Merge master into haskell-updates

2024-10-03 00:16:04 +00:00 · 2024-10-03 00:16:04 +00:00 · 9d0ab8b5db
commit 9d0ab8b5db
parent cdeda1a069 78389c563c
165 changed files with 11230 additions and 3037 deletions
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@ -277,25 +277,6 @@ let
      let
        selectEmulator = pkgs:
          let
-            qemu-user = pkgs.qemu.override {
-              smartcardSupport = false;
-              spiceSupport = false;
-              openGLSupport = false;
-              virglSupport = false;
-              vncSupport = false;
-              gtkSupport = false;
-              sdlSupport = false;
-              alsaSupport = false;
-              pulseSupport = false;
-              pipewireSupport = false;
-              jackSupport = false;
-              smbdSupport = false;
-              seccompSupport = false;
-              tpmSupport = false;
-              capstoneSupport = false;
-              enableDocs = false;
-              hostCpuTargets = [ "${final.qemuArch}-linux-user" ];
-            };
            wine = (pkgs.winePackagesFor "wine${toString final.parsed.cpu.bits}").minimal;
          in
          # Note: we guarantee that the return value is either `null` or a path
@ -306,7 +287,7 @@ let
          else if final.isWindows
          then "${wine}/bin/wine${optionalString (final.parsed.cpu.bits == 64) "64"}"
          else if final.isLinux && pkgs.stdenv.hostPlatform.isLinux && final.qemuArch != null
-          then "${qemu-user}/bin/qemu-${final.qemuArch}"
+          then "${pkgs.qemu-user}/bin/qemu-${final.qemuArch}"
          else if final.isWasi
          then "${pkgs.wasmtime}/bin/wasmtime"
          else if final.isMmix
@ -315,6 +296,10 @@ let
      in {
        emulatorAvailable = pkgs: (selectEmulator pkgs) != null;

+        # whether final.emulator pkgs.pkgsStatic works
+        staticEmulatorAvailable = pkgs: final.emulatorAvailable pkgs
+          && (final.isLinux || final.isWasi || final.isMmix);
+
        emulator = pkgs:
          if (final.emulatorAvailable pkgs)
          then selectEmulator pkgs
--- a/lib/tests/systems.nix
+++ b/lib/tests/systems.nix
@ -96,6 +96,7 @@ lib.runTests (
        canExecute = null;
        emulator = null;
        emulatorAvailable = null;
+        staticEmulatorAvailable = null;
        isCompatible = null;
      }?${platformAttrName};
    };
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2041,6 +2041,12 @@
    github = "auchter";
    githubId = 1190483;
  };
+  aucub = {
+    name = "aucub";
+    email = "dr56ekgbb@mozmail.com";
+    github = "aucub";
+    githubId = 78630225;
+  };
  augustebaum = {
    email = "auguste.apple@gmail.com";
    github = "augustebaum";
@ -14694,6 +14700,12 @@
    githubId = 6709831;
    name = "Jake Hill";
  };
+  nartsiss = {
+    name = "Daniil Nartsissov";
+    email = "nartsiss@proton.me";
+    github = "nartsisss";
+    githubId = 54633007;
+  };
  nasageek = {
    github = "NasaGeek";
    githubId = 474937;
@ -16654,6 +16666,12 @@
    githubId = 14542417;
    name = "Sergey Ichtchenko";
  };
+  pizzapim = {
+    email = "pim@kunis.nl";
+    github = "pizzapim";
+    githubId = 23135512;
+    name = "Pim Kunis";
+  };
  pjbarnoy = {
    email = "pjbarnoy@gmail.com";
    github = "waaamb";
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -81,7 +81,7 @@
  user management. This can be used instead of the `update-users-groups.pl`
  Perl script and instead of systemd-sysusers. To achieve a system without
  Perl, this is the now recommended tool over systemd-sysusers because it can
-  alos create normal users and change passwords. Available as
+  also create normal users and change passwords. Available as
  [services.userborn](#opt-services.userborn.enable)

 - [Hatsu](https://github.com/importantimport/hatsu), a self-hosted bridge that interacts with Fediverse on behalf of your static site. Available as [services.hatsu](options.html#opt-services.hatsu).
@ -120,6 +120,8 @@

 - [Localsend](https://localsend.org/), an open source cross-platform alternative to AirDrop. Available as [programs.localsend](#opt-programs.localsend.enable).

+- [Gatus](https://github.com/TwiN/gatus), an automated developer-oriented status page. Available as [services.gatus](#opt-services.gatus.enable).
+
 - [cryptpad](https://cryptpad.org/), a privacy-oriented collaborative platform (docs/drive/etc), has been added back. Available as [services.cryptpad](#opt-services.cryptpad.enable).

 - [realm](https://github.com/zhboner/realm), a simple, high performance relay server written in rust. Available as [services.realm.enable](#opt-services.realm.enable).
@ -159,6 +161,8 @@

 - [obs-studio](https://obsproject.com/), Free and open source software for video recording and live streaming. Available as [programs.obs-studio.enable](#opt-programs.obs-studio.enable).

+- [Veilid](https://veilid.com), a headless server that enables privacy-focused data sharing and messaging on a peer-to-peer network. Available as [services.veilid](#opt-services.veilid.enable).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}

 - The `sound` options have been removed or renamed, as they had a lot of unintended side effects. See [below](#sec-release-24.11-migration-sound) for details.
@ -487,7 +491,7 @@
 - The `services.syncplay` module now exposes all currently available command-line arguments for `syncplay-server` as options, as well as a `useACMEHost` option for easy TLS setup.
  The systemd service now uses `DynamicUser`/`StateDirectory` and the `user` and `group` options have been deprecated.

- The `openlens` package got removed, suggested replacment `lens-desktop`
+- The `openlens` package got removed, suggested replacement `lens-desktop`

 - The `services.dnsmasq.extraConfig` option has been removed, as it had been deprecated for over 2 years. This option has been replaced by `services.dnsmasq.settings`.

@ -612,7 +616,7 @@
 - `iproute2` now has libbpf support.

 - `nix.channel.enable = false` no longer implies `nix.settings.nix-path = []`.
-  Since Nix 2.13, a `nix-path` set in `nix.conf` cannot be overriden by the `NIX_PATH` configuration variable.
+  Since Nix 2.13, a `nix-path` set in `nix.conf` cannot be overridden by the `NIX_PATH` configuration variable.

 ## Detailed migration information {#sec-release-24.11-migration}

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -883,6 +883,7 @@
  ./services/monitoring/datadog-agent.nix
  ./services/monitoring/do-agent.nix
  ./services/monitoring/fusion-inventory.nix
+  ./services/monitoring/gatus.nix
  ./services/monitoring/goss.nix
  ./services/monitoring/grafana-agent.nix
  ./services/monitoring/grafana-image-renderer.nix
--- a/nixos/modules/services/monitoring/gatus.nix
+++ b/nixos/modules/services/monitoring/gatus.nix
@ -0,0 +1,132 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.services.gatus;
+
+  settingsFormat = pkgs.formats.yaml { };
+
+  inherit (lib)
+    getExe
+    literalExpression
+    maintainers
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    ;
+
+  inherit (lib.types)
+    bool
+    int
+    nullOr
+    path
+    submodule
+    ;
+in
+{
+  options.services.gatus = {
+    enable = mkEnableOption "Gatus";
+
+    package = mkPackageOption pkgs "gatus" { };
+
+    configFile = mkOption {
+      type = path;
+      default = settingsFormat.generate "gatus.yaml" cfg.settings;
+      defaultText = literalExpression ''
+        let settingsFormat = pkgs.formats.yaml { }; in settingsFormat.generate "gatus.yaml" cfg.settings;
+      '';
+      description = ''
+        Path to the Gatus configuration file.
+        Overrides any configuration made using the `settings` option.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = nullOr path;
+      default = null;
+      description = ''
+        File to load as environment file.
+        Environmental variables from this file can be interpolated in the configuration file using `''${VARIABLE}`.
+        This is useful to avoid putting secrets into the nix store.
+      '';
+    };
+
+    settings = mkOption {
+      type = submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          web.port = mkOption {
+            type = int;
+            default = 8080;
+            description = ''
+              The TCP port to serve the Gatus service at.
+            '';
+          };
+        };
+      };
+
+      default = { };
+
+      example = literalExpression ''
+        {
+          web.port = 8080;
+          endpoints = [{
+            name = "website";
+            url = "https://twin.sh/health";
+            interval = "5m";
+            conditions = [
+              "[STATUS] == 200"
+              "[BODY].status == UP"
+              "[RESPONSE_TIME] < 300"
+            ];
+          }];
+        }
+      '';
+
+      description = ''
+        Configuration for Gatus.
+        Supported options can be found at the [docs](https://gatus.io/docs).
+      '';
+    };
+
+    openFirewall = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Whether to open the firewall for the Gatus web interface.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.gatus = {
+      description = "Automated developer-oriented status page";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        DynamicUser = true;
+        User = "gatus";
+        Group = "gatus";
+        Type = "simple";
+        Restart = "on-failure";
+        ExecStart = getExe cfg.package;
+        StateDirectory = "gatus";
+        SyslogIdentifier = "gatus";
+        EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
+      };
+
+      environment = {
+        GATUS_CONFIG_PATH = cfg.configFile;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.settings.web.port ];
+  };
+
+  meta.maintainers = with maintainers; [ pizzapim ];
+}
--- a/nixos/modules/services/networking/i2pd.nix
+++ b/nixos/modules/services/networking/i2pd.nix
@ -1,8 +1,8 @@
 { config, lib, pkgs, ... }:

 let
-  inherit (lib) mkIf mkOption mkEnableOption types optional optionals;
-  inherit (lib.types) nullOr bool listOf str;
+  inherit (lib) mkIf mkOption mkDefault mkEnableOption types optional optionals;
+  inherit (lib.types) nullOr bool listOf str attrsOf submodule;

  cfg = config.services.i2pd;

@ -618,7 +618,7 @@ in

      outTunnels = mkOption {
        default = {};
-        type = with types; attrsOf (submodule (
+        type = attrsOf (submodule (
          { name, ... }: {
            options = {
              destinationPort = mkOption {
@ -639,7 +639,7 @@ in

      inTunnels = mkOption {
        default = {};
-        type = with types; attrsOf (submodule (
+        type = attrsOf (submodule (
          { name, ... }: {
            options = {
              inPort = mkOption {
--- a/nixos/modules/services/networking/jitsi-videobridge.nix
+++ b/nixos/modules/services/networking/jitsi-videobridge.nix
@ -156,7 +156,7 @@ in
        default = null;
        example = "192.168.1.42";
        description = ''
-          Local address when running behind NAT.
+          Local address to assume when running behind NAT.
        '';
      };

@ -165,7 +165,25 @@ in
        default = null;
        example = "1.2.3.4";
        description = ''
-          Public address when running behind NAT.
+          Public address to assume when running behind NAT.
+        '';
+      };
+
+      harvesterAddresses = lib.mkOption {
+        type = listOf str;
+        default = [
+          "stunserver.stunprotocol.org:3478"
+          "stun.framasoft.org:3478"
+          "meet-jit-si-turnrelay.jitsi.net:443"
+        ];
+        example = [];
+        description = ''
+          Addresses of public STUN services to use to automatically find
+          the public and local addresses of this Jitsi-Videobridge instance
+          without the need for manual configuration.
+
+          This option is ignored if {option}`services.jitsi-videobridge.nat.localAddress`
+          and {option}`services.jitsi-videobridge.nat.publicAddress` are set.
        '';
      };
    };
@ -199,10 +217,13 @@ in
  config = lib.mkIf cfg.enable {
    users.groups.jitsi-meet = {};

-    services.jitsi-videobridge.extraProperties = lib.optionalAttrs (cfg.nat.localAddress != null) {
-      "org.ice4j.ice.harvest.NAT_HARVESTER_LOCAL_ADDRESS" = cfg.nat.localAddress;
-      "org.ice4j.ice.harvest.NAT_HARVESTER_PUBLIC_ADDRESS" = cfg.nat.publicAddress;
-    };
+    services.jitsi-videobridge.extraProperties =
+      if (cfg.nat.localAddress != null) then {
+        "org.ice4j.ice.harvest.NAT_HARVESTER_LOCAL_ADDRESS" = cfg.nat.localAddress;
+        "org.ice4j.ice.harvest.NAT_HARVESTER_PUBLIC_ADDRESS" = cfg.nat.publicAddress;
+      } else {
+        "org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES" = lib.concatStringsSep "," cfg.nat.harvesterAddresses;
+      };

