PATH : "${piper-phonemize}/lib" \
    '' + ''
      --prefix PATH : "${ffmpeg}/bin"
    '';
@ -425,7 +482,8 @@ let
    passthru.local-packages = {
      inherit
        go-tiny-dream go-rwkv go-bert go-llama-ggml gpt4all go-piper
-        llama-cpp-grpc whisper-cpp go-tiny-dream-ncnn;
+        llama-cpp-grpc whisper-cpp go-tiny-dream-ncnn espeak-ng' piper-phonemize
+        piper-tts';
    };

    passthru.features = {
@ -448,7 +506,7 @@ let
          nodes.machine = {
            systemd.services.local-ai = {
              wantedBy = [ "multi-user.target" ];
-              serviceConfig.ExecStart = "${self}/bin/local-ai --localai-config-dir . --address :${port}";
+              serviceConfig.ExecStart = "${self}/bin/local-ai --debug --localai-config-dir . --address :${port}";
            };
          };
          testScript = ''
@ -456,6 +514,61 @@ let
            machine.succeed("curl -f http://localhost:${port}/readyz")
          '';
        };
+    }
+    // lib.optionalAttrs with_tts {
+      # https://localai.io/features/text-to-audio/#piper
+      tts =
+        let
+          port = "8080";
+          voice-en-us = fetchzip {
+            url = "https://github.com/rhasspy/piper/releases/download/v0.0.2/voice-en-us-danny-low.tar.gz";
+            hash = "sha256-5wf+6H5HeQY0qgdqnAG1vSqtjIFM9lXH53OgouuPm0M=";
+            stripRoot = false;
+          };
+          ggml-tiny-en = fetchurl {
+            url = "https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-tiny.en-q5_1.bin";
+            hash = "sha256-x3xXZvHO8JtrfUfyG1Rsvd1BV4hrO11tT3CekeZsfCs=";
+          };
+          whisper-en = {
+            name = "whisper-en";
+            backend = "whisper";
+            parameters.model = ggml-tiny-en.name;
+          };
+          models = symlinkJoin {
+            name = "models";
+            paths = [
+              voice-en-us
+              (linkFarmFromDrvs "whisper-en" [
+                (writeText "whisper-en.yaml" (builtins.toJSON whisper-en))
+                ggml-tiny-en
+              ])
+            ];
+          };
+        in
+        testers.runNixOSTest {
+          name = pname + "-tts";
+          nodes.machine = {
+            systemd.services.local-ai = {
+              wantedBy = [ "multi-user.target" ];
+              serviceConfig.ExecStart = "${self}/bin/local-ai --debug --models-path ${models} --localai-config-dir . --address :${port}";
+            };
+          };
+          testScript =
+            let
+              request = {
+                model = "en-us-danny-low.onnx";
+                backend = "piper";
+                input = "Hello, how are you?";
+              };
+            in
+            ''
+              machine.wait_for_open_port(${port})
+              machine.succeed("curl -f http://localhost:${port}/readyz")
+              machine.succeed("curl -f http://localhost:${port}/tts --json @${writeText "request.json" (builtins.toJSON request)} --output out.wav")
+              machine.succeed("curl -f http://localhost:${port}/v1/audio/transcriptions --header 'Content-Type: multipart/form-data' --form file=@out.wav --form model=${whisper-en.name} --output transcription.json")
+              machine.succeed("${jq}/bin/jq --exit-status 'debug | .segments | first.text == \"${request.input}\"' transcription.json")
+            '';
+        };
    };

    meta = with lib; {
--- a/pkgs/by-name/lx/lxd-lts/package.nix
+++ b/pkgs/by-name/lx/lxd-lts/package.nix
@ -0,0 +1,148 @@
+{
+  lib,
+  lxd-unwrapped-lts,
+  linkFarm,
+  makeWrapper,
+  stdenv,
+  symlinkJoin,
+  writeShellScriptBin,
+  acl,
+  apparmor-parser,
+  apparmor-profiles,
+  attr,
+  bash,
+  btrfs-progs,
+  cdrkit,
+  criu,
+  dnsmasq,
+  e2fsprogs,
+  getent,
+  gnutar,
+  gptfdisk,
+  gzip,
+  iproute2,
+  iptables,
+  kmod,
+  lvm2,
+  minio,
+  nftables,
+  OVMF,
+  qemu_kvm,
+  qemu-utils,
+  rsync,
+  spice-gtk,
+  squashfsTools,
+  thin-provisioning-tools,
+  util-linux,
+  virtiofsd,
+  xz,
+}:
+let
+  binPath = lib.makeBinPath [
+    acl
+    attr
+    bash
+    btrfs-progs
+    cdrkit
+    criu
+    dnsmasq
+    e2fsprogs
+    getent
+    gnutar
+    gptfdisk
+    gzip
+    iproute2
+    iptables
+    kmod
+    lvm2
+    minio
+    nftables
+    qemu_kvm
+    qemu-utils
+    rsync
+    squashfsTools
+    thin-provisioning-tools
+    util-linux
+    virtiofsd
+    xz
+
+    (writeShellScriptBin "apparmor_parser" ''
+      exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
+    '')
+  ];
+
+  clientBinPath = [ spice-gtk ];
+
+  ovmf-2mb = OVMF.override {
+    secureBoot = true;
+    fdSize2MB = true;
+  };
+
+  ovmf-4mb = OVMF.override {
+    secureBoot = true;
+    fdSize4MB = true;
+  };
+
+  ovmf-prefix = if stdenv.hostPlatform.isAarch64 then "AAVMF" else "OVMF";
+
+  # mimic ovmf from https://github.com/canonical/lxd-pkg-snap/blob/3abebe1dfeb20f9b7729556960c7e9fe6ad5e17c/snapcraft.yaml#L378
+  # also found in /snap/lxd/current/share/qemu/ on a snap install
+  ovmf = linkFarm "lxd-ovmf" [
+    {
+      name = "OVMF_CODE.2MB.fd";
+      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd";
+    }
+    {
+      name = "OVMF_CODE.4MB.fd";
+      path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_CODE.fd";
+    }
+    {
+      name = "OVMF_CODE.fd";
+      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd";
+    }
+
+    {
+      name = "OVMF_VARS.2MB.fd";
+      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.2MB.ms.fd";
+      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.4MB.fd";
+      path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.4MB.ms.fd";
+      path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.fd";
+      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.ms.fd";
+      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+  ];
+in
+symlinkJoin {
+  name = "lxd-${lxd-unwrapped-lts.version}";
+
+  paths = [ lxd-unwrapped-lts ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postBuild = ''
+    wrapProgram $out/bin/lxd --prefix PATH : ${lib.escapeShellArg binPath}:${qemu_kvm}/libexec:$out/bin --set LXD_OVMF_PATH ${ovmf}
+
+    wrapProgram $out/bin/lxc --prefix PATH : ${lib.makeBinPath clientBinPath}
+  '';
+
+  passthru = {
+    inherit (lxd-unwrapped-lts) tests ui;
+  };
+
+  inherit (lxd-unwrapped-lts) meta pname version;
+}
--- a/pkgs/by-name/lx/lxd-ui/package.nix
+++ b/pkgs/by-name/lx/lxd-ui/package.nix
@ -1,11 +1,12 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchYarnDeps
-, nodejs
-, prefetch-yarn-deps
-, yarn
-, nixosTests
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  nodejs,
+  prefetch-yarn-deps,
+  yarn,
+  nixosTests,
 }:

 stdenv.mkDerivation rec {
--- a/pkgs/by-name/lx/lxd-unwrapped-lts/package.nix
+++ b/pkgs/by-name/lx/lxd-unwrapped-lts/package.nix
@ -1,23 +1,25 @@
-{ lib
-, hwdata
-, pkg-config
-, lxc
-, buildGoModule
-, fetchurl
-, acl
-, libcap
-, dqlite
-, raft-canonical
-, sqlite
-, udev
-, installShellFiles
-, nixosTests
-, gitUpdater
-, callPackage
+{
+  lib,
+  hwdata,
+  pkg-config,
+  lxc,
+  buildGo122Module,
+  fetchurl,
+  acl,
+  libcap,
+  dqlite,
+  raft-canonical,
+  sqlite,
+  udev,
+  installShellFiles,
+  nixosTests,
+  gitUpdater,
+  callPackage,
 }:

-buildGoModule rec {
-  pname = "lxd-unwrapped";
+buildGo122Module rec {
+  pname = "lxd-unwrapped-lts";
+  # major/minor are used in updateScript to pin to LTS
  version = "5.21.0";

  src = fetchurl {
@ -32,9 +34,17 @@ buildGoModule rec {
      --replace "/usr/share/misc/usb.ids" "${hwdata}/share/hwdata/usb.ids"
  '';

-  excludedPackages = [ "test" "lxd/db/generate" "lxd-agent" "lxd-migrate" ];
+  excludedPackages = [
+    "test"
+    "lxd/db/generate"
+    "lxd-agent"
+    "lxd-migrate"
+  ];

-  nativeBuildInputs = [ installShellFiles pkg-config ];
+  nativeBuildInputs = [
+    installShellFiles
+    pkg-config
+  ];
  buildInputs = [
    lxc
    acl
@ -45,7 +55,10 @@ buildGoModule rec {
    udev.dev
  ];

-  ldflags = [ "-s" "-w" ];
+  ldflags = [
+    "-s"
+    "-w"
+  ];
  tags = [ "libsqlite3" ];

  preBuild = ''
@ -59,13 +72,15 @@ buildGoModule rec {
  '';

  preCheck =
-    let skippedTests = [
-      "TestValidateConfig"
-      "TestConvertNetworkConfig"
-      "TestConvertStorageConfig"
-      "TestSnapshotCommon"
-      "TestContainerTestSuite"
-    ]; in
+    let
+      skippedTests = [
+        "TestValidateConfig"
+        "TestConvertNetworkConfig"
+        "TestConvertStorageConfig"
+        "TestSnapshotCommon"
+        "TestContainerTestSuite"
+      ];
+    in
    ''
      # Disable tests requiring local operations
      buildFlagsArray+=("-run" "[^(${builtins.concatStringsSep "|" skippedTests})]")
@ -77,17 +92,19 @@ buildGoModule rec {

  passthru.tests.lxd = nixosTests.lxd;
  passthru.tests.lxd-to-incus = nixosTests.incus.lxd-to-incus;
-  passthru.ui = callPackage ./ui.nix { };
  passthru.updateScript = gitUpdater {
    url = "https://github.com/canonical/lxd.git";
-    rev-prefix = "lxd-";
+    rev-prefix = "lxd-5.21";
  };

  meta = with lib; {
    description = "Daemon based on liblxc offering a REST API to manage containers";
    homepage = "https://ubuntu.com/lxd";
    changelog = "https://github.com/canonical/lxd/releases/tag/lxd-${version}";
-    license = with licenses; [ asl20 agpl3Plus ];
+    license = with licenses; [
+      asl20
+      agpl3Plus
+    ];
    maintainers = teams.lxc.members;
    platforms = platforms.linux;
  };
--- a/pkgs/by-name/ma/malwoverview/package.nix
+++ b/pkgs/by-name/ma/malwoverview/package.nix
@ -0,0 +1,57 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "malwoverview";
+  version = "5.4.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "alexandreborges";
+    repo = "malwoverview";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-WAlVEEukPOynCGpRdQu3wP+JZ1UKuSR6pH5ek81L73E=";
+  };
+
+  pythonRemoveDeps = [
+    "pathlib"
+  ];
+
+  nativeBuildInputs = with python3.pkgs; [
+    pythonRelaxDepsHook
+  ];
+
+  build-system  = with python3.pkgs; [
+    setuptools
+  ];
+
+  dependencies = with python3.pkgs; [
+    colorama
+    configparser
+    geocoder
+    pefile
+    polyswarm-api
+    python-magic
+    requests
+    simplejson
+    validators
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "malwoverview"
+  ];
+
+  meta = with lib; {
+    description = "Tool for threat hunting and gathering intel information from various sources";
+    homepage = "https://github.com/alexandreborges/malwoverview";
+    changelog = "https://github.com/alexandreborges/malwoverview/releases/tag/v${version}";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "malwoverview.py";
+  };
+}
--- a/pkgs/applications/misc/mediainfo-gui/default.nix
+++ b/pkgs/applications/misc/mediainfo-gui/default.nix
@ -6,11 +6,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mediainfo-gui";
-  version = "24.01.1";
+  version = "24.03";

  src = fetchurl {
    url = "https://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    hash = "sha256-MupkbVyGxj1UQY0QsnNiYKtD5Lcn+B6N1ez16bXj/TQ=";
+    hash = "sha256-b/jx+i+FmhMJH3Wiz5E0hmRPbiWa0cJa+5qT5IRExWM=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/pkgs/applications/misc/mediainfo/default.nix
+++ b/pkgs/applications/misc/mediainfo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mediainfo";
-  version = "24.01.1";
+  version = "24.03";

