Merge staging-next into staging

2024-04-28 18:01:33 +00:00 · 2024-04-28 18:01:33 +00:00 · 8e098acf1d
commit 8e098acf1d
parent 3eebe15872 69117017f0
199 changed files with 1720 additions and 1696 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -13,7 +13,6 @@

 # GitHub actions
 /.github/workflows @NixOS/Security @Mic92 @zowoq
-/.github/workflows/merge-staging @FRidh

 # EditorConfig
 /.editorconfig @Mic92 @zowoq
@ -125,10 +124,8 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius @ma27
 /pkgs/common-updater/scripts/update-source-version    @jtojnar

 # Python-related code and docs
-/maintainers/scripts/update-python-libraries	              @FRidh
-/pkgs/development/interpreters/python                       @FRidh
-/doc/languages-frameworks/python.section.md                 @FRidh @mweinelt
-/pkgs/development/interpreters/python/hooks                 @FRidh @jonringer
+/doc/languages-frameworks/python.section.md                 @mweinelt
+/pkgs/development/interpreters/python/hooks                 @jonringer

 # Haskell
 /doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @ncfavier
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -878,7 +878,6 @@ buildPythonPackage rec {
    homepage = "https://github.com/pytoolz/toolz";
    description = "List processing tools and functional utilities";
    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
  };
 }
 ```
@ -1013,7 +1012,6 @@ buildPythonPackage rec {
    homepage = "https://github.com/ContinuumIO/datashape";
    description = "A data description language";
    license = lib.licenses.bsd2;
-    maintainers = with lib.maintainers; [ fridh ];
  };
 }
 ```
@ -1134,7 +1132,6 @@ buildPythonPackage rec {
    description = "A pythonic wrapper around FFTW, the FFT library, presenting a unified interface for all the supported transforms";
    homepage = "http://hgomersall.github.com/pyFFTW";
    license = with lib.licenses; [ bsd2 bsd3 ];
-    maintainers = with lib.maintainers; [ fridh ];
  };
 }
 ```
@ -1494,7 +1491,6 @@ buildPythonPackage rec {
    homepage = "https://github.com/pytoolz/toolz/";
    description = "List processing tools and functional utilities";
    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
  };
 }
 ```
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -1168,6 +1168,11 @@ in mkLicense lset) ({
    # channel and NixOS images.
  };

+  unicode-30 = {
+    spdxId = "Unicode-3.0";
+    fullName = "Unicode License v3";
+  };
+
  unicode-dfs-2015 = {
    spdxId = "Unicode-DFS-2015";
    fullName = "Unicode License Agreement - Data Files and Software (2015)";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1791,11 +1791,6 @@
      fingerprint = "409D 201E 9450 8732 A49E  D0FC 6BDA F874 0068 08DF";
    }];
  };
-  ashvith-shetty = {
-    github = "Ashvith10";
-    githubId = 113123021;
-    name = "Ashvith Shetty";
-  };
  asininemonkey = {
    email = "nixpkgs@asininemonkey.com";
    github = "asininemonkey";
@ -14633,12 +14628,6 @@
    githubId = 126072875;
    name = "nova madeline";
  };
-  novenary = {
-    email = "streetwalkermc@gmail.com";
-    github = "9ary";
-    githubId = 1155030;
-    name = "novenary";
-  };
  novoxd = {
    email = "radnovox@gmail.com";
    github = "novoxd";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -826,7 +826,6 @@ with lib.maintainers; {

  python = {
    members = [
-      fridh
      hexa
      jonringer
      tjni
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -203,6 +203,20 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `himalaya` was updated to v1.0.0-beta.4, which introduces breaking changes. Check out the [release note](https://github.com/soywod/himalaya/releases/tag/v1.0.0-beta.4) for details.

+- `security.pam.enableSSHAgentAuth` was replaced by the `sshAgentAuth` attrset, and **only**
+  `authorized_keys` files listed in [`sshAgentAuth.authorizedKeysFiles`] are trusted,
+  defaulting to `/etc/ssh/authorized_keys.d/%u`.
+  ::: {.warning}
+  Users of {manpage}`pam_ssh_agent_auth(8)` must take care that the pubkeys they use (for instance with `sudo`)
+  are listed in [`sshAgentAuth.authorizedKeysFiles`]..
+  :::
+  ::: {.note}
+  Previously, all `services.openssh.authorizedKeysFiles` were trusted, including `~/.ssh/authorized_keys`,
+  which results in an **insecure** configuration; see [#31611](https://github.com/NixOS/nixpkgs/issues/31611).
+  :::
+
+[`sshAgentAuth.authorizedKeysFiles`]: #opt-security.pam.sshAgentAuth.authorizedKeysFiles
+
 - The `power.ups` module now generates `upsd.conf`, `upsd.users` and `upsmon.conf` automatically from a set of new configuration options. This breaks compatibility with existing `power.ups` setups where these files were created manually. Back up these files before upgrading NixOS.

 - `programs.nix-ld.libraries` no longer sets `baseLibraries` via the option's default but in config and now merges any additional libraries with the default ones.
@ -307,6 +321,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `services.vikunja.setupNginx` setting has been removed. Users now need to setup the webserver configuration on their own with a proxy pass to the vikunja service.

+- `services.vmagent` module deprecates `dataDir`, `group` and `user` setting in favor of systemd provided CacheDirectory and DynamicUser.
+
+- `services.vmagent.remoteWriteUrl` setting has been renamed to `services.vmagent.remoteWrite.url` and now defaults to `null`.
+
 - `woodpecker-*` packages have been updated to v2 which includes [breaking changes](https://woodpecker-ci.org/docs/next/migrations#200).

 - `services.nginx` will no longer advertise HTTP/3 availability automatically. This must now be manually added, preferably to each location block.
@ -576,10 +594,6 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `mockgen` package source has changed to the [go.uber.org/mock](https://github.com/uber-go/mock) fork because [the original repository is no longer maintained](https://github.com/golang/mock#gomock).

- `security.pam.enableSSHAgentAuth` was renamed to `security.pam.sshAgentAuth.enable` and an `authorizedKeysFiles`
-  option was added, to control which `authorized_keys` files are trusted.  It defaults to the previous behaviour,
-  **which is insecure**: see [#31611](https://github.com/NixOS/nixpkgs/issues/31611).
-
 - [](#opt-boot.kernel.sysctl._net.core.wmem_max_) changed from a string to an integer because of the addition of a custom merge option (taking the highest value defined to avoid conflicts between 2 services trying to set that value), just as [](#opt-boot.kernel.sysctl._net.core.rmem_max_) since 22.11.

 - [TODO: reword to place an attribute at the front] A new top-level package set, `pkgsExtraHardening` is added. This is a set of packages built with stricter hardening flags - those that have not yet received enough testing to be applied universally, those that are more likely to cause build failures or those that have drawbacks to their use (e.g. performance or required hardware features).
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@ -1044,9 +1044,7 @@ in
          See [issue #31611](https://github.com/NixOS/nixpkgs/issues/31611)
          :::
        '';
-        example = [ "/etc/ssh/authorized_keys.d/%u" ];
-        default = config.services.openssh.authorizedKeysFiles;
-        defaultText = literalExpression "config.services.openssh.authorizedKeysFiles";
+        default = [ "/etc/ssh/authorized_keys.d/%u" ];
      };
    };

--- a/nixos/modules/services/monitoring/vmagent.nix
+++ b/nixos/modules/services/monitoring/vmagent.nix
@ -1,63 +1,62 @@
 { config, pkgs, lib, ... }:
-with lib;
+
 let
  cfg = config.services.vmagent;
  settingsFormat = pkgs.formats.json { };
 in {
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "vmagent" "dataDir" ] "dataDir has been deprecated in favor of systemd provided CacheDirectory")
+    (lib.mkRemovedOptionModule [ "services" "vmagent" "user" ] "user has been deprecated in favor of systemd DynamicUser")
+    (lib.mkRemovedOptionModule [ "services" "vmagent" "group" ] "group has been deprecated in favor of systemd DynamicUser")
+    (lib.mkRenamedOptionModule [ "services" "vmagent" "remoteWriteUrl" ] [ "services" "vmagent" "remoteWrite" "url" ])
+  ];
+
  options.services.vmagent = {
-    enable = mkEnableOption "vmagent";
+    enable = lib.mkEnableOption "vmagent";

-    user = mkOption {
-      default = "vmagent";
-      type = types.str;
-      description = ''
-        User account under which vmagent runs.
-      '';
+    package = lib.mkPackageOption pkgs "vmagent" { };
+
+    remoteWrite = {
+      url = lib.mkOption {
+        default = null;
+        type = lib.types.nullOr lib.types.str;
+        description = ''
+          Endpoint for prometheus compatible remote_write
+        '';
+      };
+      basicAuthUsername = lib.mkOption {
+        default = null;
+        type = lib.types.nullOr lib.types.str;
+        description = ''
+          Basic Auth username used to connect to remote_write endpoint
+        '';
+      };
+      basicAuthPasswordFile = lib.mkOption {
+        default = null;
+        type = lib.types.nullOr lib.types.str;
+        description = ''
+          File that contains the Basic Auth password used to connect to remote_write endpoint
+        '';
+      };
    };

-    group = mkOption {
-      type = types.str;
-      default = "vmagent";
-      description = ''
-        Group under which vmagent runs.
-      '';
-    };
-
-    package = mkPackageOption pkgs "vmagent" { };
-
-    dataDir = mkOption {
-      type = types.str;
-      default = "/var/lib/vmagent";
-      description = ''
-        The directory where vmagent stores its data files.
-      '';
-    };
-
-    remoteWriteUrl = mkOption {
-      default = "http://localhost:8428/api/v1/write";
-      type = types.str;
-      description = ''
-        The storage endpoint such as VictoriaMetrics
-      '';
-    };
-
-    prometheusConfig = mkOption {
+    prometheusConfig = lib.mkOption {
      type = lib.types.submodule { freeformType = settingsFormat.type; };
      description = ''
        Config for prometheus style metrics
      '';
    };

-    openFirewall = mkOption {
-      type = types.bool;
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
      default = false;
      description = ''
        Whether to open the firewall for the default ports.
      '';
    };

-    extraArgs = mkOption {
-      type = types.listOf types.str;
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
      default = [];
      description = ''
        Extra args to pass to `vmagent`. See the docs:
@ -67,37 +66,36 @@ in {
    };
  };

-  config = mkIf cfg.enable {
-    users.groups = mkIf (cfg.group == "vmagent") { vmagent = { }; };
-
-    users.users = mkIf (cfg.user == "vmagent") {
-      vmagent = {
-        group = cfg.group;
-        description = "vmagent daemon user";
-        home = cfg.dataDir;
-        isSystemUser = true;
-      };
-    };
-
-    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ 8429 ];
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ 8429 ];

    systemd.services.vmagent = let
      prometheusConfig = settingsFormat.generate "prometheusConfig.yaml" cfg.prometheusConfig;
+      startCommandLine = lib.concatStringsSep " " ([
+        "${cfg.package}/bin/vmagent"
+        "-promscrape.config=${prometheusConfig}"
+      ] ++ cfg.extraArgs
+        ++ lib.optionals (cfg.remoteWrite.url != null) [
+        "-remoteWrite.url=${cfg.remoteWrite.url}"
+        "-remoteWrite.tmpDataPath=%C/vmagent/remote_write_tmp"
+      ] ++ lib.optional (cfg.remoteWrite.basicAuthUsername != null) "-remoteWrite.basicAuth.username=${cfg.remoteWrite.basicAuthUsername}"
+        ++ lib.optional (cfg.remoteWrite.basicAuthPasswordFile != null) "-remoteWrite.basicAuth.passwordFile=\${CREDENTIALS_DIRECTORY}/remote_write_basic_auth_password");
    in {
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      description = "vmagent system service";
      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
+        DynamicUser = true;
+        User = "vmagent";
+        Group = "vmagent";
        Type = "simple";
        Restart = "on-failure";
-        WorkingDirectory = cfg.dataDir;
-        ExecStart = "${cfg.package}/bin/vmagent -remoteWrite.url=${cfg.remoteWriteUrl} -promscrape.config=${prometheusConfig} ${escapeShellArgs cfg.extraArgs}";
+        CacheDirectory = "vmagent";
+        ExecStart = startCommandLine;
+        LoadCredential = lib.optional (cfg.remoteWrite.basicAuthPasswordFile != null) [
+          "remote_write_basic_auth_password:${cfg.remoteWrite.basicAuthPasswordFile}"
+        ];
      };
    };
-
-    systemd.tmpfiles.rules =
-      [ "d '${cfg.dataDir}' 0755 ${cfg.user} ${cfg.group} -" ];
  };
 }
--- a/nixos/modules/services/networking/knot.nix
+++ b/nixos/modules/services/networking/knot.nix
@ -226,7 +226,7 @@ in {
      };