    systemd.services.jitsi-videobridge2 = let
      jvbProps = {
--- a/nixos/modules/services/web-apps/jitsi-meet.md
+++ b/nixos/modules/services/web-apps/jitsi-meet.md
@ -19,6 +19,13 @@ A minimal configuration using Let's Encrypt for TLS certificates looks like this
 }
 ```

+Jitsi Meet depends on the Prosody XMPP server only for message passing from
+the web browser while the default Prosody configuration is intended for use
+with standalone XMPP clients and XMPP federation. If you only use Prosody as
+a backend for Jitsi Meet it is therefore recommended to also enable
+{option}`services.jitsi-meet.prosody.lockdown` option to disable unnecessary
+Prosody features such as federation or the file proxy.
+
 ## Configuration {#module-services-jitsi-configuration}

 Here is the minimal configuration with additional configurations:
@ -27,6 +34,7 @@ Here is the minimal configuration with additional configurations:
  services.jitsi-meet = {
    enable = true;
    hostName = "jitsi.example.com";
+    prosody.lockdown = true;
    config = {
      enableWelcomePage = false;
      prejoinPageEnabled = true;
--- a/nixos/modules/services/web-apps/jitsi-meet.nix
+++ b/nixos/modules/services/web-apps/jitsi-meet.nix
@ -175,11 +175,26 @@ in
    prosody.enable = mkOption {
      type = bool;
      default = true;
+      example = false;
      description = ''
        Whether to configure Prosody to relay XMPP messages between Jitsi Meet components. Turn this
        off if you want to configure it manually.
      '';
    };
+    prosody.lockdown = mkOption {
+      type = bool;
+      default = false;
+      example = true;
+      description = ''
+        Whether to disable Prosody features not needed by Jitsi Meet.
+
+        The default Prosody configuration assumes that it will be used as a
+        general-purpose XMPP server rather than as a companion service for
+        Jitsi Meet. This option reconfigures Prosody to only listen on
+        localhost without support for TLS termination, XMPP federation or
+        the file transfer proxy.
+      '';
+    };

    excalidraw.enable = mkEnableOption "Excalidraw collaboration backend for Jitsi";
    excalidraw.port = mkOption {
@ -211,7 +226,10 @@ in
        smacks = mkDefault true;
        tls = mkDefault true;
        websocket = mkDefault true;
+        proxy65 = mkIf cfg.prosody.lockdown (mkDefault false);
      };
+      httpInterfaces = mkIf cfg.prosody.lockdown (mkDefault [ "127.0.0.1" ]);
+      httpsPorts = mkIf cfg.prosody.lockdown (mkDefault []);
      muc = [
        {
          domain = "conference.${cfg.hostName}";
@ -232,7 +250,7 @@ in
          extraConfig = ''
            restrict_room_creation = true
            storage = "memory"
-            admins = { "focus@auth.${cfg.hostName}" }
+            admins = { "focus@auth.${cfg.hostName}", "jvb@auth.${cfg.hostName}" }
          '';
        }
        {
@ -300,7 +318,7 @@ in
            muc_component = "conference.${cfg.hostName}"
            breakout_rooms_component = "breakout.${cfg.hostName}"
        '')
-        (mkBefore ''
+        (mkBefore (''
          muc_mapper_domain_base = "${cfg.hostName}"

          cross_domain_websocket = true;
@ -310,7 +328,10 @@ in
            "focus@auth.${cfg.hostName}",
            "jvb@auth.${cfg.hostName}"
          }
-        '')
+        '' + optionalString cfg.prosody.lockdown ''
+          c2s_interfaces = { "127.0.0.1" };
+          modules_disabled = { "s2s" };
+        ''))
      ];
      virtualHosts.${cfg.hostName} = {
        enabled = true;
@ -444,7 +465,29 @@ in
        Type = "simple";
        ExecStart = "${pkgs.jitsi-excalidraw}/bin/jitsi-excalidraw-backend";
        Restart = "on-failure";
+
+        DynamicUser = true;
        Group = "jitsi-meet";
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        ProtectSystem = "strict";
+        ProtectClock = true;
+        ProtectHome = true;
+        ProtectProc = true;
+        ProtectKernelLogs = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectHostname = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallFilter = [ "@system-service @pkey" "~@privileged" ];
      };
    };

@ -513,7 +556,11 @@ in
            cp ${overrideJs "${pkgs.jitsi-meet}/interface_config.js" "interfaceConfig" cfg.interfaceConfig ""} $out/interface_config.js
            cp ./libs/external_api.min.js $out/external_api.js
          '';
-        in ''
+        in (optionalString cfg.excalidraw.enable ''
+          handle /socket.io/ {
+            reverse_proxy 127.0.0.1:${toString cfg.excalidraw.port}
+          }
+        '') + ''
          handle /http-bind {
            header Host ${cfg.hostName}
            reverse_proxy 127.0.0.1:5280
--- a/nixos/modules/system/boot/binfmt.nix
+++ b/nixos/modules/system/boot/binfmt.nix
@ -28,8 +28,6 @@ let
         ''
    else interpreter;

-  getEmulator = system: (lib.systems.elaborate { inherit system; }).emulator pkgs;
-  getQemuArch = system: (lib.systems.elaborate { inherit system; }).qemuArch;

  # Mapping of systems to “magicOrExtension” and “mask”. Mostly taken from:
  # - https://github.com/cleverca22/nixos-configs/blob/master/qemu.nix
@ -280,28 +278,50 @@ in {
        '';
        type = types.listOf (types.enum (builtins.attrNames magics));
      };
+
+      preferStaticEmulators = mkOption {
+        default = false;
+        description = ''
+          Whether to use static emulators when available.
+
+          This enables the kernel to preload the emulator binaries when
+          the binfmt registrations are added, obviating the need to make
+          the emulator binaries available inside chroots and chroot-like
+          sandboxes.
+        '';
+        type = types.bool;
+      };
    };
  };

  config = {
+    assertions = lib.mapAttrsToList (name: reg: {
+      assertion = reg.fixBinary -> !reg.wrapInterpreterInShell;
+      message = "boot.binfmt.registrations.\"${name}\" cannot have fixBinary when the interpreter is invoked through a shell.";
+    }) cfg.registrations;
+
    boot.binfmt.registrations = builtins.listToAttrs (map (system: assert system != pkgs.stdenv.hostPlatform.system; {
      name = system;
      value = { config, ... }: let
-        interpreter = getEmulator system;
-        qemuArch = getQemuArch system;
+        elaborated = lib.systems.elaborate { inherit system; };
+        useStaticEmulator = cfg.preferStaticEmulators && elaborated.staticEmulatorAvailable pkgs;
+        interpreter = elaborated.emulator (if useStaticEmulator then pkgs.pkgsStatic else pkgs);
+
+        inherit (elaborated) qemuArch;
+        isQemu = "qemu-${qemuArch}" == baseNameOf interpreter;

-        preserveArgvZero = "qemu-${qemuArch}" == baseNameOf interpreter;
        interpreterReg = let
          wrapperName = "qemu-${qemuArch}-binfmt-P";
          wrapper = pkgs.wrapQemuBinfmtP wrapperName interpreter;
        in
-          if preserveArgvZero then "${wrapper}/bin/${wrapperName}"
+          if isQemu && !useStaticEmulator then "${wrapper}/bin/${wrapperName}"
          else interpreter;
      in ({
-        preserveArgvZero = mkDefault preserveArgvZero;
+        preserveArgvZero = mkDefault isQemu;

        interpreter = mkDefault interpreterReg;
-        wrapInterpreterInShell = mkDefault (!config.preserveArgvZero);
+        fixBinary = mkDefault useStaticEmulator;
+        wrapInterpreterInShell = mkDefault (!config.preserveArgvZero && !config.fixBinary);
        interpreterSandboxPath = mkDefault (dirOf (dirOf config.interpreter));
      } // (magics.${system} or (throw "Cannot create binfmt registration for system ${system}")));
    }) cfg.emulatedSystems);
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -367,6 +367,7 @@ in {
  mimir = handleTest ./mimir.nix {};
  gancio = handleTest ./gancio.nix {};
  garage = handleTest ./garage {};
+  gatus = runTest ./gatus.nix;
  gemstash = handleTest ./gemstash.nix {};
  geoserver = runTest ./geoserver.nix;
  gerrit = handleTest ./gerrit.nix {};
@ -658,6 +659,7 @@ in {
  # TODO: put in networking.nix after the test becomes more complete
  networkingProxy = handleTest ./networking-proxy.nix {};
  nextcloud = handleTest ./nextcloud {};
+  nextflow = handleTestOn ["x86_64-linux"] ./nextflow.nix {};
  nextjs-ollama-llm-ui = runTest ./web-apps/nextjs-ollama-llm-ui.nix;
  nexus = handleTest ./nexus.nix {};
  # TODO: Test nfsv3 + Kerberos
--- a/nixos/tests/gatus.nix
+++ b/nixos/tests/gatus.nix
@ -0,0 +1,34 @@
+{ pkgs, ... }:
+{
+  name = "gatus";
+  meta.maintainers = with pkgs.lib.maintainers; [ pizzapim ];
+
+  nodes.machine =
+    { ... }:
+    {
+      services.gatus = {
+        enable = true;
+
+        settings = {
+          web.port = 8080;
+          metrics = true;
+
+          endpoints = [
+            {
+              name = "metrics";
+              url = "http://localhost:8080/metrics";
+              interval = "1s";
+              conditions = [
+                "[STATUS] == 200"
+              ];
+            }
+          ];
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("gatus.service")
+    machine.succeed("curl -s http://localhost:8080/metrics | grep go_info")
+  '';
+}
--- a/nixos/tests/nextflow.nix
+++ b/nixos/tests/nextflow.nix
@ -0,0 +1,60 @@
+import ./make-test-python.nix (
+  { pkgs, ... }:
+  let
+    bash = pkgs.dockerTools.pullImage {
+      imageName = "quay.io/nextflow/bash";
+      imageDigest = "sha256:bea0e244b7c5367b2b0de687e7d28f692013aa18970941c7dd184450125163ac";
+      sha256 = "161s9f24njjx87qrwq0c9nmnwvyc6iblcxka7hirw78lm7i9x4w5";
+      finalImageName = "quay.io/nextflow/bash";
+    };
+
+    hello = pkgs.stdenv.mkDerivation {
+      name = "nextflow-hello";
+      src = pkgs.fetchFromGitHub {
+        owner = "nextflow-io";
+        repo = "hello";
+        rev = "afff16a9b45c8e8a4f5a3743780ac13a541762f8";
+        hash = "sha256-c8FirHc+J5Y439g0BdHxRtXVrOAzIrGEKA0m1mp9b/U=";
+      };
+      installPhase = ''
+        cp -r $src $out
+      '';
+    };
+    run-nextflow-pipeline = pkgs.writeShellApplication {
+      name = "run-nextflow-pipeline";
+      runtimeInputs = [ pkgs.nextflow ];
+      text = ''
+        export NXF_OFFLINE=true
+        for b in false true; do
+          echo "docker.enabled = $b" > nextflow.config
+          cat nextflow.config
+          nextflow run -ansi-log false ${hello}
+        done
+      '';
+    };
+  in
+  {
+    name = "nextflow";
+
+    nodes.machine =
+      { ... }:
+      {
+        environment.systemPackages = [
+          run-nextflow-pipeline
+          pkgs.nextflow
+        ];
+        virtualisation = {
+          docker.enable = true;
+        };
+      };
+
+    testScript =
+      { nodes, ... }:
+      ''
+        start_all()
+        machine.wait_for_unit("docker.service")
+        machine.succeed("docker load < ${bash}")
+        machine.succeed("run-nextflow-pipeline >&2")
+      '';
+  }
+)
--- a/nixos/tests/switch-test.nix
+++ b/nixos/tests/switch-test.nix
@ -260,6 +260,15 @@ in {
          systemd.services."escaped\\x2ddash".serviceConfig.X-Test = "test";
        };

+        unitWithMultilineValue.configuration = {
+          systemd.services.test.serviceConfig.ExecStart = ''
+            ${pkgs.coreutils}/bin/true \
+            # ignored
+            ; ignored
+              blah blah
+          '';
+        };
+
        unitStartingWithDash.configuration = {
          systemd.services."-" = {
            wantedBy = [ "multi-user.target" ];
@ -874,9 +883,16 @@ in {
        machine.succeed("! test -e /run/current-system/dry-activate")