  src = fetchurl {
    url = "https://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    hash = "sha256-MupkbVyGxj1UQY0QsnNiYKtD5Lcn+B6N1ez16bXj/TQ=";
+    hash = "sha256-b/jx+i+FmhMJH3Wiz5E0hmRPbiWa0cJa+5qT5IRExWM=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/pkgs/development/tools/phpactor/default.nix
+++ b/pkgs/development/tools/phpactor/default.nix
@ -30,6 +30,6 @@ php.buildComposerProject (finalAttrs: {
    homepage = "https://github.com/phpactor/phpactor";
    license = lib.licenses.mit;
    mainProgram = "phpactor";
-    maintainers = [ lib.maintainers.ryantm ] ++ lib.teams.php.members;
+    maintainers = [ lib.maintainers.patka ] ++ lib.teams.php.members;
  };
 })
--- a/pkgs/by-name/pl/plemoljp-hs/package.nix
+++ b/pkgs/by-name/pl/plemoljp-hs/package.nix
@ -0,0 +1,30 @@
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "plemoljp-hs";
+  version = "1.7.1";
+
+  src = fetchzip {
+    url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_HS_v${version}.zip";
+    hash = "sha256-JbuKBU1TT0qE89N61jX+WF25PBRHo/RSAtdPa5Ni8og=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 PlemolJP_HS/*.ttf -t $out/share/fonts/truetype/${pname}
+    install -Dm444 PlemolJP35_HS/*.ttf -t $out/share/fonts/truetype/${pname}-35
+    install -Dm444 PlemolJPConsole_HS/*.ttf -t $out/share/fonts/truetype/${pname}-console
+    install -Dm444 PlemolJP35Console_HS/*.ttf -t $out/share/fonts/truetype/${pname}-35console
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A composite font of IBM Plex Mono, IBM Plex Sans JP and hidden full-width space";
+    homepage = "https://github.com/yuru7/PlemolJP";
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ kachick ];
+  };
+}
--- a/pkgs/by-name/pl/plemoljp-nf/package.nix
+++ b/pkgs/by-name/pl/plemoljp-nf/package.nix
@ -0,0 +1,28 @@
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "plemoljp-nf";
+  version = "1.7.1";
+
+  src = fetchzip {
+    url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_NF_v${version}.zip";
+    hash = "sha256-nxGvaHLs65z4CSy/smy+koQyuYcDXJKjPZt5NusUN3E=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 PlemolJPConsole_NF/*.ttf -t $out/share/fonts/truetype/${pname}-console
+    install -Dm444 PlemolJP35Console_NF/*.ttf -t $out/share/fonts/truetype/${pname}-35console
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A composite font of IBM Plex Mono, IBM Plex Sans JP and nerd-fonts";
+    homepage = "https://github.com/yuru7/PlemolJP";
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ kachick ];
+  };
+}
--- a/pkgs/by-name/pl/plemoljp/package.nix
+++ b/pkgs/by-name/pl/plemoljp/package.nix
@ -0,0 +1,30 @@
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "plemoljp";
+  version = "1.7.1";
+
+  src = fetchzip {
+    url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_v${version}.zip";
+    hash = "sha256-YH1c/2jk8QZNyPvzRZjxNHyNeci9tjn+oOW8xLd8kjk=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 PlemolJP/*.ttf -t $out/share/fonts/truetype/${pname}
+    install -Dm444 PlemolJP35/*.ttf -t $out/share/fonts/truetype/${pname}-35
+    install -Dm444 PlemolJPConsole/*.ttf -t $out/share/fonts/truetype/${pname}-console
+    install -Dm444 PlemolJP35Console/*.ttf -t $out/share/fonts/truetype/${pname}-35console
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A composite font of IBM Plex Mono and IBM Plex Sans JP";
+    homepage = "https://github.com/yuru7/PlemolJP";
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ kachick ];
+  };
+}
--- a/pkgs/by-name/pr/prowler/package.nix
+++ b/pkgs/by-name/pr/prowler/package.nix
@ -1,39 +1,49 @@
-{ lib
-, python3
-, fetchFromGitHub
+{
+  lib,
+  python3,
+  fetchFromGitHub,
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "prowler";
-  version = "3.12.1";
+  version = "3.13.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "prowler-cloud";
    repo = "prowler";
    rev = "refs/tags/${version}";
-    hash = "sha256-QauDqeCa499AcZurGjn2Yv4GH04F/pahAH2ms7gAca4=";
+    hash = "sha256-19B6b+xR+f7dIu/6eINsxs7UxuV96QdsNncodC8/N3Q=";
  };

  pythonRelaxDeps = [
    "azure-mgmt-security"
+    "azure-storage-blob"
    "boto3"
    "botocore"
    "google-api-python-client"
+    "jsonschema"
+    "pydantic"
    "slack-sdk"
    "pydantic"
  ];

  nativeBuildInputs = with python3.pkgs; [
-    poetry-core
    pythonRelaxDepsHook
  ];

-  propagatedBuildInputs = with python3.pkgs; [
+  build-system = with python3.pkgs; [
+    poetry-core
+  ];
+
+  dependencies = with python3.pkgs; [
    alive-progress
    awsipranges
    azure-identity
+    azure-mgmt-applicationinsights
    azure-mgmt-authorization
+    azure-mgmt-cosmosdb
+    azure-mgmt-rdbms
    azure-mgmt-security
    azure-mgmt-sql
    azure-mgmt-storage
@ -46,7 +56,7 @@ python3.pkgs.buildPythonApplication rec {
    google-api-python-client
    google-auth-httplib2
    jsonschema
-    msgraph-core
+    msgraph-sdk
    msrestazure
    pydantic_1
    schema
@ -55,9 +65,7 @@ python3.pkgs.buildPythonApplication rec {
    tabulate
  ];

-  pythonImportsCheck = [
-    "prowler"
-  ];
+  pythonImportsCheck = [ "prowler" ];

  meta = with lib; {
    description = "Security tool for AWS, Azure and GCP to perform Cloud Security best practices assessments";
--- a/pkgs/tools/admin/simplotask/default.nix
+++ b/pkgs/tools/admin/simplotask/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "simplotask";
-  version = "1.13.1";
+  version = "1.14.1";

  src = fetchFromGitHub {
    owner = "umputun";
    repo = "spot";
    rev = "v${version}";
-    hash = "sha256-Sg84Q5I82W2fz/CHh9ov0QPCzAoyqkNrATWNFnMrnEw=";
+    hash = "sha256-xflMbumhHBH2K7NP+K89jLwM3Ftr/53h0ZuGqzLAmVo=";
  };

  vendorHash = null;
--- a/pkgs/by-name/wi/witnessme/package.nix
+++ b/pkgs/by-name/wi/witnessme/package.nix
@ -0,0 +1,83 @@
+{ lib
+, fetchFromGitHub
+, fetchpatch
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "witnessme";
+  version = "0-unstable-2023-12-06";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "byt3bl33d3r";
+    repo = "WitnessMe";
+    # https://github.com/byt3bl33d3r/WitnessMe/issues/47
+    rev = "16d4a377eba653315e827b0af686b948681be301";
+    hash = "sha256-CMbeGLwXqpeB31x1j8qU8Bbi3EHEmLokDtqbQER1gEA=";
+  };
+
+  patches = [
+    # Switch to poetry-core, https://github.com/byt3bl33d3r/WitnessMe/pull/48
+    (fetchpatch {
+      name = "switch-poetry-core.patch";
+      url = "https://github.com/byt3bl33d3r/WitnessMe/commit/147ce9fc7c9ac84712aa1ba2f7073bc2f29c8afe.patch";
+      hash = "sha256-ZcIt/ueLgVlZePgxYljRFtvF5t2zlB80HsNyjheCnxI=";
+    })
+  ];
+
+  pythonRelaxDeps = true;
+
+  nativeBuildInputs = with python3.pkgs; [
+    pythonRelaxDepsHook
+  ];
+
+  build-system = with python3.pkgs; [
+    poetry-core
+  ];
+
+  dependencies = with python3.pkgs; [
+    aiodns
+    aiofiles
+    aiosqlite
+    fastapi
+    imgcat
+    jinja2
+    lxml
+    prompt-toolkit
+    pydantic
+    pyppeteer
+    python-multipart
+    pyyaml
+    terminaltables
+    uvicorn
+    xmltodict
+  ];
+
+  nativeCheckInputs = with python3.pkgs; [
+    httpx
+    pytest-asyncio
+    pytestCheckHook
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "witnessme"
+  ];
+
+  disabledTestPaths = [
+    # Tests require network access
+    "tests/test_api.py"
+    "tests/test_grab.py"
+    "tests/test_scan.py"
+    "tests/test_target_parsing.py"
+  ];
+
+  meta = with lib; {
+    description = "Web Inventory tool";
+    homepage = "https://github.com/byt3bl33d3r/WitnessMe";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "witnessme";
+  };
+}
--- a/pkgs/development/tools/misc/ycmd/default.nix
+++ b/pkgs/development/tools/misc/ycmd/default.nix
@ -1,9 +1,20 @@
-{ stdenv, lib, fetchFromGitHub, cmake, ninja, python
-, withGodef ? true, godef
-, withGotools? true, gotools
-, withTypescript ? true, typescript
-, abseil-cpp, boost, llvmPackages
-, fixDarwinDylibNames, Cocoa
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, ninja
+, python
+, withGodef ? true
+, godef
+, withGotools ? true
+, gotools
+, withTypescript ? true
+, typescript
+, abseil-cpp
+, boost
+, llvmPackages
+, fixDarwinDylibNames
+, Cocoa
 }:

 stdenv.mkDerivation {
@ -23,7 +34,7 @@ stdenv.mkDerivation {
  nativeBuildInputs = [ cmake ninja ]
    ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
  buildInputs = with python.pkgs; with llvmPackages; [ abseil-cpp boost libllvm.all libclang.all ]
-    ++  [ jedi jedi-language-server pybind11 ]
+    ++ [ jedi jedi-language-server pybind11 ]
    ++ lib.optional stdenv.isDarwin Cocoa;

  buildPhase = ''
@ -45,6 +56,7 @@ stdenv.mkDerivation {
  # symlink completion backends where ycmd expects them
  installPhase = ''
    rm -rf ycmd/tests
+    find third_party -type d -name "test" -exec rm -rf {} +

    chmod +x ycmd/__main__.py
    sed -i "1i #!${python.interpreter}\
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;

 buildNpmPackage rec {
  pname = "Iosevka${toString set}";
-  version = "29.0.4";
+  version = "29.0.5";

  src = fetchFromGitHub {
    owner = "be5invis";
    repo = "iosevka";
    rev = "v${version}";
-    hash = "sha256-dkFvgiGCHvBp7gBNAG08cfpTc0c7b2oU56xfxjPHhm8=";
+    hash = "sha256-Ir/HS9MFqOO7CDDLnqFX+6vCg06U5cYAcNKFyh5Ioc8=";
  };

-  npmDepsHash = "sha256-IvMO0LZy/vlNxsp2D5pK97l6OIltrjv8iZ2CGl2XhFM=";
+  npmDepsHash = "sha256-tzrMAZv1ATYwPVBUiDm4GPVj+TVAA3hMdc3MrdblOIw=";

  nativeBuildInputs = [
    remarshal
--- a/pkgs/development/libraries/dqlite/default.nix
+++ b/pkgs/development/libraries/dqlite/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, file, libuv
-, raft-canonical, sqlite, lxd }:
+, raft-canonical, sqlite, lxd-lts }:

 stdenv.mkDerivation rec {
  pname = "dqlite";
@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
  outputs = [ "dev" "out" ];

  passthru.tests = {
-    inherit lxd;
+    inherit lxd-lts;
  };

  meta = with lib; {
--- a/pkgs/development/libraries/raft-canonical/default.nix
+++ b/pkgs/development/libraries/raft-canonical/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, file, libuv, lz4, lxd }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, file, libuv, lz4, lxd-lts }:

 stdenv.mkDerivation rec {
  pname = "raft-canonical";
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
  outputs = [ "dev" "out" ];

  passthru.tests = {
-    inherit lxd;
+    inherit lxd-lts;
  };

  meta = with lib; {
--- a/pkgs/development/python-modules/aiomisc/default.nix
+++ b/pkgs/development/python-modules/aiomisc/default.nix
@ -1,80 +1,66 @@
-{ lib
-, aiocontextvars
-  #, aiocarbon
-, aiohttp
-  #, aiohttp-asgi
-, async-timeout
-, buildPythonPackage
-, colorlog
-, croniter
-, fastapi
-, fetchPypi
-, logging-journald
-, poetry-core
-, pytestCheckHook
-, pythonOlder
-, raven
-  #, raven-aiohttp
-, setproctitle
-, setuptools
-, uvloop
+{
+  lib,
+  stdenv,
+  aiocontextvars,
+  aiohttp,
+  async-timeout,
+  buildPythonPackage,
+  colorlog,
+  croniter,
+  fastapi,
+  fetchPypi,
+  logging-journald,
+  poetry-core,
+  pytestCheckHook,
+  pythonOlder,
+  raven,
+  rich,
+  setproctitle,
+  typing-extensions,
+  uvloop,
 }:

 buildPythonPackage rec {
  pname = "aiomisc";
-  version = "17.5.2";
+  version = "17.5.4";
  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-bpR9HsR/7qVaDcTsHXJypGDyS7/BE/CzFk6eNaQ/C8k=";
+    hash = "sha256-/2WEaM9ZM9dbMA73XADOE2u5r3SfMAyjH8isOsXaJhE=";
  };

-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];