      settings = mkOption {
-        type = types.submodule { freeformType = types.attrs; };
+        type = (pkgs.formats.yaml {}).type;
        default = {};
        description = ''
          Extra configuration as nix values.
--- a/pkgs/applications/editors/kile/default.nix
+++ b/pkgs/applications/editors/kile/default.nix
@ -42,7 +42,6 @@ stdenv.mkDerivation rec {
  meta = {
    description = "User-friendly TeX/LaTeX authoring tool for the KDE desktop environment";
    homepage = "https://www.kde.org/applications/office/kile/";
-    maintainers = with lib.maintainers; [ fridh ];
    license = lib.licenses.gpl2Plus;
    mainProgram = "kile";
  };
--- a/pkgs/applications/kde/filelight.nix
+++ b/pkgs/applications/kde/filelight.nix
@ -20,7 +20,7 @@ mkDerivation {
    mainProgram = "filelight";
    homepage = "https://apps.kde.org/filelight/";
    license = with lib.licenses; [ gpl2 ];
-    maintainers = with lib.maintainers; [ fridh vcunat ];
+    maintainers = with lib.maintainers; [ vcunat ];
  };
  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
  propagatedBuildInputs = [
--- a/pkgs/applications/kde/kcalc.nix
+++ b/pkgs/applications/kde/kcalc.nix
@ -12,7 +12,6 @@ mkDerivation {
    description = "Scientific calculator";
    mainProgram = "kcalc";
    license = with lib.licenses; [ gpl2 ];
-    maintainers = [ lib.maintainers.fridh ];
  };
  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
  buildInputs = [
--- a/pkgs/applications/kde/kdeconnect-kde.nix
+++ b/pkgs/applications/kde/kdeconnect-kde.nix
@ -77,7 +77,6 @@ mkDerivation {
    description = "KDE Connect provides several features to integrate your phone and your computer";
    homepage = "https://community.kde.org/KDEConnect";
    license = with licenses; [ gpl2 ];
-    maintainers = with maintainers; [ fridh ];
    mainProgram = "kdeconnect-app";
  };
 }
--- a/pkgs/applications/kde/kolourpaint.nix
+++ b/pkgs/applications/kde/kolourpaint.nix
@ -20,7 +20,6 @@ mkDerivation {
    homepage = "https://apps.kde.org/kolourpaint/";
    description = "Paint program";
    mainProgram = "kolourpaint";
-    maintainers = [ lib.maintainers.fridh ];
    license = with lib.licenses; [ gpl2 ];
  };
 }
--- a/pkgs/applications/kde/kwalletmanager.nix
+++ b/pkgs/applications/kde/kwalletmanager.nix
@ -19,7 +19,6 @@ mkDerivation {
    description = "KDE wallet management tool";
    mainProgram = "kwalletmanager5";
    license = with lib.licenses; [ gpl2 ];
-    maintainers = with lib.maintainers; [ fridh ];
  };
  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
  buildInputs = [
--- a/pkgs/applications/kde/yakuake.nix
+++ b/pkgs/applications/kde/yakuake.nix
@ -29,7 +29,6 @@ mkDerivation {
    homepage = "https://yakuake.kde.org";
    description = "Quad-style terminal emulator for KDE";
    mainProgram = "yakuake";
-    maintainers = with lib.maintainers; [ fridh ];
    license = lib.licenses.gpl2;
  };
 }
--- a/pkgs/applications/misc/confclerk/default.nix
+++ b/pkgs/applications/misc/confclerk/default.nix
@ -2,11 +2,11 @@

 mkDerivation rec {
  pname = "confclerk";
-  version = "0.7.1";
+  version = "0.7.2";

  src = fetchurl {
    url = "https://www.toastfreeware.priv.at/tarballs/confclerk/confclerk-${version}.tar.gz";
-    sha256 = "0l5i4d6lymh0k6gzihs41x4i8v1dz0mrwpga096af0vchpvlcarg";
+    sha256 = "sha256-GgWvPHcQnQrK9SOC8U9F2P8kuPCn8I2EhoWEEMtKBww=";
  };

  buildInputs = [ qtbase ];
--- a/pkgs/applications/misc/remnote/default.nix
+++ b/pkgs/applications/misc/remnote/default.nix
@ -6,11 +6,11 @@ stdenv.mkDerivation (finalAttrs: let
 in
 {
  pname = "remnote";
-  version = "1.15.4";
+  version = "1.16.4";

  src = fetchurl {
    url = "https://download.remnote.io/remnote-desktop/RemNote-${version}.AppImage";
-    hash = "sha256-6WBdTOj/seinx1wJGb/4if3PzCPmtzHyNAFmQwmsrvE=";
+    hash = "sha256-dgbQ0cbPq7BSQ9VwwH6+GoAxb85HDxRixfjeDJBtOrg=";
  };

  appexec = appimageTools.wrapType2 {
--- a/pkgs/applications/misc/rofi-rbw/default.nix
+++ b/pkgs/applications/misc/rofi-rbw/default.nix
@ -17,14 +17,14 @@

 buildPythonApplication rec {
  pname = "rofi-rbw";
-  version = "1.3.0";
+  version = "1.4.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "fdw";
    repo = "rofi-rbw";
    rev = "refs/tags/${version}";
-    hash = "sha256-aTMKwb4BLupY0UmvPC86RnElZ9DFep8sApaMrlGbJ0M=";
+    hash = "sha256-1xbdZlZa3YPz+33AMgvhiMO12vc/ej0RybypQUzEn+8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -298,9 +298,6 @@ buildStdenv.mkDerivation {
  setOutputFlags = false; # `./mach configure` doesn't understand `--*dir=` flags.

  preConfigure = ''
-    # remove distributed configuration files
-    rm -f configure js/src/configure .mozconfig*
-
    # Runs autoconf through ./mach configure in configurePhase
    configureScript="$(realpath ./mach) configure"

@ -308,8 +305,8 @@ buildStdenv.mkDerivation {
    export MOZ_BUILD_DATE=$(head -n1 sourcestamp.txt)

    # Set predictable directories for build and state
-    export MOZ_OBJDIR=$(pwd)/mozobj
-    export MOZBUILD_STATE_PATH=$(pwd)/mozbuild
+    export MOZ_OBJDIR=$(pwd)/objdir
+    export MOZBUILD_STATE_PATH=$TMPDIR/mozbuild

    # Don't try to send libnotify notifications during build
    export MOZ_NOSPAM=1
@ -353,7 +350,7 @@ buildStdenv.mkDerivation {
      # since the profiling build has not been installed to $out
      ''
        OLD_LDFLAGS="$LDFLAGS"
-        LDFLAGS="-Wl,-rpath,$(pwd)/mozobj/dist/${binaryName}"
+        LDFLAGS="-Wl,-rpath,$(pwd)/objdir/dist/${binaryName}"
      ''}
    fi
  '' + lib.optionalString googleAPISupport ''
@ -510,7 +507,7 @@ buildStdenv.mkDerivation {
  '';

  preBuild = ''
-    cd mozobj
+    cd objdir
  '';

  postBuild = ''
@ -535,9 +532,9 @@ buildStdenv.mkDerivation {
  preInstall = lib.optionalString crashreporterSupport ''
    ./mach buildsymbols
    mkdir -p $symbols/
-    cp mozobj/dist/*.crashreporter-symbols.zip $symbols/
+    cp objdir/dist/*.crashreporter-symbols.zip $symbols/
  '' + ''
-    cd mozobj
+    cd objdir
  '';

  postInstall = ''
--- a/pkgs/applications/networking/browsers/microsoft-edge/default.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
@ -1,20 +1,20 @@
 {
  beta = import ./browser.nix {
    channel = "beta";
-    version = "124.0.2478.51";
+    version = "124.0.2478.67";
    revision = "1";
-    hash = "sha256-qQTRPkQBLRZhOqBT8U0PGcmmR2zNRxJiFl3N2UPwoSo=";
+    hash = "sha256-EywgM3G0Yph3dofullSVZpXSvT2MHc4uPyGAoaXCgN8=";
  };
  dev = import ./browser.nix {
    channel = "dev";
-    version = "125.0.2518.0";
+    version = "125.0.2535.6";
    revision = "1";
-    hash = "sha256-q4TVpO0SxSSLMv/NtmJIOzClT2WqUss2qfE5vgj4O7E=";
+    hash = "sha256-iD/e7AuPG0uNZY20wFQRbvAaKmaUw2RKeRJADU1MFRI=";
  };
  stable = import ./browser.nix {
    channel = "stable";
-    version = "124.0.2478.51";
+    version = "124.0.2478.67";
    revision = "1";
-    hash = "sha256-dAiTS+KvKVwL6tNp4YsQfH4wdNIJoBJngcLBXgHArjE=";
+    hash = "sha256-PRL2aiebCoK0eGJWlvI+Gsk14FltV+GaQdojLuDFimU=";
  };
 }
--- a/pkgs/applications/networking/cluster/helm/chart-testing/default.nix
+++ b/pkgs/applications/networking/cluster/helm/chart-testing/default.nix
@ -13,16 +13,16 @@

 buildGoModule rec {
  pname = "chart-testing";
-  version = "3.10.1";
+  version = "3.11.0";

  src = fetchFromGitHub {
    owner = "helm";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-btrnfL9U8k7jwo6ltVfbiSJFCX52zjfgf4E+IsWTYi4=";
+    hash = "sha256-eiU8omDEGDJVmumHwZkNix7qMVkoR6Irg0x9dTBzadA=";
  };

-  vendorHash = "sha256-E+7ndvXWzsU896/eWyupbvqkLed2ly91osptZKT79fk=";
+  vendorHash = "sha256-o9oZnQPztrK6HvclPt33Y05GQFWDsnUYti5x8R7aWS8=";

  postPatch = ''
    substituteInPlace pkg/config/config.go \
--- a/pkgs/applications/networking/cluster/kubedb-cli/default.nix
+++ b/pkgs/applications/networking/cluster/kubedb-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubedb-cli";
-  version = "0.44.0";
+  version = "0.45.0";

  src = fetchFromGitHub {
    owner = "kubedb";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-ppsGSzgJvAHRGs6PGPNgE7nDbK8SPYBPNbAlGwocAZs=";
+    sha256 = "sha256-4kmXz8dTxCaGbuAo3zK27BhUrecInwJCu9XOuiQY48A=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "chatterino2";
-  version = "2.5.0";
+  version = "2.5.1";
  src = fetchFromGitHub {
    owner = "Chatterino";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-uR2X0NNSLyOx5n3mZcp6+wW/7L7rHHH2MlOF+c0Uzm0=";
+    sha256 = "sha256-c3Vhzes54xLjKV0Of7D1eFpQvIWJwcUBXvLT2p6VwBE=";
    fetchSubmodules = true;
  };
  nativeBuildInputs = [ cmake pkg-config qt6.wrapQtAppsHook ];
--- a/pkgs/applications/networking/maestral-qt/default.nix
+++ b/pkgs/applications/networking/maestral-qt/default.nix
@ -10,14 +10,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "maestral-qt";
-  version = "1.9.2";
+  version = "1.9.3";
  disabled = python3.pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "SamSchott";
    repo = "maestral-qt";
    rev = "refs/tags/v${version}";
-    hash = "sha256-dgiVSwCTNDncbPJ+f0grjtq822TvtG0PhC9gDOKhwRI=";
+    hash = "sha256-7Lt0Neobtofd1JDoz8BhGn+nFKaMLbM/6z0QQmtEKpA=";
  };

  format = "pyproject";
--- a/pkgs/applications/networking/p2p/flood/default.nix
+++ b/pkgs/applications/networking/p2p/flood/default.nix
@ -5,16 +5,16 @@

 buildNpmPackage rec {
  pname = "flood";
-  version = "unstable-2023-06-03";
+  version = "4.8.0";

  src = fetchFromGitHub {
    owner = "jesec";
    repo = pname;
-    rev = "2b652f8148dab7134eeeb201b9d81dd6b8bda074";
-    hash = "sha256-wI6URPGUZUbydSgNaHN2C5IA2x/HHjBWIRT6H6iZU/0=";
+    rev = "v${version}";
+    hash = "sha256-hth8tk2DHuBGNAXdjknbdQinuwWJ//QF0e23neeTExw=";
  };

-  npmDepsHash = "sha256-XmDnvq+ni5TOf3UQFc4JvGI3LiGpjbrLAocRvrW8qgk=";
+  npmDepsHash = "sha256-WlQ/u7yIbuFETsmbW7ddAOO7OVrNPOXR3ja3N0aFWRE=";

  meta = with lib; {
    description = "Modern web UI for various torrent clients with a Node.js backend and React frontend";
--- a/pkgs/applications/science/biology/mafft/default.nix
+++ b/pkgs/applications/science/biology/mafft/default.nix
@ -1,14 +1,20 @@
-{ lib, stdenv, fetchFromGitLab }:
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  runCommand,
+  mafft,
+}:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "mafft";
-  version = "7.525";
+  version = "7.526";

  src = fetchFromGitLab {
    owner = "sysimm";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-ckBmvFssYAmYcBHAEftjQqBV0MB0theGfemaPx3XUws=";
+    repo = "mafft";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-VNe00r12qEkLEbpZdJCe5xZ73JA3uAmuAeG+eSeRDI0=";
  };

  preBuild = ''
@ -16,14 +22,34 @@ stdenv.mkDerivation rec {
    make clean
  '';

-  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "PREFIX=$(out)" ];
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "PREFIX=$(out)"
+  ];

