Merge master into haskell-updates

2024-11-07 00:16:21 +00:00 · 2024-11-07 00:16:21 +00:00 · a759676266
commit a759676266
parent 84527c8ca3 5502394d66
235 changed files with 14529 additions and 3614 deletions
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@ -162,9 +162,10 @@ rustPlatform.buildRustPackage {
 }
 ```

-Note that setting `cargoLock.lockFile` or `cargoLock.lockFileContents`
-doesn't add a `Cargo.lock` to your `src`, and a `Cargo.lock` is still
-required to build a rust package. A simple fix is to use:
+If the upstream source repository lacks a `Cargo.lock` file, you must add one
+to `src`, as it is essential for building a Rust package. Setting
+`cargoLock.lockFile` or `cargoLock.lockFileContents` will not automatically add
+a `Cargo.lock` file to `src`. A straightforward solution is to use:

 ```nix
 {
--- a/maintainers/README.md
+++ b/maintainers/README.md
@ -174,4 +174,4 @@ are available under `./scripts/`.  See its [README](./scripts/README.md)
 for further information.

 # nixpkgs-merge-bot
-To streamline autoupdates, leverage the nixpkgs-merge-bot by simply commenting `@NixOS/nixpkgs-merge-bot merge` if the package resides in pkgs-by-name and the commenter is among the package maintainers. The bot ensures that all ofborg checks, except for darwin, are successfully completed before merging the pull request. Should the checks still be underway, the bot patiently waits for ofborg to finish before attempting the merge again.
+To streamline autoupdates, leverage the nixpkgs-merge-bot by commenting `@NixOS/nixpkgs-merge-bot merge` if the package resides in pkgs-by-name and the commenter is among the package maintainers. The bot ensures that all ofborg checks, except for darwin, are successfully completed before merging the pull request. Should the checks still be underway, the bot patiently waits for ofborg to finish before attempting the merge again.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -870,6 +870,12 @@
    githubId = 56970006;
    keys = [ { fingerprint = "50E2 669C AB38 2F4A 5F72  1667 0D6B FC01 D45E DADD"; } ];
  };
+  akotro = {
+    name = "Antonis Kotronakis";
+    email = "mail@akotro.dev";
+    github = "akotro";
+    githubId = 20772540;
+  };
  akru = {
    email = "mail@akru.me";
    github = "akru";
@ -2351,7 +2357,7 @@
    email = "baduhai@pm.me";
    github = "baduhai";
    githubId = 31864305;
-    name = "William";
+    name = "William Hai";
  };
  baitinq = {
    email = "manuelpalenzuelamerino@gmail.com";
@ -9151,12 +9157,6 @@
    githubId = 30196;
    name = "Ian Liu Rodrigues";
  };
-  ianmjones = {
-    email = "ian@ianmjones.com";
-    github = "ianmjones";
-    githubId = 4710;
-    name = "Ian M. Jones";
-  };
  ianwookim = {
    email = "ianwookim@gmail.com";
    github = "wavewave";
@ -9537,6 +9537,11 @@
    github = "istoph";
    githubId = 114227790;
  };
+  istudyatuni = {
+    name = "Ilia";
+    github = "istudyatuni";
+    githubId = 43654815;
+  };
  itepastra = {
    name = "Noa Aarts";
    github = "itepastra";
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -198,6 +198,8 @@

 - [tiny-dfr](https://github.com/WhatAmISupposedToPutHere/tiny-dfr), a dynamic function row daemon for the Touch Bar found on some Apple laptops. Available as [hardware.apple.touchBar.enable](options.html#opt-hardware.apple.touchBar.enable).

+- [Swapspace](https://github.com/Tookmund/Swapspace), a dynamic swap space manager, turns your unused free space into swap automatically. Available as [services.swapspace](#opt-services.swapspace.enable).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}

 - The `sound` options have been removed or renamed, as they had a lot of unintended side effects. See [below](#sec-release-24.11-migration-sound) for details.
--- a/nixos/modules/image/repart-image.nix
+++ b/nixos/modules/image/repart-image.nix
@ -101,6 +101,11 @@ in
  ) // {
  __structuredAttrs = true;

+
+  # the image will be self-contained so we can drop references
+  # to the closure that was used to build it
+  unsafeDiscardReferences.out = true;
+
  nativeBuildInputs = [
    systemd
    fakeroot
--- a/nixos/modules/image/repart-verity-store.nix
+++ b/nixos/modules/image/repart-verity-store.nix
@ -117,10 +117,6 @@ in

              # do not prepare the ESP, this is done in the final image
              systemdRepartFlags = previousAttrs.systemdRepartFlags ++ [ "--defer-partitions=esp" ];
-
-              # the image will be self-contained so we can drop references
-              # to the closure that was used to build it
-              unsafeDiscardReferences.out = true;
            }
          );

@ -210,10 +206,6 @@ in

                rm -v repart-output_orig.json
              '';
-
-              # the image will be self-contained so we can drop references
-              # to the closure that was used to build it
-              unsafeDiscardReferences.out = true;
            }
          );
    };
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -356,7 +356,24 @@ in
      localtimed = 325;
      automatic-timezoned = 326;

-      # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
+      # When adding a uid, make sure it doesn't match an existing gid.
+      #
+      # !!! Don't use uids above "399"! !!!
+      #
+      # The reason behind this restriction is that, NixOS by default allocates
+      # system user UIDs/GIDs in the range of `400..999`. System users/groups
+      # created using command like `useradd` will have UID and GID in this range[1].
+      #
+      # If a newly added ID goes beyond "399", it may conflict with existing
+      # system user or group of the same id in someone else's NixOS.
+      # This could break their system and make that person upset for a whole day.
+      #
+      # Sidenote: the default is defined in `shadow` module[2], and the relavent change
+      # was made way back in 2014[3].
+      #
+      # [1]: https://man7.org/linux/man-pages/man5/login.defs.5.html#:~:text=SYS_UID_MAX%20(number)%2C%20SYS_UID_MIN%20(number)
+      # [2]: <nixos/modules/programs/shadow.nix>
+      # [3]: https://github.com/NixOS/nixpkgs/commit/0e23a175de3687df8232fe118cbe87f04228ff28

      nixbld = 30000; # start of range of uids
      nobody = 65534;
@ -669,7 +686,24 @@ in

      # When adding a gid, make sure it doesn't match an existing
      # uid. Users and groups with the same name should have equal
-      # uids and gids. Also, don't use gids above 399!
+      # uids and gids.
+      #
+      # !!! Don't use gids above "399"! !!!
+      #
+      # The reason behind this restriction is that, NixOS by default allocates
+      # system user UIDs/GIDs in the range of `400..999`. System users/groups
+      # created using command like `useradd` will have UID and GID in this range[1].
+      #
+      # If a newly added ID goes beyond "399", it may conflict with existing
+      # system user or group of the same id in someone else's NixOS.
+      # This could break their system and make that person upset for a whole day.
+      #
+      # Sidenote: the default is defined in `shadow` module[2], and the relavent change
+      # was made way back in 2014[3].
+      #
+      # [1]: https://man7.org/linux/man-pages/man5/login.defs.5.html#:~:text=SYS_UID_MAX%20(number)%2C%20SYS_UID_MIN%20(number)
+      # [2]: <nixos/modules/programs/shadow.nix>
+      # [3]: https://github.com/NixOS/nixpkgs/commit/0e23a175de3687df8232fe118cbe87f04228ff28

      # For exceptional cases where you really need a gid above 399, leave a
      # comment stating why.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1357,6 +1357,7 @@
  ./services/system/nscd.nix
  ./services/system/saslauthd.nix
  ./services/system/self-deploy.nix
+  ./services/system/swapspace.nix
  ./services/system/systembus-notify.nix
  ./services/system/systemd-lock-handler.nix
  ./services/system/uptimed.nix
--- a/nixos/modules/services/audio/snapserver.nix
+++ b/nixos/modules/services/audio/snapserver.nix
@ -80,6 +80,8 @@ in {
        '';
      };

+      package = lib.options.mkPackageOption pkgs "snapcast" { };
+
      listenAddress = lib.mkOption {
        type = lib.types.str;
        default = "::";
@ -286,7 +288,7 @@ in {

      serviceConfig = {
        DynamicUser = true;
-        ExecStart = "${pkgs.snapcast}/bin/snapserver --daemon ${optionString}";
+        ExecStart = "${cfg.package}/bin/snapserver --daemon ${optionString}";
        Type = "forking";
        LimitRTPRIO = 50;
        LimitRTTIME = "infinity";
--- a/nixos/modules/services/hardware/amdvlk.nix
+++ b/nixos/modules/services/hardware/amdvlk.nix
@ -37,8 +37,6 @@ in {
      extraPackages32 = [ cfg.support32Bit.package ];
    };

-    services.xserver.videoDrivers = [ "amdgpu" ];
-
    environment.sessionVariables = lib.mkIf cfg.supportExperimental.enable {
      AMDVLK_ENABLE_DEVELOPING_EXT = "all";
    };
--- a/nixos/modules/services/hardware/bluetooth.nix
+++ b/nixos/modules/services/hardware/bluetooth.nix
@ -62,7 +62,10 @@ in
            ControllerMode = "bredr";
          };
        };
-        description = "Set configuration for system-wide bluetooth (/etc/bluetooth/main.conf).";
+        description = ''
+          Set configuration for system-wide bluetooth (/etc/bluetooth/main.conf).
+          See <https://github.com/bluez/bluez/blob/master/src/main.conf> for full list of options.
+        '';
      };

      input = mkOption {
@ -74,7 +77,10 @@ in
            ClassicBondedOnly = true;
          };
        };
-        description = "Set configuration for the input service (/etc/bluetooth/input.conf).";
+        description = ''
+          Set configuration for the input service (/etc/bluetooth/input.conf).
+          See <https://github.com/bluez/bluez/blob/master/profiles/input/input.conf> for full list of options.
+        '';
      };

      network = mkOption {
@ -85,7 +91,10 @@ in
            DisableSecurity = true;
          };
        };
-        description = "Set configuration for the network service (/etc/bluetooth/network.conf).";
+        description = ''
+          Set configuration for the network service (/etc/bluetooth/network.conf).
+          See <https://github.com/bluez/bluez/blob/master/profiles/network/network.conf> for full list of options.
+        '';
      };
    };
  };
--- a/nixos/modules/services/misc/mollysocket.nix
+++ b/nixos/modules/services/misc/mollysocket.nix
@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:

 let
-  inherit (lib) getExe mkIf mkOption mkEnableOption optionals types;
+  inherit (lib) getExe mkIf mkOption mkEnableOption types;

  cfg = config.services.mollysocket;
  configuration = format.generate "mollysocket.conf" cfg.settings;
@ -85,9 +85,7 @@ in {
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];
      environment.RUST_LOG = cfg.logLevel;
-      serviceConfig = let
-        capabilities = [ "" ] ++ optionals (cfg.settings.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
-      in {
+      serviceConfig = {
        EnvironmentFile = cfg.environmentFile;
        ExecStart = "${getExe package} server";
        KillSignal = "SIGINT";
@ -97,8 +95,6 @@ in {
        WorkingDirectory = "/var/lib/mollysocket";

        # hardening
-        AmbientCapabilities = capabilities;
-        CapabilityBoundingSet = capabilities;
        DevicePolicy = "closed";
        DynamicUser = true;
        LockPersonality = true;
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@ -372,9 +372,6 @@ in
        SystemCallFilter = defaultServiceConfig.SystemCallFilter ++ [ "@setuid mbind" ];
        # Needs to serve web page
        PrivateNetwork = false;
-      } // lib.optionalAttrs (cfg.port < 1024) {
-        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
-        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
      };
      environment = env // {
        PYTHONPATH = "${cfg.package.python.pkgs.makePythonPath cfg.package.propagatedBuildInputs}:${cfg.package}/lib/paperless-ngx/src";
--- a/nixos/modules/services/misc/tandoor-recipes.nix
+++ b/nixos/modules/services/misc/tandoor-recipes.nix
@ -119,9 +119,6 @@ in
        # gunicorn needs setuid
        SystemCallFilter = [ "@system-service" "~@privileged" "@resources" "@setuid" "@keyring" ];
        UMask = "0066";
-      } // lib.optionalAttrs (cfg.port < 1024) {
-        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
-        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
      };

      wantedBy = [ "multi-user.target" ];
--- a/nixos/modules/services/misc/transfer-sh.nix
+++ b/nixos/modules/services/misc/transfer-sh.nix
@ -69,7 +69,6 @@ in
          wantedBy = [ "multi-user.target" ];
          environment = mapAttrs (_: v: if isBool v then boolToString v else toString v) cfg.settings;
          serviceConfig = {
-            CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
            DevicePolicy = "closed";
            DynamicUser = true;
            ExecStart = "${getExe cfg.package} --provider ${cfg.provider}";
--- a/nixos/modules/services/misc/wastebin.nix
+++ b/nixos/modules/services/misc/wastebin.nix
@ -126,7 +126,6 @@ in
        wantedBy = [ "multi-user.target" ];
        environment = mapAttrs (_: v: if isBool v then boolToString v else toString v) cfg.settings;
        serviceConfig = {
-          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
          DevicePolicy = "closed";
          DynamicUser = true;
          ExecStart = "${getExe cfg.package}";
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@ -1834,8 +1834,6 @@ in
        StateDirectory = cfg.stateDir;
        StateDirectoryMode = "0700";
        # Hardening
-        AmbientCapabilities = lib.mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
-        CapabilityBoundingSet = if (cfg.port < 1024) then [ "CAP_NET_BIND_SERVICE" ] else [ "" ];
        DeviceAllow = [ "/dev/null rw" ];
        DevicePolicy = "strict";
        LockPersonality = true;
--- a/nixos/modules/services/networking/iwd.nix
+++ b/nixos/modules/services/networking/iwd.nix
@ -36,7 +36,7 @@ in

      description = ''
        Options passed to iwd.
-        See [here](https://iwd.wiki.kernel.org/networkconfigurationsettings) for supported options.
+        See {manpage}`iwd.config(5)` for supported options.
      '';
    };
  };
--- a/nixos/modules/services/networking/openvpn.nix
+++ b/nixos/modules/services/networking/openvpn.nix
@ -73,8 +73,9 @@ let
    openvpn-restart = {
      wantedBy = [ "sleep.target" ];
      path = [ pkgs.procps ];
-      script = "pkill --signal SIGHUP --exact openvpn";
-      #SIGHUP makes openvpn process to self-exit and then it got restarted by systemd because of Restart=always
+      script = let
+        unitNames = map (n: "openvpn-${n}.service") (builtins.attrNames cfg.servers);
+      in "systemctl try-restart ${lib.escapeShellArgs unitNames}";
      description = "Sends a signal to OpenVPN process to trigger a restart after return from sleep";
    };
  };
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@ -198,16 +198,19 @@ let
  '';