        machine.succeed("! test -e /run/current-system/bin/switch-to-configuration")

+        # Ensure units with multiline values work
+        out = switch_to_specialisation("${machine}", "unitWithMultilineValue")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_lacks(out, "restarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+        assert_contains(out, "starting the following units: test.service")
+
        # Ensure \ works in unit names
        out = switch_to_specialisation("${machine}", "unitWithBackslash")
-        assert_contains(out, "stopping the following units: test.service\n")
        assert_lacks(out, "NOT restarting the following changed units:")
        assert_lacks(out, "reloading the following units:")
        assert_lacks(out, "\nrestarting the following units:")
--- a/nixos/tests/systemd-binfmt.nix
+++ b/nixos/tests/systemd-binfmt.nix
@ -87,4 +87,29 @@ in {
      ).lower()
    '';
  };
+
+  chroot = makeTest {
+    name = "systemd-binfmt-chroot";
+    nodes.machine = { pkgs, lib, ... }: {
+      boot.binfmt.emulatedSystems = [
+        "aarch64-linux" "wasm32-wasi"
+      ];
+      boot.binfmt.preferStaticEmulators = true;
+
+      environment.systemPackages = [
+        (pkgs.writeShellScriptBin "test-chroot" ''
+          set -euo pipefail
+          mkdir -p /tmp/chroot
+          cp ${lib.getExe' pkgs.pkgsCross.aarch64-multiplatform.pkgsStatic.busybox "busybox"} /tmp/chroot/busybox
+          cp ${lib.getExe pkgs.pkgsCross.wasi32.yaml2json} /tmp/chroot/yaml2json # wasi binaries that build are hard to come by
+          chroot /tmp/chroot /busybox uname -m | grep aarch64
+          echo 42 | chroot /tmp/chroot /yaml2json | grep 42
+        '')
+      ];
+    };
+    testScript = ''
+      machine.start()
+      machine.succeed("test-chroot")
+    '';
+  };
 }
--- a/pkgs/applications/blockchains/electrs/default.nix
+++ b/pkgs/applications/blockchains/electrs/default.nix
@ -11,16 +11,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "electrs";
-  version = "0.10.5";
+  version = "0.10.6";

  src = fetchFromGitHub {
    owner = "romanz";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-tAHN5HWI9XsiCQzqLNtiib9wMskjfogc44+b4Bsjpog=";
+    hash = "sha256-yp9fKD7zH9Ne2+WQUupaxvUx39RWE8RdY4U6lHuDGSc=";
  };

-  cargoHash = "sha256-M0DIKt41K3BcP43+fBhv3HbRcIh8U9nhQYA/sm+bNow=";
+  cargoHash = "sha256-J+6aek1PcW7G6f4h6cQcx5CyliryZeSxkSIQUX3yz6s=";

  # needed for librocksdb-sys
  nativeBuildInputs = [ rustPlatform.bindgenHook ];
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -5486,6 +5486,18 @@ final: prev:
    meta.homepage = "https://github.com/udalov/kotlin-vim/";
  };

+  kulala-nvim = buildVimPlugin {
+    pname = "kulala.nvim";
+    version = "2024-09-30";
+    src = fetchFromGitHub {
+      owner = "mistweaverco";
+      repo = "kulala.nvim";
+      rev = "3b53dbb5677b144f372ecb25cb7841fba0c85a60";
+      sha256 = "sha256-Sbeby+N8bmkof8B8BsCWzZzWhot1wjQuRwqABI2/V3M=";
+    };
+    meta.homepage = "https://github.com/mistweaverco/kulala.nvim/";
+  };
+
  lalrpop-vim = buildVimPlugin {
    pname = "lalrpop.vim";
    version = "2017-11-22";
@ -8490,6 +8502,18 @@ final: prev:
    meta.homepage = "https://github.com/mfussenegger/nvim-dap-python/";
  };

+  nvim-dap-rego = buildVimPlugin {
+    pname = "nvim-dap-rego";
+    version = "2024-09-28";
+    src = fetchFromGitHub {
+      owner = "rinx";
+      repo = "nvim-dap-rego";
+      rev = "ab13103327b5e336a0d059ec2d9f1022c26ffadf";
+      sha256 = "05ainkya2z6hm02glz2xcnd39y3fvkdmsgnl6la7kchin227l6w4";
+    };
+    meta.homepage = "https://github.com/rinx/nvim-dap-rego/";
+  };
+
  nvim-dap-rr = buildVimPlugin {
    pname = "nvim-dap-rr";
    version = "2024-07-10";
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -985,6 +985,18 @@ in
    passthru.python3Dependencies = ps: [ ps.jupytext ];
  };

+  kulala-nvim = super.kulala-nvim.overrideAttrs {
+    dependencies = with self; [
+      nvim-treesitter
+      nvim-treesitter-parsers.http
+    ];
+    buildInputs = [ curl ];
+    postPatch = ''
+      substituteInPlace lua/kulala/config/init.lua \
+        --replace 'curl_path = "curl"' 'curl_path = "${lib.getExe curl}"'
+    '';
+  };
+
  LanguageClient-neovim =
    let
      version = "0.1.161";
@ -1283,6 +1295,10 @@ in
    dependencies = with self; [ nvim-dap ];
  };

+  nvim-dap-rego = super.nvim-dap-rego.overrideAttrs {
+    dependencies = with self; [ nvim-dap ];
+  };
+
  nvim-dap-ui = super.nvim-dap-ui.overrideAttrs {
    dependencies = with self; [ nvim-dap nvim-nio ];

--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -459,6 +459,7 @@ https://github.com/kmonad/kmonad-vim/,,
 https://github.com/frabjous/knap/,HEAD,
 https://github.com/b3nj5m1n/kommentary/,,
 https://github.com/udalov/kotlin-vim/,,
+https://github.com/mistweaverco/kulala.nvim/,HEAD,
 https://github.com/qnighy/lalrpop.vim/,,
 https://github.com/sk1418/last256/,,
 https://github.com/latex-box-team/latex-box/,,
@ -713,6 +714,7 @@ https://github.com/yamatsum/nvim-cursorline/,,
 https://github.com/mfussenegger/nvim-dap/,,
 https://github.com/leoluz/nvim-dap-go/,HEAD,
 https://github.com/mfussenegger/nvim-dap-python/,HEAD,
+https://github.com/rinx/nvim-dap-rego/,HEAD,
 https://github.com/jonboh/nvim-dap-rr/,HEAD,
 https://github.com/rcarriga/nvim-dap-ui/,,
 https://github.com/theHamsta/nvim-dap-virtual-text/,,
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -2037,8 +2037,8 @@ let
        mktplcRef = {
          publisher = "github";
          name = "copilot";
-          version = "1.219.1028"; # compatible with vscode ^1.92.0
-          hash = "sha256-5f1P/CV6+Rp2kS9oSz5Ko5jMUt/Q6pWa9a+3nPyin6k=";
+          version = "1.234.1133"; # compatible with vscode ^1.93.1
+          hash = "sha256-kRQIB4ozN8f+JPG2U6tA/u0r3/J05kYfMuksaJrumZM=";
        };

        meta = {
@ -2054,8 +2054,8 @@ let
        mktplcRef = {
          publisher = "github";
          name = "copilot-chat";
-          version = "0.19.2024073102"; # compatible with vscode ^1.92.0
-          hash = "sha256-ekRBmJiAav1gITWlqBOuWtZMt1YZeseF+3fw326db/s=";
+          version = "0.21.2024090602"; # latest compatible with vscode ^1.93
+          hash = "sha256-9wl/orFbf1OFwGnF1uLfyOOtO2v5k2H1aUMBtngXDfs=";
        };
        meta = {
          description = "GitHub Copilot Chat is a companion extension to GitHub Copilot that houses experimental chat features";
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@ -14,14 +14,14 @@

 stdenv.mkDerivation rec {
  pname = "drawio";
-  version = "24.7.8";
+  version = "24.7.17";

  src = fetchFromGitHub {
    owner = "jgraph";
    repo = "drawio-desktop";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-mpFmUPdgK9S6HcoO5wc6onUkmS6tRbFwLAsMhvIQ8sU=";
+    hash = "sha256-DWNFh3ocU5WVi5WZheMOMUYH6FHJ+LJbaUC1XkQ5TFo=";
  };

  # `@electron/fuses` tries to run `codesign` and fails. Disable and use autoSignDarwinBinariesHook instead
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {

  offlineCache = fetchYarnDeps {
    yarnLock = src + "/yarn.lock";
-    hash = "sha256-/3Dn4l5Bao01pcSXuPhq/AbH+gxZzHILP8TiHvplJpw=";
+    hash = "sha256-bAvS7AXmmS+yYsEkXxvszlErpZ3J5hVVXxxzYcsVP5Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -5,10 +5,10 @@
 {
  firefox = buildMozillaMach rec {
    pname = "firefox";
-    version = "130.0.1";
+    version = "131.0";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "163d1ce9f671a4716686955c43ff23d9f200f6c52dfdabcbb93af6a326c24aa5096404f42447b02b5a3ad02e2f60d17271783638fe027d24865aebb3e70e97fe";
+      sha512 = "324cbaadff4d19a18d56ca01ae7212ac8362e3f5933f3017a19b64c35d58606ace8bba3672790ecb48d4a849619cdc95701440701725e8eb2859d55f1e8d8e3c";
    };

    extraPatches = [
@ -96,10 +96,10 @@

  firefox-esr-128 = buildMozillaMach rec {
    pname = "firefox";
-    version = "128.2.0esr";
+    version = "128.3.0esr";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "9a689929f6f86d795ea2c0318bb78f77f72a552f40715a1108dbd6361b0dedc3aaf049f1883424012459899607067d5a8374d895564591ec6679a1ce80708d7d";
+      sha512 = "3c6ef272c0fb653d030fe3f7f72aa0e1097b1c6759556166815cde15465330f988b3bc23df4b4eb753daee930edbb1ef72145273cb29d0952bd9d7c547050f9b";
    };

    meta = {
@ -125,11 +125,11 @@

  firefox-esr-115 = (buildMozillaMach rec {
    pname = "firefox-esr-115";
-    version = "115.15.0esr";
+    version = "115.16.0esr";
    applicationName = "Mozilla Firefox ESR";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "0df4c498c99cce08903004d2e0f9e977a19f7de86240aa82dba179b60f1d67ca3021eb474f56bddc38035e773eeb5d99bb3e1b0756d9f7583dc8e1f747f477ba";
+      sha512 = "b6f93ec3d6acac5df177253c65b833c017e65ed6e78e96ff029098443928d291f6f67164aedb83d80aa28ee9dee305086597798238d3330e35183030e53e3550";
    };

    meta = {
--- a/pkgs/applications/networking/cluster/kops/default.nix
+++ b/pkgs/applications/networking/cluster/kops/default.nix
@ -62,8 +62,8 @@ rec {
  };

  kops_1_29 = mkKops rec {
-    version = "1.29.2";
-    sha256 = "sha256-SRj0x9N+yfTG/UL/hu1ds46Zt6d5SUYU0PA9lPHO6jQ=";
+    version = "1.30.1";
+    sha256 = "sha256-aj2OnjkXlBEH830RoJiAlhiFfS1zjVoX38PrsgAaB7A=";
    rev = "v${version}";
  };

--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -165,8 +165,8 @@ rec {
  mkTerraform = attrs: pluggable (generic attrs);

  terraform_1 = mkTerraform {
-    version = "1.9.6";
-    hash = "sha256-rlqpqiMlLcn2LqqKRU9iFaVqUz/QQtpiiZ39h5ZvpbI=";
+    version = "1.9.7";
+    hash = "sha256-L0F0u96et18IlqAUsc0HK+cLeav2OqN4kxs58hPNMIM=";
    vendorHash = "sha256-tH9KQF4oHcQh34ikB9Bx6fij/iLZN+waxv5ZilqGGlU=";
    patches = [ ./provider-path-0_15.patch ];
    passthru = {
--- a/pkgs/applications/networking/instant-messengers/flare-signal/Cargo.lock
+++ b/pkgs/applications/networking/instant-messengers/flare-signal/Cargo.lock
--- a/pkgs/applications/networking/instant-messengers/flare-signal/default.nix
+++ b/pkgs/applications/networking/instant-messengers/flare-signal/default.nix
@ -21,23 +21,24 @@

 stdenv.mkDerivation rec {
  pname = "flare";
-  version = "0.15.0";
+  version = "0.15.2";

  src = fetchFromGitLab {
    domain = "gitlab.com";
    owner = "schmiddi-on-mobile";
    repo = "flare";
    rev = version;
-    hash = "sha256-sIT4oEmIV8TJ5MMxg3vxkvK+7PaIy/01kN9I2FTsfo0=";
+    hash = "sha256-w8H6EYnVYJ6gDhdeZwyxRquem4ayZ4cgLaJMKqcetuI=";
  };

  cargoDeps = rustPlatform.importCargoLock {
    lockFile = ./Cargo.lock;
    outputHashes = {
+      "blurhash-0.2.3" = "sha256-s1777+2O0D/VyKwlPUA53gho5sOP8pN610KqxEjugz0=";
      "curve25519-dalek-4.1.3" = "sha256-bPh7eEgcZnq9C3wmSnnYv0C4aAP+7pnwk9Io29GrI4A=";
-      "libsignal-core-0.1.0" = "sha256-4aHINlpVAqVTtm7npwXQRutZUmIxYgkhXhApg7jSM4M=";
-      "libsignal-service-0.1.0" = "sha256-UMQqp6hfyVtUwkAqsw/xsn7UrGul/F4WVC/Oy5s+hqA=";
-      "presage-0.6.2" = "sha256-4E23mzXwb5gcj0XpXB17a5BD96+ZAl7dh5I6vMvE9Kg=";
+      "libsignal-core-0.1.0" = "sha256-AdN8UHu0khgsog1btE++0J4BmdUC6wMpZzL7HPzhALQ=";
+      "libsignal-service-0.1.0" = "sha256-bnbbbnoBaHUdobBywOAUQojoMYkOlgI2O1RG2DoyvUc=";
+      "presage-0.6.2" = "sha256-AB4ttolC6MPp3foT66DG5RArqX+c1wf2w3lIZ0u0LCM=";
    };
  };

--- a/pkgs/applications/networking/newsreaders/liferea/default.nix
+++ b/pkgs/applications/networking/newsreaders/liferea/default.nix
@ -24,11 +24,11 @@

 stdenv.mkDerivation rec {
  pname = "liferea";
-  version = "1.15.7";
+  version = "1.15.8";

  src = fetchurl {
    url = "https://github.com/lwindolf/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-vv6hrvfD1T+eH/Bi1ID0yoxB4747Q+nMvklT49uaX38=";
+    hash = "sha256-eBnysEppgYar2QEHq4P+5blmBgrW4H0jHPmYMXri8f8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/shellhub-agent/default.nix