-  meta = with lib;
-    {
-      description = "Multiple alignment program for amino acid or nucleotide sequences";
-      homepage = "https://mafft.cbrc.jp/alignment/software/";
-      license = licenses.bsd3;
-      maintainers = with maintainers; [ natsukium ];
-      platforms = platforms.unix;
-    };
-}
+  passthru.tests = {
+    simple = runCommand "${finalAttrs.pname}-test" { } ''
+      mkdir $out
+      cd ${finalAttrs.src}/test
+      ${lib.getExe mafft} sample > $out/test.fftns2
+      ${lib.getExe mafft} --maxiterate 100  sample > $out/test.fftnsi
+      ${lib.getExe mafft} --globalpair sample > $out/test.gins1
+      ${lib.getExe mafft} --globalpair --maxiterate 100  sample > $out/test.ginsi
+      ${lib.getExe mafft} --localpair sample > $out/test.lins1
+      ${lib.getExe mafft} --localpair --maxiterate 100  sample > $out/test.linsi
+      diff $out/test.fftns2 sample.fftns2
+      diff $out/test.fftnsi sample.fftnsi
+      diff $out/test.gins1 sample.gins1
+      diff $out/test.ginsi sample.ginsi
+      diff $out/test.lins1 sample.lins1
+    '';
+  };
+
+  meta = with lib; {
+    description = "Multiple alignment program for amino acid or nucleotide sequences";
+    homepage = "https://mafft.cbrc.jp/alignment/software/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ natsukium ];
+    platforms = platforms.unix;
+  };
+})
--- a/pkgs/applications/science/electronics/kicad/versions.nix
+++ b/pkgs/applications/science/electronics/kicad/versions.nix
@ -3,23 +3,23 @@
 {
  "kicad" = {
    kicadVersion = {
-      version =			"8.0.1";
+      version =			"8.0.2";
      src = {
-        rev =			"20421d65e5a7ede894345d337ab47b469f5ba154";
-        sha256 =		"096kvmm96ccxir1rspgzzjkp6y2j80l3w2vphg9iv3drxmjp7qjv";
+        rev =			"55a4d4f5e2f54be6ccf74a8919d04684c9df4c50";
+        sha256 =		"069ycii9zvdxwxd73afd6bp975r1555yvifi9zdb77qyvn0d9nr9";
      };
    };
    libVersion = {
-      version =			"8.0.1";
+      version =			"8.0.2";
      libSources = {
-        symbols.rev =		"d6aff3948edfca2bacf36900ff080f6b3f65fe4c";
-        symbols.sha256 =	"00xnvikmqd1zkg9p1f89kvryvkybl5f20baij6babqyc29nbzkwy";
-        templates.rev =		"0a6c4f798a68a5c639d54b4d3093460ab9267816";
-        templates.sha256 =	"0m9bggz3cm27kqpjjwxy19mqzk0c69bywcjkqcni7kafr21c6k4z";
-        footprints.rev =	"226b4f3d5c10a4126d88b895188bdab629fe60b0";
-        footprints.sha256 =	"1bb3mb2a7vkridgmqqm9ib3hv2m4zx1i14mglb11sribypy0ma5p";
-        packages3d.rev =	"49c1cd4017499b8a7f6dedbe7ede834d1713eb28";
-        packages3d.sha256 =	"0b5jwr5bbd0kzb75nj3028knjrv0872dk54sbsnxaz669q8zaxap";
+        symbols.rev =		"099ac0c8ac402a685fde00b1369e34a116e29661";
+        symbols.sha256 =	"0w333f89yw2m0zlpkg0k6hfwlj10snm8laihdjnsb22asyz4pbhn";
+        templates.rev =		"2e2da58e02707d327d59d4101c401a82dc9a26f6";
+        templates.sha256 =	"073a6cyvzzy0vmkj3ip4ziq7b7pcizs70nm5acw838dxghjfyv3v";
+        footprints.rev =	"e8c30550cde4945cbe1bf30cccf0b3c1e2bda6c6";
+        footprints.sha256 =	"10j8qjljc1fv8k4zp3zn0da33g57hn6pgrgmbgp18dsa539xvxcz";
+        packages3d.rev =	"249f7947587529026e1676cd70c8d7493a8d8162";
+        packages3d.sha256 =	"04gvfb54jhnww2qwrxc27wpyrvmjasdc4xhr0ridl7dglh4qcp35";
      };
    };
  };
--- a/pkgs/applications/science/math/eigenmath/default.nix
+++ b/pkgs/applications/science/math/eigenmath/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "eigenmath";
-  version = "unstable-2024-04-19";
+  version = "unstable-2024-04-26";

  src = fetchFromGitHub {
    owner = "georgeweigt";
    repo = pname;
-    rev = "5d5a538e7c378e9e2d9fabdf88fa2c6dd6d13e2c";
-    hash = "sha256-vPj3YKNJAZgdhw/VVrJIo2P7IyHrt7hVpnUQCUCZmR8=";
+    rev = "14a55ff60d078b752033b4ae29d332b04b6e8912";
+    hash = "sha256-p7wcLmssTqs3LCkZWB9rhCXEc4IVgZJNBvRhS51oH5E=";
  };

  checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''
--- a/pkgs/applications/version-management/ghorg/default.nix
+++ b/pkgs/applications/version-management/ghorg/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "ghorg";
-  version = "1.9.10";
+  version = "1.9.11";

  src = fetchFromGitHub {
    owner = "gabrie30";
    repo = "ghorg";
    rev = "v${version}";
-    sha256 = "sha256-UU8iOpfM5RMwlDceDXofs3Nzyy93zcsUOuTGw/kzVe8=";
+    sha256 = "sha256-22/HM/DYkNh8V1v09fca6/3TLwzYudpH/VNbh+3+iyE=";
  };

  doCheck = false;
--- a/pkgs/applications/version-management/git-quick-stats/default.nix
+++ b/pkgs/applications/version-management/git-quick-stats/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "git-quick-stats";
-  version = "2.5.4";
+  version = "2.5.5";

  src = fetchFromGitHub {
    repo = "git-quick-stats";
    owner = "arzzen";
    rev = version;
-    sha256 = "sha256-dbi48rq3ijPa45xtTi6kAly/IwkX4aK1P9hmcPNQEqM=";
+    sha256 = "sha256-7riA3yYw2D8+x/wzzbv0RF+zHCtqVC1ZpVANZp9x2AQ=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/version-management/gitprompt-rs/default.nix
+++ b/pkgs/applications/version-management/gitprompt-rs/default.nix
@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
    description = "Simple Git prompt";
    homepage = "https://github.com/9ary/gitprompt-rs";
    license = with licenses; [ mpl20 ];
-    maintainers = with maintainers; [ novenary ];
+    maintainers = with maintainers; [ ];
    mainProgram = "gitprompt-rs";
  };
 }
--- a/pkgs/applications/virtualization/cloud-hypervisor/Cargo.lock
+++ b/pkgs/applications/virtualization/cloud-hypervisor/Cargo.lock
--- a/pkgs/applications/virtualization/cloud-hypervisor/default.nix
+++ b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
@ -2,27 +2,25 @@

 rustPlatform.buildRustPackage rec {
  pname = "cloud-hypervisor";
-  version = "38.0";
+  version = "39.0";

  src = fetchFromGitHub {
    owner = "cloud-hypervisor";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Lhug7DCa+QutlvksL6EFQa04UK/sWebDIkqQmwPUpX4=";
+    hash = "sha256-sMnfeICo/PhpljstTIj4CiE4QBuyVKYD9oWvWf0Ouew=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "acpi_tables-0.1.0" = "sha256-syDq+db1hTne6QoP0vMGUv4tB0J9arQG2Ea2hHW1k3M=";
-      "igvm-0.1.0" = "sha256-l+Qyhdy3b8h8hPLHg5M0os8aSkjM55hAP5nqi0AGmjo=";
-      "kvm-bindings-0.7.0" = "sha256-hXv5N3TTwGQaVxdQ/DTzLt+uwLxFnstJwNhxRD2K8TM=";
-      "micro_http-0.1.0" = "sha256-gyeOop6AMXEIbLXhJMN/oYGGU8Un8Y0nFZc9ucCa0y4=";
-      "mshv-bindings-0.1.1" = "sha256-yWvkpOcW3lV47s+rWnN4Bki8tt8CkiPVZ0I36nrWMi4=";
-      "versionize_derive-0.1.6" = "sha256-eI9fM8WnEBZvskPhU67IWeN6QAPg2u5EBT+AOxfb/fY=";
-      "vfio-bindings-0.4.0" = "sha256-Dk4T2dMzPZ+Aoq1YSXX2z1Nky8zvyDl7b+A8NH57Hkc=";
+      "acpi_tables-0.1.0" = "sha256-a6ojB2XVeH+YzzXRle0agg+ljn0Jsgyaf6TJZAGt8sQ=";
+      "igvm-0.1.9" = "sha256-OztgRiv+//27MS9SqSBJPbrVlXihK2m9UkG4REZ9Vn0=";
+      "micro_http-0.1.0" = "sha256-yIgcoEfc7eeS1+bijzkifaBxVNHa71Y+Vn79owMaKvM=";
+      "mshv-bindings-0.1.1" = "sha256-US/AzS7iRUQijkGs1EG04Hk4Q7dPz65BeTMsI8rtMqw=";
+      "vfio-bindings-0.4.0" = "sha256-k8Hf5y8MiTnd3k2iEgnnX/o8VdVS7prKlnssyEerVRM=";
      "vfio_user-0.1.0" = "sha256-LJ84k9pMkSAaWkuaUd+2LnPXnNgrP5LdbPOc1Yjz5xA=";
-      "vm-fdt-0.2.0" = "sha256-lKW4ZUraHomSDyxgNlD5qTaBTZqM0Fwhhh/08yhrjyE=";
+      "vm-fdt-0.3.0" = "sha256-9PywgSnSL+8gT6lcl9t6w7X4fEINa+db+H1vWS+gDOI=";
    };
  };

--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -55,11 +55,11 @@ stdenv.mkDerivation (finalAttrs: {
    + lib.optionalString hostCpuOnly "-host-cpu-only"
    + lib.optionalString nixosTestRunner "-for-vm-tests"
    + lib.optionalString toolsOnly "-utils";
-  version = "8.2.2";
+  version = "8.2.3";

  src = fetchurl {
    url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-hHNGwbgsGlSyw49u29hVSe3rF0MLfU09oSYg4pYrxPM=";
+    hash = "sha256-d1sRjKpjZiCnr0saFWRFoaKA9a1Ss7y7F/jilkhB21g=";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ]
--- a/pkgs/applications/video/bilibili/default.nix
+++ b/pkgs/applications/video/bilibili/default.nix
--- a/pkgs/applications/editors/codux/default.nix
+++ b/pkgs/applications/editors/codux/default.nix
--- a/pkgs/by-name/cs/csvlens/package.nix
+++ b/pkgs/by-name/cs/csvlens/package.nix
@ -7,20 +7,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "csvlens";
-  version = "0.8.1";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "YS-L";
    repo = "csvlens";
    rev = "refs/tags/v${version}";
-    hash = "sha256-4lKiqojBF8mqAp56eTDfJcK276IzEDLA3pORKIZpC94=";
+    hash = "sha256-Qpda9qADnj3eGz+nvD6VgxUOwTXrFI1rMam6+sfK6MQ=";
  };

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    darwin.apple_sdk.frameworks.AppKit
  ];

-  cargoHash = "sha256-EzM7qGor/B17N4KDTsQzgiV4pgXE2D47RZcrmKVkPu8=";
+  cargoHash = "sha256-PDOuAz+ov1S7i7TpRp4YaeoQQJ4paal6FI0VU25d4zU=";

  meta = with lib; {
    description = "Command line csv viewer";
--- a/pkgs/by-name/gi/gitlab-ci-local/package.nix
+++ b/pkgs/by-name/gi/gitlab-ci-local/package.nix
@ -6,16 +6,16 @@

 buildNpmPackage rec {
  pname = "gitlab-ci-local";
-  version = "4.47.0";
+  version = "4.48.2";

  src = fetchFromGitHub {
    owner = "firecow";
    repo = "gitlab-ci-local";
    rev = version;
-    hash = "sha256-AMqifAdC4aPra/KfM0Z8L1mF6+lA0dv9tt/cXSd3Ov4=";
+    hash = "sha256-QdbVI6aby/UQCR3G25nvmvoXNMDndgLYz/hOTmj5dnc=";
  };

-  npmDepsHash = "sha256-GVqGA4aMfA08j/+fy+DA6udi52lmfDeAkE59d9CMAqg=";
+  npmDepsHash = "sha256-ebrdMbSAsughHCuV86s6WA12a8hqA2yyC/rJUyViOrI=";

  postPatch = ''
    # remove cleanup which runs git commands
--- a/pkgs/tools/security/grype/default.nix
+++ b/pkgs/tools/security/grype/default.nix
--- a/pkgs/applications/networking/cluster/karmor/default.nix
+++ b/pkgs/applications/networking/cluster/karmor/default.nix
--- a/pkgs/by-name/ko/koodo-reader/package.nix
+++ b/pkgs/by-name/ko/koodo-reader/package.nix
@ -7,6 +7,7 @@
  fetchYarnDeps,
  makeDesktopItem,
  copyDesktopItems,
+  makeWrapper,
  wrapGAppsHook3,
  electron,
 }:
@ -37,6 +38,7 @@ mkYarnPackage rec {

  nativeBuildInputs = [
    copyDesktopItems
+    makeWrapper
    wrapGAppsHook3
  ];