  serverPort =
+    let
+      address = cfg.serverSettings.bindaddress;
+    in
    # ipv6:
-    if hasInfix "]:" cfg.serverSettings.bindaddress then
-      last (splitString "]:" cfg.serverSettings.bindaddress)
+    if hasInfix "]:" address then
+      last (splitString "]:" address)
    else
    # ipv4:
-    if hasInfix "." cfg.serverSettings.bindaddress then
-      last (splitString ":" cfg.serverSettings.bindaddress)
+    if hasInfix "." address then
+      last (splitString ":" address)
    # default is 8443
    else
-      "8443";
+      throw "Address not parseable as IPv4 nor IPv6.";
 in
 {
  options.services.kanidm = {
@ -225,6 +228,7 @@ in
          bindaddress = mkOption {
            description = "Address/port combination the webserver binds to.";
            example = "[::1]:8443";
+            default = "127.0.0.1:8443";
            type = types.str;
          };
          # Should be optional but toml does not accept null
--- a/nixos/modules/services/system/swapspace.nix
+++ b/nixos/modules/services/system/swapspace.nix
@ -0,0 +1,120 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+let
+  cfg = config.services.swapspace;
+  inherit (lib)
+    types
+    mkOption
+    mkPackageOption
+    mkEnableOption
+    ;
+  configFile = pkgs.writeText "swapspace.conf" (lib.generators.toKeyValue { } cfg.settings);
+in
+{
+  options.services.swapspace = {
+    enable = mkEnableOption "Swapspace, a dynamic swap space manager";
+    package = mkPackageOption pkgs "swapspace" { };
+    extraArgs = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [
+        "-P"
+        "-v"
+      ];
+      description = "Any extra arguments to pass to swapspace";
+    };
+    settings = mkOption {
+      type = types.submodule {
+        options = {
+          swappath = mkOption {
+            type = types.str;
+            default = "/var/lib/swapspace";
+            description = "Location where swapspace may create and delete swapfiles";
+          };
+          lower_freelimit = mkOption {
+            type = types.ints.between 0 99;
+            default = 20;
+            description = "Lower free-space threshold: if the percentage of free space drops below this number, additional swapspace is allocated";
+          };
+          upper_freelimit = mkOption {
+            type = types.ints.between 0 100;
+            default = 60;
+            description = "Upper free-space threshold: if the percentage of free space exceeds this number, swapspace will attempt to free up swapspace";
+          };
+          freetarget = mkOption {
+            type = types.ints.between 2 99;
+            default = 30;
+            description = ''
+              Percentage of free space swapspace should aim for when adding swapspace.
+              This should fall somewhere between lower_freelimit and upper_freelimit.
+            '';
+          };
+          min_swapsize = mkOption {
+            type = types.str;
+            default = "4m";
+            description = "Smallest allowed size for individual swapfiles";
+          };
+          max_swapsize = mkOption {
+            type = types.str;
+            default = "2t";
+            description = "Greatest allowed size for individual swapfiles";
+          };
+          cooldown = mkOption {
+            type = types.ints.unsigned;
+            default = 600;
+            description = ''
+              Duration (roughly in seconds) of the moratorium on swap allocation that is instated if disk space runs out, or the cooldown time after a new swapfile is successfully allocated before swapspace will consider deallocating swap space again.
+              The default cooldown period is about 10 minutes.
+            '';
+          };
+          buffer_elasticity = mkOption {
+            type = types.ints.between 0 100;
+            default = 30;
+            description = ''Percentage of buffer space considered to be "free"'';
+          };
+          cache_elasticity = mkOption {
+            type = types.ints.between 0 100;
+            default = 80;
+            description = ''Percentage of cache space considered to be "free"'';
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Config file for swapspace.
+        See the options here: <https://github.com/Tookmund/Swapspace/blob/master/swapspace.conf>
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    systemd.packages = [ cfg.package ];
+    systemd.services.swapspace = {
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = [
+          ""
+          "${lib.getExe cfg.package} -c ${configFile} ${utils.escapeSystemdExecArgs cfg.extraArgs}"
+        ];
+      };
+    };
+    systemd.tmpfiles.settings.swapspace = {
+      ${cfg.settings.swappath}.d = {
+        mode = "0700";
+      };
+    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [
+      Luflosi
+      phanirithvij
+    ];
+  };
+}
--- a/nixos/modules/services/web-apps/dex.nix
+++ b/nixos/modules/services/web-apps/dex.nix
@ -80,7 +80,6 @@ in
        ];

        RuntimeDirectory = "dex";
-        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
        BindReadOnlyPaths = [
          "/nix/store"
          "-/etc/dex"
@ -91,7 +90,6 @@ in
          "-/etc/ssl/certs/ca-certificates.crt"
        ];
        BindPaths = optional (cfg.settings.storage.type == "postgres") "/var/run/postgresql";
-        CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
        # ProtectClock= adds DeviceAllow=char-rtc r
        DeviceAllow = "";
        DynamicUser = true;
--- a/nixos/modules/services/web-apps/freshrss.nix
+++ b/nixos/modules/services/web-apps/freshrss.nix
@ -164,7 +164,6 @@ in
    let
      defaultServiceConfig = {
        ReadWritePaths = "${cfg.dataDir}";
-        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
        DeviceAllow = "";
        LockPersonality = true;
        NoNewPrivileges = true;
--- a/nixos/modules/services/web-apps/microbin.nix
+++ b/nixos/modules/services/web-apps/microbin.nix
@ -61,7 +61,6 @@ in
      wantedBy = [ "multi-user.target" ];
      environment = lib.mapAttrs (_: v: if lib.isBool v then lib.boolToString v else toString v) cfg.settings;
      serviceConfig = {
-        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
        DevicePolicy = "closed";
        DynamicUser = true;
        EnvironmentFile = lib.optional (cfg.passwordFile != null) cfg.passwordFile;
--- a/nixos/modules/services/web-apps/photoprism.nix
+++ b/nixos/modules/services/web-apps/photoprism.nix
@ -109,7 +109,6 @@ in
        LoadCredential = lib.optionalString (cfg.passwordFile != null)
          "PHOTOPRISM_ADMIN_PASSWORD:${cfg.passwordFile}";

-        CapabilityBoundingSet = "";
        LockPersonality = true;
        PrivateDevices = true;
        PrivateUsers = true;
@ -126,9 +125,6 @@ in
        SystemCallArchitectures = "native";
        SystemCallFilter = [ "@system-service" "~@setuid @keyring" ];
        UMask = "0066";
-      } // lib.optionalAttrs (cfg.port < 1024) {
-        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
-        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
      };

      wantedBy = [ "multi-user.target" ];
--- a/nixos/modules/services/web-apps/powerdns-admin.nix
+++ b/nixos/modules/services/web-apps/powerdns-admin.nix
@ -87,7 +87,6 @@ in
        User = "powerdnsadmin";
        Group = "powerdnsadmin";

-        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
        BindReadOnlyPaths = [
          "/nix/store"
          "-/etc/resolv.conf"
@ -97,7 +96,6 @@ in
        ]
        ++ (optional (cfg.secretKeyFile != null) cfg.secretKeyFile)
        ++ (optional (cfg.saltFile != null) cfg.saltFile);
-        CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
        # ProtectClock= adds DeviceAllow=char-rtc r
        DeviceAllow = "";
        # Implies ProtectSystem=strict, which re-mounts all paths
--- a/nixos/modules/services/web-apps/shiori.nix
+++ b/nixos/modules/services/web-apps/shiori.nix
@ -90,7 +90,6 @@ in {
            "/var/run/mysqld";

        CapabilityBoundingSet = "";
-        AmbientCapabilities = "CAP_NET_BIND_SERVICE";

        DeviceAllow = "";

--- a/nixos/modules/system/boot/shutdown.nix
+++ b/nixos/modules/system/boot/shutdown.nix
@ -14,6 +14,7 @@ with lib;
      unitConfig = {
        DefaultDependencies = false;
        ConditionPathExists = "/dev/rtc";
+        ConditionPathIsReadWrite = "/etc/";
      };

      serviceConfig = {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -870,7 +870,7 @@ in {
  realm = handleTest ./realm.nix {};
  redis = handleTest ./redis.nix {};
  redlib = handleTest ./redlib.nix {};
-  redmine = handleTest ./redmine.nix {};
+  redmine = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./redmine.nix {};
  renovate = handleTest ./renovate.nix {};
  replace-dependencies = handleTest ./replace-dependencies {};
  restartByActivationScript = handleTest ./restart-by-activation-script.nix {};
@ -960,6 +960,7 @@ in {
  swap-file-btrfs = handleTest ./swap-file-btrfs.nix {};
  swap-partition = handleTest ./swap-partition.nix {};
  swap-random-encryption = handleTest ./swap-random-encryption.nix {};
+  swapspace = handleTestOn ["aarch64-linux" "x86_64-linux"] ./swapspace.nix {};
  sway = handleTest ./sway.nix {};
  swayfx = handleTest ./swayfx.nix {};
  switchTest = handleTest ./switch-test.nix { ng = false; };
--- a/nixos/tests/swapspace.nix
+++ b/nixos/tests/swapspace.nix
@ -0,0 +1,69 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+
+  {
+    name = "swapspace";
+
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [
+        Luflosi
+        phanirithvij
+      ];
+    };
+
+    nodes.machine = {
+      virtualisation.memorySize = 512;
+
+      services.swapspace = {
+        enable = true;
+        extraArgs = [ "-v" ];
+        settings = {
+          # test outside /var/lib/swapspace
+          swappath = "/swamp";
+          cooldown = 1;
+        };
+      };
+
+      swapDevices = lib.mkOverride 0 [
+        {
+          size = 127;
+          device = "/root/swapfile";
+        }
+      ];
+      boot.kernel.sysctl."vm.swappiness" = 60;
+    };
+
+    testScript = ''
+      machine.wait_for_unit("multi-user.target")
+      machine.wait_for_unit("swapspace.service")
+      machine.wait_for_unit("root-swapfile.swap")
+
+      swamp = False
+      with subtest("swapspace works"):
+        machine.execute("mkdir /root/memfs")
+        machine.execute("mount -o size=2G -t tmpfs none /root/memfs")
+        i = 0
+        while i < 14:
+          print(machine.succeed("free -h"))
+          out = machine.succeed("sh -c 'swapon --show --noheadings --raw --bytes | grep /root/swapfile'")
+          row = out.split(' ')
+          # leave 1MB free to not get killed by oom
+          freebytes=int(row[2]) - int(row[3]) - 1*1024*1024
+          machine.succeed(f"dd if=/dev/random of=/root/memfs/{i} bs={freebytes} count=1")
+          machine.sleep(1)
+          out = machine.succeed("swapon --show")
+          print(out)
+          swamp = "/swamp" in out
+          if not swamp:
+            i += 1
+          else:
+            print("*"*10, "SWAPED", "*"*10)
+            machine.succeed("rm -f /root/memfs/*")
+            break
+
+      print(machine.succeed("swapspace -e -s /swamp"))
+      assert "/swamp" not in machine.execute("swapon --show")
+      assert swamp
+    '';
+  }
+)
--- a/pkgs/applications/audio/sidplayfp/default.nix
+++ b/pkgs/applications/audio/sidplayfp/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "sidplayfp";
-  version = "2.10.0";
+  version = "2.11.0";

  src = fetchFromGitHub {
    owner = "libsidplayfp";
    repo = "sidplayfp";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-PT0WijNvcF7opTVxpj6oRb514Alz12gZCSMYa4bqyrY=";
+    hash = "sha256-X2ds7pYglxvwLOHXfCULwSeWAS9l2Y3PUdSxcuugwHs=";
  };