-  propagatedBuildInputs = [
-    colorlog
-    logging-journald
-    setuptools
-  ];
+  dependencies =
+    [ colorlog ]
+    ++ lib.optionals (pythonOlder "3.11") [ typing-extensions ]
+    ++ lib.optionals stdenv.isLinux [ logging-journald ];

  nativeCheckInputs = [
    aiocontextvars
    async-timeout
    fastapi
    pytestCheckHook
-    raven
    setproctitle
-  ]  ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);

  passthru.optional-dependencies = {
-    aiohttp = [
+    aiohttp = [ aiohttp ];
+    #asgi = [ aiohttp-asgi ];
+    cron = [ croniter ];
+    #carbon = [ aiocarbon ];
+    raven = [
      aiohttp
+      raven
    ];
-    #asgi = [
-    #  aiohttp-asgi
-    #];
-    cron = [
-      croniter
-    ];
-    #carbon = [
-    #  aiocarbon
-    #];
-    #raven = [
-    #  raven-aiohttp
-    #];
-    uvloop = [
-      uvloop
-    ];
+    rich = [ rich ];
+    uvloop = [ uvloop ];
  };

-  pythonImportsCheck = [
-    "aiomisc"
-  ];
+  pythonImportsCheck = [ "aiomisc" ];

  # Upstream stopped tagging with 16.2
  doCheck = false;
--- a/pkgs/development/python-modules/ansible/core.nix
+++ b/pkgs/development/python-modules/ansible/core.nix
@ -29,11 +29,11 @@

 buildPythonPackage rec {
  pname = "ansible-core";
-  version = "2.16.4";
+  version = "2.16.5";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-LNIIsJFZSMiL/60zHl0HCXtu3KGHLLUzdeUbZxnmoGA=";
+    hash = "sha256-zdKbDsPyDDVlc1Wi9qnB0M8RMdqZzJpKNAGAGwqzbW0=";
  };

  # ansible_connection is already wrapped, so don't pass it through
--- a/pkgs/development/python-modules/dploot/default.nix
+++ b/pkgs/development/python-modules/dploot/default.nix
@ -1,25 +1,26 @@
-{ lib
-, buildPythonPackage
-, cryptography
-, fetchPypi
-, impacket
-, lxml
-, poetry-core
-, pyasn1
-, pythonOlder
-, pythonRelaxDepsHook
+{
+  lib,
+  buildPythonPackage,
+  cryptography,
+  fetchPypi,
+  impacket,
+  lxml,
+  poetry-core,
+  pyasn1,
+  pythonOlder,
+  pythonRelaxDepsHook,
 }:

 buildPythonPackage rec {
  pname = "dploot";
-  version = "2.7.0";
+  version = "2.7.1";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-76+cTukQOXE8tjaBrWVJY56+zVO5yqB5BT9q7+TBpnA=";
+    hash = "sha256-vNL5xrZkfYO11i8ERqD9637vrMb3Gkmo3RjvQ1ONXbY=";
  };

  pythonRelaxDeps = [
@ -28,13 +29,9 @@ buildPythonPackage rec {
    "pyasn1"
  ];

-  nativeBuildInputs = [
-    pythonRelaxDepsHook
-  ];
+  nativeBuildInputs = [ pythonRelaxDepsHook ];

-  build-system = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];

  dependencies = [
    impacket
@ -43,9 +40,7 @@ buildPythonPackage rec {
    lxml
  ];

-  pythonImportsCheck = [
-    "dploot"
-  ];
+  pythonImportsCheck = [ "dploot" ];

  # No tests
  doCheck = false;
--- a/pkgs/development/python-modules/geocoder/default.nix
+++ b/pkgs/development/python-modules/geocoder/default.nix
@ -0,0 +1,47 @@
+{ lib
+, buildPythonPackage
+, click
+, fetchPypi
+, future
+, pythonOlder
+, ratelim
+, requests
+, setuptools
+, six
+}:
+
+buildPythonPackage rec {
+  pname = "geocoder";
+  version = "1.38.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-yZJTdMlhV30K7kA7Ceb46hlx2RPwEfAMpwx2vq96d+c=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    click
+    future
+    ratelim
+    requests
+    six
+  ];
+
+  pythonImportsCheck = [
+    "geocoder"
+  ];
+
+  meta = with lib; {
+    description = "Module for geocoding";
+    homepage = "https://pypi.org/project/geocoder/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@ -1,27 +1,20 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, pythonOlder
-
-# build-system
-, setuptools
-
-# l10n
-, polib
-, lingua
-, chameleon
-
-# dependencies
-, python-dateutil
-
-# tests
-, importlib-metadata
-, pytestCheckHook
+{
+  lib,
+  buildPythonPackage,
+  chameleon,
+  fetchFromGitHub,
+  importlib-metadata,
+  lingva,
+  polib,
+  pytestCheckHook,
+  python-dateutil,
+  pythonOlder,
+  setuptools,
 }:

 buildPythonPackage rec {
  pname = "holidays";
-  version = "0.44";
+  version = "0.46";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -30,14 +23,14 @@ buildPythonPackage rec {
    owner = "vacanza";
    repo = "python-holidays";
    rev = "refs/tags/v${version}";
-    hash = "sha256-RwM4RtFIUSaM/e4kiHOMg97lZ4VknB1pOqGRuIe2ns8=";
+    hash = "sha256-v0tufmOtxUP5pTsNNJJ9fevCPnsa68e0mdDtKGXEgVs=";
  };

-  nativeBuildInputs = [
+  build-system = [
    setuptools

    # l10n
-    lingua
+    lingva
    chameleon
    polib
  ];
@ -52,9 +45,7 @@ buildPythonPackage rec {
    ./scripts/l10n/generate_mo_files.py
  '';

-  propagatedBuildInputs = [
-    python-dateutil
-  ];
+  dependencies = [ python-dateutil ];

  doCheck = false;

@ -64,21 +55,16 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  pythonImportsCheck = [
-    "holidays"
-  ];
-
-  disabledTests = [
-    # Failure starting with 0.24
-    "test_l10n"
-  ];
+  pythonImportsCheck = [ "holidays" ];

  meta = with lib; {
    description = "Generate and work with holidays in Python";
    homepage = "https://github.com/vacanza/python-holidays";
    changelog = "https://github.com/vacanza/python-holidays/releases/tag/v${version}";
    license = licenses.mit;
-    maintainers = with maintainers; [ fab jluttine ];
+    maintainers = with maintainers; [
+      fab
+      jluttine
+    ];
  };
 }
-
--- a/pkgs/development/python-modules/imgcat/default.nix
+++ b/pkgs/development/python-modules/imgcat/default.nix
@ -0,0 +1,59 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, matplotlib
+, numpy
+, pillow
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, tensorflow
+, torch
+, torchvision
+}:
+
+buildPythonPackage rec {
+  pname = "imgcat";
+  version = "0.5.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "wookayin";
+    repo = "python-imgcat";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-LFXfCMWMdOjFYhXba9PCCIYnqR7gTRG63NAoC/nD2wk=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail "'pytest-runner<5.0'" ""
+  '';
+
+  build-system = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    matplotlib
+    numpy
+    pillow
+    pytestCheckHook
+    tensorflow
+    torch
+    torchvision
+  ];
+
+  pythonImportsCheck = [
+    "imgcat"
+  ];
+
+  meta = with lib; {
+    description = "Imgcat in Python";
+    homepage = "https://github.com/wookayin/python-imgcat";
+    changelog = "https://github.com/wookayin/python-imgcat/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/lingva/default.nix
+++ b/pkgs/development/python-modules/lingva/default.nix
@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  chameleon,
+  click,
+  fetchFromGitHub,
+  polib,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "lingva";
+  version = "5.0.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "vacanza";
+    repo = "lingva";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-kr64L/DtEWZu9z2p90QJHnb/6LygwZgxE+rARbo0NYI=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    chameleon
+    click
+    polib
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "lingva" ];
+
+  meta = with lib; {
+    description = "Module with tools to extract translatable texts from your code";
+    homepage = "https://github.com/vacanza/lingva";
+    changelog = "https://github.com/vacanza/lingva/blob/${version}/changes.rst";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/medpy/default.nix
+++ b/pkgs/development/python-modules/medpy/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "medpy";
-  version = "0.5.0rc1";
+  version = "0.5.1";
  pyproject = true;

  disabled = pythonOlder "3.6";
@ -21,14 +21,14 @@ buildPythonPackage rec {
    owner = "loli";
    repo = "medpy";
    rev = "refs/tags/${version}";
-    hash = "sha256-W62LjstH42OzNG+vMkuApUWczTNugJGKuuoeeS5ok4U=";
+    hash = "sha256-kzOTYBcXAAEYoe/m/BjWNaQX4ljG17NxndevAt5KxjQ=";
  };

-  nativeBuildInputs = [
+  build-system = [
    setuptools
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    boost
    numpy
    scipy
@ -38,6 +38,7 @@ buildPythonPackage rec {
  nativeCheckInputs = [
    unittestCheckHook
  ];
+
  preCheck = ''
    rm -r medpy/  # prevent importing from build directory at test time
    rm -r tests/graphcut_  # SIGILL at test time
--- a/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
@ -1,14 +1,15 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, flit-core
-, opentelemetry-api
-, opentelemetry-sdk
-, pytest-asyncio
-, pytest-mock
-, pytestCheckHook
-, pythonOlder
-, std-uritemplate
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  flit-core,
+  opentelemetry-api,
+  opentelemetry-sdk,
+  pytest-asyncio,
+  pytest-mock,
+  pytestCheckHook,
+  pythonOlder,
+  std-uritemplate,
 }:

 buildPythonPackage rec {
@ -25,9 +26,7 @@ buildPythonPackage rec {
    hash = "sha256-n9Erm21slKm+zDblhSHA5Cwxkyrcyx0w09ua3bUc5XI=";
  };

-  build-system = [
-    flit-core
-  ];
+  build-system = [ flit-core ];

  dependencies = [
    opentelemetry-api
@ -41,9 +40,7 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  pythonImportsCheck = [
-    "kiota_abstractions"
-  ];
+  pythonImportsCheck = [ "kiota_abstractions" ];

  meta = with lib; {
    description = "Abstractions library for Kiota generated Python clients";
--- a/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-authentication-azure/default.nix
@ -1,16 +1,17 @@
-{ lib
-, aiohttp
-, azure-core
-, buildPythonPackage
-, fetchFromGitHub
-, flit-core
-, microsoft-kiota-abstractions
-, opentelemetry-api
-, opentelemetry-sdk
-, pytest-asyncio
-, pytest-mock
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  aiohttp,
+  azure-core,
+  buildPythonPackage,
+  fetchFromGitHub,
+  flit-core,
+  microsoft-kiota-abstractions,
+  opentelemetry-api,
+  opentelemetry-sdk,
+  pytest-asyncio,
+  pytest-mock,
+  pytestCheckHook,
+  pythonOlder,
 }:

 buildPythonPackage rec {
@ -27,11 +28,9 @@ buildPythonPackage rec {
    hash = "sha256-RA0BbIwDs3cXiH4tQsvCGUO1OAg+DWjEeWd7MEVIC8E=";
  };

-  nativeBuildInputs = [
-    flit-core
-  ];
+  build-system = [ flit-core ];

-  propagatedBuildInputs = [
+  dependencies = [
    aiohttp
    azure-core
    microsoft-kiota-abstractions
@ -45,9 +44,7 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  pythonImportsCheck = [
-    "kiota_authentication_azure"
-  ];
+  pythonImportsCheck = [ "kiota_authentication_azure" ];

  meta = with lib; {
    description = "Kiota Azure authentication provider";
--- a/pkgs/development/python-modules/microsoft-kiota-http/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-http/default.nix
@ -1,16 +1,17 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, flit-core
-, httpx
-, microsoft-kiota-abstractions
-, opentelemetry-api
-, opentelemetry-sdk
-, pytest-asyncio
-, pytest-mock
-, pytestCheckHook
-, pythonOlder
-, urllib3
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  flit-core,
+  httpx,
+  microsoft-kiota-abstractions,
+  opentelemetry-api,
+  opentelemetry-sdk,
+  pytest-asyncio,
+  pytest-mock,
+  pytestCheckHook,
+  pythonOlder,
+  urllib3,
 }:

 buildPythonPackage rec {
@ -27,11 +28,9 @@ buildPythonPackage rec {
    hash = "sha256-I16WARk6YBr8KgE9MtHcA5VdsnLXBKcZOaqRL/eqwKE=";
  };

-  nativeBuildInputs = [
-    flit-core
-  ];
+  build-system = [ flit-core ];

-  propagatedBuildInputs = [
+  dependencies = [
    httpx
    microsoft-kiota-abstractions
    opentelemetry-api
@ -45,9 +44,7 @@ buildPythonPackage rec {
    urllib3
  ];

-  pythonImportsCheck = [
-    "kiota_http"
-  ];
+  pythonImportsCheck = [ "kiota_http" ];

  meta = with lib; {
    description = "HTTP request adapter implementation for Kiota clients for Python";
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-form/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-form/default.nix
@ -0,0 +1,50 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  flit-core,
+  microsoft-kiota-abstractions,
+  pytest-asyncio,
+  pendulum,
+  pytest-mock,
+  pytestCheckHook,
+  pythonOlder,
+}:
+
+buildPythonPackage rec {
+  pname = "microsoft-kiota-serialization-form";
+  version = "0.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "kiota-serialization-form-python";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ecFspbCaSkRoQTTeyZdqGpWSKiQJS6viDgBVNDHPo4g=";
+  };
+
+  build-system = [ flit-core ];
+
+  dependencies = [
+    microsoft-kiota-abstractions
+    pendulum
+  ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "kiota_serialization_form" ];
+
+  meta = with lib; {
+    description = "Form serialization implementation for Kiota clients in Python";
+    homepage = "https://github.com/microsoft/kiota-serialization-form-python";
+    changelog = "https://github.com/microsoft/kiota-serialization-form-python/blob/${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-json/default.nix
@ -1,17 +1,18 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, flit-core
-, microsoft-kiota-abstractions
-, pendulum
-, pytest-asyncio
-, pytest-mock
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  flit-core,
+  microsoft-kiota-abstractions,
+  pendulum,
+  pytest-asyncio,
+  pytest-mock,
+  pytestCheckHook,
+  pythonOlder,
 }:

 buildPythonPackage rec {
-  pname = "kiota-serialization-json";
+  pname = "microsoft-kiota-serialization-json";
  version = "1.1.0";
  pyproject = true;