+++ b/pkgs/applications/networking/shellhub-agent/default.nix
@ -11,13 +11,13 @@

 buildGoModule rec {
  pname = "shellhub-agent";
-  version = "0.16.2";
+  version = "0.16.4";

  src = fetchFromGitHub {
    owner = "shellhub-io";
    repo = "shellhub";
    rev = "v${version}";
-    hash = "sha256-oIRMzifp/MVw+0s/QjhZpW7HEjNPHiCyEoNQq6ZRBGE=";
+    hash = "sha256-pxV9WLx0trgG0htWuYG/j634iaQRo5/TXOOU8rOmxDw=";
  };

  modRoot = "./agent";
--- a/pkgs/applications/science/logic/lean4/default.nix
+++ b/pkgs/applications/science/logic/lean4/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lean4";
-  version = "4.9.1";
+  version = "4.10.0";

  src = fetchFromGitHub {
    owner = "leanprover";
    repo = "lean4";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-C3N56f3mT+5f149T1BIYQil2UleAWmnRYLqUq4zcLgs=";
+    hash = "sha256-lNWr84aeVpI/p/oxkNAUlUMUROGGzHAkb2D9q8BzHeA=";
  };

  postPatch = ''
--- a/pkgs/applications/version-management/gh/default.nix
+++ b/pkgs/applications/version-management/gh/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "gh";
-  version = "2.57.0";
+  version = "2.58.0";

  src = fetchFromGitHub {
    owner = "cli";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-HNr/HBt1EqbV+/dLCztucmeAqw3jLPOgQ0WLPxGDYgY=";
+    hash = "sha256-KHJKE550XlGdB++jq/1kHP4o1QISbPtbt4GU9uIP3RE=";
  };

-  vendorHash = "sha256-gPUEfdS4iEzMQGdUNKMmEGRug66NVcrV3zvmkoEsNGo=";
+  vendorHash = "sha256-6T9LQNzGpADLwI0pFvjBe5rqbXOEDZmjYCy4RhNqcFI=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -57,24 +57,24 @@

 let
  pname = "gitkraken";
-  version = "10.3.0";
+  version = "10.4.0";

  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";

  srcs = {
    x86_64-linux = fetchzip {
      url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-      hash = "sha256-5WICLLuv+NL++fgm7p/ScyEvzwVqcXNI6eXGr4e9k20=";
+      hash = "sha256-JGWDOAkJEnhvUyQOFsmoeW9Izj0IuHNpYGlYAMiWPj0=";
    };

    x86_64-darwin = fetchzip {
      url = "https://release.axocdn.com/darwin/GitKraken-v${version}.zip";
-      hash = "sha256-zkQQR90pdYGIZf3OmAdKc1SlotgdSRGJaYsA1n74aZk=";
+      hash = "sha256-yCDE6QJMgU2Mgr/kUDnbKwQ3MpgVcdjAK7fnTAjSL54=";
    };

    aarch64-darwin = fetchzip {
      url = "https://release.axocdn.com/darwin-arm64/GitKraken-v${version}.zip";
-      hash = "sha256-WYBXupyunpAaoHmA4dHfd/oruP20rYsIq5mO4/dDsoM=";
+      hash = "sha256-nh+tO++QvPx9jyZuxNrH7rHFXZqVnu5jyiki3oWdw7E=";
    };
  };

--- a/pkgs/applications/version-management/gitstatus/default.nix
+++ b/pkgs/applications/version-management/gitstatus/default.nix
@ -1,5 +1,12 @@
-{ callPackage, lib, stdenv, fetchFromGitHub, git, zsh }:
-
+{
+  callPackage,
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  git,
+  zsh,
+  runtimeShell,
+}:
 stdenv.mkDerivation rec {
  pname = "gitstatus";
  version = "1.5.5";
@ -23,6 +30,8 @@ stdenv.mkDerivation rec {
    install -Dm755 usrbin/gitstatusd $out/bin/gitstatusd
    install -Dm444 gitstatus.plugin.sh -t $out/share/gitstatus/
    install -Dm444 gitstatus.plugin.zsh -t $out/share/gitstatus/
+    install -Dm444 gitstatus.prompt.sh -t $out/share/gitstatus/
+    install -Dm444 gitstatus.prompt.zsh -t $out/share/gitstatus/
    install -Dm555 install -t $out/share/gitstatus/
    install -Dm444 build.info -t $out/share/gitstatus/

@ -30,6 +39,14 @@ stdenv.mkDerivation rec {
    # because the FHS directories don't start at /
    substituteInPlace install \
      --replace "_gitstatus_install_main ." "_gitstatus_install_main $out"
+
+    cat <<EOF > $out/bin/gitstatus-share
+    #!${runtimeShell}
+    # Run this script to find the gitstatus shared folder where all the shell
+    # integration scripts are living.
+    echo $out/share/gitstatus
+    EOF
+    chmod +x $out/bin/gitstatus-share
  '';

  # Don't install the "install" and "build.info" files, which the end user
@ -38,6 +55,8 @@ stdenv.mkDerivation rec {
    "/bin/gitstatusd"
    "/share/gitstatus/gitstatus.plugin.sh"
    "/share/gitstatus/gitstatus.plugin.zsh"
+    "/share/gitstatus/gitstatus.prompt.sh"
+    "/share/gitstatus/gitstatus.prompt.zsh"
  ];

  # The install check sets up an empty Git repository and a minimal zshrc that
@ -45,7 +64,10 @@ stdenv.mkDerivation rec {
  # that the script was sourced successfully and that the "gitstatus_query"
  # command ran successfully. This tests the binary itself and the zsh
  # integration.
-  nativeInstallCheckInputs = [ git zsh ];
+  nativeInstallCheckInputs = [
+    git
+    zsh
+  ];
  doInstallCheck = true;
  installCheckPhase = ''
    TEMP=$(mktemp -d)
@ -83,9 +105,20 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "10x faster implementation of `git status` command";
+    longDescription = ''
+      To enable the included gitstatus prompt, add the appropriate line to your NixOS configuration:
+      `programs.bash.promptInit = "source $(gitstatus-share)/gitstatus.prompt.sh";`
+      `programs.zsh.promptInit = "source $(gitstatus-share)/gitstatus.prompt.zsh";`
+
+      See the project homepage for details on customization.
+    '';
    homepage = "https://github.com/romkatv/gitstatus";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ mmlb hexa SuperSandro2000 ];
+    maintainers = with maintainers; [
+      mmlb
+      hexa
+      SuperSandro2000
+    ];
    platforms = platforms.all;
    mainProgram = "gitstatusd";
  };
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -14,7 +14,7 @@ rec {
      , makeWrapper, installShellFiles, pkg-config, glibc
      , go-md2man, go, containerd, runc, tini, libtool
      , sqlite, iproute2, docker-buildx, docker-compose, docker-sbom
-      , iptables, e2fsprogs, xz, util-linux, xfsprogs, git
+      , iptables, e2fsprogs, xz, util-linux, xfsprogs, gitMinimal
      , procps, rootlesskit, slirp4netns, fuse-overlayfs, nixosTests
      , clientOnly ? !stdenv.hostPlatform.isLinux, symlinkJoin
      , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, systemd
@ -95,7 +95,7 @@ rec {
        ++ lib.optional withSystemd systemd
        ++ lib.optional withSeccomp libseccomp;

-      extraPath = lib.optionals stdenv.hostPlatform.isLinux (lib.makeBinPath [ iproute2 iptables e2fsprogs xz xfsprogs procps util-linux git ]);
+      extraPath = lib.optionals stdenv.hostPlatform.isLinux (lib.makeBinPath [ iproute2 iptables e2fsprogs xz xfsprogs procps util-linux gitMinimal ]);

      extraUserPath = lib.optionals (stdenv.hostPlatform.isLinux && !clientOnly) (lib.makeBinPath [ rootlesskit slirp4netns fuse-overlayfs ]);

--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -94,10 +94,9 @@ stdenv.mkDerivation (finalAttrs: {
    ++ lib.optionals stdenv.hostPlatform.isDarwin [ sigtool ]
    ++ lib.optionals (!userOnly) [ dtc ];

-  buildInputs = [ zlib glib pixman
-    vde2 lzo snappy libtasn1
-    gnutls nettle curl libslirp
-  ]
+  buildInputs = [ glib zlib ]
+    ++ lib.optionals (!minimal) [ dtc pixman vde2 lzo snappy libtasn1 gnutls nettle libslirp ]
+    ++ lib.optionals (!userOnly) [ curl ]
    ++ lib.optionals ncursesSupport [ ncurses ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices Cocoa Hypervisor Kernel rez setfile vmnet ]
    ++ lib.optionals seccompSupport [ libseccomp ]
@ -112,8 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
    ++ lib.optionals smartcardSupport [ libcacard ]
    ++ lib.optionals spiceSupport [ spice-protocol spice ]
    ++ lib.optionals usbredirSupport [ usbredir ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ libcap_ng libcap attr ]
-    ++ lib.optionals (stdenv.hostPlatform.isLinux && !userOnly) [ libaio ]
+    ++ lib.optionals (stdenv.hostPlatform.isLinux && !userOnly) [ libcap_ng libcap attr libaio ]
    ++ lib.optionals xenSupport [ xen ]
    ++ lib.optionals cephSupport [ ceph ]
    ++ lib.optionals glusterfsSupport [ glusterfs libuuid ]
@ -124,8 +122,7 @@ stdenv.mkDerivation (finalAttrs: {
    ++ lib.optionals smbdSupport [ samba ]
    ++ lib.optionals uringSupport [ liburing ]
    ++ lib.optionals canokeySupport [ canokey-qemu ]
-    ++ lib.optionals capstoneSupport [ capstone ]
-    ++ lib.optionals (!userOnly) [ dtc ];
+    ++ lib.optionals capstoneSupport [ capstone ];

  dontUseMesonConfigure = true; # meson's configurePhase isn't compatible with qemu build
  dontAddStaticConfigureFlags = true;
--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@ -54,7 +54,7 @@ python3.pkgs.buildPythonApplication rec {
    gsettings-desktop-schemas libosinfo gtksourceview4
  ] ++ lib.optional spiceSupport spice-gtk;

-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
    pygobject3 libvirt libxml2 requests cdrtools
  ];

@ -74,7 +74,7 @@ python3.pkgs.buildPythonApplication rec {
  preFixup = ''
    glib-compile-schemas $out/share/gsettings-schemas/${pname}-${version}/glib-2.0/schemas

-    gappsWrapperArgs+=(--set PYTHONPATH "$PYTHONPATH")
+    gappsWrapperArgs+=(--set PYTHONPATH "${python3.pkgs.makePythonPath dependencies}")
    # these are called from virt-install in initrdinject.py
    gappsWrapperArgs+=(--prefix PATH : "${lib.makeBinPath [ cpio e2fsprogs file findutils gzip ]}")

--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@ -3,6 +3,7 @@
 # Checkout ./README.md for more information.

 {
+  config,
  lib,
  mkAzExtension,
  mycli,
@ -83,6 +84,8 @@
    meta.maintainers = with lib.maintainers; [ katexochen ];
  };

+}
+// lib.optionalAttrs config.allowAliases {
  # Removed extensions
  blockchain = throw "The 'blockchain' extension for azure-cli was deprecated upstream"; # Added 2024-04-26
  vm-repair = throw "The 'vm-repair' extension for azure-cli was deprecated upstream"; # Added 2024-08-06
--- a/pkgs/by-name/bu/buildkite-agent/package.nix
+++ b/pkgs/by-name/bu/buildkite-agent/package.nix
@ -13,16 +13,16 @@
 }:
 buildGoModule rec {
  pname = "buildkite-agent";
-  version = "3.77.0";
+  version = "3.82.1";

  src = fetchFromGitHub {
    owner = "buildkite";
    repo = "agent";
    rev = "v${version}";
-    hash = "sha256-QsSCIAy0ekkZiqO/cFcPNNkXa3FLL3Z1LJoKsjzB6jw=";
+    hash = "sha256-xTF8zmpwEFHkLwDYBICXJZ4gjJYpcH5i76kPQM6qt5o=";
  };

-  vendorHash = "sha256-xp836ZT2x20ZbkTEubhiZlLmK9n2F8mCSWZTHmAuu6A=";
+  vendorHash = "sha256-xKAQ2yvFYl9ld3H6IGafYgCdA8jn9xig/AAej56ACns=";

  postPatch = ''
    substituteInPlace clicommand/agent_start.go --replace /bin/bash ${bash}/bin/bash
--- a/pkgs/by-name/c3/c3-lsp/package.nix
+++ b/pkgs/by-name/c3/c3-lsp/package.nix
@ -0,0 +1,35 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "c3-lsp";
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "pherrymason";
+    repo = "c3-lsp";
+    rev = "v${version}";
+    hash = "sha256-HD3NE2L1ge0pf8vtrKkYh4GIZg6lSPTZGFQ+LPbDup4=";
+  };
+
+  sourceRoot = "${src.name}/server";
+
+  vendorHash = "sha256-y+Qs3zuvTq/KRc1ziH0R7E10et+MaQW9xOsFmSdI7PM=";
+
+  postInstall = ''
+    mv $out/bin/lsp $out/bin/c3-lsp
+  '';
+
+  meta = {
+    description = "Language Server for C3 Language";
+    homepage = "https://github.com/pherrymason/c3-lsp";
+    changelog = "https://github.com/pherrymason/c3-lsp/blob/${src.rev}/changelog.md";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ arthsmn ];
+    mainProgram = "c3-lsp";
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/by-name/ch/chirp/package.nix
+++ b/pkgs/by-name/ch/chirp/package.nix
@ -10,13 +10,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "chirp";
-  version = "0.4.0-unstable-2024-09-19";
+  version = "0.4.0-unstable-2024-09-28";

  src = fetchFromGitHub {
    owner = "kk7ds";
    repo = "chirp";
-    rev = "786e37ce269a4bf50bd7a75143479862f52c0eeb";