  strictDeps = true;
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -94,12 +94,12 @@
  };
  awk = buildGrammar {
    language = "awk";
-    version = "0.0.0+rev=553fdc4";
+    version = "0.0.0+rev=34bbdc7";
    src = fetchFromGitHub {
      owner = "Beaglefoot";
      repo = "tree-sitter-awk";
-      rev = "553fdc4afb3b603332c3f4baf50c711506f4e797";
-      hash = "sha256-LJ+jRomCepFH8QbHTgecaDZ3dlO1kgjs5i71kIWi1bg=";
+      rev = "34bbdc7cce8e803096f47b625979e34c1be38127";
+      hash = "sha256-MDfAtG6ZC0KttJ5bdW71Jgts+SAJitRnwu8xQ26N9K0=";
    };
    meta.homepage = "https://github.com/Beaglefoot/tree-sitter-awk";
  };
@ -127,12 +127,12 @@
  };
  beancount = buildGrammar {
    language = "beancount";
-    version = "0.0.0+rev=01c0da2";
+    version = "0.0.0+rev=9bc460a";
    src = fetchFromGitHub {
      owner = "polarmutex";
      repo = "tree-sitter-beancount";
-      rev = "01c0da29e0fc7130420a09d939ecc524e09b6ba6";
-      hash = "sha256-obIGlAXe+Y1vffXTGgFRpiqof+F9bSRLq9NJGZcvhVE=";
+      rev = "9bc460a05b5f096d69568b5fb36105032ff4ff97";
+      hash = "sha256-MSLM7Or1SZeqj0WzJ26o5cmYa5vWcSbMhDzMkqWRJgE=";
    };
    meta.homepage = "https://github.com/polarmutex/tree-sitter-beancount";
  };
@ -193,12 +193,12 @@
  };
  c = buildGrammar {
    language = "c";
-    version = "0.0.0+rev=79284a1";
+    version = "0.0.0+rev=6c7f459";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-c";
-      rev = "79284a14a0d7e4495b095b38acdd8a27acbe870e";
-      hash = "sha256-dmvh+k+G0KrR8/bQxJOA/a+uZSrMQfZrNx3ZJQt2MZ4=";
+      rev = "6c7f459ddc0bcf78b615d3a3f4e8fed87b8b3b1b";
+      hash = "sha256-lEaHOiA4BohmxOrcBy5TlV+x5aqD7e5n5beuVpqAM0M=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-c";
  };
@ -379,6 +379,17 @@
    };
    meta.homepage = "https://github.com/eonpatapon/tree-sitter-cue";
  };
+  cylc = buildGrammar {
+    language = "cylc";
+    version = "0.0.0+rev=8b895c2";
+    src = fetchFromGitHub {
+      owner = "elliotfontaine";
+      repo = "tree-sitter-cylc";
+      rev = "8b895c278f98d05e67997f5e3a43fb5531933023";
+      hash = "sha256-+Afoxp+1hJZfRsekpz9WAEw/i/7uoXb0wl7/b6tlPro=";
+    };
+    meta.homepage = "https://github.com/elliotfontaine/tree-sitter-cylc";
+  };
  d = buildGrammar {
    language = "d";
    version = "0.0.0+rev=45e5f1e";
@ -392,45 +403,45 @@
  };
  dart = buildGrammar {
    language = "dart";
-    version = "0.0.0+rev=9ac03bb";
+    version = "0.0.0+rev=a7496b9";
    src = fetchFromGitHub {
      owner = "UserNobody14";
      repo = "tree-sitter-dart";
-      rev = "9ac03bb2154316624fb4c41fe0f372a5f1597b43";
-      hash = "sha256-8bSlsDi1QU0Z9sLxrTfqOi6aB1fe+jP9lHuIjIGNx1o=";
+      rev = "a7496b9d562be91e6588eecd5d7045832f575cd0";
+      hash = "sha256-HEeg1Jovvg65NLyjICd4Gi/+e1QapxuEF2tqhh4B0dA=";
    };
    meta.homepage = "https://github.com/UserNobody14/tree-sitter-dart";
  };
  desktop = buildGrammar {
    language = "desktop";
-    version = "0.0.0+rev=0d8b8cf";
+    version = "0.0.0+rev=de93cdb";
    src = fetchFromGitHub {
      owner = "ValdezFOmar";
      repo = "tree-sitter-desktop";
-      rev = "0d8b8cf7c9311fe3f1730df8e193d836f6dd9d1b";
-      hash = "sha256-tDZB6gkQyVF1wN4343Qft0tRkTDDm49AFzhbIz+LK40=";
+      rev = "de93cdbd1cba965c102ce8b659d79f5759b933bd";
+      hash = "sha256-aBdF9s1Km5vrb+kXnwdcxuhUJyzQCpGlQ/EE0h2kT0U=";
    };
    meta.homepage = "https://github.com/ValdezFOmar/tree-sitter-desktop";
  };
  devicetree = buildGrammar {
    language = "devicetree";
-    version = "0.0.0+rev=16c9cb9";
+    version = "0.0.0+rev=16f640f";
    src = fetchFromGitHub {
      owner = "joelspadin";
      repo = "tree-sitter-devicetree";
-      rev = "16c9cb959675bc9bc4f4e5bebe473d511a12a06d";
-      hash = "sha256-UVxLF4IKRXexz+PbSlypS/1QsWXkS/iYVbgmFCgjvZM=";
+      rev = "16f640f3c59117c9e749d581634afdb00e004f4c";
+      hash = "sha256-0J1Q25JEWVAlBHAgWRtHAwIIDNoSLYrEdMC45/jf7Uc=";
    };
    meta.homepage = "https://github.com/joelspadin/tree-sitter-devicetree";
  };
  dhall = buildGrammar {
    language = "dhall";
-    version = "0.0.0+rev=affb6ee";
+    version = "0.0.0+rev=4a6c08a";
    src = fetchFromGitHub {
      owner = "jbellerb";
      repo = "tree-sitter-dhall";
-      rev = "affb6ee38d629c9296749767ab832d69bb0d9ea8";
-      hash = "sha256-q9OkKmp0Nor+YkFc8pBVAOoXoWzwjjzg9lBUKAUnjmQ=";
+      rev = "4a6c08abfb54827db4e722d6cdca81b093898988";
+      hash = "sha256-EP6eL04ltnnP2ypNsq6rLrG3F4bVg7QtnK3k0KP2/MY=";
    };
    meta.homepage = "https://github.com/jbellerb/tree-sitter-dhall";
  };
@ -537,12 +548,12 @@
  };
  editorconfig = buildGrammar {
    language = "editorconfig";
-    version = "0.0.0+rev=38cf8d0";
+    version = "0.0.0+rev=5eca41a";
    src = fetchFromGitHub {
      owner = "ValdezFOmar";
      repo = "tree-sitter-editorconfig";
-      rev = "38cf8d0af6049025de0e5486a40881dac06285b4";
-      hash = "sha256-ndZ/oGquSMkxsEHUPh5/qDEUVfhyZbI4mcQKtLHVBOU=";
+      rev = "5eca41a689dc03534e9c459b066d116f8befb4ef";
+      hash = "sha256-bsefC7SCJvSPy83BeIYxmFe+0Zt96QNs49Tlh/Vbx5s=";
    };
    meta.homepage = "https://github.com/ValdezFOmar/tree-sitter-editorconfig";
  };
@ -724,12 +735,12 @@
  };
  fortran = buildGrammar {
    language = "fortran";
-    version = "0.0.0+rev=cb4cb11";
+    version = "0.0.0+rev=e9fbb3a";
    src = fetchFromGitHub {
      owner = "stadelmanma";
      repo = "tree-sitter-fortran";
-      rev = "cb4cb11ca2dced205fb54005684a44e2ceb813c1";
-      hash = "sha256-c15BxiXhmQeOz0G5v2R9fpBUbhmcibm15ax6hbWQOnI=";
+      rev = "e9fbb3acbfc62b051616e53b17ab97b9823e8617";
+      hash = "sha256-G7tsnI22k7Ndur3fLnfr2xk4fUaJ4kIy3Dw0GuqHSqg=";
    };
    meta.homepage = "https://github.com/stadelmanma/tree-sitter-fortran";
  };
@ -879,12 +890,12 @@
  };
  gleam = buildGrammar {
    language = "gleam";
-    version = "0.0.0+rev=57c9951";
+    version = "0.0.0+rev=2702fe8";
    src = fetchFromGitHub {
      owner = "gleam-lang";
      repo = "tree-sitter-gleam";
-      rev = "57c9951b290c8084d7c60b0aee7a2b30986ea031";
-      hash = "sha256-ieOvtZvOUwiJwJN6AtHVK91GTh+RKge9FMo+mYCtisk=";
+      rev = "2702fe84b986e4403a071bcb112d48e3dcde0ca4";
+      hash = "sha256-DY79MOnZqb145DtmUyhma0WZ5PksDeqVvhwGuvFXGjM=";
    };
    meta.homepage = "https://github.com/gleam-lang/tree-sitter-gleam";
  };
@ -1066,12 +1077,12 @@
  };
  groovy = buildGrammar {
    language = "groovy";
-    version = "0.0.0+rev=0d88845";
+    version = "0.0.0+rev=b53a8cc";
    src = fetchFromGitHub {
      owner = "murtaza64";
      repo = "tree-sitter-groovy";
-      rev = "0d8884514fe10c4fa47527d9a0284d207f38ddea";
-      hash = "sha256-Dv7FxfHA+2VM60iFZGaytmDVCUEoCJY3bpOJrw5Q8ik=";
+      rev = "b53a8cc1075e056b8223b86f3bb392e0d57ae101";
+      hash = "sha256-yLl3/4qla45tsjCd2EFutcNqVrDjyMUjnSpUUHwaIyE=";
    };
    meta.homepage = "https://github.com/murtaza64/tree-sitter-groovy";
  };
@ -1143,12 +1154,12 @@
  };
  heex = buildGrammar {
    language = "heex";
-    version = "0.0.0+rev=6dd0303";
+    version = "0.0.0+rev=9359017";
    src = fetchFromGitHub {
      owner = "connorlay";
      repo = "tree-sitter-heex";
-      rev = "6dd0303acf7138dd2b9b432a229e16539581c701";
-      hash = "sha256-VakMZtWQ/h7dNy5ehk2Bh14a5s878AUgwY3Ipq8tPec=";
+      rev = "9359017bd0dc6b023044713aa215544885663637";
+      hash = "sha256-4DEfL/RxZk7cvP5qUHNohJlfAIW+ks34rdMd/uCvsvA=";
    };
    meta.homepage = "https://github.com/connorlay/tree-sitter-heex";
  };
@ -1276,12 +1287,12 @@
  };
  idl = buildGrammar {
    language = "idl";
-    version = "0.0.0+rev=5573b29";
+    version = "0.0.0+rev=9ac6fdd";
    src = fetchFromGitHub {
      owner = "cathaysia";
      repo = "tree-sitter-idl";
-      rev = "5573b295410201ed22771776b34d636900eba368";
-      hash = "sha256-Pf9Wtmza6bKQsZ54EzVhSnUFkEcHuTgPGNZuH8jh42o=";
+      rev = "9ac6fdd7840b5c0f271fe11b4ab656634dc2074a";
+      hash = "sha256-cedxIEfqyvnVdJOqPbXnsKoajMXwejVu9BV3qLCuYR8=";
    };
    meta.homepage = "https://github.com/cathaysia/tree-sitter-idl";
  };
@ -1474,12 +1485,12 @@
  };
  koto = buildGrammar {
    language = "koto";
-    version = "0.0.0+rev=9e5ab09";
+    version = "0.0.0+rev=0017388";
    src = fetchFromGitHub {
      owner = "koto-lang";
      repo = "tree-sitter-koto";
-      rev = "9e5ab09710b9f035efdcef1eecaadbf261af7ec3";
-      hash = "sha256-xlU3iOjwYcoCf6kdkxTX/zASY0+n+TwAn8GBfACYr1k=";
+      rev = "0017388765b8b9d89febfe08b5f82805b4e173a5";
+      hash = "sha256-L8IK4dvejZ1yfEkPGufkNArxm3hTStpk15HFNkSQdv0=";
    };
    meta.homepage = "https://github.com/koto-lang/tree-sitter-koto";
  };
@ -1808,12 +1819,12 @@
  };
  nix = buildGrammar {
    language = "nix";
-    version = "0.0.0+rev=456b14a";
+    version = "0.0.0+rev=1b26cb6";
    src = fetchFromGitHub {
      owner = "cstrahan";
      repo = "tree-sitter-nix";
-      rev = "456b14a2fa6315abc7e02fcffaf4a1f35d4955d3";
-      hash = "sha256-eY+e48XFHvTRlew4LvndGHQog3d/RKDLlIrGr7QOWBY=";
+      rev = "1b26cb63284287344bc3820804cea18419b3edec";
+      hash = "sha256-tkGOSi0NqtKl6w473+G66mWwbXwpmRySMLH8DEEcEXQ=";
    };
    meta.homepage = "https://github.com/cstrahan/tree-sitter-nix";
  };
@ -1839,6 +1850,17 @@
    };
    meta.homepage = "https://github.com/amaanq/tree-sitter-nqc";
  };
+  nu = buildGrammar {
+    language = "nu";
+    version = "0.0.0+rev=082a7c7";
+    src = fetchFromGitHub {
+      owner = "nushell";
+      repo = "tree-sitter-nu";
+      rev = "082a7c7df7db460da6b280c9f902bf2b19a2f423";
+      hash = "sha256-BUOadkcQAXqMI8qpDcPN8NwNI+LScPKl/GsGvhfUmhw=";
+    };
+    meta.homepage = "https://github.com/nushell/tree-sitter-nu";
+  };
  objc = buildGrammar {
    language = "objc";
    version = "0.0.0+rev=62e61b6";
@ -2066,12 +2088,12 @@
  };
  printf = buildGrammar {
    language = "printf";
-    version = "0.0.0+rev=0e0acea";
+    version = "0.0.0+rev=94b84fb";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-printf";
-      rev = "0e0aceabbf607ea09e03562f5d8a56f048ddea3d";
-      hash = "sha256-y/7CDnHpT3D6hL0f+52mReCphn+lvElfQQKJwY4fr9c=";
+      rev = "94b84fbc4768a7cbdeadfe5e489a45a6a8af400e";
+      hash = "sha256-Ax23Y2arS+8g45F1NuffTq0ZlPZ2NBz0aHuQJyEVy2Y=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-printf";
  };
@ -2344,12 +2366,12 @@
  };
  regex = buildGrammar {
    language = "regex";
-    version = "0.0.0+rev=58f4caf";
+    version = "0.0.0+rev=b518ad4";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-regex";
-      rev = "58f4caf9db12db3b38b81c77d274aa73c9e85aca";
-      hash = "sha256-IeAp2fEdxVf8r/f8B85ex5Y5DL8Z1ZOqovjVyMBIOKM=";
+      rev = "b518ad4bbee3ad59672b1826ca4dc62825983533";
+      hash = "sha256-gApL+F03m24ibIrLMcirk1s+uJRM0vv7J34YRHkO78U=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-regex";
  };
@ -2386,17 +2408,6 @@
    };
    meta.homepage = "https://github.com/rescript-lang/tree-sitter-rescript";
  };
-  river = buildGrammar {
-    language = "river";
-    version = "0.0.0+rev=eafcdc5";
-    src = fetchFromGitHub {
-      owner = "grafana";
-      repo = "tree-sitter-river";
-      rev = "eafcdc5147f985fea120feb670f1df7babb2f79e";
-      hash = "sha256-fhuIO++hLr5DqqwgFXgg8QGmcheTpYaYLMo7117rjyk=";
-    };
-    meta.homepage = "https://github.com/grafana/tree-sitter-river";
-  };
  rnoweb = buildGrammar {
    language = "rnoweb";
    version = "0.0.0+rev=1a74dc0";
@ -2465,12 +2476,12 @@
  };
  ruby = buildGrammar {
    language = "ruby";
-    version = "0.0.0+rev=83aec5f";
+    version = "0.0.0+rev=557ec01";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-ruby";
-      rev = "83aec5f7d1659aaa79e6f24b406a9cd49b87e8e8";
-      hash = "sha256-LmZ2CmsAtxVcR/FuEZXunOHbGR9w8IL5DmLINFWqBAE=";
+      rev = "557ec01403bd1fcfea50f1805641ca773cbaaa42";
+      hash = "sha256-3MzlgYW65MSpukd8Nt9ooUC39g7ZigLjqXIaNB0sNEg=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-ruby";
  };
@ -2678,12 +2689,12 @@
  };
  ssh_config = buildGrammar {
    language = "ssh_config";
-    version = "0.0.0+rev=77450e8";
+    version = "0.0.0+rev=dd32616";
    src = fetchFromGitHub {
      owner = "ObserverOfTime";
      repo = "tree-sitter-ssh-config";
-      rev = "77450e8bce8853921512348f83c73c168c71fdfb";
-      hash = "sha256-V7JI1o30+mzGA4X1oh+pyu3rSWOfHFKfCUbYaFPLOmM=";
+      rev = "dd32616275c6e9d7800c58f40c16a09ad1c7c238";
+      hash = "sha256-BOvCOnt76f00+hqjEmJ8VLiwqSPd3p/yScTXsuNdexY=";
    };
    meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-ssh-config";
  };
@ -2711,12 +2722,12 @@
  };
  styled = buildGrammar {
    language = "styled";
-    version = "0.0.0+rev=764af55";
+    version = "0.0.0+rev=2e0e623";
    src = fetchFromGitHub {
      owner = "mskelton";
      repo = "tree-sitter-styled";
-      rev = "764af55fc6b8e5ae177eb272f5c5de6238db23e6";
-      hash = "sha256-Zh35KWOYQbtsG3/F7g68dniBu5UZTA6ZuiX2GA0E2ww=";
+      rev = "2e0e6231348d8cb0a82406490771825b8ac80422";
+      hash = "sha256-RwhHCWK1ckXdPgIVZ4NC5zCBna91NBYub2MlrIwHeGk=";
    };
    meta.homepage = "https://github.com/mskelton/tree-sitter-styled";
  };
@ -2733,12 +2744,12 @@
  };
  superhtml = buildGrammar {
    language = "superhtml";
-    version = "0.0.0+rev=e561df3";
+    version = "0.0.0+rev=7d61ccc";
    src = fetchFromGitHub {
      owner = "kristoff-it";
      repo = "superhtml";
-      rev = "e561df3b5ce94e598a4c3d0ee4abd9635bad63b3";
-      hash = "sha256-sF5uAEYV32HROnqvM3oltvpwtBydx2au8SIJCAMmpMY=";
+      rev = "7d61cccdb865b2028301a0597b55ac8b225af6cf";
+      hash = "sha256-rO7HS07nSqwOq6345q/SOL2imoD0cKV16QJcVVr6mHw=";
    };
    location = "tree-sitter-superhtml";
    meta.homepage = "https://github.com/kristoff-it/superhtml";
@ -2765,6 +2776,17 @@
    };
    meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-svelte";
  };
+  sway = buildGrammar {
+    language = "sway";
+    version = "0.0.0+rev=03d97aa";
+    src = fetchFromGitHub {
+      owner = "FuelLabs";
+      repo = "tree-sitter-sway";
+      rev = "03d97aad336ecc6b302f23bdd9b695ddc937160b";
+      hash = "sha256-Y08vgnlxOSjvI3NURU8VUyaGjKt+q4IiCaV18C5co0s=";
+    };
+    meta.homepage = "https://github.com/FuelLabs/tree-sitter-sway.git";
+  };
  swift = buildGrammar {
    language = "swift";
    version = "0.0.0+rev=5098007";
@ -2913,12 +2935,12 @@
  };
  tlaplus = buildGrammar {
    language = "tlaplus";
-    version = "0.0.0+rev=ffb6c4b";
+    version = "0.0.0+rev=d711f24";
    src = fetchFromGitHub {
      owner = "tlaplus-community";
      repo = "tree-sitter-tlaplus";
-      rev = "ffb6c4b91862a03af767d6b0e627d3d20539b79a";
-      hash = "sha256-eKHpiAtOYn9fFhR35m1d1jLNwLeXL1GT5cAWWoYZI/k=";
+      rev = "d711f24c93221cdfc9a9b4dbb0998f528fc982ac";
+      hash = "sha256-CHoqOY990/30GqLkxee/xexQ9uni7VTdW0iZ+inunoc=";
    };
    meta.homepage = "https://github.com/tlaplus-community/tree-sitter-tlaplus";
  };
@ -3116,12 +3138,12 @@
  };
  vala = buildGrammar {
    language = "vala";
-    version = "0.0.0+rev=8f690bf";
+    version = "0.0.0+rev=97e6db3";
    src = fetchFromGitHub {
      owner = "vala-lang";
      repo = "tree-sitter-vala";
-      rev = "8f690bfa639f2b83d1fb938ed3dd98a7ba453e8b";
-      hash = "sha256-YZTE3PkBPCEkMXnLC0HSQ86v5+3/J7/ETDQp8eguFW8=";
+      rev = "97e6db3c8c73b15a9541a458d8e797a07f588ef4";
+      hash = "sha256-hAekweZGDHVrWVd04RrN+9Jz0D2kode+DpceTlUXii0=";
    };
    meta.homepage = "https://github.com/vala-lang/tree-sitter-vala";
  };
@ -3149,12 +3171,12 @@
  };
  vhdl = buildGrammar {
    language = "vhdl";
-    version = "0.0.0+rev=d6e8301";
+    version = "0.0.0+rev=606cc72";
    src = fetchFromGitHub {
      owner = "jpt13653903";
      repo = "tree-sitter-vhdl";
-      rev = "d6e8301999336b47d663052d43f983c3edeb01dd";
-      hash = "sha256-vQIsWcmm5szh7L8iSDDHenSJDqJrXcTDn0A/0WJYWGc=";
+      rev = "606cc728e7d55bbcecfa37b20d7313a609af1361";
+      hash = "sha256-H8BApOAcRIFNI5Ke8DtCDZUDptKNeS8wTMHQp6xZZBM=";
    };
    meta.homepage = "https://github.com/jpt13653903/tree-sitter-vhdl";
  };
@ -3282,12 +3304,12 @@
  };
  xresources = buildGrammar {
    language = "xresources";
-    version = "0.0.0+rev=630af80";
+    version = "0.0.0+rev=d36d356";
    src = fetchFromGitHub {
      owner = "ValdezFOmar";
      repo = "tree-sitter-xresources";
-      rev = "630af80f563ede09a652a808277950c36306e3a3";
-      hash = "sha256-kQmswwZgevQFayhU0Q+UnLh+lnjgvr+m48FtYWUv3Bw=";
+      rev = "d36d356624af4b46d3fc815d0701ebf72654473c";
+      hash = "sha256-h3rS89e+eZTCxCNJVJdBbgCFEMDXQ884Lkmol0Gcq5k=";
    };
    meta.homepage = "https://github.com/ValdezFOmar/tree-sitter-xresources";
  };
@ -3348,24 +3370,24 @@
  };
  ziggy = buildGrammar {
    language = "ziggy";
-    version = "0.0.0+rev=42b6f5d";
+    version = "0.0.0+rev=fe73bee";
    src = fetchFromGitHub {
      owner = "kristoff-it";
      repo = "ziggy";
-      rev = "42b6f5d7320340bc5903c4c29d34065e8517a549";
-      hash = "sha256-08y6Km7tO9YhJBmWXvPVjiku1QRRNcmJ2h2EbMa6Q/g=";
+      rev = "fe73beef9f52f04048d8b19016fc4fbc66b4596f";
+      hash = "sha256-GSiVrl3GMp5Y8DF/gxdl1ToUoN5s3RQxNKxmab5tSHs=";
    };
    location = "tree-sitter-ziggy";
    meta.homepage = "https://github.com/kristoff-it/ziggy";
  };
  ziggy_schema = buildGrammar {
    language = "ziggy_schema";
-    version = "0.0.0+rev=42b6f5d";
+    version = "0.0.0+rev=fe73bee";
    src = fetchFromGitHub {
      owner = "kristoff-it";
      repo = "ziggy";
-      rev = "42b6f5d7320340bc5903c4c29d34065e8517a549";
-      hash = "sha256-08y6Km7tO9YhJBmWXvPVjiku1QRRNcmJ2h2EbMa6Q/g=";
+      rev = "fe73beef9f52f04048d8b19016fc4fbc66b4596f";
+      hash = "sha256-GSiVrl3GMp5Y8DF/gxdl1ToUoN5s3RQxNKxmab5tSHs=";
    };
    location = "tree-sitter-ziggy-schema";
    meta.homepage = "https://github.com/kristoff-it/ziggy";
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -173,7 +173,7 @@ in
        pname = "avante-nvim-lib";
        inherit (oldAttrs) version src;