@ -24,11 +25,9 @@ buildPythonPackage rec {
    hash = "sha256-igMqwoKArfQ37pzdjUICgXY795dfg/MX65iwTVe0sLM=";
  };

-  nativeBuildInputs = [
-    flit-core
-  ];
+  build-system = [ flit-core ];

-  propagatedBuildInputs = [
+  dependencies = [
    microsoft-kiota-abstractions
    pendulum
  ];
@ -39,9 +38,7 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  pythonImportsCheck = [
-    "kiota_serialization_json"
-  ];
+  pythonImportsCheck = [ "kiota_serialization_json" ];

  disabledTests = [
    # Test compare an output format
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-multipart/default.nix
@ -0,0 +1,48 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  flit-core,
+  microsoft-kiota-abstractions,
+  microsoft-kiota-serialization-json,
+  pytest-asyncio,
+  pytest-mock,
+  pytestCheckHook,
+  pythonOlder,
+}:
+
+buildPythonPackage rec {
+  pname = "microsoft-kiota-serialization-multipart";
+  version = "0.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "kiota-serialization-multipart-python";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-OGX6vX02928F1uCP8bF/q1Z5aDrdj29iQNOITzF2LQI=";
+  };
+
+  build-system = [ flit-core ];
+
+  dependencies = [ microsoft-kiota-abstractions ];
+
+  nativeCheckInputs = [
+    microsoft-kiota-serialization-json
+    pytest-asyncio
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "kiota_serialization_multipart" ];
+
+  meta = with lib; {
+    description = "Multipart serialization implementation for Kiota clients in Python";
+    homepage = "https://github.com/microsoft/kiota-serialization-multipart-python";
+    changelog = "https://github.com/microsoft/kiota-serialization-multipart-python/blob/${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
@ -1,17 +1,18 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, flit-core
-, microsoft-kiota-abstractions
-, pytest-asyncio
-, pytest-mock
-, pytestCheckHook
-, python-dateutil
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  flit-core,
+  microsoft-kiota-abstractions,
+  pytest-asyncio,
+  pytest-mock,
+  pytestCheckHook,
+  python-dateutil,
+  pythonOlder,
 }:

 buildPythonPackage rec {
-  pname = "kiota-serialization-text";
+  pname = "microsoft-kiota-serialization-text";
  version = "1.0.0";
  pyproject = true;

@ -24,11 +25,9 @@ buildPythonPackage rec {
    hash = "sha256-jPuRfvqO4n5/PjSOS5NMCawaYRhXmrZtfg6LgYFCv7o=";
  };

-  nativeBuildInputs = [
-    flit-core
-  ];
+  build-system = [ flit-core ];

-  propagatedBuildInputs = [
+  dependencies = [
    microsoft-kiota-abstractions
    python-dateutil
  ];
@ -39,9 +38,7 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  pythonImportsCheck = [
-    "kiota_serialization_text"
-  ];
+  pythonImportsCheck = [ "kiota_serialization_text" ];

  meta = with lib; {
    description = "Text serialization implementation for Kiota generated clients in Python";
--- a/pkgs/development/python-modules/msgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/msgraph-sdk/default.nix
@ -0,0 +1,58 @@
+{
+  lib,
+  azure-identity,
+  buildPythonPackage,
+  fetchFromGitHub,
+  microsoft-kiota-abstractions,
+  microsoft-kiota-authentication-azure,
+  microsoft-kiota-http,
+  microsoft-kiota-serialization-form,
+  microsoft-kiota-serialization-json,
+  microsoft-kiota-serialization-multipart,
+  microsoft-kiota-serialization-text,
+  msgraph-core,
+  pythonOlder,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "msgraph-sdk";
+  version = "1.2.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "microsoftgraph";
+    repo = "msgraph-sdk-python";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-UaGdusPGWlF7gTzpCq9WrF/evdDSK5srrkH8/Vz9O8M=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    azure-identity
+    microsoft-kiota-abstractions
+    microsoft-kiota-authentication-azure
+    microsoft-kiota-http
+    microsoft-kiota-serialization-form
+    microsoft-kiota-serialization-json
+    microsoft-kiota-serialization-multipart
+    microsoft-kiota-serialization-text
+    msgraph-core
+  ];
+
+  # Module doesn't have tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "msgraph" ];
+
+  meta = with lib; {
+    description = "Microsoft Graph SDK for Python";
+    homepage = "https://github.com/microsoftgraph/msgraph-sdk-python";
+    changelog = "https://github.com/microsoftgraph/msgraph-sdk-python/blob/${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/netutils/default.nix
+++ b/pkgs/development/python-modules/netutils/default.nix
@ -1,20 +1,21 @@
-{ lib
-, stdenv
-, buildPythonPackage
-, fetchFromGitHub
-, jinja2
-, jsonschema
-, napalm
-, poetry-core
-, pytestCheckHook
-, pythonOlder
-, pyyaml
-, toml
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchFromGitHub,
+  jinja2,
+  jsonschema,
+  napalm,
+  poetry-core,
+  pytestCheckHook,
+  pythonOlder,
+  pyyaml,
+  toml,
 }:

 buildPythonPackage rec {
  pname = "netutils";
-  version = "1.7.0";
+  version = "1.8.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -23,16 +24,12 @@ buildPythonPackage rec {
    owner = "networktocode";
    repo = "netutils";
    rev = "refs/tags/v${version}";
-    hash = "sha256-B2epTqG0PzcD876Bk222nDSorHHB8Znepp+cgl1++gY=";
+    hash = "sha256-Eqs/YkU2XrjD7x2WgvvR89/Pdi9AW9vhw3alJ8kIDgc=";
  };

-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];

-  propagatedBuildInputs = [
-    jsonschema
-  ];
+  dependencies = [ jsonschema ];

  passthru.optional-dependencies.optionals = [
    jsonschema
@ -46,9 +43,7 @@ buildPythonPackage rec {
    toml
  ];

-  pythonImportsCheck = [
-    "netutils"
-  ];
+  pythonImportsCheck = [ "netutils" ];

  disabledTests = [
    # Tests require network access
--- a/pkgs/development/python-modules/pinecone-client/default.nix
+++ b/pkgs/development/python-modules/pinecone-client/default.nix
@ -1,52 +1,60 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, setuptools
-, poetry-core
-, pythonRelaxDepsHook
-, numpy
-, pyyaml
-, python-dateutil
-, urllib3
-, tqdm
 , dnspython
-, requests
-, typing-extensions
+, fetchPypi
 , loguru
+, numpy
+, poetry-core
+, python-dateutil
+, pythonOlder
+, pythonRelaxDepsHook
+, pyyaml
+, requests
+, setuptools
+, tqdm
+, typing-extensions
+, urllib3
 }:
+
 buildPythonPackage rec {
  pname = "pinecone-client";
-  version = "3.2.1";
+  version = "3.2.2";
  pyproject = true;

+  disabled = pythonOlder "3.8";
+
  src = fetchPypi {
    pname = "pinecone_client";
    inherit version;
-    hash = "sha256-hWD/r7E7nEWpLrnrd6LbMtWh+nkDodsX969Y7hBYu2A=";
+    hash = "sha256-iHoSQF+QrBHDlkkPYF/EefMc8oI2EDTRrg/MwCrHW+4=";
  };

-  nativeBuildInputs = [
-    setuptools
-    poetry-core
-    pythonRelaxDepsHook
-  ];
-
-  propagatedBuildInputs = [
-    numpy
-    pyyaml
-    python-dateutil
-    urllib3
-    tqdm
-    dnspython
-    requests
-    typing-extensions
-    loguru
-  ];
-
  pythonRelaxDeps = [
    "urllib3"
  ];

+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
+  build-system = [
+    setuptools
+    poetry-core
+  ];
+
+  dependencies = [
+    dnspython
+    loguru
+    numpy
+    python-dateutil
+    pyyaml
+    requests
+    tqdm
+    typing-extensions
+    urllib3
+  ];
+
+  # Tests require network access
  doCheck = false;

  pythonImportsCheck = [
@ -54,8 +62,9 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
-    homepage = "https://www.pinecone.io/";
    description = "The Pinecone python client";
+    homepage = "https://www.pinecone.io/";
+    changelog = "https://github.com/pinecone-io/pinecone-python-client/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ happysalada ];
  };
--- a/pkgs/development/python-modules/polyswarm-api/default.nix
+++ b/pkgs/development/python-modules/polyswarm-api/default.nix
@ -0,0 +1,66 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, future
+, jsonschema
+, pytestCheckHook
+, python-dateutil
+, pythonOlder
+, pythonRelaxDepsHook
+, requests
+, responses
+, setuptools
+, vcrpy
+}:
+
+buildPythonPackage rec {
+  pname = "polyswarm-api";
+  version = "3.5.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "polyswarm";
+    repo = "polyswarm-api";
+    rev = "refs/tags/${version}";
+    hash = "sha256-GMLgph6mjDSDn2CCfeqcqFY2gjtziH4xVHJhYTGRYw8=";
+  };
+
+  pythonRelaxDeps = [
+    "future"
+  ];
+
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    future
+    jsonschema
+    python-dateutil
+    requests
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    responses
+    vcrpy
+  ];
+
+  pythonImportsCheck = [
+    "polyswarm_api"
+  ];
+
+  meta = with lib; {
+    description = "Library to interface with the PolySwarm consumer APIs";
+    homepage = "https://github.com/polyswarm/polyswarm-api";
+    changelog = "https://github.com/polyswarm/polyswarm-api/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@ -1,49 +1,38 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pandoc
-, pytestCheckHook
-, pythonOlder
-, requests
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  pandoc,
+  pytestCheckHook,
+  pythonOlder,
+  requests,
+  setuptools,
 }:

 buildPythonPackage rec {
  pname = "publicsuffixlist";
-  version = "0.10.0.20240328";
+  version = "0.10.0.20240403";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-XArawQzC9J5ShtgCG02qf8RRxNTKJMn8aiclG+4CUKY=";
+    hash = "sha256-DQgjgr35l5I33BWLaOQTUnQpFhBMXUB0Jx4jQXbeBZU=";
  };

-  build-system = [
-    setuptools
-  ];
+  build-system = [ setuptools ];

  passthru.optional-dependencies = {
-    update = [
-      requests
-    ];
-    readme = [
-      pandoc
-    ];
+    update = [ requests ];
+    readme = [ pandoc ];
  };

-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];

-  pythonImportsCheck = [
-    "publicsuffixlist"
-  ];
+  pythonImportsCheck = [ "publicsuffixlist" ];

-  pytestFlagsArray = [
-    "publicsuffixlist/test.py"
-  ];
+  pytestFlagsArray = [ "publicsuffixlist/test.py" ];

  meta = with lib; {
    description = "Public Suffix List parser implementation";
--- a/pkgs/development/python-modules/pyeapi/default.nix
+++ b/pkgs/development/python-modules/pyeapi/default.nix
@ -1,51 +1,55 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, setuptools
-, mock
-, netaddr
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchpatch,
+  setuptools,
+  mock,
+  netaddr,
+  pytestCheckHook,
+  pythonOlder,
 }:

 buildPythonPackage rec {
  pname = "pyeapi";
  version = "1.0.2";
-  format = "pyproject";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "arista-eosplus";
-    repo = pname;
+    repo = "pyeapi";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-GZBoCoAqij54rZezRDF/ihJDQ5T6FFyDSRXGV3//avQ=";
+    hash = "sha256-GZBoCoAqij54rZezRDF/ihJDQ5T6FFyDSRXGV3//avQ=";
  };

-  nativeBuildInputs = [
-    setuptools
+  patches = [
+    # Replace imp, https://github.com/arista-eosplus/pyeapi/pull/295
+    (fetchpatch {
+      name = "replace-imp.patch";
+      url = "https://github.com/arista-eosplus/pyeapi/commit/1f2d8e1fa61566082ccb11a1a17e0f3d8a0c89df.patch";
+      hash = "sha256-ONviRU6eUUZ+TTJ4F41ZXqavW7RIi1MBO7s7OsnWknk=";
+    })
  ];

-  propagatedBuildInputs = [
-    netaddr
-  ];
+  build-system = [ setuptools ];
+
+  dependencies = [ netaddr ];

  nativeCheckInputs = [
    mock
    pytestCheckHook
  ];

-  pytestFlagsArray = [
-    "test/unit"
-  ];
+  pytestFlagsArray = [ "test/unit" ];