-    hash = "sha256-+vY4d4z5oqrhPqokSGwCCP/oNz0al3+91akisSESXGk=";
+    rev = "c09d51c5b92995de266ef4d7f285b8d110c0bdc7";
+    hash = "sha256-ErIAqXexgKjpbnubekX9Gy0qAkUDhNil8PtEOcxYVdk=";
  };
  buildInputs = [
    glib
--- a/pkgs/by-name/cl/cljfmt/package.nix
+++ b/pkgs/by-name/cl/cljfmt/package.nix
@ -8,11 +8,11 @@

 buildGraalvmNativeImage rec {
  pname = "cljfmt";
-  version = "0.12.0";
+  version = "0.13.0";

  src = fetchurl {
    url = "https://github.com/weavejester/cljfmt/releases/download/${version}/cljfmt-${version}-standalone.jar";
-    hash = "sha256-JdrMsRmTT8U8RZDI2SnQxM5WGMpo1pL2CQ5BqLxcf5M=";
+    hash = "sha256-gPIDaFb8mmJyoAIOUWV7ZNNi/rSnuRkYN16Grqly0/c=";
  };

  extraNativeImageBuildArgs = [
--- a/pkgs/by-name/cr/crystal-dock/package.nix
+++ b/pkgs/by-name/cr/crystal-dock/package.nix
@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "crystal-dock";
-  version = "2.3";
+  version = "2.5";

  src = fetchFromGitHub {
    owner = "dangvd";
    repo = "crystal-dock";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-lqj2C4WrpJd1WMtm8JvGTEWeEUh17DR6J5TqxKt5hWM=";
+    hash = "sha256-y7Wt0o57z8NaAcYoaigWtI7twx8UAUgSIEWz86LcNKM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@ -6,7 +6,7 @@
 , testers
 , cachix
 , darwin
-, libgit2
+, sqlx-cli
 , nixVersions
 , openssl
 , pkg-config
@ -19,15 +19,14 @@ let
    src = fetchFromGitHub {
      owner = "domenkozar";
      repo = "nix";
-      rev = "1e61e9f40673f84c3b02573145492d8af581bec5";
-      hash = "sha256-uDwWyizzlQ0HFzrhP6rVp2+2NNA+/TM5zT32dR8GUlg=";
+      rev = "f6c5ae4c1b2e411e6b1e6a8181cc84363d6a7546";
+      hash = "sha256-X8ES7I1cfNhR9oKp06F6ir4Np70WGZU5sfCOuNBEwMg=";
    };
-    buildInputs = old.buildInputs ++ [ libgit2 ];
    doCheck = false;
    doInstallCheck = false;
  });

-  version = "1.2";
+  version = "1.3";
 in rustPlatform.buildRustPackage {
  pname = "devenv";
  inherit version;
@ -36,14 +35,24 @@ in rustPlatform.buildRustPackage {
    owner = "cachix";
    repo = "devenv";
    rev = "v${version}";
-    hash = "sha256-95MYldiApQ7gqoUa79yolPahudKmFv6B2HnF+ZqWiGI=";
+    hash = "sha256-14hqEeVy72nYDOFn7HK6Mff7L49kUI5K6wMLVHG3A90=";
  };

-  cargoHash = "sha256-A2s+DXq00T0DCVXUHy2ZN6XvqpHy6PmL0H9l1NIfFVU=";
+  cargoHash = "sha256-E4pU/tZHxMrKSheqWF5qeOfS/NZ/Uw5jY+AbSUHmoaI=";

  buildAndTestSubdir = "devenv";

-  nativeBuildInputs = [ makeWrapper pkg-config ];
+  # Force sqlx to use the prepared queries
+  SQLX_OFFLINE = true;
+  # A local database to use for preparing queries
+  DATABASE_URL = "sqlite:nix-eval-cache.db";
+
+  preBuild = ''
+    cargo sqlx database setup --source devenv-eval-cache/migrations
+    cargo sqlx prepare --workspace
+  '';
+
+  nativeBuildInputs = [ makeWrapper pkg-config sqlx-cli ];

  buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
    darwin.apple_sdk.frameworks.SystemConfiguration
--- a/pkgs/by-name/di/diffedit3/package.nix
+++ b/pkgs/by-name/di/diffedit3/package.nix
@ -4,14 +4,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "diffedit3";
-  version = "0.4.0";
+  version = "0.5.0";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-qw5Wos2u/H6ccJ3qkrVOCisMFDTNwxp/YeOTE1x5lcU=";
+    hash = "sha256-zBdLz8O2WCR8SN0UXUAaEdIpmmL+LIaGt44STBw6nyU=";
  };

-  cargoHash = "sha256-e5bm8GLubA9BzH9oKKSC/Ysh+O+GJA8x6W576vKIIUA=";
+  cargoHash = "sha256-jZTXM+2Gd4N9D4Pj2KsuQ2MFPuWJdHg30u/5BlM3HEE=";

  passthru = {
    updateScript = nix-update-script { };
--- a/pkgs/by-name/du/dumbpipe/package.nix
+++ b/pkgs/by-name/du/dumbpipe/package.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "dumbpipe";
-  version = "0.17.0";
+  version = "0.18.0";

  src = fetchFromGitHub {
    owner = "n0-computer";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-7OHghotSibkGRrcsh7CqZBp94FY6RKZvcn8QW+dTH1I=";
+    hash = "sha256-FVS0+2BuM2/X+SEBk9DngzlFlpSL16vzn4oEsjelM6c=";
  };

-  cargoHash = "sha256-rlhfGw/b0HnV1Xl9VWIqEuyM9pq29O6bpaawk2hnG+o=";
+  cargoHash = "sha256-o+nUTqIPycUxz2VXwse7QN7q3j1Stjck1VUf6rHgS64=";

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
    with darwin.apple_sdk.frameworks; [
--- a/pkgs/by-name/ea/easytier/package.nix
+++ b/pkgs/by-name/ea/easytier/package.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "easytier";
-  version = "1.2.3";
+  version = "2.0.0";

  src = fetchFromGitHub {
    owner = "EasyTier";
    repo = "EasyTier";
    rev = "refs/tags/v${version}";
-    hash = "sha256-7T6xdJrVTgg7rSTC2PaVTsBTgi14qJzaR6M8tRUL8OQ=";
+    hash = "sha256-Qej6g9oxY6Wvv7jbyK9TN7QE7sfrdref7XPj10mSKUg=";
  };

-  cargoHash = "sha256-9wAGUVYKz7+Q8y+dmay8pEZnv7PikzuAoas/h5T3sLE=";
+  cargoHash = "sha256-UegTL9ZdqLQYtcg8sJSGkie3ezt9OFMX0iVm/B1D91I=";

  nativeBuildInputs = [ protobuf ];

--- a/pkgs/by-name/ei/eigenlayer/package.nix
+++ b/pkgs/by-name/ei/eigenlayer/package.nix
@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
  pname = "eigenlayer";
-  version = "0.10.4";
+  version = "0.10.6";

  src = fetchFromGitHub {
    owner = "Layr-Labs";
    repo = "eigenlayer-cli";
    rev = "v${version}";
-    hash = "sha256-veq1x5fV4guj4ElpwxGdXPLrORdLGGrPT5Q8a8IR8LY=";
+    hash = "sha256-FvmS9rWmf6bzY5QjVS3otylHYPyQ7KqXVJ0m28/zEi8=";
  };

-  vendorHash = "sha256-Pf0dEtHhbNCwOMgbeGRwZ5x2JS/U8PEI7/AnVwsXFzk=";
+  vendorHash = "sha256-7KC99PqAPfGnm7yA4nfAlC7V4NhCEYDyPxY7CdOdwno=";

  ldflags = ["-s" "-w"];
  subPackages = ["cmd/eigenlayer"];
--- a/pkgs/by-name/en/envision-unwrapped/package.nix
+++ b/pkgs/by-name/en/envision-unwrapped/package.nix
@ -31,13 +31,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "envision-unwrapped";
-  version = "0-unstable-2024-09-21";
+  version = "0-unstable-2024-09-28";

  src = fetchFromGitLab {
    owner = "gabmus";
    repo = "envision";
-    rev = "41e9af1676d3cfd458939a34b5c8b06d84c3f764";
-    hash = "sha256-qk9xlHWbkCRpve3SZMtq5ojfS2tRwyXsckqu7fs/Lm0=";
+    rev = "56d500a9f914ce2ddad038223711192e4d1dcbe1";
+    hash = "sha256-8wU2sjhH026l6a11XZ5Qdu5x/EbI+ZqwE7AixsYMCFk=";
  };

  strictDeps = true;
--- a/pkgs/by-name/fo/fooyin/package.nix
+++ b/pkgs/by-name/fo/fooyin/package.nix
@ -9,17 +9,18 @@
 , kdsingleapplication
 , pipewire
 , taglib
+, libvgm
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "fooyin";
-  version = "0.5.3";
+  version = "0.7.2";

  src = fetchFromGitHub {
    owner = "ludouzi";
    repo = "fooyin";
    rev = "v" + finalAttrs.version;
-    hash = "sha256-h8unOzDSQ9ME6nbfLxau1EctJeNH8P2VG0IBQoqhwGs=";
+    hash = "sha256-9tNd0TDTxlm6jV2kkZGZbi8tZMj13jbp3+aKXOkNtIw=";
  };

  buildInputs = [
@ -31,6 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
    kdePackages.qtbase
    kdePackages.qtsvg
    taglib
+    libvgm
  ];

  nativeBuildInputs = [
--- a/pkgs/by-name/ga/gatus/package.nix
+++ b/pkgs/by-name/ga/gatus/package.nix
@ -1,4 +1,9 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nixosTests,
+}:

 buildGoModule rec {
  pname = "gatus";
@ -15,12 +20,15 @@ buildGoModule rec {

  subPackages = [ "." ];

-  meta = with lib;
-    {
-      description = "Automated developer-oriented status page";
-      homepage = "https://gatus.io";
-      license = licenses.asl20;
-      maintainers = with maintainers; [ undefined-moe ];
-      mainProgram = "gatus";
-    };
+  passthru.tests = {
+    inherit (nixosTests) gatus;
+  };
+
+  meta = with lib; {
+    description = "Automated developer-oriented status page";
+    homepage = "https://gatus.io";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ undefined-moe ];
+    mainProgram = "gatus";
+  };
 }
--- a/pkgs/by-name/gg/gg-jj/package.nix
+++ b/pkgs/by-name/gg/gg-jj/package.nix
@ -0,0 +1,80 @@
+{
+  rustPlatform,
+  callPackage,
+  pkg-config,
+  lib,
+  fetchFromGitHub,
+  libayatana-appindicator,
+  openssl,
+  webkitgtk_4_1,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "gg-jj";
+  version = "0.20.0";
+
+  src = fetchFromGitHub {
+    owner = "gulbanana";
+    repo = "gg";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-xOi/AUlH0FeenTXz3hsDYixCEl+yr22PGy6Ow4TKxY0=";
+  };
+
+  sourceRoot = "${src.name}/src-tauri";
+
+  webui = callPackage ./webui.nix {
+    inherit
+      src
+      pname
+      version
+      meta
+      ;
+  };
+
+  env = {
+    OPENSSL_NO_VENDOR = 1;
+  };
+
+  buildInputs = [
+    webkitgtk_4_1
+    openssl
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  cargoHash = "sha256-u3SkRA7327ZwqEnB+Xq2JDbI0k5HfeKzV17dvQ8B6xk=";
+
+  postPatch = ''
+    buildRoot=$(pwd)
+    pushd $cargoDepsCopy/libappindicator-sys
+    oldHash=$(sha256sum src/lib.rs | cut -d " " -f 1)
+    substituteInPlace src/lib.rs \
+      --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
+    substituteInPlace .cargo-checksum.json \
+      --replace-fail $oldHash $(sha256sum src/lib.rs | cut -d " " -f 1)
+    popd
+
+    pushd $cargoDepsCopy/jj-cli
+    oldHash=$(sha256sum build.rs | cut -d " " -f 1)
+    substituteInPlace build.rs \
+      --replace-fail 'let path = std::env::var("CARGO_MANIFEST_DIR").unwrap();' "let path = \"$buildRoot\";"
+    substituteInPlace .cargo-checksum.json \
+      --replace-fail $oldHash $(sha256sum build.rs | cut -d " " -f 1)
+    popd
+
+    substituteInPlace ./tauri.conf.json \
+      --replace-fail '"frontendDist": "../dist"' '"frontendDist": "${webui}"' \
+      --replace-fail '"beforeBuildCommand": "npm run build"' '"beforeBuildCommand": ""'
+  '';
+
+  meta = {
+    homepage = "https://github.com/gulbanana/gg";
+    changelog = "https://github.com/gulbanana/gg/releases/tag/v${version}";
+    description = "GUI for jj users";
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    mainProgram = "gg";
+    license = lib.licenses.apsl20;
+  };
+}
--- a/pkgs/by-name/gg/gg-jj/webui.nix
+++ b/pkgs/by-name/gg/gg-jj/webui.nix
@ -0,0 +1,31 @@
+{
+  version,
+  src,
+  pname,
+  pnpm,
+  meta,
+  buildNpmPackage,
+}:
+
+buildNpmPackage {
+  inherit version src meta;
+  pname = "${pname}-webui";
+
+  npmDepsHash = "sha256-oHBFuX65D/FgnGa03jjpIKAdH8Q4c2NrpD64bhfe720=";
+
+  buildPhase = ''
+    runHook preBuild
+
+    node --max_old_space_size=1024000 ./node_modules/vite/bin/vite.js build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r dist $out
+
+    runHook postInstall
+  '';
+}
--- a/pkgs/by-name/gl/glfw3/package.nix
+++ b/pkgs/by-name/gl/glfw3/package.nix
@ -1,7 +1,7 @@
-{ stdenv, lib, fetchFromGitHub, cmake
+{ stdenv, lib, fetchFromGitHub, cmake, pkg-config
 , libGL, libXrandr, libXinerama, libXcursor, libX11, libXi, libXext
 , darwin, fixDarwinDylibNames
-, extra-cmake-modules, wayland
+, wayland
 , wayland-scanner, wayland-protocols, libxkbcommon, libdecor
 , withMinecraftPatch ? false
 }:
@ -28,7 +28,7 @@ stdenv.mkDerivation {

  propagatedBuildInputs = lib.optionals (!stdenv.hostPlatform.isWindows) [ libGL ];

-  nativeBuildInputs = [ cmake extra-cmake-modules ]
+  nativeBuildInputs = [ cmake pkg-config ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [ wayland-scanner ];

--- a/pkgs/development/tools/goda/default.nix
+++ b/pkgs/development/tools/goda/default.nix
@ -1,4 +1,9 @@
-{ lib, nix-update-script, buildGoModule, fetchFromGitHub }:
+{
+  lib,
+  nix-update-script,
+  buildGoModule,
+  fetchFromGitHub,
+}:

 buildGoModule rec {
  pname = "goda";
--- a/pkgs/by-name/ju/jujutsu/package.nix
+++ b/pkgs/by-name/ju/jujutsu/package.nix
@ -21,7 +21,7 @@
 }:

 let
-  version = "0.21.0";
+  version = "0.22.0";
 in

 rustPlatform.buildRustPackage {
@ -32,10 +32,10 @@ rustPlatform.buildRustPackage {
    owner = "martinvonz";
    repo = "jj";
    rev = "v${version}";
-    hash = "sha256-uZsfHhcYpobatWaDQczuc9Z3BWHN5VO0qr/8mu5kEio=";