-        cargoHash = "sha256-Hh7qAmGtxfWtkBBsNq0iVTruUSe0duE4tXaajDIt8zQ=";
+        cargoHash = "sha256-X8JqUoPjm9emJjmwCh7+0bfdtPXLwOg6IRfQHaYlH90=";

        nativeBuildInputs = [
          pkg-config
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -406,8 +406,8 @@ let
        mktplcRef = {
          name = "vscode-neovim";
          publisher = "asvetliakov";
-          version = "1.18.13";
-          hash = "sha256-FFgleWhzFaAE0UdKQ6lZsszBtJ46UZ3bfx1V3SopDNc=";
+          version = "1.18.14";
+          hash = "sha256-Db49bLX0QLr7fS7ZUyeWOustN63LpaJ6IBTKMqAz8uc=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/asvetliakov.vscode-neovim/changelog";
--- a/pkgs/applications/emulators/tamatool/default.nix
+++ b/pkgs/applications/emulators/tamatool/default.nix
@ -1,15 +1,15 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, zip
-, copyDesktopItems
-, libpng
-, SDL2
-, SDL2_image
-, darwin
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  zip,
+  copyDesktopItems,
+  libpng,
+  SDL2,
+  SDL2_image,

-# Optionally bundle a ROM file
-, rom ? null
+  # Optionally bundle a ROM file
+  rom ? null,
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -43,8 +43,6 @@ stdenv.mkDerivation (finalAttrs: {
    libpng
    SDL2
    SDL2_image
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreFoundation
  ];

  makeFlags = [
@ -56,6 +54,10 @@ stdenv.mkDerivation (finalAttrs: {
    "CC=${stdenv.cc.targetPrefix}cc"
  ];

+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_LDFLAGS = "-framework CoreFoundation";
+  };
+
  desktopItems = [ "linux/tamatool.desktop" ];

  installPhase = ''
--- a/pkgs/applications/misc/bambu-studio/default.nix
+++ b/pkgs/applications/misc/bambu-studio/default.nix
@ -1,9 +1,6 @@
 {
  stdenv,
  lib,
-  openexr,
-  jemalloc,
-  c-blosc,
  binutils,
  fetchFromGitHub,
  cmake,
@ -55,17 +52,6 @@ let
          "--enable-debug=no"
        ];
      });
-
-  openvdb' = openvdb.overrideAttrs (old: {
-    buildInputs = [
-      openexr
-      boost179
-      tbb_2021_11
-      jemalloc
-      c-blosc
-      ilmbase
-    ];
-  });
 in
 stdenv.mkDerivation rec {
  pname = "bambu-studio";
@ -111,7 +97,7 @@ stdenv.mkDerivation rec {
    mpfr
    nlopt
    opencascade-occt_7_6
-    openvdb'
+    openvdb
    pcre
    tbb_2021_11
    webkitgtk_4_0
--- a/pkgs/applications/misc/deckmaster/default.nix
+++ b/pkgs/applications/misc/deckmaster/default.nix
@ -41,7 +41,7 @@ buildGoModule rec {
    homepage = "https://github.com/muesli/deckmaster";
    changelog = "https://github.com/muesli/deckmaster/releases/tag/v${version}";
    license = licenses.mit;
-    maintainers = with maintainers; [ ianmjones ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/pdfsam-basic/default.nix
+++ b/pkgs/applications/misc/pdfsam-basic/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "pdfsam-basic";
-  version = "5.2.8";
+  version = "5.2.9";

  src = fetchurl {
    url = "https://github.com/torakiki/pdfsam/releases/download/v${version}/pdfsam_${version}-1_amd64.deb";
-    hash = "sha256-81TIGTo00qSAlmfCTjvqeJH1xKYQPkvti3JFgVvLwmQ=";
+    hash = "sha256-ZLVO2VD0XUVUG/GSot21c6nJ2N8h39vDzyzAzk1pQ6c=";
  };

  unpackPhase = ''
--- a/pkgs/applications/networking/browsers/ladybird/default.nix
+++ b/pkgs/applications/networking/browsers/ladybird/default.nix
@ -26,6 +26,7 @@
 , Cocoa
 , Foundation
 , OpenGL
+, unstableGitUpdater
 }:

 let
@ -148,6 +149,8 @@ stdenv.mkDerivation (finalAttrs: {
    nixosTest = nixosTests.ladybird;
  };

+  passthru.updateScript = unstableGitUpdater { };
+
  meta = with lib; {
    description = "Browser using the SerenityOS LibWeb engine with a Qt or Cocoa GUI";
    homepage = "https://ladybird.org";
--- a/pkgs/applications/networking/browsers/nyxt/default.nix
+++ b/pkgs/applications/networking/browsers/nyxt/default.nix
@ -39,14 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
    stripRoot = false;
  };

-  # for sbcl 2.4.3
-  postPatch = ''
-    substituteInPlace _build/cl-gobject-introspection/src/init.lisp \
-       --replace-warn sb-ext::set-floating-point-modes sb-int:set-floating-point-modes
-    substituteInPlace _build/fset/Code/port.lisp \
-       --replace-warn sb-ext::once-only sb-int:once-only
-  '';
-
  nativeBuildInputs = [ wrapGAppsHook3 ];

  buildInputs = [
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@ -34,13 +34,13 @@ let
 in
 buildGoModule rec {
  pname = "argo";
-  version = "3.5.11";
+  version = "3.5.12";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Yw61BCcMLl/zkmPm79SI0AdT6Nj2bxQkt6IKRBu0FmQ=";
+    hash = "sha256-WJh6YP5WICgqJMPug3AIqxgrzH5Pp+rVtt5RfMjS9IU=";
  };

  vendorHash = "sha256-QwQasJMSEnHvBxyxCjLuinPt47XAhERch3j60KXGxa4=";
--- a/pkgs/applications/networking/cluster/opentofu/default.nix
+++ b/pkgs/applications/networking/cluster/opentofu/default.nix
@ -14,13 +14,13 @@
 let
  package =  buildGoModule rec {
    pname = "opentofu";
-    version = "1.8.4";
+    version = "1.8.5";

    src = fetchFromGitHub {
      owner = "opentofu";
      repo = "opentofu";
      rev = "v${version}";
-      hash = "sha256-YUN+JBYn8Bq4glZNBdlr++WJgGpGSKK1PjWqaduF8bg=";
+      hash = "sha256-sZGKM6Dxz0bZkHIITujojSsKtRD4E+q1uReWRg5EfC8=";
    };

    vendorHash = "sha256-cM2DSP2ss3vleUhPBIdyxKeWJxtHpdjL5b5HVS/iC6o=";
--- a/pkgs/applications/networking/cluster/popeye/default.nix
+++ b/pkgs/applications/networking/cluster/popeye/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "popeye";
-  version = "0.21.3";
+  version = "0.21.5";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "derailed";
    repo = "popeye";
-    sha256 = "sha256-2+AV2gt67zLa7bRIfsxQIeB82iJba8Y4P0fq9273r7Q=";
+    sha256 = "sha256-2Ooh8yk6sD0VuHHxgkyIwqbJ9ynEUFDW3ti9ZzBOPX0=";
  };

  ldflags = [
@ -17,7 +17,7 @@ buildGoModule rec {
    "-X github.com/derailed/popeye/cmd.commit=${version}"
  ];