-  pythonImportsCheck = [
-    "pyeapi"
-  ];
+  pythonImportsCheck = [ "pyeapi" ];

  meta = with lib; {
    description = "Client for Arista eAPI";
    homepage = "https://github.com/arista-eosplus/pyeapi";
+    changelog = "https://github.com/arista-eosplus/pyeapi/releases/tag/v${version}";
    license = licenses.bsd3;
    maintainers = with maintainers; [ astro ];
  };
--- a/pkgs/development/python-modules/pysnmp-pysmi/default.nix
+++ b/pkgs/development/python-modules/pysnmp-pysmi/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "pysnmp-pysmi";
-  version = "1.1.11";
+  version = "1.1.12";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -18,14 +18,14 @@ buildPythonPackage rec {
    owner = "pysnmp";
    repo = "pysmi";
    rev = "refs/tags/v${version}";
-    hash = "sha256-qe99nLOyUvE6LJagtQ9whPF4zwIWiM7g5zn40QsmrmA=";
+    hash = "sha256-dK02y8HXhwq1W6NOYsycjTpIMxoQY4qNT4n8TEycmWM=";
  };

-  nativeBuildInputs = [
+  build-system = [
    poetry-core
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    ply
    requests
  ];
--- a/pkgs/development/python-modules/reptor/default.nix
+++ b/pkgs/development/python-modules/reptor/default.nix
@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "reptor";
-  version = "0.16";
+  version = "0.17";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -41,7 +41,7 @@ buildPythonPackage rec {
    owner = "Syslifters";
    repo = "reptor";
    rev = "refs/tags/${version}";
-    hash = "sha256-xyk83XPITD1sAtuFcndTQg0otDMO89LK+B+9SD89kvo=";
+    hash = "sha256-3GINDFKgvFv03xF+77K+sTKSm0+kLF5m70dQ/iksZeM=";
  };

  pythonRelaxDeps = true;
--- a/pkgs/development/python-modules/sievelib/default.nix
+++ b/pkgs/development/python-modules/sievelib/default.nix
@ -3,20 +3,23 @@
 , fetchPypi
 , mock
 , pytestCheckHook
+, pythonOlder
 , setuptools-scm
 }:

 buildPythonPackage rec {
  pname = "sievelib";
-  version = "1.2.1";
+  version = "1.3.0";
  format = "setuptools";

+  disabled = pythonOlder "3.7";
+
  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-7cubQWqYWjzFt9f01+wBPjcuv5DmTJ2eAOIDEpmvOP0=";
+    hash = "sha256-MxPX8fP4Mkq2qOISnknXbuCN8NQ+L1UOaBuPEuP0TNE=";
  };

-  nativeBuildInputs = [
+  build-system = [
    setuptools-scm
  ];

@ -30,7 +33,7 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
-    description = "Client-side Sieve and Managesieve library written in Python";
+    description = "Client-side Sieve and Managesieve library";
    longDescription = ''
      A library written in Python that implements RFC 5228 (Sieve: An Email
      Filtering Language) and RFC 5804 (ManageSieve: A Protocol for
@ -43,6 +46,7 @@ buildPythonPackage rec {
       * Imap4flags (RFC 5232)
    '';
    homepage = "https://github.com/tonioo/sievelib";
+    changelog = "https://github.com/tonioo/sievelib/releases/tag/${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ leenaars ];
  };
--- a/pkgs/development/python-modules/tabcmd/default.nix
+++ b/pkgs/development/python-modules/tabcmd/default.nix
@ -1,25 +1,27 @@
-{ lib
-, appdirs
-, argparse
-, buildPythonPackage
-, doit
-, fetchPypi
-, ftfy
-, mock
-, pyinstaller-versionfile
-, pytestCheckHook
-, python3
-, pythonOlder
-, requests
-, pythonRelaxDepsHook
-, setuptools
-, setuptools-scm
-, tableauserverclient
-, types-appdirs
-, types-mock
-, types-requests
-, types-setuptools
-, urllib3
+{
+  lib,
+  appdirs,
+  argparse,
+  buildPythonPackage,
+  doit,
+  fetchPypi,
+  ftfy,
+  mock,
+  pyinstaller-versionfile,
+  pytest-order,
+  pytestCheckHook,
+  python3,
+  pythonOlder,
+  pythonRelaxDepsHook,
+  requests,
+  setuptools,
+  setuptools-scm,
+  tableauserverclient,
+  types-appdirs,
+  types-mock,
+  types-requests,
+  types-setuptools,
+  urllib3,
 }:

 buildPythonPackage rec {
@ -34,17 +36,22 @@ buildPythonPackage rec {
    hash = "sha256-f9zoYeb4RzcCtgcCYYvvuCuFrjqpP3Fhv38bUWH24+g=";
  };

+  prePatch = ''
+    # Remove an unneeded dependency that can't be resolved
+    # https://github.com/tableau/tabcmd/pull/282
+    sed -i "/'argparse',/d" pyproject.toml
+  '';
+
  pythonRelaxDeps = [
    "tableauserverclient"
    "urllib3"
  ];

-  nativeBuildInputs = [
-    pythonRelaxDepsHook
-    setuptools
-  ];
+  nativeBuildInputs = [ pythonRelaxDepsHook ];

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    appdirs
    argparse
    doit
@ -62,14 +69,10 @@ buildPythonPackage rec {

  nativeCheckInputs = [
    mock
+    pytest-order
    pytestCheckHook
  ];

-  # Remove an unneeded dependency that can't be resolved
-  prePatch = ''
-    sed -i "/'argparse',/d" pyproject.toml
-  '';
-
  # Create a "tabcmd" executable
  postInstall = ''
    # Create a directory for our wrapped binary.
@ -87,13 +90,14 @@ buildPythonPackage rec {
    chmod +x $out/bin/tabcmd
  '';

+  pythonImportsCheck = [ "tabcmd" ];

  meta = with lib; {
-    description = "A command line client for working with Tableau Server.";
-    mainProgram = "tabcmd";
+    description = "A command line client for working with Tableau Server";
    homepage = "https://github.com/tableau/tabcmd";
    changelog = "https://github.com/tableau/tabcmd/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ ];
+    mainProgram = "tabcmd";
  };
 }
--- a/pkgs/development/python-modules/types-psutil/default.nix
+++ b/pkgs/development/python-modules/types-psutil/default.nix
@ -5,12 +5,12 @@

 buildPythonPackage rec {
  pname = "types-psutil";
-  version = "5.9.5.20240205";
+  version = "5.9.5.20240316";
  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Ud82o2GqWXv0g9zFtY8qt6qHRSo20tqXyQmU1qge90M=";
+    hash = "sha256-Vjb1cUu5MMZLs0xNR6WdyS+dYQt3i1Nkox2qVYSUSEg=";
  };

  # Module doesn't have tests
--- a/pkgs/development/python-modules/types-requests/default.nix
+++ b/pkgs/development/python-modules/types-requests/default.nix
@ -1,36 +1,33 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, setuptools
-, urllib3
-, types-urllib3
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  types-urllib3,
+  urllib3,
 }:

 buildPythonPackage rec {
  pname = "types-requests";
-  version = "2.31.0.20240311";
+  version = "2.31.0.20240403";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-scG2ar+3+nmq4JCXqBHEqpcTDriDHGDkeu5Mo0RzHKU=";
+    hash = "sha256-4eDNC2VTNPOdn4craKExDw40Nkdoi/LO6TLsTCsE3lk=";
  };

-  nativeBuildInputs = [
-    setuptools
-    urllib3
-  ];
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [
+  dependencies = [
    types-urllib3
+    urllib3
  ];

  # Module doesn't have tests
  doCheck = false;

-  pythonImportsCheck = [
-    "requests-stubs"
-  ];
+  pythonImportsCheck = [ "requests-stubs" ];

  meta = with lib; {
    description = "Typing stubs for requests";
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -1,23 +1,22 @@
-{ lib
-, fetchFromGitHub
-, python3
+{
+  lib,
+  fetchFromGitHub,
+  python3,
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "checkov";
-  version = "3.2.51";
+  version = "3.2.53";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = "checkov";
    rev = "refs/tags/${version}";
-    hash = "sha256-aUu1sxP4YUuF2E4oPh8QJ/hpqLSvAz0aYei+QSj9qqQ=";
+    hash = "sha256-fldD2V/Qlwg6tvl3IxdLEzc2meWToIeGHQCsMM+b2vI=";
  };

-  patches = [
-    ./flake8-compat-5.x.patch
-  ];
+  patches = [ ./flake8-compat-5.x.patch ];

  pythonRelaxDeps = [
    "boto3"
@ -146,9 +145,7 @@ python3.pkgs.buildPythonApplication rec {
    "dogfood_tests/test_checkov_dogfood.py"
  ];

-  pythonImportsCheck = [
-    "checkov"
-  ];
+  pythonImportsCheck = [ "checkov" ];

  postInstall = ''
    chmod +x $out/bin/checkov
@ -163,6 +160,9 @@ python3.pkgs.buildPythonApplication rec {
      Kubernetes, Serverless framework and other infrastructure-as-code-languages.
    '';
    license = licenses.asl20;
-    maintainers = with maintainers; [ anhdle14 fab ];
+    maintainers = with maintainers; [
+      anhdle14
+      fab
+    ];
  };
 }
--- a/pkgs/development/tools/misc/hydra/unstable.nix
+++ b/pkgs/development/tools/misc/hydra/unstable.nix
@ -123,13 +123,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "hydra";
-  version = "2023-12-24";
+  version = "2024-03-08";

  src = fetchFromGitHub {
    owner = "NixOS";
    repo = "hydra";
-    rev = "02e453fc8c39751843220eaecdeaf7d539b7e765";
-    hash = "sha256-hIXRgu2MGqFYCALDKAiP+8lE859zftRe4OVIgGOTkvc=";
+    rev = "8f56209bd6f3b9ec53d50a23812a800dee7a1969";
+    hash = "sha256-mhEj02VruXPmxz3jsKHMov2ERNXk9DwaTAunWEO1iIQ=";
  };

  buildInputs = [
--- a/pkgs/os-specific/darwin/raycast/default.nix
+++ b/pkgs/os-specific/darwin/raycast/default.nix
@ -1,17 +1,21 @@
 { lib
 , stdenvNoCC
 , fetchurl
+, writeShellApplication
+, curl
+, jq
+, common-updater-scripts
 , undmg
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "raycast";
-  version = "1.70.2";
+  version = "1.70.3";

  src = fetchurl {
    name = "Raycast.dmg";
    url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-t0lc59RcOF7umUjyxQll4RZNyboiuMaP8dZ15vcuaAE=";
+    hash = "sha256-BSeWkopuBszBAITiaAPIwUvP7I7sZTl1laQXWIN4qRE=";
  };

  dontPatch = true;
@ -32,6 +36,19 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  passthru = {
+    updateScript = writeShellApplication {
+      name = "raycast-update-script";
+      runtimeInputs = [ curl jq common-updater-scripts ];
+      text = ''
+        set -eo pipefail
+        url=$(curl --silent "https://releases.raycast.com/releases/latest?build=universal")
+        version=$(echo "$url" | jq -r '.version')
+        update-source-version raycast "$version" --file=./pkgs/os-specific/darwin/raycast/default.nix
+      '';
+    };
+  };
+
  meta = with lib; {
    description = "Control your tools with a few keystrokes";
    homepage = "https://raycast.app/";
--- a/pkgs/os-specific/darwin/raycast/update.sh
+++ b/pkgs/os-specific/darwin/raycast/update.sh
@ -1,20 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=../../../../. -i bash -p common-updater-scripts jq
-
-set -eo pipefail
-
-new_version=$(curl --silent https://releases.raycast.com/releases/latest?build=universal | jq -r '.version')
-old_version=$(sed -nE 's/\s*version = "(.*)".*/\1/p' ./default.nix)
-
-if [[ $new_version == $old_version ]]; then
-    echo "Already up to date."
-    exit 0
-else
-    echo "raycast: $old_version -> $new_version"
-    sed -Ei.bak '/ *version = "/s/".+"/"'"$new_version"'"/' ./default.nix
-    rm ./default.nix.bak
-fi
-
-hash=$(nix --extra-experimental-features nix-command store prefetch-file --json --hash-type sha256 "https://releases.raycast.com/releases/$new_version/download?build=universal" | jq -r '.hash')
-sed -Ei.bak '/ *hash = /{N;N; s@("sha256-)[^;"]+@"'"$hash"'@}' ./default.nix
-rm ./default.nix.bak
--- a/pkgs/servers/janus-gateway/default.nix
+++ b/pkgs/servers/janus-gateway/default.nix
@ -15,13 +15,13 @@ in

 stdenv.mkDerivation rec {
  pname = "janus-gateway";
-  version = "1.2.1";
+  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "meetecho";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Bqb4UO4R5CnV8+2OthGrEVORzH+k+zgzI4UsvwRHgk8=";
+    sha256 = "sha256-BS6ErS2Wi8pOy8oFmVnbujYPwClxX8e+GL4CcqvOL9E=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config gengetopt ];
--- a/pkgs/shells/nix-your-shell/default.nix
+++ b/pkgs/shells/nix-your-shell/default.nix
@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "nix-your-shell";
-  version = "1.4.4";
+  version = "1.4.5";

  src = fetchFromGitHub {
    owner = "MercuryTechnologies";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-pBryTpCFwOkK5astzpYzhj/fJ9QS7IiKUck/Y4gLZZw=";
+    hash = "sha256-gjOvAy15y4WJ4LMmiF17nuY6aAsC1V7/zZ+nt+xDh24=";
  };