+    hash = "sha256-GbKmX1Ev/8di3A1XT5ZIRjzn2zP6DMye2NpA26PGVIs=";
  };

-  cargoHash = "sha256-BOO1jP1Y5CNbE97zj+tpariiBdcuxKb1wyvI7i/VpYI=";
+  cargoHash = "sha256-+3oO2M2293Nba6P8bejgZD5OxgCpkIRdcPICDswJyEU=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/la/lammps/package.nix
+++ b/pkgs/by-name/la/lammps/package.nix
@ -49,14 +49,14 @@
 stdenv.mkDerivation (finalAttrs: {
  # LAMMPS has weird versioning convention. Updates should go smoothly with:
  # nix-update --commit lammps --version-regex 'stable_(.*)'
-  version = "29Aug2024";
+  version = "29Aug2024_update1";
  pname = "lammps";

  src = fetchFromGitHub {
    owner = "lammps";
    repo = "lammps";
    rev = "stable_${finalAttrs.version}";
-    hash = "sha256-UySWbJPubl318IA2MeTrz3Ya+9YyVOeR/Fs4aYI1R2o=";
+    hash = "sha256-B2oMs9bVYO+G3yL1DGJVK/INIfANMDREV7AtC4kH3H8=";
  };
  preConfigure = ''
    cd cmake
--- a/pkgs/by-name/li/libresplit/package.nix
+++ b/pkgs/by-name/li/libresplit/package.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation {
  pname = "libresplit";
-  version = "0-unstable-2024-06-05";
+  version = "0-unstable-2024-09-24";

  src = fetchFromGitHub {
    owner = "wins1ey";
    repo = "LibreSplit";
-    rev = "ba10e054e2cd3a96034e3a8d5758f4ad32759ff0";
-    hash = "sha256-imKzBXwyJQeChT36FuY7ihZw+IcGbjp7LoMGRy3hM/0=";
+    rev = "b56ce6743378fc09c9ab621713423754eac945a1";
+    hash = "sha256-mhX5xyBmElPV6NUQRTz8KKL+H1on3WJ4DYatv89MRPo=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/li/libsignal-ffi/Cargo.lock
+++ b/pkgs/by-name/li/libsignal-ffi/Cargo.lock
@ -269,6 +269,7 @@ dependencies = [
 "assert_matches",
 "base64 0.21.7",
 "bitflags",
+ "blake2",
 "boring",
 "chacha20poly1305",
 "chrono",
@ -278,6 +279,7 @@ dependencies = [
 "hex-literal",
 "lazy_static",
 "libc",
+ "libcrux-ml-kem",
 "log",
 "prost",
 "prost-build",
@ -1495,6 +1497,43 @@ version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"

+[[package]]
+name = "hax-lib"
+version = "0.1.0-pre.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b4c24729b7608f3a2f2b798b503e18ca3d46b5287e85e42c3e2a81a6431c20e"
+dependencies = [
+ "hax-lib-macros",
+ "num-bigint",
+ "num-traits 0.2.19",
+]
+
+[[package]]
+name = "hax-lib-macros"
+version = "0.1.0-pre.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e537b6582ecf0d2bc9761b6c129840c9a039263e71b933850af8e24d5e3a840"
+dependencies = [
+ "hax-lib-macros-types",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.72",
+]
+
+[[package]]
+name = "hax-lib-macros-types"
+version = "0.1.0-pre.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1025439d93a495700d7099f7bd2285845837def514b2f97b2f8a4cd93fab5bd9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "uuid",
+]
+
 [[package]]
 name = "headers"
 version = "0.3.9"
@ -1943,6 +1982,45 @@ version = "0.2.155"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"

+[[package]]
+name = "libcrux-intrinsics"
+version = "0.0.2-alpha.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9995f4888b0bbcb4bab293c271ac6f5a4fa6a06f76576cb2c31063ba618d9914"
+
+[[package]]
+name = "libcrux-ml-kem"
+version = "0.0.2-alpha.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6cac73db2e2fa0382c2f37632e0d1e188201175deda0158b49a2632bc8deefe1"
+dependencies = [
+ "hax-lib",
+ "libcrux-intrinsics",
+ "libcrux-platform",
+ "libcrux-sha3",
+ "rand_core",
+]
+
+[[package]]
+name = "libcrux-platform"
+version = "0.0.2-pre.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "647e39666194b11df17c19451d1154b9be79df98b9821532560c2ecad0cf3410"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "libcrux-sha3"
+version = "0.0.2-alpha.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee374451378a5b7ec908373d03a78cbf050c387cd1996a50724d88a392f4d1a5"
+dependencies = [
+ "hax-lib",
+ "libcrux-intrinsics",
+ "libcrux-platform",
+]
+
 [[package]]
 name = "libloading"
 version = "0.8.5"
@ -2018,16 +2096,24 @@ dependencies = [
 name = "libsignal-bridge-testing"
 version = "0.1.0"
 dependencies = [
+ "attest",
 "futures-util",
+ "http 1.1.0",
 "jni 0.21.1",
 "libsignal-bridge-macros",
 "libsignal-bridge-types",
 "libsignal-message-backup",
+ "libsignal-net",
+ "libsignal-protocol",
 "linkme",
 "neon",
+ "nonzero_ext",
 "paste",
+ "prost",
 "scopeguard",
+ "strum",
 "tokio",
+ "uuid",
 ]

 [[package]]
@ -2091,7 +2177,7 @@ dependencies = [

 [[package]]
 name = "libsignal-ffi"
-version = "0.55.1"
+version = "0.57.1"
 dependencies = [
 "cpufeatures",
 "futures-util",
@ -2106,7 +2192,7 @@ dependencies = [

 [[package]]
 name = "libsignal-jni"
-version = "0.55.1"
+version = "0.57.1"
 dependencies = [
 "cfg-if",
 "cpufeatures",
@ -2122,12 +2208,12 @@ dependencies = [

 [[package]]
 name = "libsignal-jni-testing"
-version = "0.55.1"
+version = "0.57.1"
 dependencies = [
 "jni 0.21.1",
 "libsignal-bridge-testing",
+ "libsignal-bridge-types",
 "log",
- "log-panics",
 ]

 [[package]]
@ -2135,7 +2221,6 @@ name = "libsignal-keytrans"
 version = "0.0.1"
 dependencies = [
 "assert_matches",
- "async-trait",
 "curve25519-dalek",
 "displaydoc",
 "ed25519-dalek",
@ -2173,9 +2258,9 @@ dependencies = [
 "hmac",
 "itertools 0.13.0",
 "json5",
+ "libsignal-core",
 "libsignal-message-backup",
 "libsignal-message-backup-macros",
- "libsignal-protocol",
 "log",
 "macro_rules_attribute",
 "mediasan-common",
@ -2264,13 +2349,16 @@ dependencies = [
 "serde_json",
 "sha2",
 "snow",
+ "socks5-server",
 "static_assertions",
 "strum",
 "test-case",
+ "test-log",
 "thiserror",
 "tls-parser",
 "tokio",
 "tokio-boring",
+ "tokio-socks",
 "tokio-stream",
 "tokio-tungstenite 0.23.1",
 "tokio-util",
@ -2278,11 +2366,12 @@ dependencies = [
 "url",
 "uuid",
 "warp",
+ "zerocopy",
 ]

 [[package]]
 name = "libsignal-node"
-version = "0.55.1"
+version = "0.57.1"
 dependencies = [
 "cmake",
 "futures",
@ -2343,6 +2432,7 @@ dependencies = [
 name = "libsignal-svr3"
 version = "0.1.0"
 dependencies = [
+ "aes-gcm-siv",
 "assert_matches",
 "criterion",
 "curve25519-dalek",
@ -2351,11 +2441,13 @@ dependencies = [
 "hex-literal",
 "hkdf",
 "nonzero_ext",
+ "proptest",
 "prost",
 "prost-build",
 "rand_core",
 "sha2",
- "strum_macros",
+ "signal-crypto",
+ "strum",
 "subtle",
 "test-case",
 "zerocopy",
@ -3180,6 +3272,30 @@ dependencies = [
 "toml_edit",
 ]

+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.86"
@ -3895,6 +4011,7 @@ dependencies = [
 "hex-literal",
 "hkdf",
 "hmac",
+ "rand_core",
 "sha2",
 "static_assertions",
 "thiserror",
@ -3967,6 +4084,29 @@ dependencies = [
 "windows-sys 0.52.0",
 ]

+[[package]]
+name = "socks5-proto"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d91431c4672e25e372ef46bc554be8f315068c03608f99267a71ad32a12e8c4"
+dependencies = [
+ "bytes",
+ "thiserror",
+ "tokio",
+]
+
+[[package]]
+name = "socks5-server"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5223c26981806584cc38c74fddf58808dbdcf4724890471ced69e7a2e8d86345"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "socks5-proto",
+ "tokio",
+]
+
 [[package]]
 name = "spin"
 version = "0.9.8"
@ -4287,6 +4427,18 @@ dependencies = [
 "tokio",
 ]

+[[package]]
+name = "tokio-socks"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d4770b8024672c1101b3f6733eab95b18007dbe0847a8afe341fcf79e06043f"
+dependencies = [
+ "either",
+ "futures-util",
+ "thiserror",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-stream"
 version = "0.1.15"
@ -4579,6 +4731,7 @@ version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "81dfa00651efa65069b0b6b651f4aaa31ba9e3c3ce0137aaad053604ee7e0314"
 dependencies = [
+ "getrandom",
 "serde",
 "sha1_smol",
 ]
--- a/pkgs/by-name/li/libsignal-ffi/package.nix
+++ b/pkgs/by-name/li/libsignal-ffi/package.nix
@ -22,14 +22,14 @@ rustPlatform.buildRustPackage rec {
  pname = "libsignal-ffi";
  # must match the version used in mautrix-signal
  # see https://github.com/mautrix/signal/issues/401
-  version = "0.55.1";
+  version = "0.57.1";

  src = fetchFromGitHub {
    fetchSubmodules = true;
    owner = "signalapp";
    repo = "libsignal";
    rev = "v${version}";
-    hash = "sha256-hQ3iWGLef1y3yyzjWH2MWcs32A7HxUSxGG8fCyMn/KE=";
+    hash = "sha256-13XhblN82lbIdv9RVjrabQfCgW1hEG1B6pp3/nQcVgY=";
  };

  buildInputs = lib.optional stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
--- a/pkgs/by-name/lm/lmstudio/darwin.nix
+++ b/pkgs/by-name/lm/lmstudio/darwin.nix
@ -9,8 +9,8 @@ stdenv.mkDerivation {
  inherit meta pname version;

  src = fetchurl {
-    url = "https://releases.lmstudio.ai/darwin/arm64/${version}/LM%20Studio-${version}-arm64.dmg";
-    hash = "sha256-KC4nXhMkrRDRtLPnpD5UTyKzQ+xH9jhZZHnjk9gDVfo=";
+    url = "https://releases.lmstudio.ai/darwin/arm64/${version}/LM-Studio-${version}-arm64.dmg";
+    hash = "sha256-PmXekM7rHY8EIp6l2XiLQlxyIB00MJS5C0gzFfe1i70=";
  };

  nativeBuildInputs = [ undmg ];
--- a/pkgs/by-name/lm/lmstudio/linux.nix
+++ b/pkgs/by-name/lm/lmstudio/linux.nix
@ -6,8 +6,8 @@
 }:
 let
  src = fetchurl {
-    url = "https://releases.lmstudio.ai/linux/x86/${version}/LM_Studio-${version}.AppImage";
-    hash = "sha256-w+g7/YezpOr/mBNZbmtLMPt3xTRDIHgGTSroo6mRXxw=";
+    url = "https://releases.lmstudio.ai/linux/x86/${version}/1/LM_Studio-${version}.AppImage";
+    hash = "sha256-B+V0MOn/07IEzUXiubO2TG/XvfDZDgttnK/buL/nHQY=";
  };

  appimageContents = appimageTools.extractType2 { inherit pname version src; };
--- a/pkgs/by-name/lm/lmstudio/package.nix
+++ b/pkgs/by-name/lm/lmstudio/package.nix
@ -5,7 +5,7 @@
 }:
 let
  pname = "lmstudio";
-  version = "0.3.2";
+  version = "0.3.3";
  meta = {
    description = "LM Studio is an easy to use desktop app for experimenting with local and open-source Large Language Models (LLMs)";
    homepage = "https://lmstudio.ai/";
--- a/pkgs/development/tools/luaformatter/fix-lib-paths.patch
+++ b/pkgs/development/tools/luaformatter/fix-lib-paths.patch
--- a/pkgs/development/tools/luaformatter/default.nix
+++ b/pkgs/development/tools/luaformatter/default.nix
@ -1,9 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, substituteAll, antlr4_9, libargs, catch2, cmake, yaml-cpp }:
-
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  substituteAll,
+  antlr4_9,
+  libargs,
+  catch2,
+  cmake,
+  yaml-cpp,
+}:
 let
  antlr4 = antlr4_9;
 in
-
 stdenv.mkDerivation rec {
  pname = "luaformatter";
  version = "1.3.6";
@ -25,7 +33,14 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake ];

-  buildInputs = [ antlr4.runtime.cpp yaml-cpp ];
+  buildInputs = [
+    antlr4.runtime.cpp
+    yaml-cpp
+  ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (
+    stdenv.isDarwin && stdenv.isx86_64
+  ) "-D_LIBCPP_HAS_NO_LIBRARY_ALIGNED_ALLOCATION=1";

  meta = with lib; {
    description = "Code formatter for Lua";
--- a/pkgs/by-name/mi/miracle-wm/package.nix
+++ b/pkgs/by-name/mi/miracle-wm/package.nix
@ -27,13 +27,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "miracle-wm";
-  version = "0.3.5";
+  version = "0.3.6";

  src = fetchFromGitHub {
    owner = "mattkae";
    repo = "miracle-wm";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-2OoMkD4ChNXzqqzdOvzYRL0UYU7Uecm5yTXCvG45jCI=";
+    hash = "sha256-fK/g6DhcxJMvxujZDZXs1yXRu2FGZQKmhxw7/czAQiY=";
  };

  patches = [
--- a/pkgs/by-name/mo/mongodb-compass/package.nix
+++ b/pkgs/by-name/mo/mongodb-compass/package.nix
@ -34,7 +34,7 @@
 }:

 let
-  version = "1.44.3";
+  version = "1.44.4";

  rpath = lib.makeLibraryPath [
    alsa-lib
@ -84,7 +84,7 @@ let
    if stdenv.hostPlatform.system == "x86_64-linux" then
      fetchurl {
        url = "https://downloads.mongodb.com/compass/mongodb-compass_${version}_amd64.deb";
-        hash = "sha256-3w9alnv51KNyc1pCqCtG022YI7LNrkTihn4Ldacc01M=";