-  vendorHash = "sha256-qrw/7fauMVb3Ai5E5MXL84yXHcReJZZ1oioB/Cv32Is=";
+  vendorHash = "sha256-uTuDI9cQFE5Fdf5wcCAwjO1p/niSNHnXmWF6QhLkDUk=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "dnscontrol";
-  version = "4.14.0";
+  version = "4.14.2";

  src = fetchFromGitHub {
    owner = "StackExchange";
    repo = "dnscontrol";
    rev = "v${version}";
-    hash = "sha256-XKsP6ZJCY196wYsp54d0OgF4zj0b9H8820wBAOjrDbg=";
+    hash = "sha256-Sdm/3Svg37NW710whH58YtFULKWXU5+87LmErfjRm3Y=";
  };

-  vendorHash = "sha256-6ePEgHVFPtkW+C57+cPLj5yc9YaCRKrnBFo2Y1pcglM=";
+  vendorHash = "sha256-yyj5uP1v49mieLnNvCDG6n4+jC/+zRvdtfjaTYsAhhA=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/expressvpn/default.nix
+++ b/pkgs/applications/networking/expressvpn/default.nix
@ -58,6 +58,7 @@ let

    # expressvpnd binary has hard-coded the path /sbin/sysctl hence below workaround.
    extraBuildCommands = ''
+      mkdir -p sbin
      chmod +w sbin
      ln -s ${sysctl}/bin/sysctl sbin/sysctl
    '';
--- a/pkgs/applications/networking/instant-messengers/element/pin.nix
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@ -1,9 +1,9 @@
 {
-  "version" = "1.11.82";
+  "version" = "1.11.84";
  "hashes" = {
-    "desktopSrcHash" = "sha256-XG8q37N4PehYKPyoedgsIIBp2jrSHtoSJKaGrsxaIM8=";
-    "desktopYarnHash" = "11130y915pa356fikk3i96w81ms41284x11d4xm1xw8385smjbgq";
-    "webSrcHash" = "sha256-2W3noZfVnxpxwihimH6mlTxFpBpAdvXtLLfVHRiToxE=";
-    "webYarnHash" = "1rmimxkd70ynrf29s67336vv43g2i6ry8bibc06zb8qyicg6ld83";
+    "desktopSrcHash" = "sha256-XpXyLMYaxXTnDeJJio729TFMLn5BpUQnSb4/Rn434uo=";
+    "desktopYarnHash" = "1wh867yw7ic3nx623c5dknn9wk4zgq9b000p9mdf79spfp57lqlw";
+    "webSrcHash" = "sha256-va3r2Gk1zaP2fK/RGmU7wj52jVYo4PI5Gm/rRQGpuvo=";
+    "webYarnHash" = "0w48744ick4ji1vwh9ma6ywsb4j5hfq4knw86zqqh0ciflylcywc";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/fractal/default.nix
+++ b/pkgs/applications/networking/instant-messengers/fractal/default.nix
@ -22,6 +22,7 @@
 , sqlite
 , xdg-desktop-portal
 , libseccomp
+, glycin-loaders
 }:

 stdenv.mkDerivation rec {
@ -44,6 +45,14 @@ stdenv.mkDerivation rec {
    };
  };

+  # Dirty approach to add patches after cargoSetupPostUnpackHook
+  # We should eventually use a cargo vendor patch hook instead
+  preConfigure = ''
+    pushd ../$(stripHash $cargoDeps)/glycin-2.*
+      patch -p3 < ${glycin-loaders.passthru.glycinPathsPatch}
+    popd
+  '';
+
  nativeBuildInputs = [
    glib
    gtk4
@ -77,6 +86,12 @@ stdenv.mkDerivation rec {
    gst-plugins-good
  ]);

+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${glycin-loaders}/share"
+    )
+  '';
+
  passthru = {
    updateScript = nix-update-script { };
  };
--- a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "signal-cli";
-  version = "0.13.7";
+  version = "0.13.9";

  # Building from source would be preferred, but is much more involved.
  src = fetchurl {
    url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}.tar.gz";
-    hash = "sha256-KeSKupExFIaLKdkXJw+UTclNaiMfrIomCec6GUV0E7M=";
+    hash = "sha256-axvMUbF9TE1WLbunZni/KyjFUCdHSimP4AB8nSKf9zI=";
  };

  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libmatthew_java dbus dbus_java ];
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@ -38,7 +38,6 @@ let

    meta = with lib; {
      description = "Low-latency, high quality voice chat software";
-      mainProgram = "mumble-server";
      homepage = "https://mumble.info";
      license = licenses.bsd3;
      maintainers = with maintainers; [ felixsinger lilacious ];
@ -117,6 +116,6 @@ let
    ];
  };
 in {
-  mumble  = client source;
-  murmur  = server source;
+  mumble  = lib.recursiveUpdate (client source) {meta.mainProgram = "mumble";};
+  murmur  = lib.recursiveUpdate (server source) {meta.mainProgram = "mumble-server";};
 }
--- a/pkgs/applications/networking/onionshare/default.nix
+++ b/pkgs/applications/networking/onionshare/default.nix
@ -82,6 +82,7 @@ rec {
      pysocks
      qrcode
      requests
+      setuptools
      stem
      unidecode
      waitress
--- a/pkgs/applications/networking/seafile-client/default.nix
+++ b/pkgs/applications/networking/seafile-client/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "seafile-client";
-  version = "9.0.8";
+  version = "9.0.9";

  src = fetchFromGitHub {
    owner = "haiwen";
    repo = "seafile-client";
    rev = "v${version}";
-    sha256 = "sha256-1E/PgQEg8lQntKpafCubPNUIF/L3kjA/rp1xAL8vFfs=";
+    sha256 = "sha256-dy5EXDEyxtV88Fgbao/J3fNwO5AO/ES0IJLIeRenO8I=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "seaweedfs";
-  version = "3.75";
+  version = "3.79";

  src = fetchFromGitHub {
    owner = "seaweedfs";
    repo = "seaweedfs";
    rev = version;
-    hash = "sha256-f4ddm9+A3Km0aKlKFeoFMKxm94u0pbNvHaozesmQCH4=";
+    hash = "sha256-oAgeK9ZPH1uTFaGQv9T+yhHVla/hxyp84WTZ2PfpjOg=";
  };

-  vendorHash = "sha256-hdvlz3KbB6wPva3o5suEApgZ6w98R8TPYrPlmqYJbvo=";
+  vendorHash = "sha256-4hftmcIHItEM4t2U/iT4mZsURejaO0JqSG3kjlBk77M=";

  subPackages = [ "weed" ];

--- a/pkgs/applications/office/jameica/default.nix
+++ b/pkgs/applications/office/jameica/default.nix
@ -24,6 +24,7 @@ let
    else if stdenv.hostPlatform.system == "x86_64-linux" then "linux64"
    else if stdenv.hostPlatform.system == "aarch64-linux" then "linux-arm64"
    else if stdenv.hostPlatform.system == "x86_64-darwin" then "macos64"
+    else if stdenv.hostPlatform.system == "aarch64-darwin" then "macos-aarch64"
    else throw "Unsupported system: ${stdenv.hostPlatform.system}";

  desktopItem = makeDesktopItem {
@ -57,7 +58,7 @@ stdenv.mkDerivation rec {
  # and is not able to build the application itself
  buildPhase = ''
    runHook preBuild
-    ant -f build -Dsystem.version=${version} init compile jar
+    ant -f build -Dsystem.version=${version} init compile jar ${lib.optionalString stdenv.hostPlatform.isDarwin "zip lib"}
    runHook postBuild
  '';

@ -75,6 +76,13 @@ stdenv.mkDerivation rec {
    install -Dm644 plugin.xml $out/share/java/
    install -Dm644 build/jameica-icon.png $out/share/pixmaps/jameica.png
    cp ${desktopItem}/share/applications/* $out/share/applications/
+  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+
+    # Create .app bundle for macOS
+    mkdir -p $out/Applications
+    chmod +x releases/${_version}-${_build}-${_build}/tmp/jameica.app/jameica*.sh
+    cp -r releases/${_version}-${_build}-${_build}/tmp/jameica.app $out/Applications/Jameica.app
+  '' + ''

    runHook postInstall
  '';
@ -101,7 +109,7 @@ stdenv.mkDerivation rec {
      binaryBytecode # source bundles dependencies as jars
    ];
    license = licenses.gpl2Plus;
-    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" "aarch64-linux" ];
+    platforms = platforms.unix;
    maintainers = with maintainers; [ flokli r3dl3g ];
    mainProgram = "jameica";
  };
--- a/pkgs/applications/version-management/josh/default.nix
+++ b/pkgs/applications/version-management/josh/default.nix
@ -13,7 +13,7 @@
 let
  # josh-ui requires javascript dependencies, haven't tried to figure it out yet
  cargoFlags = [ "--workspace" "--exclude" "josh-ui" ];
-  version = "24.08.14";
+  version = "24.10.04";
 in

 rustPlatform.buildRustPackage {
@ -21,13 +21,13 @@ rustPlatform.buildRustPackage {
  inherit version;

  src = fetchFromGitHub {
-    owner = "esrlabs";
+    owner = "josh-project";
    repo = "josh";
-    rev = "v${version}";
-    hash = "sha256-6U1nhERpPQAVgQm6xwRlHIhslYBLd65DomuGn5yRiSs=";
+    rev = "r${version}";
+    hash = "sha256-6rfNEWNeC0T/OXhCReaV5npcJjQoH6XhsZzHXGnnxOo=";
  };

-  cargoHash = "sha256-s6+Bd4ucwUinrcbjNvlDsf9LhWc/U9SAvBRW7JAmxVA=";
+  cargoHash = "sha256-tK/5qNvN1zs6DM7dXNc1nPhbUOt5lPqRpbie6h2d7Y0=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
@ -1,6 +1,7 @@
 {
  lib,
  fetchFromGitHub,
+  nix-update-script,

  cmake,
  ninja,
@ -15,33 +16,48 @@
  procps,
  qtbase,
  stdenv,
-  tesseract,
  websocketpp,
  libXScrnSaver,
+  libusb1,
+  pkg-config,
+  fetchpatch,
+# #FIXME: Could not get cmake to pick up on these dependencies
+# Prevents cmake from building the OCR video capabilities
+# Everything else should work just missing this on plugin
+# tesseract,
+# leptonica,
 }:
-
 let
  httplib-src = fetchFromGitHub {
    owner = "yhirose";
    repo = "cpp-httplib";
-    rev = "v0.17.3";
-    hash = "sha256-yvaPIbRqJGkiob3Nrv3H1ieFAC5b+h1tTncJWTy4dmk=";
+    rev = "v0.13.3";
+    hash = "sha256-ESaH0+n7ycpOKM+Mnv/UgT16UEx86eFMQDHB3RVmgBw=";
  };
 in
 stdenv.mkDerivation rec {
  pname = "advanced-scene-switcher";
-  version = "1.27.2";
+  version = "1.28.1";

  src = fetchFromGitHub {
    owner = "WarmUpTill";
    repo = "SceneSwitcher";
    rev = version;
-    hash = "sha256-7IciHCe2KemKNJpD9QcYK4AtxHlYuWaPsBCcVuPVvgA=";
+    hash = "sha256-1U5quhfdhEBcCbEzW0uEpimYgvdbsIwaL2EdQ4cLF/M=";
  };

  nativeBuildInputs = [
    cmake
    ninja
+    pkg-config
+  ];
+
+  patches = [
+    # https://github.com/WarmUpTill/SceneSwitcher/pull/1244
+    (fetchpatch {
+      url = "https://github.com/WarmUpTill/SceneSwitcher/commit/e0c650574f9f7f6cae5626afa9abf8a838dc0858.diff";
+      hash = "sha256-eXO8LdGYf60sd/kyxWVDSEpwyzp4Uu9TpPADg5ED4yU=";
+    })
  ];

  buildInputs = [
@ -52,11 +68,13 @@ stdenv.mkDerivation rec {
    nlohmann_json
    obs-studio
    opencv
+    # tesseract
+    # leptonica
    procps
    qtbase
-    tesseract
    websocketpp
    libXScrnSaver
+    libusb1
  ];

  dontWrapQtApps = true;
@ -68,13 +86,14 @@ stdenv.mkDerivation rec {
    chmod -R +w $sourceRoot/deps/libremidi
  '';

-  env.NIX_CFLAGS_COMPILE = "-Wno-error=stringop-overflow";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=stringop-overflow -Wno-error=deprecated-declarations";

+  passthru.updateScript = nix-update-script { };
  meta = with lib; {
    description = "Automated scene switcher for OBS Studio";
    homepage = "https://github.com/WarmUpTill/SceneSwitcher";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ patrickdag ];
  };
 }
--- a/pkgs/by-name/ac/actionlint/package.nix
+++ b/pkgs/by-name/ac/actionlint/package.nix
@ -10,7 +10,7 @@
 }:

 let
-  version = "1.7.3";
+  version = "1.7.4";
 in
 buildGoModule {
  pname = "actionlint";
@ -22,10 +22,10 @@ buildGoModule {
    owner = "rhysd";
    repo = "actionlint";
    rev = "v${version}";
-    hash = "sha256-IwkTiuQ3eTZMn1y0NG1jo9UrX7AmEUBRSGQ/vq/0YL8=";
+    hash = "sha256-NPlDD74vrVXsVgdoMHD0F3SYebH1p/RH9h1qVgLQMRw=";
  };