-  cargoHash = "sha256-6A7Lvys22dnFMKm1uRo2CCZk9LBRqHPBnmRPbvbDryI=";
+  cargoHash = "sha256-EyE/Sv8cY/e8uf4b/7M3kJhd/l+dZS62np58xICF77U=";

  meta = with lib; {
    mainProgram = "nix-your-shell";
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@ -24,7 +24,7 @@
 }:

 let
-  version = "0.91.0";
+  version = "0.92.0";
 in

 rustPlatform.buildRustPackage {
@ -35,10 +35,10 @@ rustPlatform.buildRustPackage {
    owner = "nushell";
    repo = "nushell";
    rev = version;
-    hash = "sha256-X3D+JRvnk6HMKWJMTNR16Fmhu+gYd8Ip+7PZQoLIoEU=";
+    hash = "sha256-k1YBKLRKqHIQ4k1tTtQ4OxJ+UFWrpGi3j/XoRTSJLIk=";
  };

-  cargoHash = "sha256-Xj4P/qd4GvmhWGwGaPvY23cQwdjdf6cSb1xyRZLN0tQ=";
+  cargoHash = "sha256-A+3ge+R0TZ4gRf4fZlFbIttb1IzFR2GfEo/2PmRZAyc=";

  nativeBuildInputs = [ pkg-config ]
    ++ lib.optionals (withDefaultFeatures && stdenv.isLinux) [ python3 ]
--- a/pkgs/shells/nushell/plugins/formats.nix
+++ b/pkgs/shells/nushell/plugins/formats.nix
@ -12,7 +12,7 @@
 rustPlatform.buildRustPackage rec {
  pname = "nushell_plugin_formats";
  inherit (nushell) version src;
-  cargoHash = "sha256-sEc+Oa2s8d3/9mye/9cHipjamPmLj6P38Jh24VrpfXM=";
+  cargoHash = "sha256-vl7tGXEFYc8ffS65SiQvUDkXLW4WhjHlb4tW2BSTWDU=";

  env = lib.optionalAttrs stdenv.cc.isClang {
    LIBCLANG_PATH = "${libclang.lib}/lib";
--- a/pkgs/shells/nushell/plugins/gstat.nix
+++ b/pkgs/shells/nushell/plugins/gstat.nix
@ -12,7 +12,7 @@
 rustPlatform.buildRustPackage rec {
  pname = "nushell_plugin_gstat";
  inherit (nushell) version src;
-  cargoHash = "sha256-wtw4S5fbZPh6OXmbbQu8oXpo0/rXWdOGHspx+z8Fjns=";
+  cargoHash = "sha256-n7oMaFUG5eCKFW3ZkeFzSbQ4at/BwxUQPLseeWvEGw4=";

  env = lib.optionalAttrs stdenv.cc.isClang {
    LIBCLANG_PATH = "${libclang.lib}/lib";
--- a/pkgs/shells/nushell/plugins/query.nix
+++ b/pkgs/shells/nushell/plugins/query.nix
@ -11,7 +11,7 @@
 rustPlatform.buildRustPackage {
  pname = "nushell_plugin_query";
  inherit (nushell) version src;
-  cargoHash = "sha256-u6etPrtq/q37CvJ2rkoFvVDBgu/YyVugeGOJbeHcSek=";
+  cargoHash = "sha256-gKVJTGDpKS79TNJxk302h9K9oaTPE5GP0v+OPwpY9K4=";

  env = lib.optionalAttrs stdenv.cc.isClang {
    LIBCLANG_PATH = "${libclang.lib}/lib";
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@ -59,14 +59,14 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
  pname = "awscli2";
-  version = "2.15.32"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.15.34"; # N.B: if you change this, check if overrides are still up-to-date
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-cli";
    rev = "refs/tags/${version}";
-    hash = "sha256-EdS8nsSlFtCvHn6Aysj8C5tmdBBRUtbTEVqkYex5vgc=";
+    hash = "sha256-lFovWxPlo3WlKE4yOlTtILbsRsILgioqVmPptOQO0bM=";
  };

  postPatch = ''
--- a/pkgs/tools/admin/lxd/wrapper.nix
+++ b/pkgs/tools/admin/lxd/wrapper.nix
@ -1,122 +0,0 @@
-{ lib
-, lxd-unwrapped
-, linkFarm
-, makeWrapper
-, stdenv
-, symlinkJoin
-, writeShellScriptBin
-, acl
-, apparmor-parser
-, apparmor-profiles
-, attr
-, bash
-, btrfs-progs
-, cdrkit
-, criu
-, dnsmasq
-, e2fsprogs
-, getent
-, gnutar
-, gptfdisk
-, gzip
-, iproute2
-, iptables
-, kmod
-, lvm2
-, minio
-, nftables
-, OVMF
-, qemu_kvm
-, qemu-utils
-, rsync
-, spice-gtk
-, squashfsTools
-, thin-provisioning-tools
-, util-linux
-, virtiofsd
-, xz
-}:
-let
-  binPath = lib.makeBinPath [
-    acl
-    attr
-    bash
-    btrfs-progs
-    cdrkit
-    criu
-    dnsmasq
-    e2fsprogs
-    getent
-    gnutar
-    gptfdisk
-    gzip
-    iproute2
-    iptables
-    kmod
-    lvm2
-    minio
-    nftables
-    qemu_kvm
-    qemu-utils
-    rsync
-    squashfsTools
-    thin-provisioning-tools
-    util-linux
-    virtiofsd
-    xz
-
-    (writeShellScriptBin "apparmor_parser" ''
-      exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
-    '')
-  ];
-
-  clientBinPath = [
-    spice-gtk
-  ];
-
-  ovmf-2mb = OVMF.override {
-    secureBoot = true;
-    fdSize2MB = true;
-  };
-
-  ovmf-4mb = OVMF.override {
-    secureBoot = true;
-    fdSize4MB = true;
-  };
-
-  ovmf-prefix = if stdenv.hostPlatform.isAarch64 then "AAVMF" else "OVMF";
-
-  # mimic ovmf from https://github.com/canonical/lxd-pkg-snap/blob/3abebe1dfeb20f9b7729556960c7e9fe6ad5e17c/snapcraft.yaml#L378
-  # also found in /snap/lxd/current/share/qemu/ on a snap install
-  ovmf = linkFarm "lxd-ovmf" [
-    { name = "OVMF_CODE.2MB.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd"; }
-    { name = "OVMF_CODE.4MB.fd"; path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_CODE.fd"; }
-    { name = "OVMF_CODE.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd"; }
-
-    { name = "OVMF_VARS.2MB.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
-    { name = "OVMF_VARS.2MB.ms.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
-    { name = "OVMF_VARS.4MB.fd"; path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
-    { name = "OVMF_VARS.4MB.ms.fd"; path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
-    { name = "OVMF_VARS.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
-    { name = "OVMF_VARS.ms.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
-  ];
-in
-symlinkJoin {
-  name = "lxd-${lxd-unwrapped.version}";
-
-  paths = [ lxd-unwrapped ];
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  postBuild = ''
-    wrapProgram $out/bin/lxd --prefix PATH : ${lib.escapeShellArg binPath}:${qemu_kvm}/libexec:$out/bin --set LXD_OVMF_PATH ${ovmf}
-
-    wrapProgram $out/bin/lxc --prefix PATH : ${lib.makeBinPath clientBinPath}
-  '';
-
-  passthru = {
-    inherit (lxd-unwrapped) tests ui;
-  };
-
-  inherit (lxd-unwrapped) meta pname version;
-}
--- a/pkgs/tools/graphics/resvg/default.nix
+++ b/pkgs/tools/graphics/resvg/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "resvg";
-  version = "0.40.0";
+  version = "0.41.0";

  src = fetchFromGitHub {
    owner = "RazrFalcon";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-M1log9JAgKB+S1jyieXNOhI8Wa0GwujbzyLJUd6b8VI=";
+    hash = "sha256-plZiyEiBWeV2mwTsNK5Je8Axs/hcHH8aV2VpOix6QCY=";
  };

-  cargoHash = "sha256-KyiwupObxEVyDzwsQOKWw0+avhf96L83m7tiI6EK3/U=";
+  cargoHash = "sha256-U7xzb9e9wh9XbLvlYQ0ofIjH8FuSzVcrXnrehQmZgww=";

  cargoBuildFlags = [
    "--package=resvg"
--- a/pkgs/tools/misc/goreleaser/default.nix
+++ b/pkgs/tools/misc/goreleaser/default.nix
@ -9,16 +9,16 @@
 }:
 buildGoModule rec {
  pname = "goreleaser";
-  version = "1.24.0";
+  version = "1.25.0";

  src = fetchFromGitHub {
    owner = "goreleaser";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-oC35g9F9tsbpoccfh1bgLHveW4xAQ3cMnvdYiGoI8Ys=";
+    hash = "sha256-1GQOnDwQkzoyLPehog32uwg6h2swBcbvxmZENaVaLCI=";
  };

-  vendorHash = "sha256-5M2OkmjQJM+n5Hr4nRGSFWSmNAj5vXJp/3aw6ppOXoI=";
+  vendorHash = "sha256-vI/S4QtN72tmBVZ2PPcavotJBkl+bdXO9OFqlOGw1J8=";

  ldflags =
    [ "-s" "-w" "-X main.version=${version}" "-X main.builtBy=nixpkgs" ];
--- a/pkgs/tools/networking/ockam/default.nix
+++ b/pkgs/tools/networking/ockam/default.nix
@ -12,7 +12,7 @@

 let
  pname = "ockam";
-  version = "0.118.0";
+  version = "0.119.0";
 in
 rustPlatform.buildRustPackage {
  inherit pname version;
@ -21,10 +21,10 @@ rustPlatform.buildRustPackage {
    owner = "build-trust";
    repo = pname;
    rev = "ockam_v${version}";
-    sha256 = "sha256-cH32moDRBIl5zbXAQNbltwPGcfeNlCBAlAa/iL0gG7c=";
+    hash = "sha256-gZBlh8Rg6lChcvTBRzPDIQk2wEJep/3Hei9xaIi8cZo=";
  };

-  cargoHash = "sha256-bgB1AYjDvpIsHKQUyRlPZHXKo3egmPdCBioCuDYPTaI=";
+  cargoHash = "sha256-0WzX6WsgUWGsToIX3cbiax4crhTbYuWI6EIF2xQWTxU=";
  nativeBuildInputs = [ git pkg-config ];
  buildInputs = [ openssl dbus ]
    ++ lib.optionals stdenv.isDarwin [ Security ];
--- a/pkgs/tools/security/cie-middleware-linux/default.nix
+++ b/pkgs/tools/security/cie-middleware-linux/default.nix
@ -1,13 +1,12 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchpatch
 , makeWrapper
-, strip-nondeterminism
+, stripJavaArchivesHook
 , meson
 , ninja
 , pkg-config
-, gradle_7
+, gradle_8
 , curl
 , cryptopp
 , fontconfig
@ -21,16 +20,16 @@

 let
  pname = "cie-middleware-linux";
-  version = "1.5.0";
+  version = "1.5.2";

  src = fetchFromGitHub {
    owner = "M0rf30";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Z8K2Ibg5bBfSql5HEapKgdfiCf/EIKTTD15oVeysQGk=";
+    sha256 = "sha256-M3Xwg3G2ZZhPRV7uhFVXQPyvuuY4zI5Z+D/Dt26KVM0=";
  };

-  gradle = gradle_7;
+  gradle = gradle_8;

  # Shared libraries needed by the Java application
  libraries = lib.makeLibraryPath [ ghostscript ];
@ -45,7 +44,6 @@ let
    buildPhase = ''
      # Run the fetchDeps task
      export GRADLE_USER_HOME=$(mktemp -d)
-      ls -l
      gradle --no-daemon -b cie-java/build.gradle fetchDeps
    '';

@ -62,7 +60,7 @@ let

    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
-    outputHash = "sha256-jtaH8dBpnx8KMJe+jzJfkvcx1NO4nL5jsRO4+GI+d0c=";
+    outputHash = "sha256-fxrjo4iduXzTgMqmQGwdI1vLMA4EZLObsHyKGZ6b14I=";
  };

 in
@ -72,44 +70,31 @@ stdenv.mkDerivation {

  hardeningDisable = [ "format" ];

-  outputs = [ "out" "dev" ];
-
  nativeBuildInputs = [
    makeWrapper
+    stripJavaArchivesHook
    meson
    ninja
    pkg-config
    gradle
-    strip-nondeterminism
  ];

  buildInputs = [
    cryptopp
    fontconfig
-    podofo.dev
+    podofo
    openssl
    pcsclite
    curl
    libxml2
  ];

-  patches = [
-    # Fix gcc-13 build by adding missing include.
-    (fetchpatch {
-      name = "gcc-13.patch";
-      url = "https://github.com/M0Rf30/cie-middleware-linux/commit/1da1196152f7a3bbe92ba3ce993ebb6785ff049e.patch";
-      hash = "sha256-aM23A1ZX8kebgX6RXVS78SEa+to93glUmIYO+lfUzfg=";
-    })
-  ];
+  patches = [ ./use-system-podofo.patch ];

  postPatch = ''
    # substitute the cieid command with this $out/bin/cieid
    substituteInPlace libs/pkcs11/src/CSP/AbilitaCIE.cpp \
      --replace 'file = "cieid"' 'file = "'$out'/bin/cieid"'
-
-    # revert https://github.com/M0Rf30/cie-middleware-linux/commit/1a389d8
-    sed -i libs/meson.build \
-        -e "s@podofo_dep = .\+@podofo_dep = dependency('libpodofo')@g"
  '';

  # Note: we use pushd/popd to juggle between the
@ -159,14 +144,6 @@ stdenv.mkDerivation {
    install -Dm644 LICENSE "$out/share/licenses/cieid/LICENSE"
  '';