@ -77,8 +79,9 @@ mkYarnPackage rec {
    runHook postInstall
  '';

+  # we use makeShellWrapper instead of the makeBinaryWrapper provided by wrapGAppsHook for proper shell variable expansion
  postFixup = ''
-    makeWrapper ${electron}/bin/electron $out/bin/koodo-reader \
+    makeShellWrapper ${electron}/bin/electron $out/bin/koodo-reader \
      --add-flags $out/share/lib/koodo-reader/resources/app.asar \
      "''${gappsWrapperArgs[@]}" \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
--- a/pkgs/by-name/la/labelle/package.nix
+++ b/pkgs/by-name/la/labelle/package.nix
@ -8,14 +8,14 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "labelle";
-  version = "1.1.0";
+  version = "1.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "labelle-org";
    repo = "labelle";
    rev = "v${version}";
-    hash = "sha256-JnV5A3/toTCHCEb0dygouR9MZfk2kdmsKVscwYI2y/Y=";
+    hash = "sha256-fLlYqJs/V5t8IdfVkfBsjtjM1rRdCyTYF87G+h1VU5Y=";
  };

  postPatch = ''
@ -39,6 +39,8 @@ python3Packages.buildPythonApplication rec {
    pyqt6
    python-barcode
    pyusb
+    rich
+    typer
  ];

  desktopItems = [
--- a/pkgs/by-name/lu/lunacy/package.nix
+++ b/pkgs/by-name/lu/lunacy/package.nix
@ -18,11 +18,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lunacy";
-  version = "9.5.0";
+  version = "9.6.0";

  src = fetchurl {
    url = "https://lcdn.icons8.com/setup/Lunacy_${finalAttrs.version}.deb";
-    hash = "sha256-dG2xLoqRQJsaR7v00iN46GP4jB8WVrxayn2CSQLCUlQ=";
+    hash = "sha256-PvQGDUC9BsIql4xMM1OH45gq3YtJMKJcYg4N2o18hno=";
  };

  unpackCmd = ''
--- a/pkgs/by-name/lx/lx-music-desktop/package.nix
+++ b/pkgs/by-name/lx/lx-music-desktop/package.nix
@ -0,0 +1,88 @@
+{ lib
+, stdenv
+, fetchurl
+, makeWrapper
+
+, dpkg
+, libGL
+, systemd
+, electron_28
+
+, commandLineArgs ? ""
+}:
+
+let
+  pname = "lx-music-desktop";
+  version = "2.7.0";
+
+  buildUrl = version: arch: "https://github.com/lyswhut/lx-music-desktop/releases/download/v${version}/lx-music-desktop_${version}_${arch}.deb";
+
+  srcs = {
+    x86_64-linux = fetchurl {
+      url = buildUrl version "amd64";
+      hash = "sha256-+mCAFfiJwa+RQ/9vnSPDrC1LoLIoZyFUEJAF6sXdqRM=";
+    };
+
+    aarch64-linux = fetchurl {
+      url = buildUrl version "arm64";
+      hash = "sha256-fDlgHJqoZLGnUuZeZGdocYLbsE02QBrWPKS31fbGThk=";
+    };
+
+    armv7l-linux = fetchurl {
+      url = buildUrl version "armv7l";
+      hash = "sha256-X6EXsBvTbPGXCJ+ektMCMGDG2zqGKBvWT/TwjGFL3ug=";
+    };
+  };
+
+  host = stdenv.hostPlatform.system;
+  src = srcs.${host} or (throw "Unsupported system: ${host}");
+
+  runtimeLibs = lib.makeLibraryPath [
+    libGL
+    stdenv.cc.cc.lib
+  ];
+in
+stdenv.mkDerivation {
+  inherit pname version src;
+
+  nativeBuildInputs = [
+    dpkg
+    makeWrapper
+  ];
+
+  runtimeDependencies = map lib.getLib [
+    systemd
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/opt/lx-music-desktop
+    cp -r opt/lx-music-desktop/{resources,locales} $out/opt/lx-music-desktop
+    cp -r usr/share $out/share
+
+    substituteInPlace $out/share/applications/lx-music-desktop.desktop \
+        --replace-fail "/opt/lx-music-desktop/lx-music-desktop" "$out/bin/lx-music-desktop" \
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper ${electron_28}/bin/electron $out/bin/lx-music-desktop \
+        --add-flags $out/opt/lx-music-desktop/resources/app.asar \
+        --prefix LD_LIBRARY_PATH : "${runtimeLibs}" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+        --add-flags ${lib.escapeShellArg commandLineArgs} \
+  '';
+
+  meta = with lib; {
+    description = "A music software based on Electron and Vue";
+    homepage = "https://github.com/lyswhut/lx-music-desktop";
+    changelog = "https://github.com/lyswhut/lx-music-desktop/releases/tag/v${version}";
+    license = licenses.asl20;
+    platforms = [ "x86_64-linux" "aarch64-linux" "armv7l-linux" ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    mainProgram = "lx-music-desktop";
+    maintainers = with maintainers; [ oo-infty ];
+  };
+}
--- a/pkgs/by-name/mi/mixxc/package.nix
+++ b/pkgs/by-name/mi/mixxc/package.nix
@ -13,6 +13,7 @@
  enableSass ? true,
  enableX11 ? true,
 }:
+
 rustPlatform.buildRustPackage rec {
  pname = "mixxc";
  version = "0.2.2";
@ -26,10 +27,11 @@ rustPlatform.buildRustPackage rec {
  cargoHash = "sha256-l9inqqUiLObrqd/8pNobwBbLaiPJD39YK/38CWfDh+Q=";

  cargoBuildFlags = [ "--locked" ];
-  buildFeatures = with lib; [
-    (optionals enableWayland "Wayland")
-    (optionals enableX11 "X11")
-    (optionals enableSass "Sass")
+
+  buildFeatures = [
+    (lib.optionals enableWayland "Wayland")
+    (lib.optionals enableX11 "X11")
+    (lib.optionals enableSass "Sass")
  ];

  nativeBuildInputs = [
@ -37,11 +39,12 @@ rustPlatform.buildRustPackage rec {
    installShellFiles
    wrapGAppsHook4
  ];
-  buildInputs = with lib; [
+
+  buildInputs = [
    libpulseaudio
    gtk4
-    (optionals enableWayland gtk4-layer-shell)
-    (optionals enableX11 libxcb)
+    (lib.optionals enableWayland gtk4-layer-shell)
+    (lib.optionals enableX11 libxcb)
  ];

  outputs = [
@ -53,12 +56,12 @@ rustPlatform.buildRustPackage rec {
    installManPage $src/doc/mixxc.1
  '';

-  meta = with lib; {
+  meta = {
    description = "A minimalistic and customizable volume mixer";
    homepage = "https://github.com/Elvyria/mixxc";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ daru-san ];
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [ daru-san ];
    mainProgram = "mixxc";
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/by-name/oe/oelint-adv/package.nix
+++ b/pkgs/by-name/oe/oelint-adv/package.nix
@ -6,13 +6,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "oelint-adv";
-  version = "5.3.0";
+  version = "5.3.1";
  format = "setuptools";

  src = fetchPypi {
    inherit version;
    pname = "oelint_adv";
-    hash = "sha256-EAYHxp7pXXYNYRGsQ3XckRxDM1pFHgiZr+gj8fJLqa0=";
+    hash = "sha256-8fftHQpv2GZhi3ZDXYUG7uAiWuuX79dntGAbKIvv4Kc=";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/by-name/qr/qrtool/package.nix
+++ b/pkgs/by-name/qr/qrtool/package.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "qrtool";
-  version = "0.10.9";
+  version = "0.10.10";

  src = fetchFromGitHub {
    owner = "sorairolake";
    repo = "qrtool";
    rev = "v${version}";
-    sha256 = "sha256-wLi2lb48+leH7AfpIj0/vDxPZhBjvuacVit8U8zArjs=";
+    sha256 = "sha256-2gUvnQjAA0nTeJL4IbsfCmeSD+mGKjywJCCi914f5mM=";
  };

-  cargoHash = "sha256-igbRsNWPtE/KcSLqzKIFEm3lmdkIxj/22yo/8Gye96k=";
+  cargoHash = "sha256-M5G5f+aycpIbFaPbkUNalMK3if1PIAXD7MaNsLzdvI4=";

  nativeBuildInputs = [ asciidoctor installShellFiles ];

--- a/pkgs/by-name/st/stirling-pdf/package.nix
+++ b/pkgs/by-name/st/stirling-pdf/package.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "stirling-pdf";
-  version = "0.23.0";
+  version = "0.23.1";

  src = fetchFromGitHub {
    owner = "Stirling-Tools";
    repo = "Stirling-PDF";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-MKNXjQSSjpGeIBeXUy42vQkCf3zEQyR3q1/j3xWVFvw=";
+    hash = "sha256-71caSM4J0sNMqWX0ok8aO3wdpVcjfrn/yVGLWeO5fOk=";
  };

  patches = [
--- a/pkgs/tools/admin/syft/default.nix
+++ b/pkgs/tools/admin/syft/default.nix
--- a/pkgs/by-name/ta/taler-exchange/package.nix
+++ b/pkgs/by-name/ta/taler-exchange/package.nix
@ -21,7 +21,7 @@
 }:

 let
-  version = "0.10.1";
+  version = "0.10.2";
 in
 stdenv.mkDerivation {
  pname = "taler-exchange";
@ -31,14 +31,7 @@ stdenv.mkDerivation {
    url = "https://git.taler.net/exchange.git";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-SKnMep8bMQaJt4r3u0SrzwYSuFbzv4RnflbutSqwtPg=";
-
-    # When fetching submodules without the .git folder we get the following error:
-    # "Server does not allow request for unadvertised object"
-    leaveDotGit = true;
-    postFetch = ''
-      rm -rf $out/.git
-    '';
+    hash = "sha256-dl8lZ7uKUr+KSUaT4xlkaX3W5UoW2Zfu/0iVXvLejnA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ta/taler-merchant/package.nix
+++ b/pkgs/by-name/ta/taler-merchant/package.nix
@ -12,12 +12,12 @@
 }:

 let
-  version = "0.10.1";
+  version = "0.10.2";

  taler-wallet-core = fetchgit {
    url = "https://git.taler.net/wallet-core.git";
    rev = "v${version}";
-    hash = "sha256-sgiJd1snN9JDqS7IUeORKL60Gcm7XwL/JCX3sNRDTdY=";
+    hash = "sha256-jC8XhcHZxv7ww+wspJUqTq6x6FIeEehQmE03ttJZWT4=";
  };
 in
 stdenv.mkDerivation {
@ -28,7 +28,7 @@ stdenv.mkDerivation {
    url = "https://git.taler.net/merchant.git";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-8VpoyloLpd/HckSIRU6IclWUXQyEHqlcNdoJI9U3t0Y=";
+    hash = "sha256-WY5Fk5HcVjxsnqt69m8E9ikW+nQDkCuKtT1CTsupz5c=";
  };

  postUnpack = ''
--- a/pkgs/applications/networking/cluster/terraform-compliance/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-compliance/default.nix
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
--- a/pkgs/by-name/tu/tuifimanager/package.nix
+++ b/pkgs/by-name/tu/tuifimanager/package.nix
@ -5,14 +5,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "tuifimanager";
-  version = "4.0.0";
+  version = "4.0.5";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "GiorgosXou";
    repo = "TUIFIManager";
-    rev = "v${version}";
-    hash = "sha256-bv/+x2xppUK9i3HOm93FIQRu1xlB4wCKZzAapkVlrM0=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-DuCrIJuADmJ0MHIP0+OJ0zCrQR/oGdgzJ1xck4m/tPo=";
  };

  nativeBuildInputs = [
@ -34,7 +34,6 @@ python3.pkgs.buildPythonApplication rec {
      attempt to get more attention to the Uni-Curses project.
    '';
    homepage = "https://github.com/GiorgosXou/TUIFIManager";
-    changelog = "https://github.com/GiorgosXou/TUIFIManager/blob/${src.rev}/CHANGELOG.md";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ michaelBelsanti sigmanificient ];
    mainProgram = "tuifi";
--- a/pkgs/by-name/un/universal-android-debloater/package.nix
+++ b/pkgs/by-name/un/universal-android-debloater/package.nix
@ -6,6 +6,8 @@
 , freetype
 , lib
 , libglvnd
+, libxkbcommon
+, wayland
 , makeWrapper
 , mold
 , pkg-config
@ -47,7 +49,7 @@ rustPlatform.buildRustPackage rec {

  postInstall = ''
    wrapProgram $out/bin/uad-ng \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ fontconfig freetype libglvnd xorg.libX11 xorg.libXcursor xorg.libXi xorg.libXrandr ]} \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ fontconfig freetype libglvnd libxkbcommon wayland xorg.libX11 xorg.libXcursor xorg.libXi xorg.libXrandr ]} \
      --suffix PATH : ${lib.makeBinPath [ android-tools ]}
  '';