-  vendorHash = "sha256-SIY79SjYYXW2slUQr2Bm9dLH8K2wE3l/TL3QP0m8GLs=";
+  vendorHash = "sha256-pKmN5duaSp5EuQ8L2SWduh3g1gbQq2jrUaKsQuEuy98=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/by-name/ag/age-plugin-yubikey/Cargo.lock
+++ b/pkgs/by-name/ag/age-plugin-yubikey/Cargo.lock
--- a/pkgs/tools/security/age-plugin-yubikey/default.nix
+++ b/pkgs/tools/security/age-plugin-yubikey/default.nix
@ -5,23 +5,25 @@
 , pkg-config
 , openssl
 , pcsclite
-, PCSC
-, Foundation
-, IOKit
 }:

 rustPlatform.buildRustPackage rec {
  pname = "age-plugin-yubikey";
-  version = "0.5.0";
+  version = "0.5.0-unstable-2024-11-02";

  src = fetchFromGitHub {
    owner = "str4d";
    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-9ghnPe83K+qixaFKCdM2FCPoENTNJnZA+OmmpD0E5LE=";
+    rev = "36290c74ebd2723832aae684d43b927c9104f744";
+    hash = "sha256-vfemYGQnn3IzG7Y6iVKHZlYN+55/+A+N/GMG3TLs1h0=";
  };

-  cargoHash = "sha256-8petNuCJ1qS6XKt+24Lg/bZh96yj9oO6fu/z65Xhi4k=";
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "age-core-0.10.0" = "sha256-Iw1KPYhUwfAvLGpYAGuSRhynrRJhD3EqOIS4UY6qC6c=";
+    };
+  };

  nativeBuildInputs = [
    pkg-config
@ -30,12 +32,7 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [
    openssl
  ]
-  ++ lib.optional stdenv.hostPlatform.isLinux pcsclite
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    IOKit
-    Foundation
-    PCSC
-  ];
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ pcsclite ];

  meta = with lib; {
    description = "YubiKey plugin for age";
@ -43,6 +40,6 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/str4d/age-plugin-yubikey";
    changelog = "https://github.com/str4d/age-plugin-yubikey/blob/${src.rev}/CHANGELOG.md";
    license = with licenses; [ mit asl20 ];
-    maintainers = with maintainers; [ kranzes vtuan10 ];
+    maintainers = with maintainers; [ kranzes vtuan10 adamcstephens ];
  };
 }
--- a/pkgs/by-name/al/alice-lg/package.nix
+++ b/pkgs/by-name/al/alice-lg/package.nix
@ -1,12 +1,14 @@
-{ lib
-, fetchFromGitHub
-, buildGoModule
-, fetchYarnDeps
-, stdenv
-, yarn
-, nodejs
-, nixosTests
-, fixup-yarn-lock
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  fetchYarnDeps,
+  stdenv,
+  gitUpdater,
+  yarn,
+  nodejs,
+  nixosTests,
+  fixup-yarn-lock,
 }:

 buildGoModule rec {
@ -32,7 +34,12 @@ buildGoModule rec {
      hash = "sha256-PwByNIegKYTOT8Yg3nDMDFZiLRVkbX07z99YaDiBsIY=";
    };

-    nativeBuildInputs = [ nodejs yarn fixup-yarn-lock ];
+    nativeBuildInputs = [
+      nodejs
+      yarn
+      fixup-yarn-lock
+    ];
+
    configurePhase = ''
      runHook preConfigure

@ -74,14 +81,17 @@ buildGoModule rec {
  subPackages = [ "cmd/alice-lg" ];
  doCheck = false;

-  passthru.tests = nixosTests.alice-lg;
+  passthru = {
+    tests = nixosTests.alice-lg;
+    updateScript = gitUpdater { };
+  };

-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/alice-lg/alice-lg";
    description = "Looking-glass for BGP sessions";
    changelog = "https://github.com/alice-lg/alice-lg/blob/main/CHANGELOG.md";
-    license = licenses.bsd3;
-    maintainers = [ ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ stv0g ];
    mainProgram = "alice-lg";
  };
 }
--- a/pkgs/by-name/al/alpaca/package.nix
+++ b/pkgs/by-name/al/alpaca/package.nix
@ -18,14 +18,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "alpaca";
-  version = "2.6.5";
+  version = "2.7.0";
  pyproject = false; # Built with meson

  src = fetchFromGitHub {
    owner = "Jeffser";
    repo = "Alpaca";
    rev = "refs/tags/${version}";
-    hash = "sha256-tXUM2XxYXUTXsycfq0hmkzc4quHKh7+0qit1YuKdCeQ=";
+    hash = "sha256-gEQUVSNf8u92qIg0+5fsLIOPgIASdYdlTRDpzl61P+Q=";
  };

  nativeBuildInputs = [
@ -51,6 +51,7 @@ python3Packages.buildPythonApplication rec {
    pypdf
    pytube
    html2text
+    youtube-transcript-api
  ];

  dontWrapGApps = true;
--- a/pkgs/by-name/an/angular-language-server/package.nix
+++ b/pkgs/by-name/an/angular-language-server/package.nix
@ -0,0 +1,88 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  nodejs,
+  makeBinaryWrapper,
+  runCommand,
+  angular-language-server,
+  writeShellApplication,
+  curl,
+  common-updater-scripts,
+  unzip,
+}:
+
+let
+  owner = "angular";
+  repo = "vscode-ng-language-service";
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "angular-language-server";
+  version = "18.2.0";
+  src = fetchurl {
+    name = "${finalAttrs.pname}-${finalAttrs.version}.zip";
+    url = "https://github.com/${owner}/${repo}/releases/download/v${finalAttrs.version}/ng-template.vsix";
+    hash = "sha256-rl04nqSSBMjZfPW8Y+UtFLFLDFd5FSxJs3S937mhDWE=";
+  };
+
+  nativeBuildInputs = [
+    unzip
+    makeBinaryWrapper
+  ];
+
+  buildInputs = [ nodejs ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 server/bin/ngserver $out/lib/bin/ngserver
+    install -Dm755 server/index.js $out/lib/index.js
+    cp -r node_modules $out/lib/node_modules
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    patchShebangs $out/lib/bin/ngserver $out/lib/index.js $out/lib/node_modules
+    makeWrapper $out/lib/bin/ngserver $out/bin/ngserver \
+      --prefix PATH : ${lib.makeBinPath [ nodejs ]} \
+      --add-flags "--tsProbeLocations $out/lib/node_modules --ngProbeLocations $out/lib/node_modules"
+  '';
+
+  passthru = {
+    tests = {
+      start-ok = runCommand "${finalAttrs.pname}-test" { } ''
+        ${lib.getExe angular-language-server} --stdio --help &> $out
+        cat $out | grep "Angular Language Service that implements the Language Server Protocol (LSP)"
+      '';
+    };
+
+    updateScript = lib.getExe (writeShellApplication {
+      name = "update-${finalAttrs.pname}";
+      runtimeInputs = [
+        curl
+        common-updater-scripts
+      ];
+      text = ''
+        if [ -z "''${GITHUB_TOKEN:-}" ]; then
+            echo "no GITHUB_TOKEN provided - you could meet API request limiting" >&2
+        fi
+
+        LATEST_VERSION=$(curl -H "Accept: application/vnd.github+json" \
+            ''${GITHUB_TOKEN:+-H "Authorization: bearer $GITHUB_TOKEN"} \
+          -Lsf https://api.github.com/repos/${owner}/${repo}/releases/latest | \
+          jq -r .tag_name | cut -c 2-)
+        update-source-version ${finalAttrs.pname} "$LATEST_VERSION"
+      '';
+    });
+  };
+
+  meta = {
+    description = "LSP for angular completions, AOT diagnostic, quick info and go to definitions";
+    homepage = "https://github.com/angular/vscode-ng-language-service";
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    changelog = "https://github.com/angular/vscode-ng-language-service/blob/${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    mainProgram = "ngserver";
+    maintainers = with lib.maintainers; [ tricktron ];
+  };
+})
--- a/pkgs/by-name/ap/apostrophe/package.nix
+++ b/pkgs/by-name/ap/apostrophe/package.nix
@ -19,36 +19,24 @@
 }:

 let
-  version = "3.1";
+  version = "3.2";

  src = fetchFromGitLab {
    owner = "World";
    repo = "apostrophe";
    domain = "gitlab.gnome.org";
-    rev = "v${version}";
-    hash = "sha256-rXaz0EtLuKOBJLF81K/4qoTZtG6B8Wn+KwSiqYvxAVc=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-NPpBu6Wmd8z99vzVQ394CyHRV2RQBtkbuqcaFqKqlkQ=";
  };

-  # Patches are required by upstream. Without the patches
-  # typing `- aaa`, newline, `- bbb` the program crashes
-  gtksourceview5-patched = gtksourceview5.overrideAttrs (prev: {
-    patches = (prev.patches or [ ]) ++ [ "${src}/build-aux/flatpak/sourceview_text_commits.patch" ];
-  });
-
-  libspelling-patched =
-    (libspelling.override { gtksourceview5 = gtksourceview5-patched; }).overrideAttrs
-      (prev: {
-        patches = (prev.patches or [ ]) ++ [ "${src}/build-aux/flatpak/libspelling_text_commits.patch" ];
-      });
-
  reveal-js = fetchFromGitHub {
    owner = "hakimel";
    repo = "reveal.js";

    # keep in sync with upstream shipped version
    # in build-aux/flatpak/org.gnome.gitlab.somas.Apostrophe.json
-    rev = "4.6.0";
-    hash = "sha256-a+J+GasFmRvu5cJ1GLXscoJ+owzFXsLhCbeDbYChkyQ=";
+    rev = "refs/tags/5.1.0";
+    hash = "sha256-L6KVBw20K67lHT07Ws+ZC2DwdURahqyuyjAaK0kTgN0=";
  };
 in
 python3Packages.buildPythonApplication {
@ -67,13 +55,14 @@ python3Packages.buildPythonApplication {
    + ''
      substituteInPlace apostrophe/preview_converter.py \
        --replace-fail "--mathjax" "--mathjax=file://${nodePackages.mathjax}/lib/node_modules/mathjax/es5/tex-chtml-full.js"
-    ''
-    # Should be done in postInstall, but meson checks this eagerly before build
-    + ''
-      install -d $out/share/apostrophe/libs
-      cp -r ${reveal-js} $out/share/apostrophe/libs/reveal.js
    '';

+  # Should be done in postInstall, but meson checks this eagerly before build
+  preConfigure = ''
+    install -d $out/share/apostrophe/libs
+    cp -r ${reveal-js} $out/share/apostrophe/libs/reveal.js
+  '';
+
  nativeBuildInputs = [
    meson
    ninja
@ -85,8 +74,8 @@ python3Packages.buildPythonApplication {

  buildInputs = [
    libadwaita
-    gtksourceview5-patched
-    libspelling-patched
+    gtksourceview5
+    libspelling
    webkitgtk_6_0
  ];

@ -94,6 +83,7 @@ python3Packages.buildPythonApplication {
    pygobject3
    pypandoc
    chardet
+    levenshtein
  ];

  dontWrapGApps = true;
@ -107,7 +97,7 @@ python3Packages.buildPythonApplication {
  '';

  passthru = {
-    inherit gtksourceview5-patched libspelling-patched reveal-js;
+    inherit reveal-js;
  };

  meta = {
--- a/pkgs/by-name/ar/argc/package.nix
+++ b/pkgs/by-name/ar/argc/package.nix
@ -14,16 +14,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "argc";
-  version = "1.20.1";
+  version = "1.21.0";

  src = fetchFromGitHub {
    owner = "sigoden";
    repo = "argc";
    rev = "v${version}";
-    hash = "sha256-pOkZmk7boFPqHHBDet/on6Y8V2Ik+hpqN0cUtY0BiR0=";
+    hash = "sha256-DTE78+POQXPOAXt16WWheyfO+WHvBKAmdCXKvRApyk8=";
  };

-  cargoHash = "sha256-FxhDnTy/KAeN0Zd5I12EUgXRc0VhHN0lRm5DQyCinyw=";
+  cargoHash = "sha256-xy8Vdy66Hb7NK2EEKj1Mn6HCVb7oxKkv/ffh+JS0Ync=";

  nativeBuildInputs = [ installShellFiles ] ++ lib.optional (!canExecuteHost) buildPackages.argc;

--- a/pkgs/by-name/ar/argo-expr/package.nix
+++ b/pkgs/by-name/ar/argo-expr/package.nix
@ -0,0 +1,36 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule rec {
+  pname = "argo-expr";
+  version = "1.1.3";
+
+  src = fetchFromGitHub {
+    owner = "blacha";
+    repo = "argo-expr";
+    rev = "v${version}";
+    hash = "sha256-XQnPFzT3PRmKeAQXLzBE5R2VvXotzxmsq+u9u5iE1QA=";
+  };
+
+  vendorHash = "sha256-HGmJVxmAj9ijsWX+qJ7J9l3uO7WvXtRU2gvx2G7N7/M=";
+
+  ldflags = [ "-X main.Version=v${version}" ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  doInstallCheck = true;
+
+  meta = {
+    description = "Argo expression tester";
+    homepage = "https://github.com/blacha/argo-expr";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ l0b0 ];
+    mainProgram = "argo-expr";
+  };
+}
--- a/pkgs/by-name/bi/birdwatcher/package.nix
+++ b/pkgs/by-name/bi/birdwatcher/package.nix
@ -1,7 +1,9 @@
-{ lib
-, fetchFromGitHub
-, buildGoModule
-, nixosTests
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  nixosTests,
+  gitUpdater,
 }:

 buildGoModule rec {
@ -19,16 +21,20 @@ buildGoModule rec {

  deleteVendor = true;

-  passthru.tests = {
-    inherit (nixosTests) birdwatcher;
+  passthru = {
+    tests = {
+      inherit (nixosTests) birdwatcher;
+    };
+
+    updateScript = gitUpdater { };
  };