+        hash = "sha256-0b0bdKRw+l4m144OVaH/KHB+UtAZ0zIA7KlP9zOE7A8=";
      }
    else
      throw "MongoDB compass is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/by-name/mo/mov-cli/package.nix
+++ b/pkgs/by-name/mo/mov-cli/package.nix
@ -8,7 +8,7 @@

 let
  pname = "mov-cli";
-  version = "4.4.14";
+  version = "4.4.15";
 in
 python3.pkgs.buildPythonPackage {
  inherit pname version;
@ -18,7 +18,7 @@ python3.pkgs.buildPythonPackage {
    owner = "mov-cli";
    repo = "mov-cli";
    rev = "refs/tags/${version}";
-    hash = "sha256-c8Su215d3Lix2ft+J9zypLkolKFvO+HBFvXDibiCS14=";
+    hash = "sha256-mHtKQtLhHYwd2GEA0rCZQ4C/DEgsc6Rk7ZLpXFyW5d8=";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/by-name/nf/nf-test/package.nix
+++ b/pkgs/by-name/nf/nf-test/package.nix
@ -18,14 +18,7 @@ stdenv.mkDerivation rec {
  };
  sourceRoot = ".";

-  buildInputs = [
-    makeWrapper
-  ];
-
-  nativeBuildInputs = [
-    nextflow
-  ];
-
+  nativeBuildInputs = [ makeWrapper ];

  installPhase = ''
    runHook preInstall
@ -36,7 +29,7 @@ stdenv.mkDerivation rec {
    mkdir -p $out/bin
    makeWrapper ${openjdk11}/bin/java $out/bin/nf-test \
      --add-flags "-jar $out/share/nf-test/nf-test.jar" \
-      --prefix PATH : ${lib.makeBinPath nativeBuildInputs} \
+      --prefix PATH : ${lib.makeBinPath [ nextflow ]} \

    runHook postInstall
  '';
--- a/pkgs/by-name/nw/nwg-panel/package.nix
+++ b/pkgs/by-name/nw/nwg-panel/package.nix
@ -16,13 +16,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "nwg-panel";
-  version = "0.9.39";
+  version = "0.9.40";

  src = fetchFromGitHub {
    owner = "nwg-piotr";
    repo = "nwg-panel";
    rev = "refs/tags/v${version}";
-    hash = "sha256-uXhhtE91BqYdTQjavOU5p0JoprFZTGCcxQr66iJixu4=";
+    hash = "sha256-MymxhQxPS07qZlD+TsiMyMtOrmIuqi3LAhc0Huxwxjs=";
  };

  # No tests
--- a/pkgs/by-name/ob/oboete/Cargo.lock
+++ b/pkgs/by-name/ob/oboete/Cargo.lock
--- a/pkgs/by-name/ob/oboete/package.nix
+++ b/pkgs/by-name/ob/oboete/package.nix
@ -13,13 +13,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "oboete";
-  version = "0.1.5";
+  version = "0.1.6";

  src = fetchFromGitHub {
    owner = "mariinkys";
    repo = "oboete";
    rev = "refs/tags/${version}";
-    hash = "sha256-y3lHiAIhIt5XL/88HBuCqVQlRzNcw9VAKjqgQJmyziU=";
+    hash = "sha256-tiYZ8xMIxMvRdQCf9+LI2B1lXbJz7MFyyeAOkJR+8Vk=";
  };

  cargoLock = {
@ -28,12 +28,12 @@ rustPlatform.buildRustPackage rec {
      "accesskit-0.12.2" = "sha256-1UwgRyUe0PQrZrpS7574oNLi13fg5HpgILtZGW6JNtQ=";
      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
      "clipboard_macos-0.1.0" = "sha256-cG5vnkiyDlQnbEfV2sPbmBYKv1hd3pjJrymfZb8ziKk=";
-      "cosmic-config-0.1.0" = "sha256-p/1ABYyXGSr34ZC7ozu2syBjkmElA9oI2bzyWhaxKnc=";
-      "cosmic-settings-daemon-0.1.0" = "sha256-+1XB7r45Uc71fLnNR4U0DUF2EB8uzKeE4HIrdvKhFXo=";
-      "cosmic-text-0.12.0" = "sha256-VUUCcW5XnkmCB8cQ5t2xT70wVD5WKXEOPNgNd2xod2A=";
+      "cosmic-config-0.1.0" = "sha256-joMHmFbgMAuaXtSvJutahE/8y+4AL7dd8bb9bs6Usc0=";
+      "cosmic-settings-daemon-0.1.0" = "sha256-mklNPKVMO6iFrxki2DwiL5K78KiWpGxksisYldaASIE=";
+      "cosmic-text-0.12.1" = "sha256-u2Tw+XhpIKeFg8Wgru/sjGw6GUZ2m50ZDmRBJ1IM66w=";
      "d3d12-0.19.0" = "sha256-usrxQXWLGJDjmIdw1LBXtBvX+CchZDvE8fHC0LjvhD4=";
      "glyphon-0.5.0" = "sha256-j1HrbEpUBqazWqNfJhpyjWuxYAxkvbXzRKeSouUoPWg=";
-      "smithay-clipboard-0.8.0" = "sha256-pBQZ+UXo9hZ907mfpcZk+a+8pKrIWdczVvPkjT3TS8U=";
+      "smithay-clipboard-0.8.0" = "sha256-4InFXm0ahrqFrtNLeqIuE3yeOpxKZJZx+Bc0yQDtv34=";
      "softbuffer-0.4.1" = "sha256-a0bUFz6O8CWRweNt/OxTvflnPYwO5nm6vsyc/WcXyNg=";
      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
      "winit-0.29.10" = "sha256-ScTII2AzK3SC8MVeASZ9jhVWsEaGrSQ2BnApTxgfxK4=";
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@ -218,9 +218,7 @@ goBuild {
        service-cuda = nixosTests.ollama-cuda;
        service-rocm = nixosTests.ollama-rocm;
      };
-
-    updateScript = nix-update-script { };
-  };
+  } // lib.optionalAttrs (!enableRocm && !enableCuda) { updateScript = nix-update-script { }; };

  meta = {
    description =
--- a/pkgs/applications/misc/OSCAR/default.nix
+++ b/pkgs/applications/misc/OSCAR/default.nix
@ -1,6 +1,12 @@
-{ lib, stdenv, mkDerivation, fetchFromGitLab, qmake, qtbase, qttools, qtserialport, libGLU }:
-mkDerivation rec {
-  pname = "OSCAR";
+{
+  lib,
+  stdenv,
+  qt5,
+  fetchFromGitLab,
+  libGLU,
+}:
+qt5.mkDerivation rec {
+  pname = "oscar";
  version = "1.5.1";

  src = fetchFromGitLab {
@ -10,8 +16,13 @@ mkDerivation rec {
    hash = "sha256-FBHbPtMZeIgcR1pQflfEWK2FS8bquctXaeY/yaZofHg=";
  };

-  buildInputs = [ qtbase qttools qtserialport libGLU ];
-  nativeBuildInputs = [ qmake ];
+  buildInputs = [
+    qt5.qtbase
+    qt5.qttools
+    qt5.qtserialport
+    libGLU
+  ];
+  nativeBuildInputs = [ qt5.qmake ];
  postPatch = ''
    substituteInPlace oscar/oscar.pro --replace "/bin/bash" "${stdenv.shell}"
  '';
--- a/pkgs/by-name/pi/picocom/use-system-linenoise.patch
+++ b/pkgs/by-name/pi/picocom/use-system-linenoise.patch
@ -10,8 +10,8 @@ index 8fca24ee38..33b59b5b96 100644
 -OBJS += linenoise-1.0/linenoise.o
 -linenoise-1.0/linenoise.o : linenoise-1.0/linenoise.c linenoise-1.0/linenoise.h
 +	    -DLINENOISE \
-+	    $(shell pkg-config --cflags linenoise)
-+LDFLAGS += $(shell pkg-config --libs linenoise)
+	    $(shell $(PKG_CONFIG) --cflags linenoise)
+LDFLAGS += $(shell $(PKG_CONFIG) --libs linenoise)
 
 ## Comment this in to enable (force) custom baudrate support
 ## even on systems not enabled by default.
--- a/pkgs/by-name/po/powermode-indicator/package.nix
+++ b/pkgs/by-name/po/powermode-indicator/package.nix
@ -0,0 +1,40 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  gtkmm3,
+  glibmm,
+  libappindicator,
+}:
+stdenv.mkDerivation {
+  pname = "powermode-indicator";
+  version = "0-unstable-2024-07-13";
+
+  src = fetchFromGitHub {
+    owner = "PiyushXCoder";
+    repo = "powermode-indicator";
+    rev = "0a67f63290b087f1eeff2c6c6869c2122ac78e6f";
+    hash = "sha256-qqV99s+uNYCUx/xGY3gQL38eG9siuKTRT0bA2UoN6Sk=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+  buildInputs = [
+    libappindicator
+    gtkmm3
+    glibmm
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/PiyushXCoder/powermode-indicator";
+    description = "Tray tool for power profiles management";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.aacebedo ];
+    mainProgram = "powermode-indicator";
+  };
+}
--- a/pkgs/by-name/pr/protols/package.nix
+++ b/pkgs/by-name/pr/protols/package.nix
@ -0,0 +1,28 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "protols";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "coder3101";
+    repo = "protols";
+    rev = "refs/tags/${version}";
+    hash = "sha256-oxcC+PRQ+gyYyg5r9C3N7lP8ZJj+8sqJMA+Ovoxq+P4=";
+  };
+
+  cargoHash = "sha256-rrurR/3OgjaAAq5Z9RTFOC6j13eBI34+z+aTLQkKjV4=";
+
+  meta = {
+    description = "Protocol Buffers language server written in Rust";
+    homepage = "https://github.com/coder3101/protols";
+    changelog = "https://github.com/coder3101/protols/releases/tag/${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ nartsiss ];
+    mainProgram = "protols";
+  };
+}
--- a/pkgs/by-name/py/pyright/package.nix
+++ b/pkgs/by-name/py/pyright/package.nix
@ -1,13 +1,13 @@
 { lib, buildNpmPackage, fetchFromGitHub, runCommand, jq }:

 let
-  version = "1.1.381";
+  version = "1.1.382";

  src = fetchFromGitHub {
    owner = "Microsoft";
    repo = "pyright";
    rev = "${version}";
-    hash = "sha256-JMLQRTv0p38rZGnoxOjVF/qzscZCegFy92PCumEWETk=";
+    hash = "sha256-/qmDCx1bkqCF/4T3jNz2xiUYwnVYw5IOguRW8DYVQZg=";
  };

  patchedPackageJSON = runCommand "package.json" { } ''
@ -37,7 +37,7 @@ let
    pname = "pyright-internal";
    inherit version src;
    sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-UvsBNSCKznaxtuKyQ4NOQehvhhXd9omhwRygKsr9mQo=";
+    npmDepsHash = "sha256-zITMHDiZTEbRy/1aqeCrnr9NaO1IUZ1enDw4LXjUjxs=";
    dontNpmBuild = true;
    installPhase = ''
      runHook preInstall
@ -51,7 +51,7 @@ buildNpmPackage rec {
  inherit version src;

  sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-N3O8KWYeYhmbSyHTJwqFUf2wqqrsmN7Wt1jS5wI6SCE=";
+  npmDepsHash = "sha256-Ibeg9LgqUhxCgnNryk8ZYu4wNOmVbFHz8ZklNH6msoM=";

  postPatch = ''
    chmod +w ../../
--- a/pkgs/by-name/qr/qrq/package.nix
+++ b/pkgs/by-name/qr/qrq/package.nix
@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  ncurses,
+  pulseaudio,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "qrq";
+  version = "0.3.5";
+
+  src = fetchFromGitHub {
+    owner = "dj1yfk";
+    repo = "qrq";
+    rev = "qrq-${version}";
+    hash = "sha256-uuETGbv5qm0Z+45+kK66SBHhQ0Puu6I5z+TWIh3iR2g=";
+  };
+
+  buildInputs = [
+    ncurses
+    pulseaudio
+  ];
+
+  makeFlags = [
+    "BUILD_INFO=nix"
+    "DESTDIR=${builtins.placeholder "out"}"
+  ];
+
+  postPatch = ''
+    substituteInPlace src/qrq.c \
+      --replace-fail '[80]' '[4000]' \
+      --replace-fail '80,' '4000,'
+  '';
+
+  meta = {
+    description = "High Speed Morse trainer - mirror of https://git.fkurz.net/dj1yfk/qrq";
+    homepage = "https://github.com/dj1yfk/qrq";
+    changelog = "https://github.com/dj1yfk/qrq/blob/${src.rev}/ChangeLog";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ pkharvey ];
+    mainProgram = "qrq";
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/by-name/qu/quarkus/package.nix
+++ b/pkgs/by-name/qu/quarkus/package.nix
@ -7,11 +7,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "quarkus-cli";
-  version = "3.14.4";
+  version = "3.15.1";

  src = fetchurl {
    url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-N0NLP8VvUvr/oi3U1McD+jyV8UXGXCwuITRbwudw1Q0=";
+    hash = "sha256-cvZ1jEIeEQOgmAiQba6AYob+84ozM0AQcnVpgRLSIIc=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/ra/railway/package.nix
+++ b/pkgs/by-name/ra/railway/package.nix
@ -12,16 +12,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "railway";
-  version = "3.14.1";
+  version = "3.15.1";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = "cli";
    rev = "v${version}";
-    hash = "sha256-w52PzDRApKuRgJLYxY8ikqNOo6rC0kLCKWh8tgFzcIY=";
+    hash = "sha256-2/Yaz+eqZEOh/bCme9DuQep4XDkatr9kw32zN1yn9DQ=";
  };

-  cargoHash = "sha256-6VjloZ8s5LqyYPz1uMwdkwvHIhXjmifjd46PIx5d8xQ=";
+  cargoHash = "sha256-9fO8YmmqyqVp0FYndUnTD6+nSvlV9jzjT+G/iNlZYLo=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/re/realvnc-vnc-viewer/darwin.nix
+++ b/pkgs/by-name/re/realvnc-vnc-viewer/darwin.nix
@ -11,7 +11,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  src = fetchurl rec {
      name = "VNC-Viewer-${finalAttrs.version}-MacOSX-universal.dmg";
      url = "https://downloads.realvnc.com/download/file/viewer.files/${name}";
-      hash = "sha256-haD2QsBF9Dps1V/2tkkALAc7+kUY3PSNj7BjTIqnNcU=";
+      hash = "sha256-SiBlw9ihKDLDWBPUxn3cfM0jbUaWDxQ9JDaeDNczQ7c=";
  };
  sourceRoot = ".";

--- a/pkgs/by-name/re/realvnc-vnc-viewer/linux.nix
+++ b/pkgs/by-name/re/realvnc-vnc-viewer/linux.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
    "x86_64-linux" = fetchurl rec {
      name = "VNC-Viewer-${finalAttrs.version}-Linux-x64.rpm";
      url = "https://downloads.realvnc.com/download/file/viewer.files/${name}";
-      hash = "sha256-KJZbH3mfxuyUslkYvB/RKquEsB7ayJSv6yNqfLmAsGI=";
+      hash = "sha256-fwMfQdOyLnYVfdBj80JHWT+CnKpq/9oM5oNF3aP+jgo=";
    };
  }.${stdenv.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

--- a/pkgs/by-name/re/realvnc-vnc-viewer/package.nix
+++ b/pkgs/by-name/re/realvnc-vnc-viewer/package.nix