-  postFixup = ''
-    # Move static libraries to the dev output
-    mv -t "$dev/lib" "$out/lib/"*.a
-
-    # Make the jar deterministic (mainly, sorting its files)
-    strip-nondeterminism "$out/share/cieid/cieid.jar"
-  '';
-
  passthru = { inherit javaDeps; };

  meta = with lib; {
--- a/pkgs/tools/security/cie-middleware-linux/use-system-podofo.patch
+++ b/pkgs/tools/security/cie-middleware-linux/use-system-podofo.patch
@ -0,0 +1,343 @@
+commit c9ac4243a6def08790bbf5552bb31894169596ca
+Author: rnhmjoj <rnhmjoj@inventati.org>
+Date:   Wed Apr 3 12:54:58 2024 +0200
+
+    use system podofo
+
+diff --git a/libs/meson.build b/libs/meson.build
+index 3ee31c1..5022ba8 100644
+--- a/libs/meson.build
+++ b/libs/meson.build
+@@ -16,21 +16,15 @@ curl_dep = dependency('libcurl')
+ fontconfig_dep = dependency('fontconfig')
+ freetype_dep = dependency('freetype2')
+ png_dep = dependency('libpng')
+-podofo_dep = cpp.find_library('libpodofo', dirs: libdir)
+podofo_dep = dependency('libpodofo')
+ libxml2_dep = dependency('libxml-2.0', required: false)
+ xml2_dep = dependency('xml2', required: false)
+ zlib_dep = dependency('zlib')
+ 
+ inc_so = include_directories('pkcs11/src/.', 'shared/src/')
+ 
+-inc_a = include_directories(
+-    'sign-sdk/include',
+-    'sign-sdk/include/podofo',
+-    'sign-sdk/include/podofo/include',
+-    'sign-sdk/include/podofo/include/podofo',
+-    'sign-sdk/src',
+-    'shared/src/',
+-)
+inc_a = include_directories('sign-sdk/include', 'sign-sdk/src', 'shared/src/')
+
+ cie_pkcs11_sources = [
+     'shared/src/Util/log.cpp',
+     'shared/src/Util/funccallinfo.cpp',
+diff --git a/libs/sign-sdk/include/PdfSignatureGenerator.h b/libs/sign-sdk/include/PdfSignatureGenerator.h
+index 93ab445..65d438f 100644
+--- a/libs/sign-sdk/include/PdfSignatureGenerator.h
+++ b/libs/sign-sdk/include/PdfSignatureGenerator.h
+@@ -10,9 +10,7 @@
+ #ifndef _PDFSIGNATUREGENERATOR_H_
+ #define _PDFSIGNATUREGENERATOR_H_
+ #include "Util/UUCByteArray.h"
+-#include "podofo/doc/PdfSignOutputDevice.h"
+-#include "podofo/doc/PdfSignatureField.h"
+-#include "podofo/podofo.h"
+#include <podofo/podofo.h>
+ 
+ using namespace PoDoFo;
+ using namespace std;
+@@ -60,7 +58,11 @@ class PdfSignatureGenerator {
+   const double getHeight(int pageIndex);
+ 
+  private:
+-  PdfMemDocument* m_pPdfDocument;
+  PdfDocument* m_pPdfDocument;
+
+  PdfMemDocument* m_pPdfMemDocument;
+
+  PdfWriter* m_pPdfWriter;
+ 
+   PdfSignatureField* m_pSignatureField;
+ 
+diff --git a/libs/sign-sdk/src/PdfSignatureGenerator.cpp b/libs/sign-sdk/src/PdfSignatureGenerator.cpp
+index 44ef54a..e8b8c8e 100644
+--- a/libs/sign-sdk/src/PdfSignatureGenerator.cpp
+++ b/libs/sign-sdk/src/PdfSignatureGenerator.cpp
+@@ -27,7 +27,7 @@ int GetNumberOfSignatures(PdfMemDocument* pPdfDocument);
+ USE_LOG;
+ 
+ PdfSignatureGenerator::PdfSignatureGenerator()
+-    : m_pPdfDocument(NULL),
+    : m_pPdfMemDocument(NULL),
+       m_pSignatureField(NULL),
+       m_pSignOutputDevice(NULL),
+       m_pFinalOutDevice(NULL),
+@@ -37,7 +37,7 @@ PdfSignatureGenerator::PdfSignatureGenerator()
+ }
+ 
+ PdfSignatureGenerator::~PdfSignatureGenerator() {
+-  if (m_pPdfDocument) delete m_pPdfDocument;
+  if (m_pPdfMemDocument) delete m_pPdfMemDocument;
+ 
+   if (m_pSignatureField) delete m_pSignatureField;
+ 
+@@ -51,21 +51,21 @@ PdfSignatureGenerator::~PdfSignatureGenerator() {
+ }
+ 
+ int PdfSignatureGenerator::Load(const char* pdf, int len) {
+-  if (m_pPdfDocument) delete m_pPdfDocument;
+  if (m_pPdfMemDocument) delete m_pPdfMemDocument;
+ 
+   try {
+     printf("PDF LENGTH");
+     printf("%i", len);
+     printf("STOP");
+ 
+-    m_pPdfDocument = new PdfMemDocument();
+-    m_pPdfDocument->Load(pdf, len);
+-    printf("OK m_pPdfDocument");
+-    int nSigns = PDFVerifier::GetNumberOfSignatures(m_pPdfDocument);
+    m_pPdfMemDocument = new PdfMemDocument();
+    m_pPdfMemDocument->Load(pdf);
+    printf("OK m_pPdfMemDocument");
+    int nSigns = PDFVerifier::GetNumberOfSignatures(m_pPdfMemDocument);
+     printf("OK nSigns: %d", nSigns);
+ 
+     if (nSigns > 0) {
+-      m_pPdfDocument->SetIncrementalUpdates(true);
+      m_pPdfWriter->PdfWriter::SetIncrementalUpdate(true);
+     }
+     m_actualLen = len;
+ 
+@@ -82,14 +82,8 @@ void PdfSignatureGenerator::AddFont(const char* szFontName,
+   // printf(szFontName);
+   // printf(szFontPath);
+ 
+-  m_pPdfDocument->CreateFont(
+-      szFontName, false, false,
+-      PdfEncodingFactory::GlobalWinAnsiEncodingInstance(),
+-      PdfFontCache::eFontCreationFlags_AutoSelectBase14, true, szFontPath);
+-  m_pPdfDocument->CreateFont(
+-      szFontName, true, false,
+-      PdfEncodingFactory::GlobalWinAnsiEncodingInstance(),
+-      PdfFontCache::eFontCreationFlags_AutoSelectBase14, true, szFontPath);
+  m_pPdfDocument->PoDoFo::PdfDocument::CreateFont( szFontName, false, PdfEncodingFactory::GlobalWinAnsiEncodingInstance(), PdfFontCache::eFontCreationFlags_AutoSelectBase14, true);
+  m_pPdfDocument->PoDoFo::PdfDocument::CreateFont( szFontName, true, PdfEncodingFactory::GlobalWinAnsiEncodingInstance(), PdfFontCache::eFontCreationFlags_AutoSelectBase14, true);
+ }
+ 
+ void PdfSignatureGenerator::InitSignature(
+@@ -130,7 +124,7 @@ void PdfSignatureGenerator::InitSignature(
+ 
+   if (m_pSignatureField) delete m_pSignatureField;
+ 
+-  PdfPage* pPage = m_pPdfDocument->GetPage(pageIndex);
+  PdfPage* pPage = m_pPdfMemDocument->GetPage(pageIndex);
+   PdfRect cropBox = pPage->GetCropBox();
+ 
+   float left0 = left * cropBox.GetWidth();
+@@ -145,15 +139,14 @@ void PdfSignatureGenerator::InitSignature(
+ 
+   LOG_DBG((0, "InitSignature", "PdfSignatureField"));
+ 
+-  m_pSignatureField = new PdfSignatureField(
+-      pPage, rect, m_pPdfDocument, PdfString(szFieldName), szSubFilter);
+  m_pSignatureField = new PdfSignatureField(pPage, rect, m_pPdfMemDocument);
+ 
+   LOG_DBG((0, "InitSignature", "PdfSignatureField OK"));
+ 
+   if (szReason && szReason[0]) {
+     PdfString reason(szReason);
+     PdfString reasonLabel(szReasonLabel);
+-    m_pSignatureField->SetSignatureReason(reasonLabel, reason);
+    m_pSignatureField->SetSignatureReason(reason);
+   }
+ 
+   LOG_DBG((0, "InitSignature", "szReason OK"));
+@@ -161,7 +154,7 @@ void PdfSignatureGenerator::InitSignature(
+   if (szLocation && szLocation[0]) {
+     PdfString location(szLocation);
+     PdfString locationLabel(szLocationLabel);
+-    m_pSignatureField->SetSignatureLocation(locationLabel, location);
+    m_pSignatureField->SetSignatureLocation(location);
+   }
+ 
+   LOG_DBG((0, "InitSignature", "szLocation OK"));
+@@ -171,54 +164,42 @@ void PdfSignatureGenerator::InitSignature(
+ 
+   LOG_DBG((0, "InitSignature", "Date OK"));
+ 
+-  if (szName && szName[0]) {
+-    PdfString name(szName);
+-    PdfString nameLabel(szNameLabel);
+-    m_pSignatureField->SetSignatureName(nameLabel, name);
+-  }
+-
+-  LOG_DBG((0, "InitSignature", "szName OK"));
+-
+-  m_pSignatureField->SetSignatureSize(SIGNATURE_SIZE);
+  m_pSignOutputDevice->PdfSignOutputDevice::SetSignatureSize(SIGNATURE_SIZE);
+ 
+   LOG_DBG((0, "InitSignature", "SIGNATURE_SIZE OK"));
+ 
+-  // if((szImagePath && szImagePath[0]) || (szDescription && szDescription[0]))
+-  if (width * height > 0) {
+-    try {
+-      // m_pSignatureField->SetFontSize(5);
+-      m_pSignatureField->SetAppearance(szImagePath, szDescription);
+-      LOG_DBG((0, "InitSignature", "SetAppearance OK"));
+-    } catch (PdfError& error) {
+-      LOG_ERR((0, "InitSignature", "SetAppearance error: %s, %s",
+-               PdfError::ErrorMessage(error.GetError()), error.what()));
+-    } catch (PdfError* perror) {
+-      LOG_ERR((0, "InitSignature", "SetAppearance error2: %s, %s",
+-               PdfError::ErrorMessage(perror->GetError()), perror->what()));
+-    } catch (std::exception& ex) {
+-      LOG_ERR(
+-          (0, "InitSignature", "SetAppearance std exception, %s", ex.what()));
+-    } catch (std::exception* pex) {
+-      LOG_ERR((0, "InitSignature", "SetAppearance std exception2, %s",
+-               pex->what()));
+-    } catch (...) {
+-      LOG_ERR((0, "InitSignature", "SetAppearance unknown error"));
+-    }
+-  }
+  // if (width * height > 0) {
+  //   try {
+  //     m_pSignatureField->SetAppearance(szImagePath, szDescription);
+  //     LOG_DBG((0, "InitSignature", "SetAppearance OK"));
+  //   } catch (PdfError& error) {
+  //     LOG_ERR((0, "InitSignature", "SetAppearance error: %s, %s",
+  //              PdfError::ErrorMessage(error.GetError()), error.what()));
+  //   } catch (PdfError* perror) {
+  //     LOG_ERR((0, "InitSignature", "SetAppearance error2: %s, %s",
+  //              PdfError::ErrorMessage(perror->GetError()), perror->what()));
+  //   } catch (std::exception& ex) {
+  //     LOG_ERR(
+  //         (0, "InitSignature", "SetAppearance std exception, %s",
+  //         ex.what()));
+  //   } catch (std::exception* pex) {
+  //     LOG_ERR((0, "InitSignature", "SetAppearance std exception2, %s",
+  //              pex->what()));
+  //   } catch (...) {
+  //     LOG_ERR((0, "InitSignature", "SetAppearance unknown error"));
+  //   }
+  // }
+ 
+-  if (szGraphometricData && szGraphometricData[0])
+-    m_pSignatureField->SetGraphometricData(
+-        PdfString("Aruba_Sign_Biometric_Data"), PdfString(szGraphometricData),
+-        PdfString(szVersion));
+  // if (szGraphometricData && szGraphometricData[0])
+  //   m_pSignatureField->SetGraphometricData(
+  //       PdfString("Aruba_Sign_Biometric_Data"),
+  //       PdfString(szGraphometricData), PdfString(szVersion));
+ 
+-  LOG_DBG((0, "InitSignature", "szGraphometricData OK"));
+  // LOG_DBG((0, "InitSignature", "szGraphometricData OK"));
+ 
+   LOG_DBG((0, "InitSignature", "m_actualLen %d", m_actualLen));
+   // crea il nuovo doc con il campo di firma
+-  int fulllen = m_actualLen * 2 + SIGNATURE_SIZE * 2 +
+-                (szGraphometricData
+-                     ? (strlen(szGraphometricData) + strlen(szVersion) + 100)
+-                     : 0);
+  int fulllen = m_actualLen * 2 + SIGNATURE_SIZE * 2;
+ 
+   int mainDoclen = 0;
+   m_pMainDocbuffer = NULL;
+@@ -227,7 +208,7 @@ void PdfSignatureGenerator::InitSignature(
+       LOG_DBG((0, "InitSignature", "fulllen %d", fulllen));
+       m_pMainDocbuffer = new char[fulllen];
+       PdfOutputDevice pdfOutDevice(m_pMainDocbuffer, fulllen);
+-      m_pPdfDocument->Write(&pdfOutDevice);
+      m_pPdfMemDocument->Write(&pdfOutDevice);
+       mainDoclen = pdfOutDevice.GetLength();
+     } catch (::PoDoFo::PdfError err) {
+       if (m_pMainDocbuffer) {
+@@ -301,32 +282,32 @@ void PdfSignatureGenerator::GetSignedPdf(UUCByteArray& signedPdf) {
+ }
+ 
+ const double PdfSignatureGenerator::getWidth(int pageIndex) {
+-  if (m_pPdfDocument) {
+-    PdfPage* pPage = m_pPdfDocument->GetPage(pageIndex);
+  if (m_pPdfMemDocument) {
+    PdfPage* pPage = m_pPdfMemDocument->GetPage(pageIndex);
+     return pPage->GetPageSize().GetWidth();
+   }
+   return 0;
+ }
+ 
+ const double PdfSignatureGenerator::getHeight(int pageIndex) {
+-  if (m_pPdfDocument) {
+-    PdfPage* pPage = m_pPdfDocument->GetPage(pageIndex);
+  if (m_pPdfMemDocument) {
+    PdfPage* pPage = m_pPdfMemDocument->GetPage(pageIndex);
+     return pPage->GetPageSize().GetHeight();
+   }
+   return 0;
+ }
+ 
+ const double PdfSignatureGenerator::lastSignatureY(int left, int bottom) {
+-  if (!m_pPdfDocument) return -1;
+  if (!m_pPdfMemDocument) return -1;
+   /// Find the document catalog dictionary
+-  const PdfObject* const trailer = m_pPdfDocument->GetTrailer();
+  const PdfObject* const trailer = m_pPdfMemDocument->GetTrailer();
+   if (!trailer->IsDictionary()) return -1;
+   const PdfObject* const catalogRef =
+       trailer->GetDictionary().GetKey(PdfName("Root"));
+   if (catalogRef == 0 || !catalogRef->IsReference())
+     return -2;  // throw std::invalid_argument("Invalid /Root entry");
+   const PdfObject* const catalog =
+-      m_pPdfDocument->GetObjects().GetObject(catalogRef->GetReference());
+      m_pPdfMemDocument->GetObjects().GetObject(catalogRef->GetReference());
+   if (catalog == 0 || !catalog->IsDictionary())
+     return -3;  // throw std::invalid_argument("Invalid or non-dictionary
+   // referenced by /Root entry");
+@@ -336,8 +317,8 @@ const double PdfSignatureGenerator::lastSignatureY(int left, int bottom) {
+       catalog->GetDictionary().GetKey(PdfName("AcroForm"));
+   if (acroFormValue == 0) return bottom;
+   if (acroFormValue->IsReference())
+-    acroFormValue =
+-        m_pPdfDocument->GetObjects().GetObject(acroFormValue->GetReference());
+    acroFormValue = m_pPdfMemDocument->GetObjects().GetObject(
+        acroFormValue->GetReference());
+ 
+   if (!acroFormValue->IsDictionary()) return bottom;
+ 
+@@ -346,8 +327,8 @@ const double PdfSignatureGenerator::lastSignatureY(int left, int bottom) {
+   if (fieldsValue == 0) return bottom;
+ 
+   if (fieldsValue->IsReference())
+-    fieldsValue =
+-        m_pPdfDocument->GetObjects().GetObject(acroFormValue->GetReference());
+    fieldsValue = m_pPdfMemDocument->GetObjects().GetObject(
+        acroFormValue->GetReference());
+ 
+   if (!fieldsValue->IsArray()) return bottom;
+ 
+@@ -360,8 +341,8 @@ const double PdfSignatureGenerator::lastSignatureY(int left, int bottom) {
+ 
+   for (unsigned int i = 0; i < array.size(); i++) {
+     const PdfObject* pObj =
+-        m_pPdfDocument->GetObjects().GetObject(array[i].GetReference());
+-    if (IsSignatureField(m_pPdfDocument, pObj)) {
+        m_pPdfMemDocument->GetObjects().GetObject(array[i].GetReference());
+    if (IsSignatureField(m_pPdfMemDocument, pObj)) {
+       const PdfObject* const keyRect =
+           pObj->GetDictionary().GetKey(PdfName("Rect"));
+       if (keyRect == 0) {
+diff --git a/libs/sign-sdk/src/disigonsdk.cpp b/libs/sign-sdk/src/disigonsdk.cpp
+index 250c93f..84e1b0b 100644
+--- a/libs/sign-sdk/src/disigonsdk.cpp
+++ b/libs/sign-sdk/src/disigonsdk.cpp
+@@ -5,6 +5,7 @@
+ 
+ #include <libxml/tree.h>
+ #include <libxml/xmlmemory.h>
+#include <podofo/podofo.h>
+ #include <stdlib.h>
+ #include <string.h>
+ 
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@ -1,24 +1,23 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
 }:

 buildGoModule rec {
  pname = "nuclei";
-  version = "3.2.2";
+  version = "3.2.3";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "nuclei";
    rev = "refs/tags/v${version}";
-    hash = "sha256-eYFHKXB6TSCLPMKiXvuSpt/2B+rbn7VZqoGEHp2vito=";
+    hash = "sha256-rcFgSblSXQUGu58cLbjGtvVfEa3AJUwkYEcrizqJTwM=";
  };

-  vendorHash = "sha256-s0hspa3fKMHmFPPwB0tCDJoGEH2JpgFUaIbiSQJTtr0=";
+  vendorHash = "sha256-Ttv25D7GAFjbP25AcRfKPu4wT3SMroAAf3px48IWZLA=";

-  subPackages = [
-    "cmd/nuclei/"
-  ];
+  subPackages = [ "cmd/nuclei/" ];

  ldflags = [
    "-w"
@ -40,7 +39,10 @@ buildGoModule rec {
    homepage = "https://github.com/projectdiscovery/nuclei";
    changelog = "https://github.com/projectdiscovery/nuclei/releases/tag/v${version}";
    license = licenses.mit;
-    maintainers = with maintainers; [ fab Misaka13514 ];
+    maintainers = with maintainers; [
+      fab
+      Misaka13514
+    ];
    mainProgram = "nuclei";
  };
 }
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -748,6 +748,8 @@ mapAliases ({

  lobster-two = google-fonts; # Added 2021-07-22
  luxcorerender = throw "'luxcorerender' has been removed as it's unmaintained and broken in nixpkgs since a while ago"; # Added 2023-06-07
+  lxd = lib.warn "lxd has been renamed to lxd-lts" lxd-lts; # Added 2024-04-01
+  lxd-unwrapped = lib.warn "lxd-unwrapped has been renamed to lxd-unwrapped-lts" lxd-unwrapped-lts; # Added 2024-04-01
  lzma = xz; # moved from top-level 2021-03-14

  ### M ###
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -10572,11 +10572,6 @@ with pkgs;

  lxc = callPackage ../os-specific/linux/lxc {  };

-  lxd = callPackage ../tools/admin/lxd/wrapper.nix { };
-  lxd-unwrapped = callPackage ../tools/admin/lxd {
-    buildGoModule = buildGo122Module;
-  };
-
  lxd-image-server = callPackage ../tools/virtualization/lxd-image-server { };

  lzfse = callPackage ../tools/compression/lzfse { };
@ -13100,8 +13095,6 @@ with pkgs;

  simple-mtpfs = callPackage ../tools/filesystems/simple-mtpfs { };

-  simplotask = callPackage ../tools/admin/simplotask { };
-
  simpleproxy = callPackage ../tools/networking/simpleproxy { };

  simplescreenrecorder = libsForQt5.callPackage ../applications/video/simplescreenrecorder { };
@ -17591,8 +17584,6 @@ with pkgs;
  php81Extensions = recurseIntoAttrs php81.extensions;
  php81Packages = recurseIntoAttrs php81.packages;

-  phpactor = callPackage ../development/tools/phpactor { };
-
  picoc = callPackage ../development/interpreters/picoc { };

  picolisp = callPackage ../development/interpreters/picolisp { };
@ -20118,7 +20109,7 @@ with pkgs;

  yams = callPackage ../applications/audio/yams { };

-  ycmd = callPackage ../development/tools/misc/ycmd {
+  ycmd = callPackage ../by-name/yc/ycmd/package.nix {
    inherit (darwin.apple_sdk.frameworks) Cocoa;
    python = python3;
  };
@ -21676,7 +21667,7 @@ with pkgs;

  hwloc = callPackage ../development/libraries/hwloc { };

-  hydra_unstable = callPackage ../development/tools/misc/hydra/unstable.nix { nix = nixVersions.nix_2_19; };
+  hydra_unstable = callPackage ../development/tools/misc/hydra/unstable.nix { nix = nixVersions.nix_2_20; };

  hydra-cli = callPackage ../development/tools/misc/hydra-cli { };

@ -22609,8 +22600,6 @@ with pkgs;

  libmediaart = callPackage ../development/libraries/libmediaart { };

-  libmediainfo = callPackage ../development/libraries/libmediainfo { };
-
  libmhash = callPackage ../development/libraries/libmhash { };

  libmodbus = callPackage ../development/libraries/libmodbus { };
@ -27800,7 +27789,7 @@ with pkgs;
    inherit (darwin.apple_sdk_11_0.frameworks) AppKit Security;
  };

-  nushellFull = nushell.override { additionalFeatures = p: p ++ ["dataframe" "extra"]; };
+  nushellFull = nushell.override { additionalFeatures = p: p ++ ["dataframe"]; };

  nu_scripts = callPackage ../shells/nushell/nu_scripts { };

@ -32993,10 +32982,6 @@ with pkgs;
  mediaelch-qt5 = libsForQt5.callPackage ../applications/misc/mediaelch { };
  mediaelch-qt6 = qt6Packages.callPackage ../applications/misc/mediaelch { };

-  mediainfo = callPackage ../applications/misc/mediainfo { };
-
-  mediainfo-gui = callPackage ../applications/misc/mediainfo-gui { };
-
  mediathekview = callPackage ../applications/video/mediathekview { jre = temurin-bin-20; };

  meteo = callPackage ../applications/networking/weather/meteo { };
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -11310,7 +11310,14 @@ with self; {
      hash = "sha256-cNxL8qp0mBx54V/SmNmY4FqS66SBHxrVyfH03jdzesw=";
    };
    propagatedBuildInputs = [ pkgs.gtk3 CairoGObject GlibObjectIntrospection ];
-    preCheck = lib.optionalString stdenv.isDarwin "rm t/overrides.t"; # Currently failing on macOS
+    preCheck = lib.optionalString stdenv.isDarwin ''
+      # Currently failing on macOS
+      rm t/overrides.t
+      rm t/signals.t
+      rm t/zz-GdkEvent.t
+      rm t/zz-GtkContainer.t
+      rm t/zz-GtkDialog.t
+    '';
    meta = {
      description = "Perl interface to the 3.x series of the gtk+ toolkit";
      license = with lib.licenses; [ lgpl21Plus ];
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -4646,6 +4646,8 @@ self: super: with self; {

  geocachingapi = callPackage ../development/python-modules/geocachingapi { };

+  geocoder = callPackage ../development/python-modules/geocoder { };
+
  geographiclib = callPackage ../development/python-modules/geographiclib { };

  geoip2 = callPackage ../development/python-modules/geoip2 { };
@ -5636,6 +5638,8 @@ self: super: with self; {

  img2pdf = callPackage ../development/python-modules/img2pdf { };

+  imgcat = callPackage ../development/python-modules/imgcat { };
+
  imgdiff = callPackage ../development/python-modules/imgdiff { };

  imgsize = callPackage ../development/python-modules/imgsize { };
@ -6730,6 +6734,8 @@ self: super: with self; {

  lingua = callPackage ../development/python-modules/lingua { };

+  lingva = callPackage ../development/python-modules/lingva { };
+
  linien-client = callPackage ../development/python-modules/linien-client { };

  linien-common = callPackage ../development/python-modules/linien-common { };
@ -7304,8 +7310,12 @@ self: super: with self; {

  microsoft-kiota-http = callPackage ../development/python-modules/microsoft-kiota-http { };

+  microsoft-kiota-serialization-form = callPackage ../development/python-modules/microsoft-kiota-serialization-form { };
+
  microsoft-kiota-serialization-json = callPackage ../development/python-modules/microsoft-kiota-serialization-json { };

+  microsoft-kiota-serialization-multipart = callPackage ../development/python-modules/microsoft-kiota-serialization-multipart { };
+
  microsoft-kiota-serialization-text = callPackage ../development/python-modules/microsoft-kiota-serialization-text { };

  midiutil = callPackage ../development/python-modules/midiutil { };
@ -9547,6 +9557,8 @@ self: super: with self; {

  msgraph-core = callPackage ../development/python-modules/msgraph-core { };

+  msgraph-sdk = callPackage ../development/python-modules/msgraph-sdk { };
+
  multipart = callPackage ../development/python-modules/multipart { };

  netmap = callPackage ../development/python-modules/netmap { };
@ -10076,6 +10088,8 @@ self: super: with self; {

  polygon3 = callPackage ../development/python-modules/polygon3 { };

+  polyswarm-api = callPackage ../development/python-modules/polyswarm-api { };
+
  pomegranate = callPackage ../development/python-modules/pomegranate { };

  pontos = callPackage ../development/python-modules/pontos { };