-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/alice-lg/birdwatcher";
    description = "Small HTTP server meant to provide an API defined by Barry O'Donovan's birds-eye to the BIRD internet routing daemon";
    changelog = "https://github.com/alice-lg/birdwatcher/blob/master/CHANGELOG";
-    license = licenses.bsd3;
-    maintainers = [ ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ stv0g ];
    mainProgram = "birdwatcher";
  };
 }
--- a/pkgs/by-name/bo/bootc/package.nix
+++ b/pkgs/by-name/bo/bootc/package.nix
@ -0,0 +1,49 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  libz,
+  zstd,
+  pkg-config,
+  openssl,
+  glib,
+  ostree,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "bootc";
+  version = "1.1.0";
+  cargoHash = "sha256-2Ka3n6sT1RUlReNjtV6tMe4ow/M7DFNvWPZktwcEi/w=";
+  doInstallCheck = true;
+
+  src = fetchFromGitHub {
+    owner = "containers";
+    repo = "bootc";
+    rev = "v${version}";
+    hash = "sha256-vsJwJHPE5Puv9xCnDRDtHzNuFj1U7s1HzZ2vQKTavhs=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libz
+    zstd
+    openssl
+    glib
+    ostree
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  meta = {
+    description = "Boot and upgrade via container images";
+    homepage = "https://containers.github.io/bootc";
+    license = lib.licenses.mit;
+    mainProgram = "bootc";
+    maintainers = with lib.maintainers; [ thesola10 ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/bu/bustle/package.nix
+++ b/pkgs/by-name/bu/bustle/package.nix
@ -1,39 +1,39 @@
-{ lib
-, stdenv
-, fetchFromGitLab
-, buildPackages
-, cargo
-, meson
-, ninja
-, pkg-config
-, desktop-file-utils
-, rustPlatform
-, rustc
-, wrapGAppsHook4
-, darwin
-, gettext
-, glib
-, gtk4
-, libadwaita
-, libiconv
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  buildPackages,
+  cargo,
+  meson,
+  ninja,
+  pkg-config,
+  desktop-file-utils,
+  rustPlatform,
+  rustc,
+  wrapGAppsHook4,
+  darwin,
+  gettext,
+  glib,
+  gtk4,
+  libadwaita,
+  libiconv,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "bustle";
-  version = "0.9.2";
+  version = "0.10.0";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "bustle";
    rev = finalAttrs.version;
-    hash = "sha256-/B1rY8epcP0OFv+kVgv4Jx6x/oK3XpNnZcpSGvdIPx0=";
+    hash = "sha256-5ZZiRD64OOMtTNxI0uvilGM22rsJv7vU3yPDY8ROrxU=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit (finalAttrs) src;
-    name = "bustle-${finalAttrs.version}";
-    hash = "sha256-r29Z+6P+yuCpOBUE3vkESd15lcGXs5+ZTBiQ9nW6DJ4=";
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-tUSGldWeCLEHi35bDLMnfjnfofF2Qse5uBu2mDGJrsE=";
  };

  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
@ -60,17 +60,17 @@ stdenv.mkDerivation (finalAttrs: {
    glib
    gtk4
    libadwaita
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Foundation
-    libiconv
  ];

-  meta = with lib; {
+  meta = {
    description = "Graphical D-Bus message analyser and profiler";
    homepage = "https://gitlab.gnome.org/World/bustle";
-    license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ jtojnar ];
+    license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [
+      jtojnar
+      aleksana
+    ];
    mainProgram = "bustle";
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
  };
 })
--- a/pkgs/by-name/bu/butterfly/package.nix
+++ b/pkgs/by-name/bu/butterfly/package.nix
@ -0,0 +1,82 @@
+{
+  lib,
+  fetchFromGitHub,
+  flutter,
+  stdenv,
+  fetchzip,
+}:
+let
+  pname = "butterfly";
+  version = "2.2.1";
+  src = fetchFromGitHub {
+    owner = "LinwoodDev";
+    repo = "Butterfly";
+    rev = "v${version}";
+    hash = "sha256-TV7C0v3y9G44Df/x1ST8D0c0QqNBuuhzPBMKUyf/iwo=";
+  };
+  pdfium-binaries = fetchzip {
+    url = "https://github.com/bblanchon/pdfium-binaries/releases/download/chromium/5200/pdfium-linux-x64.tgz";
+    hash = "sha256-AJop6gKjF/DPgItuPQsWpgngxiqVNeqBbhHZz3aQ1n0=";
+    stripRoot = false;
+  };
+in
+flutter.buildFlutterApplication {
+  inherit pname version src;
+
+  pubspecLock = lib.importJSON ./pubspec.lock.json;
+
+  sourceRoot = "${src.name}/app";
+
+  customSourceBuilders = {
+    printing =
+      { version, src, ... }:
+      stdenv.mkDerivation rec {
+        pname = "printing";
+        inherit version src;
+        inherit (src) passthru;
+        patches = [ ./printing.patch ];
+        installPhase = ''
+          runHook preInstall
+          mkdir $out
+          cp -a ./* $out/
+          runHook postInstall
+        '';
+      };
+  };
+
+  env.PDFIUM_DIR = "${pdfium-binaries}";
+
+  gitHashes = {
+    dart_leap = "sha256-eEyUqdVToybQoDwdmz47H0f3/5zRdJzmPv1d/5mTOgA=";
+    lw_file_system = "sha256-CPBwaDTK57SKcaD4IzjIL4cWixEDK9sv3zCDeNfFpw0=";
+    flutter_secure_storage_web = "sha256-ULYXcFjz9gKMjw1Q1KAmX2J7EcE8CbW0MN/EnwmaoQY=";
+    networker = "sha256-8ol5YRim4dLpgR30DXbgHzq+VDk1sPLIi+AxUtwOls8=";
+    lw_file_system_api = "sha256-OOLbqKLvgHUJf3LiiQoHJS6kngnWtHPhswM69sX5fwE=";
+    lw_sysapi = "sha256-9hCAYB5tqYKQPHGa7+Zma6fE8Ei08RvyL9d65FMuI+I=";
+    flex_color_scheme = "sha256-MYEiiltevfz0gDag3yS/ZjeVaJyl1JMS8zvgI0k4Y0k=";
+    material_leap = "sha256-pQ+OvecHaav5QI+Hf7+DDcXYM3JMwogseMzce1ULveY=";
+    networker_socket = "sha256-+h5FXqPhB6VJ269WPoqKk+/1cE+p7UbLvDwnXrJh+CE=";
+    perfect_freehand = "sha256-dMJ8CyhoQWbBRvUQyzPc7vdAhCzcAl1X7CcaT3u6dWo=";
+  };
+
+  postInstall = ''
+    cp -r linux/debian/usr/share $out/share
+  '';
+
+  meta = {
+    description = "Powerful, minimalistic, cross-platform, opensource note-taking app";
+    homepage = "https://github.com/LinwoodDev/Butterfly";
+    mainProgram = "butterfly";
+    license = with lib.licenses; [
+      agpl3Plus
+      cc-by-sa-40
+      asl20 # pdfium-binaries
+    ];
+    maintainers = with lib.maintainers; [ aucub ];
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryNativeCode # pdfium-binaries
+    ];
+  };
+}
--- a/pkgs/by-name/bu/butterfly/printing.patch
+++ b/pkgs/by-name/bu/butterfly/printing.patch
@ -0,0 +1,45 @@
+--- old/linux/CMakeLists.txt	2024-07-16 18:45:19.000000000 +0800
+++ new/linux/CMakeLists.txt	2024-10-01 01:49:05.544910894 +0800
+@@ -16,6 +16,7 @@
+ set(PROJECT_NAME "printing")
+ project(${PROJECT_NAME} LANGUAGES CXX)
+ 
+set(PDFIUM_DIR $ENV{PDFIUM_DIR})
+ set(PDFIUM_VERSION "5200" CACHE STRING "Version of pdfium used")
+ string(REPLACE "linux-" "" TARGET_ARCH ${FLUTTER_TARGET_PLATFORM})
+ set(PDFIUM_ARCH ${TARGET_ARCH} CACHE STRING "Architecture of pdfium used")
+@@ -32,18 +33,11 @@
+     )
+ endif()
+ 
+-# Download pdfium
+-include(../windows/DownloadProject.cmake)
+-download_project(PROJ
+-                 pdfium
+-                 URL
+-                 ${PDFIUM_URL})
+-
+ # This value is used when generating builds using this plugin, so it must not be
+ # changed
+ set(PLUGIN_NAME "printing_plugin")
+ 
+-include(${pdfium_SOURCE_DIR}/PDFiumConfig.cmake)
+include(${PDFIUM_DIR}/PDFiumConfig.cmake)
+ 
+ # System-level dependencies.
+ find_package(PkgConfig REQUIRED)
+@@ -67,7 +61,7 @@
+ target_link_libraries(${PLUGIN_NAME}
+                       PRIVATE PkgConfig::GTK PkgConfig::GTKUnixPrint)
+ target_link_libraries(${PLUGIN_NAME} PRIVATE pdfium)
+-get_filename_component(PDFium_lib_path "${PDFium_LIBRARY}" DIRECTORY)
+set(PDFium_lib_path "${PDFIUM_DIR}/lib")
+ set_target_properties(${PLUGIN_NAME}
+                       PROPERTIES SKIP_BUILD_RPATH
+                                  FALSE
+@@ -77,4 +71,4 @@
+                                  "$ORIGIN:${PDFium_lib_path}")
+ 
+ # List of absolute paths to libraries that should be bundled with the plugin
+-set(printing_bundled_libraries "${PDFium_LIBRARY}" PARENT_SCOPE)
+set(printing_bundled_libraries "${PDFIUM_DIR}/lib/libpdfium.so" PARENT_SCOPE)
--- a/pkgs/by-name/bu/butterfly/pubspec.lock.json
+++ b/pkgs/by-name/bu/butterfly/pubspec.lock.json
--- a/pkgs/by-name/ca/cartero/package.nix
+++ b/pkgs/by-name/ca/cartero/package.nix
@ -0,0 +1,71 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  meson,
+  ninja,
+  pkg-config,
+  cargo,
+  rustc,
+  blueprint-compiler,
+  wrapGAppsHook4,
+  desktop-file-utils,
+  libxml2,
+  libadwaita,
+  gtksourceview5,
+  openssl,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cartero";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "danirod";
+    repo = "cartero";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-fXFrxaqHgf7XWX1guySsaP6PxmAPwVxoPaEOTpz4OqY=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-hbByC2r48+Zm/On99m9VWj4TJi6aeM/km2vcfvMMz38=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    cargo
+    rustc
+    blueprint-compiler
+    wrapGAppsHook4
+    desktop-file-utils
+    libxml2 # xmllint
+  ];
+
+  buildInputs = [
+    libadwaita
+    gtksourceview5
+    openssl
+  ];
+
+  meta = {
+    description = "Make HTTP requests and test APIs";
+    longDescription = ''
+      Cartero is a graphical HTTP client that can be used
+      as a developer tool to test web APIs and perform all
+      kind of HTTP requests to web servers. It is compatible
+      with any REST, SOAP or XML-RPC API and it supports
+      multiple request methods as well as attaching body
+      payloads to compatible requests.
+    '';
+    homepage = "https://cartero.danirod.es";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "cartero";
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/ce/cemu/0000-spirv-tools-opt-cmakelists.patch
+++ b/pkgs/by-name/ce/cemu/0000-spirv-tools-opt-cmakelists.patch
@ -1,8 +1,8 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 4b2b789..48d9be0 100644
+index 54e2012..a9b6b0e 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -92,6 +92,7 @@ find_package(pugixml REQUIRED)
+@@ -149,6 +149,7 @@ find_package(pugixml REQUIRED)
 find_package(RapidJSON REQUIRED)
 find_package(Boost COMPONENTS program_options filesystem nowide REQUIRED)
 find_package(libzip REQUIRED)
--- a/pkgs/by-name/ce/cemu/0001-glslang-cmake-target.patch
+++ b/pkgs/by-name/ce/cemu/0001-glslang-cmake-target.patch
@ -0,0 +1,13 @@
+diff --git a/src/Cafe/CMakeLists.txt.orig b/src/Cafe/CMakeLists.txt
+index 91d257b..cff779a 100644
+--- a/src/Cafe/CMakeLists.txt
+++ b/src/Cafe/CMakeLists.txt
+@@ -545,7 +545,7 @@ target_link_libraries(CemuCafe PRIVATE
+	Boost::nowide
+	CURL::libcurl
+	fmt::fmt
+-	glslang::SPIRV
+	glslang::glslang
+	ih264d
+	OpenSSL::Crypto
+	OpenSSL::SSL
--- a/pkgs/by-name/ce/cemu/package.nix
+++ b/pkgs/by-name/ce/cemu/package.nix
@ -47,15 +47,16 @@ let
      hash = "sha256-gf47uLeNiXQic43buB5ZnMqiotlUfIyAsP+3H7yJuFg=";
    };
  };
-in stdenv.mkDerivation (finalAttrs: {
+in
+stdenv.mkDerivation (finalAttrs: {
  pname = "cemu";
-  version = "2.0-92";
+  version = "2.2";

  src = fetchFromGitHub {
    owner = "cemu-project";
    repo = "Cemu";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-bjt+2RzmG8iKcdyka4HsHM5NEzCwGah4s9eiywSHXbw=";
+    hash = "sha256-d4FMAj99SPj5S1p5nAUFNo386ZJvWxOKD9iGxHJYVBI=";
  };

  patches = [
@ -63,6 +64,7 @@ in stdenv.mkDerivation (finalAttrs: {
    # > The following imported targets are referenced, but are missing:
    # > SPIRV-Tools-opt
    ./0000-spirv-tools-opt-cmakelists.patch
+    ./0001-glslang-cmake-target.patch
  ];

  nativeBuildInputs = [
@ -113,15 +115,20 @@ in stdenv.mkDerivation (finalAttrs: {

  strictDeps = true;

-  preConfigure = let
-    tag = lib.last (lib.splitString "-" finalAttrs.version);
-  in ''
-    rm -rf dependencies/imgui
-    # cemu expects imgui source code, not just header files
-    ln -s ${imgui'.src} dependencies/imgui
-    substituteInPlace src/Common/version.h --replace-fail " (experimental)" "-${tag} (experimental)"
-    substituteInPlace dependencies/gamemode/lib/gamemode_client.h --replace-fail "libgamemode.so.0" "${gamemode.lib}/lib/libgamemode.so.0"
-  '';
+  preConfigure =
+    let
+      tag = lib.splitString "." (lib.last (lib.splitString "-" finalAttrs.version));
+      majorv = builtins.elemAt tag 0;
+      minorv = builtins.elemAt tag 1;
+    in
+    ''
+      rm -rf dependencies/imgui
+      # cemu expects imgui source code, not just header files
+      ln -s ${imgui'.src} dependencies/imgui
+      substituteInPlace CMakeLists.txt --replace-fail "EMULATOR_VERSION_MAJOR \"0\"" "EMULATOR_VERSION_MAJOR \"${majorv}\""
+      substituteInPlace CMakeLists.txt --replace-fail "EMULATOR_VERSION_MINOR \"0\"" "EMULATOR_VERSION_MINOR \"${minorv}\""
+      substituteInPlace dependencies/gamemode/lib/gamemode_client.h --replace-fail "libgamemode.so.0" "${gamemode.lib}/lib/libgamemode.so.0"
+    '';

  installPhase = ''
    runHook preInstall
@ -139,13 +146,15 @@ in stdenv.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