@ -57,7 +59,7 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation";
    license = licenses.gpl3Only;
    mainProgram = "uad-ng";
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ lavafroth ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/by-name/ve/vencord/package-lock.json
+++ b/pkgs/by-name/ve/vencord/package-lock.json
@ -1,12 +1,12 @@
 {
    "name": "vencord",
-    "version": "1.7.8",
+    "version": "1.7.9",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
        "": {
            "name": "vencord",
-            "version": "1.7.8",
+            "version": "1.7.9",
            "license": "GPL-3.0-or-later",
            "dependencies": {
                "@sapphi-red/web-noise-suppressor": "0.3.3",
@ -54,15 +54,6 @@
                "pnpm": ">=8"
            }
        },
-        "node_modules/@aashutoshrathi/word-wrap": {
-            "version": "1.2.6",
-            "resolved": "https://registry.npmjs.org/@aashutoshrathi/word-wrap/-/word-wrap-1.2.6.tgz",
-            "integrity": "sha512-1Yjs2SvM8TflER/OD3cOjhWWOZb58A2t7wpE2S9XfBYTiIl+XFhQG2bjy4Pu1I+EAlCNUzRDYDdFwFYUKvXcIA==",
-            "dev": true,
-            "engines": {
-                "node": ">=0.10.0"
-            }
-        },
        "node_modules/@babel/code-frame": {
            "version": "7.24.2",
            "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.24.2.tgz",
@ -779,9 +770,9 @@
            }
        },
        "node_modules/@types/diff": {
-            "version": "5.0.9",
-            "resolved": "https://registry.npmjs.org/@types/diff/-/diff-5.0.9.tgz",
-            "integrity": "sha512-RWVEhh/zGXpAVF/ZChwNnv7r4rvqzJ7lYNSmZSVTxjV0PBLf6Qu7RNg+SUtkpzxmiNkjCx0Xn2tPp7FIkshJwQ==",
+            "version": "5.2.0",
+            "resolved": "https://registry.npmjs.org/@types/diff/-/diff-5.2.0.tgz",
+            "integrity": "sha512-pjJH+02ukgJRW0mViDUA1cdC+wzSgRu0e4cPuogPLAw0i66y62iMP0ZlXoJAmoXrKRZnF3pMDwyKZsgNVlMX4A==",
            "dev": true
        },
        "node_modules/@types/filesystem": {
@ -845,9 +836,9 @@
            "dev": true
        },
        "node_modules/@types/react": {
-            "version": "18.2.79",
-            "resolved": "https://registry.npmjs.org/@types/react/-/react-18.2.79.tgz",
-            "integrity": "sha512-RwGAGXPl9kSXwdNTafkOEuFrTBD5SA2B3iEB96xi8+xu5ddUa/cpvyVCSNn+asgLCTHkb5ZxN8gbuibYJi4s1w==",
+            "version": "18.3.1",
+            "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.1.tgz",
+            "integrity": "sha512-V0kuGBX3+prX+DQ/7r2qsv1NsdfnCLnTgnRJ1pYnxykBhGMz+qj+box5lq7XsO5mtZsBqpjwwTu/7wszPfMBcw==",
            "dev": true,
            "dependencies": {
                "@types/prop-types": "*",
@ -855,9 +846,9 @@
            }
        },
        "node_modules/@types/react-dom": {
-            "version": "18.2.25",
-            "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-18.2.25.tgz",
-            "integrity": "sha512-o/V48vf4MQh7juIKZU2QGDfli6p1+OOi5oXx36Hffpc9adsHeXjVp8rHuPkjd8VT8sOJ2Zp05HR7CdpGTIUFUA==",
+            "version": "18.3.0",
+            "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-18.3.0.tgz",
+            "integrity": "sha512-EhwApuTmMBmXuFOikhQLIBUn6uFg81SwLMOAUgodJF14SOBOCMdU04gDoYi0WOJJHD144TL32z4yDqCW3dnkQg==",
            "dev": true,
            "dependencies": {
                "@types/react": "*"
@ -1658,9 +1649,9 @@
            }
        },
        "node_modules/css-functions-list": {
-            "version": "3.2.1",
-            "resolved": "https://registry.npmjs.org/css-functions-list/-/css-functions-list-3.2.1.tgz",
-            "integrity": "sha512-Nj5YcaGgBtuUmn1D7oHqPW0c9iui7xsTsj5lIX8ZgevdfhmjFfKB3r8moHJtNJnctnYXJyYX5I1pp90HM4TPgQ==",
+            "version": "3.2.2",
+            "resolved": "https://registry.npmjs.org/css-functions-list/-/css-functions-list-3.2.2.tgz",
+            "integrity": "sha512-c+N0v6wbKVxTu5gOBBFkr9BEdBWaqqjQeiJ8QvSRIJOf+UxlJh930m8e6/WNeODIK0mYLFkoONrnj16i2EcvfQ==",
            "dev": true,
            "engines": {
                "node": ">=12 || >=16"
@ -2779,8 +2770,7 @@
        "node_modules/gifenc": {
            "version": "1.0.3",
            "resolved": "git+ssh://git@github.com/mattdesl/gifenc.git#64842fca317b112a8590f8fef2bf3825da8f6fe3",
-            "integrity": "sha512-TCgWVyjxLxM20WaQQT5neiMbdt2cuFL0BngwxcK8sV9x+M6IF0x3RIETc3VRVxfmRUxzZk+Yfv1b9cLdDnTRIw==",
-            "license": "MIT"
+            "integrity": "sha512-TCgWVyjxLxM20WaQQT5neiMbdt2cuFL0BngwxcK8sV9x+M6IF0x3RIETc3VRVxfmRUxzZk+Yfv1b9cLdDnTRIw=="
        },
        "node_modules/glob": {
            "version": "7.2.3",
@ -3823,17 +3813,17 @@
            }
        },
        "node_modules/optionator": {
-            "version": "0.9.3",
-            "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.3.tgz",
-            "integrity": "sha512-JjCoypp+jKn1ttEFExxhetCKeJt9zhAgAve5FXHixTvFDW/5aEktX9bufBKLRRMdU7bNtpLfcGu94B3cdEJgjg==",
+            "version": "0.9.4",
+            "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
+            "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
            "dev": true,
            "dependencies": {
-                "@aashutoshrathi/word-wrap": "^1.2.3",
                "deep-is": "^0.1.3",
                "fast-levenshtein": "^2.0.6",
                "levn": "^0.4.1",
                "prelude-ls": "^1.2.1",
-                "type-check": "^0.4.0"
+                "type-check": "^0.4.0",
+                "word-wrap": "^1.2.5"
            },
            "engines": {
                "node": ">= 0.8.0"
@ -5435,6 +5425,15 @@
                "node": ">= 8"
            }
        },
+        "node_modules/word-wrap": {
+            "version": "1.2.5",
+            "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
+            "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
+            "dev": true,
+            "engines": {
+                "node": ">=0.10.0"
+            }
+        },
        "node_modules/wrap-ansi": {
            "version": "7.0.0",
            "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@ -5,8 +5,8 @@
 , buildWebExtension ? false
 }:
 let
-  version = "1.7.8";
-  gitHash = "97ce410";
+  version = "1.7.9";
+  gitHash = "d294128";
 in
 buildNpmPackage rec {
  pname = "vencord";
@ -16,7 +16,7 @@ buildNpmPackage rec {
    owner = "Vendicated";
    repo = "Vencord";
    rev = "v${version}";
-    hash = "sha256-5kMBUdFupVxmlQ7NVJ7qzFoyQieDGHrFNkrzhlhEzJ0=";
+    hash = "sha256-iXcWz/ZqhCQnqS37LVTXYW+1eeos0AUA0O5URb2FELU=";
  };

  ESBUILD_BINARY_PATH = lib.getExe (esbuild.overrideAttrs (final: _: {
@ -34,7 +34,7 @@ buildNpmPackage rec {
  npmRebuildFlags = [ "|| true" ];

  makeCacheWritable = true;
-  npmDepsHash = "sha256-LdLPNM2yCUXh0PxAbzI2YNF6QoX1iG2TixMh6XdVuX0=";
+  npmDepsHash = "sha256-G3adLiSrEyAShTsNEaYLEPYACHoXTISiNp/9jru0mUc=";
  npmFlags = [ "--legacy-peer-deps" ];
  npmBuildScript = if buildWebExtension then "buildWeb" else "build";
  npmBuildFlags = [ "--" "--standalone" "--disable-updater" ];
--- a/pkgs/by-name/wl/wlogout/package.nix
+++ b/pkgs/by-name/wl/wlogout/package.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "wlogout";
-  version = "1.2.1";
+  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "ArtsyMacaw";
    repo = "wlogout";
    rev = finalAttrs.version;
-    hash = "sha256-n8r+E6GXXjyDYBTOMiv5musamaUFSpRTM2qHgb047og=";
+    hash = "sha256-/tYZy56ku68ziSOhy6Dex9RGy+blkU6CN2ze76y7718=";
  };

  outputs = [ "out" "man" ];
--- a/pkgs/by-name/xc/xclicker/package.nix
+++ b/pkgs/by-name/xc/xclicker/package.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@ -12,23 +11,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xclicker";
-  version = "1.5.0";
+  version = "1.5.1";

  src = fetchFromGitHub {
    owner = "robiot";
    repo = "xclicker";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-3D49iMzCCT9Z2Pf5INHYFZusG0BQI7La7lLaSVM/4mc=";
+    hash = "sha256-zVbOfqh21+/41N3FcAFajcZCrQ8iNqedZjgNQO0Zj04=";
  };

-  patches = [
-    (fetchpatch {
-      name = "fix-malloc-size.patch";
-      url = "https://github.com/robiot/xclicker/commit/c99f69a747e9df75fb3676be20a3ec805526d022.patch";
-      hash = "sha256-ESbMBusJVNfbGxlEn1Kby00mnXvM5H0r03bX5ofC6Fg=";
-    })
-  ];
-
  nativeBuildInputs = [
    meson
    ninja
@ -57,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://xclicker.xyz/";
    license = lib.licenses.gpl3Only;
    mainProgram = "xclicker";
-    maintainers = with lib.maintainers; [ tomasajt ];
+    maintainers = with lib.maintainers; [ gepbird tomasajt ];
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/applications/misc/xlights/default.nix
+++ b/pkgs/applications/misc/xlights/default.nix
--- a/pkgs/by-name/ya/yamlscript/package.nix
+++ b/pkgs/by-name/ya/yamlscript/package.nix
@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "yamlscript";
-  version = "0.1.57";
+  version = "0.1.58";

  src = fetchurl {
    url = "https://github.com/yaml/yamlscript/releases/download/${version}/yamlscript.cli-${version}-standalone.jar";
-    hash = "sha256-nuYfYz1Q7PtVb9A2KEN2XGeINifEjsM4IqGiUBbTGFM=";
+    hash = "sha256-rARUkbVq77uPrQZwfQ0NNM4XwYaVhSinLi0sCoVR63E=";
  };

  executable = "ys";
--- a/pkgs/common-updater/unstable-updater.nix
+++ b/pkgs/common-updater/unstable-updater.nix
@ -1,5 +1,5 @@
 { lib
-, writeShellScript
+, writeShellApplication
 , coreutils
 , git
 , nix
@ -10,114 +10,162 @@
 # commit.
 { url ? null # The git url, if empty it will be set to src.gitRepoUrl
 , branch ? null
-, stableVersion ? false # Use version format according to RFC 107 (i.e. LAST_TAG+date=YYYY-MM-DD)
-, tagPrefix ? "" # strip this prefix from a tag name when using stable version
+, hardcodeZeroVersion ? false # Use a made-up version "0" instead of latest tag. Use when there is no previous release, or the project's tagging system is incompatible with what we expect from versions
+, tagFormat ? "*" # A `git describe --tags --match '<format>'` pattern that tags must match to be considered
+, tagPrefix ? null # strip this prefix from a tag name
+, tagConverter ? null # A command to convert more complex tag formats. It receives the git tag via stdin and should convert it into x.y.z format to stdout
 , shallowClone ? true
 }:

+assert lib.asserts.assertMsg (tagPrefix == null || tagConverter == null) "Can only use either tagPrefix or tagConverter!";
+
 let
-  updateScript = writeShellScript "unstable-update-script.sh" ''
-    set -ex
+  updateScript = writeShellApplication {
+    name = "unstable-update-script";
+    runtimeInputs = [
+      common-updater-scripts
+      coreutils
+      git
+      nix
+    ];
+    text = ''
+      set -ex

-    url=""
-    branch=""
-    use_stable_version=""
-    tag_prefix=""
-    shallow_clone=""
+      url=""
+      branch=""
+      hardcode_zero_version=""
+      tag_format=""
+      tag_prefix=""
+      tag_converter=""
+      shallow_clone=""
+      : "''${systemArg:=}"