@ -4,7 +4,7 @@
 }:
 let
  pname = "realvnc-vnc-viewer";
-  version = "7.12.0";
+  version = "7.12.1";

  meta = {
    description = "VNC remote desktop client software by RealVNC";
--- a/pkgs/by-name/re/remind/package.nix
+++ b/pkgs/by-name/re/remind/package.nix
@ -15,11 +15,11 @@

 tcl.mkTclDerivation rec {
  pname = "remind";
-  version = "05.00.02";
+  version = "05.00.06";

  src = fetchurl {
    url = "https://dianne.skoll.ca/projects/remind/download/remind-${version}.tar.gz";
-    hash = "sha256-XxVjAV3TGDPI8XaFXXSminsMffq8m8ljw68YMIC2lYg=";
+    hash = "sha256-uGGh1eRPT6bGYF4F9e79D+aMnpOQukktlmJbyM2uRco=";
  };

  propagatedBuildInputs = lib.optionals withGui [
--- a/pkgs/by-name/sm/smtp4dev/deps.nix
+++ b/pkgs/by-name/sm/smtp4dev/deps.nix
--- a/pkgs/by-name/sm/smtp4dev/package.nix
+++ b/pkgs/by-name/sm/smtp4dev/package.nix
@ -9,12 +9,12 @@
  dotnetCorePackages,
 }:
 let
-  version = "3.3.4";
+  version = "3.6.1";
  src = fetchFromGitHub {
    owner = "rnwood";
    repo = "smtp4dev";
    rev = "refs/tags/${version}";
-    hash = "sha256-ARq5OpFJ4o9KdBXvzOx7QLB8GNfmXWjO0RR4jKP8qRI=";
+    hash = "sha256-T6ci7+xbzpOrNr8hpDCwk5qe01L2Ho5V1oM7Hhd8bgg=";
  };
  npmRoot = "Rnwood.Smtp4dev/ClientApp";
 in
@ -31,7 +31,7 @@ buildDotnetModule {

  npmDeps = fetchNpmDeps {
    src = "${src}/${npmRoot}";
-    hash = "sha256-VBcfRKYe/uPf6urWuLI5TrnX9bgiKiZKo+N4zL7O3SM=";
+    hash = "sha256-/Z6sBxA2ReHlEbz0zJjlpn6IwzHDQiXN5ixEV1/iCJI=";
  };

  dotnet-sdk = dotnetCorePackages.sdk_8_0;
--- a/pkgs/by-name/st/stevenblack-blocklist/package.nix
+++ b/pkgs/by-name/st/stevenblack-blocklist/package.nix
@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "stevenblack-blocklist";
-  version = "3.14.112";
+  version = "3.14.115";

  src = fetchFromGitHub {
    owner = "StevenBlack";
    repo = "hosts";
    rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-ESgu1n7Fa9UrR/OJkMsldcyqV7R3Bdq3GRouTn3GIrw=";
+    hash = "sha256-Iw3NUY0rWF+/lbGcO6zn96oNnRWRH33+8gs4e5yA1vM=";
  };

  outputs = [
--- a/pkgs/by-name/sw/switch-to-configuration-ng/package.nix
+++ b/pkgs/by-name/sw/switch-to-configuration-ng/package.nix
@ -12,7 +12,10 @@ rustPlatform.buildRustPackage {

  src = ./src;

-  cargoLock.lockFile = ./src/Cargo.lock;
+  cargoLock = {
+    lockFile = ./src/Cargo.lock;
+    outputHashes."rust-ini-0.21.1" = "sha256-0nSBhme/g+mVsYdiq0Ash0ek9WEdvbf/b9FRxA7sauk=";
+  };

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ dbus ];
--- a/pkgs/by-name/sw/switch-to-configuration-ng/src/Cargo.lock
+++ b/pkgs/by-name/sw/switch-to-configuration-ng/src/Cargo.lock
@ -337,9 +337,8 @@ checksum = "7a66a03ae7c801facd77a29370b4faec201768915ac14a721ba36f20bc9c209b"

 [[package]]
 name = "rust-ini"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d625ed57d8f49af6cfa514c42e1a71fadcff60eb0b1c517ff82fe41aa025b41"
+version = "0.21.1"
+source = "git+https://github.com/zonyitoo/rust-ini?rev=5748ae57a178216a920b88dfac1296618e967447#5748ae57a178216a920b88dfac1296618e967447"
 dependencies = [
 "cfg-if",
 "ordered-multimap",
--- a/pkgs/by-name/sw/switch-to-configuration-ng/src/Cargo.toml
+++ b/pkgs/by-name/sw/switch-to-configuration-ng/src/Cargo.toml
@ -12,7 +12,9 @@ glob = "0.3.1"
 log = "0.4.21"
 nix = { version = "0.28.0", features = ["fs", "signal"] }
 regex = "1.10.4"
-rust-ini = "0.21.0"
+rust-ini = { git = "https://github.com/zonyitoo/rust-ini", rev = "5748ae57a178216a920b88dfac1296618e967447", features = [
+  "inline-comment",
+] }
 syslog = "6.1.1"

 [build-dependencies]
--- a/pkgs/by-name/vi/viddy/package.nix
+++ b/pkgs/by-name/vi/viddy/package.nix
--- a/pkgs/by-name/vi/viddy/update.sh
+++ b/pkgs/by-name/vi/viddy/update.sh
--- a/pkgs/by-name/wa/waveterm/package.nix
+++ b/pkgs/by-name/wa/waveterm/package.nix
@ -0,0 +1,191 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  makeDesktopItem,
+  copyDesktopItems,
+  unzip,
+  autoPatchelfHook,
+  atk,
+  at-spi2-atk,
+  cups,
+  libdrm,
+  gtk3,
+  pango,
+  cairo,
+  libX11,
+  libXcomposite,
+  libXdamage,
+  libXext,
+  libXfixes,
+  libXrandr,
+  mesa,
+  expat,
+  libxcb,
+  alsa-lib,
+  nss,
+  nspr,
+  vips,
+  wrapGAppsHook3,
+  udev,
+  libGL,
+}:
+
+let
+  inherit (stdenv.hostPlatform) system;
+  throwSystem = throw "Unsupported system: ${system}";
+
+  pname = "waveterm";
+  version = "0.8.7";
+
+  suffix =
+    {
+      x86_64-linux = "waveterm-linux-x64-${version}.zip";
+      aarch64-linux = "waveterm-linux-arm64-${version}.zip";
+      x86_64-darwin = "Wave-darwin-universal-${version}.zip ";
+      aarch64-darwin = "Wave-darwin-arm64-${version}.zip";
+    }
+    .${system} or throwSystem;
+
+  src = fetchurl {
+    url = "https://github.com/wavetermdev/waveterm/releases/download/v${version}/${suffix}";
+    hash =
+      {
+        x86_64-linux = "sha256-pWBKZid8sumi/EP3DA5KcLnZsHsuKYK6E6NHXdWKh8s=";
+        aarch64-linux = "sha256-2paRX+OGPSEktV4S+V43ZE9UgltLYZ+Nyba5/miBQkA=";
+        x86_64-darwin = "sha256-tsqw597gQIMnQ/OPZhrWwaRliF94KyS+ryajttDLqBA=";
+        aarch64-darwin = "sha256-PD38UBSNKuv836P/py/CtrLOlddHa0+w7R20YVY4Ybc=";
+      }
+      .${system} or throwSystem;
+  };
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "waveterm";
+      exec = "waveterm --no-sandbox %U";
+      icon = fetchurl {
+        url = "https://raw.githubusercontent.com/wavetermdev/waveterm/refs/tags/v${version}/build/appicon.png";
+        hash = "sha256-qob27/64C9XPBtXghxg5/g0qRaiOUOpuFYL1n7/aEB0=";
+      };
+      startupWMClass = "Wave";
+      comment = "Open-Source AI-Native Terminal Built for Seamless Workflows";
+      desktopName = "Wave";
+      genericName = "Terminal Emulator";
+      categories = [
+        "Development"
+        "Utility"
+        "TerminalEmulator"
+      ];
+      keywords = [
+        "developer"
+        "terminal"
+        "emulator"
+      ];
+    })
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+    unzip ${src} -d ./
+    runHook postUnpack
+  '';
+
+  meta = {
+    description = "Open-source, cross-platform terminal for seamless workflows";
+    homepage = "https://www.waveterm.dev";
+    mainProgram = "waveterm";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.asl20;
+    platforms = [
+      "aarch64-linux"
+      "aarch64-darwin"
+      "x86_64-linux"
+      "x86_64-darwin"
+    ];
+    maintainers = with lib.maintainers; [ aucub ];
+  };
+
+  linux = stdenv.mkDerivation {
+    inherit
+      pname
+      version
+      src
+      desktopItems
+      unpackPhase
+      ;
+
+    nativeBuildInputs = [
+      unzip
+      copyDesktopItems
+      autoPatchelfHook
+      wrapGAppsHook3
+    ];
+
+    buildInputs = [
+      atk
+      at-spi2-atk
+      cups
+      libdrm
+      gtk3
+      pango
+      cairo
+      libX11
+      libXcomposite
+      libXdamage
+      libXext
+      libXfixes
+      libXrandr
+      mesa
+      expat
+      libxcb
+      alsa-lib
+      nss
+      nspr
+      vips
+    ];
+
+    runtimeDependencies = map lib.getLib [
+      udev
+    ];
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/waveterm $out/bin
+      cp -r ./* $out/waveterm/
+      runHook postInstall
+    '';
+
+    preFixup = ''
+      makeWrapper $out/waveterm/waveterm $out/bin/waveterm \
+        --prefix LD_LIBRARY_PATH : "${
+          lib.makeLibraryPath [
+            libGL
+          ]
+        }"
+    '';
+  };
+
+  darwin = stdenv.mkDerivation {
+    inherit
+      pname
+      version
+      src
+      unpackPhase
+      meta
+      ;
+
+    nativeBuildInputs = [
+      unzip
+    ];
+
+    sourceRoot = "Wave.app";
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/Applications/Wave.app
+      cp -R . $out/Applications/Wave.app
+      runHook postInstall
+    '';
+  };
+in
+if stdenv.hostPlatform.isDarwin then darwin else linux
--- a/pkgs/by-name/wg/wgpu/Cargo.lock
+++ b/pkgs/by-name/wg/wgpu/Cargo.lock
--- a/pkgs/by-name/wg/wgpu/package.nix
+++ b/pkgs/by-name/wg/wgpu/package.nix
@ -0,0 +1,65 @@
+{
+  rustPlatform,
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  cmake,
+  pkg-config,
+  fontconfig,
+  stdenv,
+  darwin,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "wgpu";
+  version = "22.1.0";
+
+  src = fetchFromGitHub {
+    owner = "gfx-rs";
+    repo = "wgpu";
+    rev = "refs/tags/wgpu-v${version}";
+    hash = "sha256-Gtq0xYZoWNwW+BKVLqVVKGqc+4HjaD7NN1hlzyFP5g0=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "noise-0.8.2" = "sha256-7GvShJeSNfwMCBIfqLghXgKQv7EDMqVchJw0uxPhNr4=";
+      "rspirv-0.11.0+sdk-1.2.198" = "sha256-AcJqkcXBr/+SHdUDXd63sQ0h5eosMqRhV4aUREJH8Bw=";
+    };
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs =
+    [
+      fontconfig
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin (
+      with darwin.apple_sdk.frameworks;
+      [
+        CoreServices
+        QuartzCore
+        AppKit
+      ]
+    );
+
+  #requires GPU
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://wgpu.rs/";
+    description = "Cross-platform, safe, pure-Rust graphics API.";
+    changelog = "https://github.com/gfx-rs/wgpu/releases/tag/v${version}";
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    license = with lib.licenses; [
+      mit
+      apsl20
+    ];
+  };
+}
--- a/pkgs/by-name/zo/zoekt/package.nix
+++ b/pkgs/by-name/zo/zoekt/package.nix
@ -7,13 +7,13 @@

 buildGoModule {
  pname = "zoekt";
-  version = "3.7.2-2-unstable-2024-09-19";
+  version = "3.7.2-2-unstable-2024-10-01";

  src = fetchFromGitHub {
    owner = "sourcegraph";
    repo = "zoekt";
-    rev = "5379bc90f3f96b371b219beeb64340bcfd7f7149";
-    hash = "sha256-1i95C11unZV7eUDxsRKRswwsxELH+oHXUbmY74c5mVs=";
+    rev = "650136078a98ef99acf4159310a2c12fd25075d7";
+    hash = "sha256-MtN/x5o0iHZeDqIQCuio8y5pmZXq5qFIE6FySgIY2CY=";
  };

  vendorHash = "sha256-+ayixWCD2e+7Nh9WJmDAloSzp63v9hQYQd8UMuo8qxQ=";
--- a/pkgs/data/fonts/libertinus/default.nix
+++ b/pkgs/data/fonts/libertinus/default.nix
@ -1,14 +1,16 @@
-{ lib, stdenvNoCC, fetchurl }:
+{ lib, stdenvNoCC, fetchurl, zstd }:

 stdenvNoCC.mkDerivation rec {
  pname = "libertinus";
-  version = "7.040";
+  version = "7.051";

  src = fetchurl {
-    url = "https://github.com/alerque/libertinus/releases/download/v${version}/Libertinus-${version}.tar.xz";
-    hash = "sha256-f+nwInItHBzGfcLCihELO7VbrjV1GWFg0kIsiTM7OFA=";
+    url = "https://github.com/alerque/libertinus/releases/download/v${version}/Libertinus-${version}.tar.zst";
+    hash = "sha256-JQZ3ySnTd1owkTZDWUN5ryZKwu8oAQNaody+MLm+I6Y=";
  };

+  nativeBuildInputs = [ zstd ];
+
  installPhase = ''
    runHook preInstall

--- a/pkgs/data/themes/alacritty-theme/default.nix
+++ b/pkgs/data/themes/alacritty-theme/default.nix
@ -6,13 +6,13 @@

 stdenvNoCC.mkDerivation (self: {
  pname = "alacritty-theme";
-  version = "0-unstable-2024-09-03";
+  version = "0-unstable-2024-09-27";

  src = fetchFromGitHub {
    owner = "alacritty";
    repo = "alacritty-theme";
-    rev = "e759dafb8e2e00abb428592979ce006da7fba4a7";
-    hash = "sha256-cZ+ziE+VbQFpJ+iDS7X9Q2YC1Ziu+JITzDmX79BCcRY=";
+    rev = "90a8406beb095fdb1617135a98c38df1ef08859c";
+    hash = "sha256-Uav3hn2HxwtpOWdGt8WDCqTR0erxXWF6Wxkcltru1Yw=";
  };

  dontConfigure = true;
--- a/pkgs/desktops/xfce/applications/xfce4-dict/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-dict/default.nix
@ -10,9 +10,9 @@
 mkXfceDerivation {
  category = "apps";
  pname = "xfce4-dict";
-  version = "0.8.7";
+  version = "0.8.8";

-  sha256 = "sha256-1xjprnQG2P+LYAhEGxdu1wpoP/+C+udmNqb/3zEojr0=";
+  sha256 = "sha256-nVpEeOSSfXCIxuIj0qie+oi8FVRiVUmDMPZZwIZ9L/k=";

  buildInputs = [
    glib
--- a/Show More
+++ b/Show More