-    while (( $# > 0 )); do
-        flag="$1"
-        shift 1
-        case "$flag" in
-          --url=*)
-            url="''${flag#*=}"
-            ;;
-          --branch=*)
-            branch="''${flag#*=}"
-            ;;
-          --use-stable-version)
-            use_stable_version=1
-            ;;
-          --tag-prefix=*)
-            tag_prefix="''${flag#*=}"
-            ;;
-          --shallow-clone)
-            shallow_clone=1
-            ;;
-          *)
-            echo "$0: unknown option ‘''${flag}’"
-            exit 1
-            ;;
-        esac
-    done
+      while (( $# > 0 )); do
+          flag="$1"
+          shift 1
+          case "$flag" in
+            --url=*)
+              url="''${flag#*=}"
+              ;;
+            --branch=*)
+              branch="''${flag#*=}"
+              ;;
+            --hardcode-zero-version)
+              hardcode_zero_version=1
+              ;;
+            --tag-format=*)
+              tag_format="''${flag#*=}"
+              ;;
+            --tag-prefix=*)
+              tag_prefix="''${flag#*=}"
+              ;;
+            --tag-converter=*)
+              tag_converter="''${flag#*=}"
+              ;;
+            --shallow-clone)
+              shallow_clone=1
+              ;;
+            *)
+              echo "$0: unknown option ‘''${flag}’"
+              exit 1
+              ;;
+          esac
+      done

-    # By default we set url to src.gitRepoUrl
-    if [[ -z "$url" ]]; then
-        url="$(${nix}/bin/nix-instantiate $systemArg --eval -E \
-                   "with import ./. {}; $UPDATE_NIX_ATTR_PATH.src.gitRepoUrl" \
-            | tr -d '"')"
-    fi
+      # By default we set url to src.gitRepoUrl
+      if [[ -z "$url" ]]; then
+          # system argument cannot be passed as 1 argument
+          # shellcheck disable=SC2086
+          url="$(nix-instantiate $systemArg --eval -E \
+                     "with import ./. {}; $UPDATE_NIX_ATTR_PATH.src.gitRepoUrl" \
+              | tr -d '"')"
+      fi

-    # Get info about HEAD from a shallow git clone
-    tmpdir="$(${coreutils}/bin/mktemp -d)"
+      # Get info about HEAD from a shallow git clone
+      tmpdir="$(mktemp -d)"

-    cloneArgs=(
-      --bare
-    )
+      cloneArgs=()

-    if [[ "$shallow_clone" == "1" ]]; then
-        cloneArgs+=(--depth=1)
-    fi
+      if [[ "$shallow_clone" == "1" ]]; then
+          cloneArgs+=(--depth=1)
+      fi

-    if [[ -n "$branch" ]]; then
-        cloneArgs+=(--branch="$branch")
-    fi
+      if [[ -n "$branch" ]]; then
+          cloneArgs+=(--branch="$branch")
+      fi

-    ${git}/bin/git clone "''${cloneArgs[@]}" "$url" "$tmpdir"
+      git clone "''${cloneArgs[@]}" "$url" "$tmpdir"
+      getLatestVersion() {
+          git describe --tags --abbrev=0 --match "''${tag_format}" 2> /dev/null || true
+      }

-    pushd "$tmpdir"
-    commit_date="$(${git}/bin/git show -s --pretty='format:%cs')"
-    commit_sha="$(${git}/bin/git show -s --pretty='format:%H')"
-    if [[ -z "$use_stable_version" ]]; then
-        new_version="unstable-$commit_date"
-    else
-        depth=100
-        while (( $depth < 10000 )); do
-            last_tag="$(${git}/bin/git describe --tags --abbrev=0 2> /dev/null || true)"
-            if [[ -n "$last_tag" ]]; then
-                break
-            fi
-            ${git}/bin/git fetch --depth="$depth" --tags
-            depth=$(( $depth * 2 ))
-        done
-        if [[ -z "$last_tag" ]]; then
-            echo "Cound not found a tag within last 10000 commits" > /dev/stderr
-            exit 1
-        fi
-        if [[ -n "$tag_prefix" ]]; then
-          last_tag="''${last_tag#$tag_prefix}"
-        fi
-        new_version="$last_tag+date=$commit_date"
-    fi
-    popd
-    # ${coreutils}/bin/rm -rf "$tmpdir"
+      pushd "$tmpdir"
+      commit_date="$(git show -s --pretty='format:%cs')"
+      commit_sha="$(git show -s --pretty='format:%H')"
+      last_tag=""
+      if [[ -z "$hardcode_zero_version" ]]; then
+          if [[ "$shallow_clone" == "1" ]]; then
+              depth=100
+              while (( depth < 10000 )); do
+                  last_tag="$(getLatestVersion)"
+                  if [[ -n "$last_tag" ]]; then
+                      break
+                  fi
+                  git fetch --depth="$depth" --tags
+                  depth=$(( depth * 2 ))
+              done

-    # update the nix expression
-    ${common-updater-scripts}/bin/update-source-version \
-        "$UPDATE_NIX_ATTR_PATH" \
-        "$new_version" \
-        --rev="$commit_sha"
-  '';
+              if [[ -z "$last_tag" ]]; then
+                  # To be extra sure, check if full history helps with finding a tag
+                  git fetch --tags
+                  last_tag="$(getLatestVersion)"
+              fi
+          else
+              last_tag="$(getLatestVersion)"
+          fi
+          if [[ -z "$last_tag" ]]; then
+              last_tag="0"
+          fi
+          if [[ -n "$tag_prefix" ]]; then
+              echo "Stripping prefix '$tag_prefix' from tag '$last_tag'"
+              last_tag="''${last_tag#"''${tag_prefix}"}"
+          fi
+          if [[ -n "$tag_converter" ]]; then
+              echo "Running '$last_tag' through: $tag_converter"
+              last_tag="$(echo "''${last_tag}" | ''${tag_converter})"
+          fi
+      else
+          last_tag="0"
+      fi
+      if [[ ! "$last_tag" =~ ^[[:digit:]] ]]; then
+          echo "Last tag '$last_tag' does not start with a digit" > /dev/stderr
+          exit 1
+      fi
+      new_version="$last_tag-unstable-$commit_date"
+      popd
+      # rm -rf "$tmpdir"
+
+      # update the nix expression
+      update-source-version \
+          "$UPDATE_NIX_ATTR_PATH" \
+          "$new_version" \
+          --rev="$commit_sha"
+    '';
+  };

 in
 [
-  updateScript
+  (lib.getExe updateScript)
  "--url=${builtins.toString url}"
+  "--tag-format=${tagFormat}"
 ] ++ lib.optionals (branch != null) [
  "--branch=${branch}"
-] ++ lib.optionals stableVersion [
-  "--use-stable-version"
+] ++ lib.optionals (tagPrefix != null) [
  "--tag-prefix=${tagPrefix}"
+] ++ lib.optionals (tagConverter != null) [
+  "--tag-converter=${tagConverter}"
+] ++ lib.optionals hardcodeZeroVersion [
+  "--hardcode-zero-version"
 ] ++ lib.optionals shallowClone [
  "--shallow-clone"
 ]
--- a/pkgs/data/icons/tau-hydrogen/default.nix
+++ b/pkgs/data/icons/tau-hydrogen/default.nix
@ -31,6 +31,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/tau-OS/tau-hydrogen";
    license = licenses.gpl3Only;
    platforms = platforms.unix;
-    maintainers = with maintainers; [ ashvith-shetty ];
+    maintainers = [ ];
  };
 })
--- a/pkgs/data/misc/cldr-annotations/default.nix
+++ b/pkgs/data/misc/cldr-annotations/default.nix
@ -2,12 +2,12 @@

 stdenvNoCC.mkDerivation rec {
  pname = "cldr-annotations";
-  version = "44.0";
+  version = "45.0";

  src = fetchzip {
    url = "https://unicode.org/Public/cldr/${lib.versions.major version}/cldr-common-${version}.zip";
    stripRoot = false;
-    hash = "sha256-oK+NlzuRF45laEMJKhNDzr12RF4CHIfDFNBFsIjJh1I=";
+    hash = "sha256-8Id9thc3LWSw87aNpuSjQuLmFsx+XvXcz8Ox1Ua3sJw=";
  };

  installPhase = ''
@ -22,7 +22,7 @@ stdenvNoCC.mkDerivation rec {
  meta = with lib; {
    description = "Names and keywords for Unicode characters from the Common Locale Data Repository";
    homepage = "https://cldr.unicode.org";
-    license = licenses.unicode-dfs-2016;
+    license = licenses.unicode-30;
    platforms = platforms.all;
    maintainers = with maintainers; [ DeeUnderscore ];
  };
--- a/pkgs/data/themes/dracula-theme/default.nix
+++ b/pkgs/data/themes/dracula-theme/default.nix
@ -2,7 +2,7 @@

 let
  themeName = "Dracula";
-  version = "unstable-2024-04-16";
+  version = "unstable-2024-04-24";
 in
 stdenvNoCC.mkDerivation {
  pname = "dracula-theme";
@ -11,8 +11,8 @@ stdenvNoCC.mkDerivation {
  src = fetchFromGitHub {
    owner = "dracula";
    repo = "gtk";
-    rev = "557e276b41b00bbdc981c32f22ce6adc062d7c1e";
-    hash = "sha256-il9zpzJeszGJ1gLkG73mtaMD8nBUFCfCXjcJV1fizxg=";
+    rev = "5e9a46b7610da0944a8131bbf08487861cae2c46";
+    hash = "sha256-pKKEZ/GheyIf6pPb+Sz4AfF8oRlf1Jk4cl0tub5Ye10=";
  };

  propagatedUserEnvPkgs = [
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, callPackage, clisp, coreutils, fetchurl, strace, texinfo, which, writeText, zstd
+{ lib, stdenv, callPackage, ecl, coreutils, fetchurl, strace, texinfo, which, writeText, zstd
 , threadSupport ? (stdenv.hostPlatform.isx86 || "aarch64-linux" == stdenv.hostPlatform.system || "aarch64-darwin" == stdenv.hostPlatform.system)
 , linkableRuntime ? stdenv.hostPlatform.isx86
 , disableImmobileSpace ? false
@ -6,14 +6,14 @@
  # Note that the created binaries still need `patchelf --set-interpreter ...`
  # to get rid of ${glibc} dependency.
 , purgeNixReferences ? false
-, coreCompression ? lib.versionAtLeast version "2.2.6"
-, markRegionGC ? lib.versionAtLeast version "2.4.0"
+, coreCompression ? true
+, markRegionGC ? true
 , version
-  # Set this to a lisp binary to use a custom bootstrap lisp compiler for
-  # SBCL. Leave as null to use the default. This is useful for local development
-  # of SBCL, because you can use your existing stock SBCL as a boostrap. On Hydra
+  # Set this to a lisp binary to use a custom bootstrap lisp compiler for SBCL.
+  # Leave as null to use the default.  This is useful for local development of
+  # SBCL, because you can use your existing stock SBCL as a boostrap.  On Hydra
  # of course we can’t do that because SBCL hasn’t been built yet, so we use
-  # CLISP, but that’s much slower.
+  # ECL but that’s much slower.
 , bootstrapLisp ? null
 }:

@ -27,16 +27,10 @@ let
    };
  };
  # Collection of pre-built SBCL binaries for platforms that need them for
-  # bootstrapping. Ideally these are to be avoided.  If CLISP (or any other
+  # bootstrapping. Ideally these are to be avoided.  If ECL (or any other
  # non-binary-distributed Lisp) can run on any of these systems, that entry
  # should be removed from this list.
  bootstrapBinaries = rec {
-    # This build segfaults using CLISP.
-    x86_64-darwin = {
-      version = "2.2.9";
-      system = "x86-64-darwin";
-      sha256 = "sha256-b1BLkoLIOELAYBYA9eBmMgm1OxMxJewzNP96C9ADfKY=";
-    };
    i686-linux = {
      version = "1.2.7";
      system = "x86-linux";
@ -67,7 +61,7 @@ let
    then bootstrapLisp
    else if (builtins.hasAttr stdenv.hostPlatform.system bootstrapBinaries)
    then "${sbclBootstrap}/bin/sbcl --disable-debugger --no-userinit --no-sysinit"
-    else "${clisp}/bin/clisp -E UTF-8 --silent -norc";
+    else "${lib.getExe ecl} --norc";

 in

@ -173,15 +167,8 @@ stdenv.mkDerivation (self: rec {
    "--arch=arm64"
  ];

-  env.NIX_CFLAGS_COMPILE = toString (lib.optionals (lib.versionOlder self.version "2.1.10") [
-    # Workaround build failure on -fno-common toolchains like upstream
-    # clang-13. Without the change build fails as:
-    #   duplicate symbol '_static_code_space_free_pointer' in: alloc.o traceroot.o
-    # Should be fixed past 2.1.10 release.
-    "-fcommon"
-  ]
-    # Fails to find `O_LARGEFILE` otherwise.
-    ++ [ "-D_GNU_SOURCE" ]);
+  # Fails to find `O_LARGEFILE` otherwise.
+  env.NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";

  buildPhase = ''
    runHook preBuild
@ -241,6 +228,7 @@ stdenv.mkDerivation (self: rec {
    platforms = attrNames bootstrapBinaries ++ [
      # These aren’t bootstrapped using the binary distribution but compiled
      # using a separate (lisp) host
+      "x86_64-darwin"
      "x86_64-linux"
      "aarch64-darwin"
      "aarch64-linux"
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@ -350,7 +350,6 @@ in with passthru; stdenv.mkDerivation ({
      '';
      license = lib.licenses.psfl;
      platforms = lib.platforms.all;
-      maintainers = with lib.maintainers; [ fridh ];
      knownVulnerabilities = [
        "Python 2.7 has reached its end of life after 2020-01-01. See https://www.python.org/doc/sunset-python-2/."
        # Quote: That means that we will not improve it anymore after that day,
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@ -662,7 +662,6 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
    license = licenses.psfl;
    pkgConfigModules = [ "python3" ];
    platforms = platforms.linux ++ platforms.darwin ++ platforms.windows;
-    maintainers = with maintainers; [ fridh ];
    mainProgram = executable;
  };
 })
--- a/pkgs/development/libraries/babl/default.nix
+++ b/pkgs/development/libraries/babl/default.nix
@ -1,30 +1,36 @@
 { stdenv
 , lib
-, fetchpatch
 , fetchurl
 , meson
 , ninja
 , pkg-config
+, gi-docgen
 , gobject-introspection
 , lcms2
 , vala
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "babl";
-  version = "0.1.106";
+  version = "0.1.108";

-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" "devdoc" ];

  src = fetchurl {
-    url = "https://download.gimp.org/pub/babl/${lib.versions.majorMinor version}/babl-${version}.tar.xz";
-    hash = "sha256-0yUTXTME8IjBNMxiABOs8DXeLl0SWlCi2RBU5zd8QV8=";
+    url = "https://download.gimp.org/pub/babl/${lib.versions.majorMinor finalAttrs.version}/babl-${finalAttrs.version}.tar.xz";
+    hash = "sha256-Jt7+neqresTQ4HbKtJwqDW69DfDDH9IJklpfB+3uFHU=";
  };

+  patches = [
+    # Allow overriding path to dev output that will be hardcoded e.g. in pkg-config file.
+    ./dev-prefix.patch
+  ];
+
  nativeBuildInputs = [
    meson
    ninja
    pkg-config
+    gi-docgen
    gobject-introspection
    vala
  ];
@ -33,6 +39,15 @@ stdenv.mkDerivation rec {
    lcms2
  ];

+  mesonFlags = [
+    "-Dprefix-dev=${placeholder "dev"}"
+  ];
+
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
+
  meta = with lib; {
    description = "Image pixel format conversion library";
    mainProgram = "babl";
@ -42,4 +57,4 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ jtojnar ];
    platforms = platforms.unix;
  };
-}
+})
--- a/pkgs/development/libraries/babl/dev-prefix.patch
+++ b/pkgs/development/libraries/babl/dev-prefix.patch
@ -0,0 +1,29 @@
+diff --git a/meson.build b/meson.build
+index 2350a1f..56f015d 100644
+--- a/meson.build
+++ b/meson.build
+@@ -551,7 +551,7 @@ pkgconfig.generate(
+   variables: [
+     'datadir=${prefix}/share',
+     'pluginsdir=${libdir}/@0@'.format(lib_name),
+-    'girdir=${datadir}/gir-1.0',
+    'girdir=@0@/share/gir-1.0'.format(get_option('prefix-dev')),
+     'typelibdir=${libdir}/girepository-1.0',
+   ],
+   uninstalled_variables: [
+diff --git a/meson_options.txt b/meson_options.txt
+index f9d558c..3cac593 100644
+--- a/meson_options.txt
+++ b/meson_options.txt
+@@ -9,6 +9,11 @@ option('enable-gir',
+   choices: ['auto', 'true', 'false'],
+   description: 'gobject introspection .gir generation'
+ )
+option('prefix-dev',
+  type: 'string',
+  value: '',
+  description: 'Like prefix but for dev output of the package'
+)
+ option('enable-vapi',
+   type: 'boolean',
+   value: 'true', 
--- a/pkgs/development/libraries/catboost/default.nix
+++ b/pkgs/development/libraries/catboost/default.nix
@ -1,8 +1,8 @@
 { lib
 , config
-, stdenv
 , fetchFromGitHub
 , cmake
+, darwin
 , libiconv
 , llvmPackages
 , ninja
@ -13,18 +13,22 @@
 , zlib
 , cudaSupport ? config.cudaSupport
 , cudaPackages ? {}
+, llvmPackages_12
 , pythonSupport ? false
 }:
+let
+  inherit (llvmPackages) stdenv;
+in

 stdenv.mkDerivation (finalAttrs: {
  pname = "catboost";
-  version = "1.2.2";
+  version = "1.2.3";

  src = fetchFromGitHub {
    owner = "catboost";
    repo = "catboost";
    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-A1zCIqPOW21dHKBQHRtS+/sstZ2o6F8k71lmJFGn0+g=";
+    hash = "sha256-wn9STnpqX3zmdxPmMYAz9JPdg13Goux76CMaCiqohk8=";
  };

  patches = [
@ -33,8 +37,8 @@ stdenv.mkDerivation (finalAttrs: {

  postPatch = ''
    substituteInPlace cmake/common.cmake \
-      --replace  "\''${RAGEL_BIN}" "${ragel}/bin/ragel" \
-      --replace "\''${YASM_BIN}" "${yasm}/bin/yasm"
+      --replace-fail  "\''${RAGEL_BIN}" "${ragel}/bin/ragel" \
+      --replace-fail "\''${YASM_BIN}" "${yasm}/bin/yasm"

    shopt -s globstar
    for cmakelists in **/CMakeLists.*; do
@ -55,6 +59,8 @@ stdenv.mkDerivation (finalAttrs: {
    (python3Packages.python.withPackages (ps: with ps; [ six ]))
    ragel
    yasm
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.cctools
  ] ++ lib.optionals cudaSupport (with cudaPackages; [
    cuda_nvcc
  ]);
@ -71,17 +77,19 @@ stdenv.mkDerivation (finalAttrs: {
  ]);

  env = {
-    CUDAHOSTCXX = lib.optionalString cudaSupport "${stdenv.cc}/bin/cc";
+    # catboost requires clang 14+ for build, but does clang 12 for cuda build.
+    # after bumping the default version of llvm, check for compatibility with the cuda backend and pin it.
+    # see https://catboost.ai/en/docs/installation/build-environment-setup-for-cmake#compilers,-linkers-and-related-tools
+    CUDAHOSTCXX = lib.optionalString cudaSupport "${llvmPackages_12.stdenv.cc}/bin/cc";
    NIX_CFLAGS_LINK = lib.optionalString stdenv.isLinux "-fuse-ld=lld";
    NIX_LDFLAGS = "-lc -lm";
  };

  cmakeFlags = [
-    "-DCMAKE_BINARY_DIR=$out"
-    "-DCMAKE_POSITION_INDEPENDENT_CODE=on"
-    "-DCATBOOST_COMPONENTS=app;libs${lib.optionalString pythonSupport ";python-package"}"
-  ] ++ lib.optionals cudaSupport [
-    "-DHAVE_CUDA=on"
+    (lib.cmakeFeature "CMAKE_BINARY_DIR" "$out")
+    (lib.cmakeBool "CMAKE_POSITION_INDEPENDENT_CODE" true)
+    (lib.cmakeFeature "CATBOOST_COMPONENTS" "app;libs${lib.optionalString pythonSupport ";python-package"}")
+    (lib.cmakeBool "HAVE_CUDA" cudaSupport)
  ];

  installPhase = ''
--- a/pkgs/development/libraries/catboost/remove-conan.patch
+++ b/pkgs/development/libraries/catboost/remove-conan.patch
@ -1,26 +1,26 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index becd2ad03c..7e3c8c99b1 100644
+index ed6c53b220..5c6fb8f157 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -27,7 +27,6 @@ cmake_policy(SET CMP0104 OLD)
- 
+@@ -29,7 +29,6 @@ include(cmake/global_flags.cmake)
+ include(cmake/global_vars.cmake)
 include(cmake/archive.cmake)
 include(cmake/common.cmake)
 -include(cmake/conan.cmake)
 include(cmake/cuda.cmake)
 include(cmake/cython.cmake)
 include(cmake/fbs.cmake)
-@@ -37,21 +36,6 @@ include(cmake/recursive_library.cmake)
+@@ -38,21 +37,6 @@ include(cmake/recursive_library.cmake)
+ include(cmake/shared_libs.cmake)
 include(cmake/swig.cmake)
- include(cmake/global_vars.cmake)
 
 -if (CMAKE_CROSSCOMPILING)
-  include(${CMAKE_BINARY_DIR}/conan_paths.cmake)
+-  include(${PROJECT_BINARY_DIR}/conan_paths.cmake)
 -else()
 -  conan_cmake_autodetect(settings)
 -  conan_cmake_install(
-    PATH_OR_REFERENCE ${CMAKE_SOURCE_DIR}
-    INSTALL_FOLDER ${CMAKE_BINARY_DIR}
+-    PATH_OR_REFERENCE ${PROJECT_SOURCE_DIR}
+-    INSTALL_FOLDER ${PROJECT_BINARY_DIR}
 -    BUILD missing
 -    REMOTE conancenter
 -    SETTINGS ${settings}
--- a/pkgs/development/libraries/dbus-cplusplus/default.nix
+++ b/pkgs/development/libraries/dbus-cplusplus/default.nix
@ -52,7 +52,12 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ dbus glib expat ];

-  configureFlags = [ "--disable-ecore" "--disable-tests" ];
+  configureFlags = [
+    "--disable-ecore"
+    "--disable-tests"
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    "--disable-examples"
+  ];

  meta = with lib; {
    homepage = "https://dbus-cplusplus.sourceforge.net";
--- a/pkgs/development/libraries/libjxl/default.nix
+++ b/pkgs/development/libraries/libjxl/default.nix
@ -18,6 +18,7 @@
 , doxygen
 , python3
 , lcms2
+, enablePlugins ? stdenv.buildPlatform.canExecute stdenv.hostPlatform
 }:

 let
@ -106,7 +107,7 @@ stdenv.mkDerivation rec {
    # TODO: Update this package to enable this (overridably via an option):
    # Viewer tools for evaluation.
    # "-DJPEGXL_ENABLE_VIEWERS=ON"
-
+  ] ++ lib.optionals enablePlugins [
    # Enable plugins, such as:
    # * the `gdk-pixbuf` one, which allows applications like `eog` to load jpeg-xl files
    # * the `gimp` one, which allows GIMP to load jpeg-xl files
@ -122,7 +123,7 @@ stdenv.mkDerivation rec {
      --replace '/usr/bin/gdk-pixbuf-thumbnailer' "$out/libexec/gdk-pixbuf-thumbnailer-jxl"
  '';

-  postInstall = ''
+  postInstall = lib.optionalString enablePlugins ''
    GDK_PIXBUF_MODULEDIR="$out/${gdk-pixbuf.moduleDir}" \
    GDK_PIXBUF_MODULE_FILE="$out/${loadersPath}" \
      gdk-pixbuf-query-loaders --update-cache
--- a/pkgs/development/libraries/librime/default.nix
+++ b/pkgs/development/libraries/librime/default.nix
@ -11,13 +11,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "librime";
-  version = "1.11.0";
+  version = "1.11.2";

  src = fetchFromGitHub {
    owner = "rime";
    repo = pname;
    rev = version;
-    sha256 = "sha256-yP7YmmeA3k0/NI4XPsC/k2BX4mMnyMJvguiFZIWo8I8=";
+    sha256 = "sha256-QHuzpitxSYQ4EcBPY1f0R5zl4UFtefu0bFXA76Iv+j0=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/libvisual/default.nix
+++ b/pkgs/development/libraries/libvisual/default.nix
@ -47,6 +47,9 @@ stdenv.mkDerivation rec {
  configureFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
    # Remove once "sdl-cross-prereq.patch" patch above is removed.
    "--disable-lv-tool"
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
  ];

  meta = {
--- a/pkgs/development/libraries/ogre/default.nix
+++ b/pkgs/development/libraries/ogre/default.nix
@ -112,8 +112,8 @@ let
 in
 {
  ogre_14 = common {
-    version = "14.2.2";
-    hash = "sha256-85hpujmlM3N81mkiA80xx2C4GsdzWkP61bwdfmw1zt8=";
+    version = "14.2.4";
+    hash = "sha256-Gr72KNjxZPZtFrgsbevPYiVog/fQNvJHvQEH0WA2DW4=";
    # https://github.com/OGRECave/ogre/blob/v14.2.2/Components/Overlay/CMakeLists.txt
    imguiVersion = "1.90.4";
    imguiHash = "sha256-7+Ay7H97tIO6CUsEyaQv4i9q2FCw98eQUq/KYZyfTAw=";
--- a/pkgs/development/libraries/wlroots/default.nix
+++ b/pkgs/development/libraries/wlroots/default.nix
@ -125,8 +125,8 @@ rec {
  };

  wlroots_0_17 = generic {
-    version = "0.17.2";
-    hash = "sha256-Of9qykyVnBURc5A2pvCMm7sLbnuuG7OPWLxodQLN2Xg=";
+    version = "0.17.3";
+    hash = "sha256-jth6BKci3sVDC86o+gSHKyDWnibVcNmipm7nn0S6LTg=";
    extraBuildInputs = [
      ffmpeg
      hwdata
--- a/pkgs/development/python-modules/acoustics/default.nix
+++ b/pkgs/development/python-modules/acoustics/default.nix
@ -53,7 +53,6 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Python package for acousticians";
-    maintainers = with maintainers; [ fridh ];
    license = with licenses; [ bsd3 ];
    homepage = "https://github.com/python-acoustics/python-acoustics";
  };
--- a/pkgs/development/python-modules/aiofiles/default.nix
+++ b/pkgs/development/python-modules/aiofiles/default.nix
@ -49,6 +49,5 @@ buildPythonPackage rec {
    description = "File support for asyncio";
    homepage = "https://github.com/Tinche/aiofiles";
    license = with licenses; [ asl20 ];
-    maintainers = with maintainers; [ fridh ];
  };
 }
--- a/pkgs/development/python-modules/aiovodafone/default.nix
+++ b/pkgs/development/python-modules/aiovodafone/default.nix
@ -1,48 +1,43 @@
-{ lib
-, aiohttp
-, beautifulsoup4
-, buildPythonPackage
-, fetchFromGitHub
-, poetry-core
-, pytestCheckHook
-, pythonOlder
+{
+  lib,
+  aiohttp,
+  beautifulsoup4,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  pytestCheckHook,
+  pythonOlder,
 }:

 buildPythonPackage rec {
  pname = "aiovodafone";
-  version = "0.5.4";
+  version = "0.6.0";
  pyproject = true;

-  disabled = pythonOlder "3.10";
+  disabled = pythonOlder "3.11";

  src = fetchFromGitHub {
    owner = "chemelli74";
    repo = "aiovodafone";
    rev = "refs/tags/v${version}";
-    hash = "sha256-J2VdRxCzIjRUOqQW4YzOC8RRth9tibBS9YuizveqhhI=";
+    hash = "sha256-sy7/nCthmfI0WdBkwBU83fifcYTe9zUBOpxV7RX9F6w=";
  };

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace " --cov=aiovodafone --cov-report=term-missing:skip-covered" ""
+      --replace-fail " --cov=aiovodafone --cov-report=term-missing:skip-covered" ""
  '';

-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];

-  propagatedBuildInputs = [
+  dependencies = [
    aiohttp
    beautifulsoup4
  ];

-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];

-  pythonImportsCheck = [
-    "aiovodafone"
-  ];
+  pythonImportsCheck = [ "aiovodafone" ];

  meta = with lib; {
    description = "Library to control Vodafon Station";
--- a/pkgs/development/python-modules/ansible/default.nix
+++ b/pkgs/development/python-modules/ansible/default.nix
@ -21,7 +21,7 @@

 let
  pname = "ansible";
-  version = "9.4.0";
+  version = "9.5.1";
 in
 buildPythonPackage {
  inherit pname version;
@ -31,7 +31,7 @@ buildPythonPackage {

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-3UMcYzgOGMP6yjKI696M4vT5kjY6tVijwRyPIDLZCGc=";
+    hash = "sha256-PCeLyWQrl/yVOyugW5nNgIAedb81Z9+qHLUTH+DsHs0=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/anywidget/default.nix
+++ b/pkgs/development/python-modules/anywidget/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "anywidget";
-  version = "0.9.9";
+  version = "0.9.10";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-vs5tYcVabzlkCeu1p20mDo9LIh+cUeUWFQc3o18WUu8=";
+    hash = "sha256-OQpigkCYHAmBPHUjJ53cq4L/T9Moet1UM7eLE2kIkGg=";
  };

  # We do not need the jupyterlab build dependency, because we do not need to
--- a/pkgs/development/python-modules/bibtexparser/default.nix
+++ b/pkgs/development/python-modules/bibtexparser/default.nix
@ -36,6 +36,5 @@ buildPythonPackage rec {
    description = "Bibtex parser for Python";
    homepage = "https://github.com/sciunto-org/python-bibtexparser";
    license = with licenses; [ lgpl3Only /* or */ bsd3 ];
-    maintainers = with maintainers; [ fridh ];
  };
 }
--- a/pkgs/development/python-modules/clarifai-grpc/default.nix
+++ b/pkgs/development/python-modules/clarifai-grpc/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "clarifai-grpc";
-  version = "10.3.2";
+  version = "10.3.4";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "Clarifai";
    repo = "clarifai-python-grpc";
    rev = "refs/tags/${version}";
-    hash = "sha256-rymu9BUbU8d0BgBpE/1bOAqGxVN3ksyvq6Wy0KZ+KkY=";
+    hash = "sha256-1Yx00g2Cd9/41DZYK5cRwcFQv2qD6B4cl4cpVZ6slTA=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/cohere/default.nix
+++ b/pkgs/development/python-modules/cohere/default.nix
@ -1,40 +1,43 @@
 { lib
 , buildPythonPackage
-, fetchpatch
 , fetchPypi
 , poetry-core
 , pythonOlder
-, aiohttp
-, backoff
 , fastavro
-, importlib-metadata
+, httpx
+, httpx-sse
+, pydantic
 , requests
-, urllib3
+, tokenizers
+, types-requests
+, typing-extensions
 }:

 buildPythonPackage rec {
  pname = "cohere";
-  version = "4.57";
+  version = "5.3.3";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-cazgIEqS0aKo1LlJuIs1O08i/GRUhoUZJChMxaDrcA0=";
+    hash = "sha256-+/WcC6sN7U0oCR+gwZOhFtgwPEwLCaQnId2KEjDqJ8M=";
  };

-  nativeBuildInputs = [
+  build-system = [
    poetry-core
  ];

-  propagatedBuildInputs = [
-    aiohttp
-    backoff
+  dependencies = [
    fastavro
-    importlib-metadata
+    httpx
+    httpx-sse
+    pydantic
    requests
-    urllib3
+    tokenizers
+    types-requests
+    typing-extensions
  ];

  # tests require CO_API_KEY
@ -47,7 +50,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Simplify interfacing with the Cohere API";
    homepage = "https://docs.cohere.com/docs";
-    changelog = "https://github.com/cohere-ai/cohere-python/blob/main/CHANGELOG.md#${builtins.replaceStrings ["."] [""] version}";
+    changelog = "https://github.com/cohere-ai/cohere-python/releases/tag/${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ natsukium ];
  };
--- a/pkgs/development/python-modules/cycler/default.nix
+++ b/pkgs/development/python-modules/cycler/default.nix
@ -36,6 +36,5 @@ buildPythonPackage rec {
    description = "Composable style cycles";
    homepage = "https://github.com/matplotlib/cycler";
    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
  };
 }
--- a/pkgs/development/python-modules/cython/0.nix
+++ b/pkgs/development/python-modules/cython/0.nix
@ -86,6 +86,5 @@ in buildPythonPackage rec {
    description = "An optimising static compiler for both the Python programming language and the extended Cython programming language";
    homepage = "https://cython.org";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ fridh ];
  };
 }
--- a/pkgs/development/python-modules/cython/default.nix
+++ b/pkgs/development/python-modules/cython/default.nix
@ -66,6 +66,5 @@ in buildPythonPackage rec {
    description = "An optimising static compiler for both the Python programming language and the extended Cython programming language";
    homepage = "https://cython.org";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ fridh ];
  };
 }
--- a/pkgs/development/python-modules/cytoolz/default.nix
+++ b/pkgs/development/python-modules/cytoolz/default.nix
@ -47,6 +47,5 @@ buildPythonPackage rec {
    homepage = "https://github.com/pytoolz/cytoolz/";
    description = "Cython implementation of Toolz: High performance functional utilities";
    license = licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
  };
 }
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@ -191,6 +191,5 @@ let self = buildPythonPackage rec {
    homepage = "https://dask.org/";
    changelog = "https://docs.dask.org/en/latest/changelog.html";
    license = licenses.bsd3;
-    maintainers = with maintainers; [ fridh ];
  };
 }; in self
--- a/pkgs/development/python-modules/datashape/default.nix
+++ b/pkgs/development/python-modules/datashape/default.nix
@ -46,6 +46,5 @@ in buildPythonPackage rec {
    homepage = "https://github.com/ContinuumIO/datashape";
    description = "A data description language";
    license = lib.licenses.bsd2;
-    maintainers = with lib.maintainers; [ fridh ];
  };
 }
--- a/pkgs/development/python-modules/dulwich/default.nix
+++ b/pkgs/development/python-modules/dulwich/default.nix
@ -30,7 +30,7 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "jelmer";
    repo = "dulwich";
-    rev = "refs/tags/${version}";
+    rev = "refs/tags/${pname}-${version}";
    hash = "sha256-bf3ZUMX4afpdTBpFnx0HMyzCNG6V/p4eOl36djxGbtk=";
  };

--- a/pkgs/development/python-modules/epitran/default.nix
+++ b/pkgs/development/python-modules/epitran/default.nix
@ -0,0 +1,58 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  fetchFromGitHub,
+
+  unittestCheckHook,
+
+  setuptools,
+
+  regex,
+  panphon,
+  marisa-trie,
+  requests,
+}:
+
+buildPythonPackage rec {
+  pname = "epitran";
+  version = "1.24";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "dmort27";
+    repo = "epitran";
+    rev = "refs/tags/${version}";
+    hash = "sha256-AH4q8J5oMaUVJ559qe/ZlJXlCcGdxWnxMhnZKCH5Rlk=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    regex
+    panphon
+    marisa-trie
+    requests
+  ];
+
+  nativeCheckInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [
+    "-s"
+    "test"
+  ];
+
+  pythonImportsCheck = [
+    "epitran"
+    "epitran.backoff"
+    "epitran.vector"
+  ];
+
+  meta = with lib; {
+    description = "Tools for transcribing languages into IPA";
+    homepage = "https://github.com/dmort27/epitran";
+    changelog = "https://github.com/dmort27/epitran/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ vizid ];
+  };
+}
--- a/pkgs/development/python-modules/flit/default.nix
+++ b/pkgs/development/python-modules/flit/default.nix
@ -56,6 +56,5 @@ buildPythonPackage rec {
    mainProgram = "flit";
    homepage = "https://github.com/pypa/flit";
    license = licenses.bsd3;
-    maintainers = with maintainers; [ fridh ];
  };
 }
--- a/pkgs/development/python-modules/folium/default.nix
+++ b/pkgs/development/python-modules/folium/default.nix
@ -75,6 +75,5 @@ buildPythonPackage rec {
    homepage = "https://github.com/python-visualization/folium";
    changelog = "https://github.com/python-visualization/folium/blob/v${version}/CHANGES.txt";
    license = with lib.licenses; [ mit ];
-    maintainers = with lib.maintainers; [ fridh ];
  };
 }
--- a/pkgs/development/python-modules/httpx-sse/default.nix
+++ b/pkgs/development/python-modules/httpx-sse/default.nix
@ -0,0 +1,54 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  wheel,
+  httpx,
+  pytest-asyncio,
+  pytestCheckHook,
+  sse-starlette,
+}:
+
+buildPythonPackage rec {
+  pname = "httpx-sse";
+  version = "0.4.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "florimondmanca";
+    repo = "httpx-sse";
+    rev = "refs/tags/${version}";
+    hash = "sha256-nU8vkmV/WynzQrSrq9+FQXtfAJPVLpMsRSuntU0HWrE=";
+  };
+
+  # pytest-cov configuration is not necessary for packaging
+  postPatch = ''
+    rm setup.cfg
+  '';
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    wheel
+  ];
+
+  dependencies = [ httpx ];
+
+  pythonImportsCheck = [ "httpx_sse" ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+    sse-starlette
+  ];
+
+  meta = with lib; {
+    description = "Consume Server-Sent Event (SSE) messages with HTTPX";
+    homepage = "https://github.com/florimondmanca/httpx-sse";
+    changelog = "https://github.com/florimondmanca/httpx-sse/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ natsukium ];
+  };
+}
--- a/pkgs/development/python-modules/ipycanvas/default.nix
+++ b/pkgs/development/python-modules/ipycanvas/default.nix
@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, jupyter-packaging
+, hatchling
 , ipywidgets
 , numpy
 , pillow
@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "ipycanvas";
-  version = "0.13.1";
-  format = "pyproject";
+  version = "0.13.2";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-+cOUBoG8ODgzkPjEbqXYRF1uEcbaZITDfYnfWuHawTE=";
+    hash = "sha256-Ujh9nYf2WVXzlVL7eSfEReXl5JN9hTgU2RDL6O+g+3k=";
  };

  # We relax dependencies here instead of pulling in a patch because upstream
@ -26,13 +26,16 @@ buildPythonPackage rec {
  #
  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace '"jupyterlab==3.*",' "" \
-      --replace 'jupyter_packaging~=' 'jupyter_packaging>='
+      --replace-fail '"jupyterlab>=3,<5",' "" \
  '';

-  nativeBuildInputs = [ jupyter-packaging ];
+  build-system = [
+    hatchling
+  ];

-  propagatedBuildInputs = [ ipywidgets numpy pillow ];
+  env.HATCH_BUILD_NO_HOOKS = true;
+
+  dependencies = [ ipywidgets numpy pillow ];

  doCheck = false;  # tests are in Typescript and require `npx` and `chromium`
  pythonImportsCheck = [ "ipycanvas" ];
--- a/pkgs/development/python-modules/ipykernel/default.nix
+++ b/pkgs/development/python-modules/ipykernel/default.nix
@ -70,6 +70,6 @@ buildPythonPackage rec {
    homepage = "https://ipython.org/";
    changelog = "https://github.com/ipython/ipykernel/releases/tag/v${version}";
    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ] ++ lib.teams.jupyter.members;
+    maintainers = lib.teams.jupyter.members;
  };
 }
--- a/Show More
+++ b/Show More