-  preFixup = let
-    libs = [ vulkan-loader ] ++ cubeb.passthru.backendLibs;
-  in ''
-    gappsWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath libs}"
-    )
-  '';
+  preFixup =
+    let
+      libs = [ vulkan-loader ] ++ cubeb.passthru.backendLibs;
+    in
+    ''
+      gappsWrapperArgs+=(
+        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath libs}"
+      )
+    '';

  passthru = {
    updateScript = nix-update-script { };
@ -161,7 +170,11 @@ in stdenv.mkDerivation (finalAttrs: {
    homepage = "https://cemu.info";
    license = lib.licenses.mpl20;
    mainProgram = "cemu";
-    maintainers = with lib.maintainers; [ zhaofengli baduhai AndersonTorres ];
+    maintainers = with lib.maintainers; [
+      zhaofengli
+      baduhai
+      AndersonTorres
+    ];
    platforms = [ "x86_64-linux" ];
  };
 })
--- a/pkgs/development/compilers/circt/circt-llvm.nix
+++ b/pkgs/development/compilers/circt/circt-llvm.nix
@ -1,17 +1,23 @@
-{ lib
-, stdenv
-, cmake
-, ninja
-, circt
-, llvm
-, python3
-}: stdenv.mkDerivation {
+{
+  lib,
+  stdenv,
+  cmake,
+  ninja,
+  circt,
+  llvm,
+  python3,
+}:
+stdenv.mkDerivation {
  pname = circt.pname + "-llvm";
  inherit (circt) version src;

  requiredSystemFeatures = [ "big-parallel" ];

-  nativeBuildInputs = [ cmake ninja python3 ];
+  nativeBuildInputs = [
+    cmake
+    ninja
+    python3
+  ];

  preConfigure = ''
    cd llvm/llvm
@ -30,7 +36,11 @@
    "-DLLVM_INSTALL_UTILS=ON"
  ];

-  outputs = [ "out" "lib" "dev" ];
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];

  # Get rid of ${extra_libdir} (which ends up containing a path to circt-llvm.dev
  # in circt) so that we only have to remove the one fixed rpath.
@ -70,7 +80,7 @@
  #
  # Inspired by fixDarwinDylibNames.
  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    local flags=(-delete_rpath @loader_path/../lib)
+    local flags
    for file in "$lib"/lib/*.dylib; do
      flags+=(-change @rpath/"$(basename "$file")" "$file")
    done
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@ -1,15 +1,16 @@
-{ stdenv
-, lib
-, cmake
-, coreutils
-, python3
-, git
-, fetchFromGitHub
-, ninja
-, lit
-, z3
-, gitUpdater
-, callPackage
+{
+  stdenv,
+  lib,
+  cmake,
+  coreutils,
+  python3,
+  git,
+  fetchFromGitHub,
+  ninja,
+  lit,
+  z3,
+  gitUpdater,
+  callPackage,
 }:

 let
@ -29,7 +30,13 @@ stdenv.mkDerivation rec {

  requiredSystemFeatures = [ "big-parallel" ];

-  nativeBuildInputs = [ cmake ninja git pythonEnv z3 ];
+  nativeBuildInputs = [
+    cmake
+    ninja
+    git
+    pythonEnv
+    z3
+  ];
  buildInputs = [ circt-llvm ];

  cmakeFlags = [
@ -65,7 +72,17 @@ stdenv.mkDerivation rec {
  doCheck = true;
  checkTarget = "check-circt check-circt-integration";

-  outputs = [ "out" "lib" "dev" ];
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    echo moving libarc-jit-env.dylib to '$lib' before check because archilator links to the output path
+    mkdir -pv $lib/lib
+    cp -v ./lib/libarc-jit-env.dylib $lib/lib
+  '';
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];

  # Copy circt-llvm's postFixup stage so that it can make all our dylib references
  # absolute as well.
@ -89,7 +106,11 @@ stdenv.mkDerivation rec {
    description = "Circuit IR compilers and tools";
    homepage = "https://circt.org/";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ sharzy pineapplehunter sequencer ];
+    maintainers = with lib.maintainers; [
+      sharzy
+      pineapplehunter
+      sequencer
+    ];
    platforms = lib.platforms.all;
  };
 }
--- a/pkgs/by-name/cl/clerk/package.nix
+++ b/pkgs/by-name/cl/clerk/package.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation {
  pname = "clerk";
-  version = "4.0.5-unstable-2023-10-07";
+  version = "0-unstable-2024-02-20";

  src = fetchFromGitHub {
    owner = "carnager";
    repo = "clerk";
-    rev = "907138d8fc2b1709fb49d062d0b663a48eb210bd";
-    hash = "sha256-V2nDLq2ViC5Twve0EILBEYOdEavqgYB/TQq/T+ftfmk=";
+    rev = "a3c4a0b88597e8194a5b29a20bc9eab1a12f4de9";
+    hash = "sha256-UlACMlH4iYj1l/GIpBf6Pb7MuRHWlgxLPgAqzc+Zol8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/co/cosmic-wallpapers/package.nix
+++ b/pkgs/by-name/co/cosmic-wallpapers/package.nix
@ -8,7 +8,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "cosmic-wallpapers";
-  version = "1.0.0-alpha.2";
+  version = "1.0.0-alpha.3";

  src = fetchFromGitHub {
    owner = "pop-os";
@ -16,7 +16,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    rev = "epoch-${finalAttrs.version}";
    forceFetchGit = true;
    fetchLFS = true;
-    hash = "sha256-9abkb9dECE7qVq547DkpIUvaYLXLGfkRlTgLCbQtSPw=";
+    hash = "sha256-Exrps3DicL/G/g0kbSsCvoFhiJn1k3v8I09GhW7EwNM=";
  };

  patches = [
@ -39,9 +39,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    description = "Wallpapers for the COSMIC Desktop Environment";
    homepage = "https://system76.com/cosmic";
    license = with lib.licenses; [
-      unfree # https://github.com/pop-os/cosmic-wallpapers/issues/1 https://github.com/pop-os/cosmic-wallpapers/issues/3
-      cc-by-40 # https://www.esa.int/ESA_Multimedia/Images/2017/06/A_stormy_stellar_nursery (A_stormy_stellar_nursery_esa_379309.jpg)
-      publicDomain # https://earthobservatory.nasa.gov/image-use-policy (otherworldly_earth_nasa_ISS064-E-29444.jpg, phytoplankton_bloom_nasa_oli2_20240121.jpg); https://hubblesite.org/copyright (orion_nebula_nasa_heic0601a.jpg); https://webbtelescope.org/copyright (tarantula_nebula_nasa_PIA23646.jpg); https://www.planetary.org/space-images/the-solar-systems-round-moons (round_moons_nasa.jpg)
+      # A_stormy_stellar_nursery_esa_379309.jpg: https://www.esa.int/ESA_Multimedia/Images/2017/06/A_stormy_stellar_nursery
+      # webb-inspired-wallpaper-system76.jpg
+      cc-by-40
+
+      # otherworldly_earth_nasa_ISS064-E-29444.jpg: https://earthobservatory.nasa.gov/image-use-policy
+      # phytoplankton_bloom_nasa_oli2_20240121.jpg: https://earthobservatory.nasa.gov/image-use-policy
+      # orion_nebula_nasa_heic0601a.jpg: https://hubblesite.org/copyright
+      # tarantula_nebula_nasa_PIA23646.jpg: https://webbtelescope.org/copyright
+      # round_moons_nasa.jpg: https://www.planetary.org/space-images/the-solar-systems-round-moons
+      publicDomain
    ];
    maintainers = with lib.maintainers; [ pandapip1 ];
    platforms = lib.platforms.unix;
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@ -19,16 +19,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "deno";
-  version = "2.0.2";
+  version = "2.0.5";

  src = fetchFromGitHub {
    owner = "denoland";
    repo = "deno";
    rev = "refs/tags/v${version}";
-    hash = "sha256-nbwLkkO1ucRmlgGDRCJLHPpu4lk0xLQvz3wWpq7rics=";
+    hash = "sha256-JTNLxUT1C9Q8XiP3BYn6NhytbvilQ20DzWwLjNXjlCI=";
  };

-  cargoHash = "sha256-y/hAEu8c/CFS4mfp4f/pvPJRz4cxGoi39uIUbn5J+Pw=";
+  cargoHash = "sha256-EDphp03j6HpTxgBgsaGHuO+hQX57QXkTz6fHN0+or48=";

  postPatch = ''
    # upstream uses lld on aarch64-darwin for faster builds
--- a/pkgs/by-name/de/dependabot-cli/package.nix
+++ b/pkgs/by-name/de/dependabot-cli/package.nix
@ -1,12 +1,13 @@
 {
  buildGoModule,
  dependabot-cli,
+  dockerTools,
  fetchFromGitHub,
  installShellFiles,
  lib,
-  testers,
-  dockerTools,
  makeWrapper,
+  symlinkJoin,
+  testers,
 }:
 let
  pname = "dependabot-cli";
@ -65,13 +66,6 @@ buildGoModule {
      --bash <($out/bin/dependabot completion bash) \
      --fish <($out/bin/dependabot completion fish) \
      --zsh <($out/bin/dependabot completion zsh)
-
-    # Create a wrapper that pins the docker images that are depended upon
-    makeWrapper $out/bin/dependabot $out/bin/dependabot-pinned \
-      --run "docker load --input ${updateJobProxy}" \
-      --add-flags "--proxy-image=dependabot-update-job-proxy:${tag}" \
-      --run "docker load --input ${updaterGitHubActions}" \
-      --add-flags "--updater-image=dependabot-updater-github-actions:${tag}"
  '';

  checkFlags = [
@ -83,6 +77,20 @@ buildGoModule {
    $out/bin/dependabot --help
  '';

+  passthru.withDockerImages = symlinkJoin {
+    name = "dependabot-cli-with-docker-images";
+    paths = [ dependabot-cli ];
+    buildInputs = [ makeWrapper ];
+    postBuild = ''
+      # Create a wrapper that pins the docker images that are depended upon
+      wrapProgram $out/bin/dependabot \
+        --run "docker load --input ${updateJobProxy} >&2" \
+        --add-flags "--proxy-image=dependabot-update-job-proxy:${tag}" \
+        --run "docker load --input ${updaterGitHubActions} >&2" \
+        --add-flags "--updater-image=dependabot-updater-github-actions:${tag}"
+    '';
+  };
+
  passthru.tests.version = testers.testVersion {
    package = dependabot-cli;
    command = "dependabot --version";
--- a/pkgs/by-name/du/dua/package.nix
+++ b/pkgs/by-name/du/dua/package.nix
@ -0,0 +1,54 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "dua";
+  version = "2.29.4";
+
+  src = fetchFromGitHub {
+    owner = "Byron";
+    repo = "dua-cli";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-TVwRz5bAdJMtmhhzfZZ/NuV+YrLcnuK6d86Oj/JmgW4=";
+    # Remove unicode file names which leads to different checksums on HFS+
+    # vs. other filesystems because of unicode normalisation.
+    postFetch = ''
+      rm -r $out/tests/fixtures
+    '';
+  };
+
+  cargoHash = "sha256-h4Z0Gb4lf/KXrBxU6gEGcRvuhqjUABsggcv/A+AFclo=";
+
+  checkFlags = [
+    # Skip interactive tests
+    "--skip=interactive::app::tests::journeys_readonly::simple_user_journey_read_only"
+    "--skip=interactive::app::tests::journeys_with_writes::basic_user_journey_with_deletion"
+    "--skip=interactive::app::tests::unit::it_can_handle_ending_traversal_reaching_top_but_skipping_levels"
+    "--skip=interactive::app::tests::unit::it_can_handle_ending_traversal_without_reaching_the_top"
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool to conveniently learn about the disk usage of directories";
+    homepage = "https://github.com/Byron/dua-cli";
+    changelog = "https://github.com/Byron/dua-cli/blob/v${version}/CHANGELOG.md";
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [
+      figsoda
+      killercup
+    ];
+    mainProgram = "dua";
+  };
+}
--- a/pkgs/tools/backup/duplicacy/default.nix
+++ b/pkgs/tools/backup/duplicacy/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "duplicacy";
-  version = "3.2.3";
+  version = "3.2.4";

  src = fetchFromGitHub {
    owner = "gilbertchen";
    repo = "duplicacy";
    rev = "v${version}";
-    hash = "sha256-7LflTRBB4JG84QM46wvSJrP4o3CHV4gnR24RJgDSlDg=";
+    hash = "sha256-JxBS40g97GPTzKXW+k0RrwLBuK4ItLvnVHzBZRSOEIM=";
  };

  vendorHash = "sha256-4M/V4vP9XwHBkZ6UwsAxZ81YAzP4inuNC5yI+5ygQsA=";
--- a/pkgs/by-name/ef/efmt/package.nix
+++ b/pkgs/by-name/ef/efmt/package.nix
@ -0,0 +1,30 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "efmt";
+  version = "0.18.2";
+
+  src = fetchFromGitHub {
+    owner = "sile";
+    repo = "efmt";
+    rev = version;
+    hash = "sha256-sS6OqcVuRZXGjrTv5gYz3ECrHNOsu/1eN7Jqs9QRm3Q=";
+  };
+
+  cargoHash = "sha256-gcgKOgWdQwSFN9WMTJ/PBob+iuAqG+yTrSnbevM+csI=";
+
+  meta = {
+    description = "Erlang code formatter";
+    homepage = "https://github.com/sile/efmt";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ haruki7049 ];
+    mainProgram = "efmt";
+  };
+}
--- a/pkgs/by-name/em/empty-epsilon/package.nix
+++ b/pkgs/by-name/em/empty-epsilon/package.nix
@ -2,8 +2,8 @@

 let
  version = {
-    seriousproton = "2024.06.20";
-    emptyepsilon = "2024.06.20";
+    seriousproton = "2024.08.09";
+    emptyepsilon = "2024.08.09";
    basis-universal = "v1_15_update2";
  };

@ -22,7 +22,7 @@ let
      owner = "daid";
      repo = "SeriousProton";
      rev = "EE-${version.seriousproton}";
-      hash = "sha256-byLk4ukpj+s74+3K+1wzRTXhe4pKkH0pOSYeVs94muc=";
+      hash = "sha256-B7BUe5rtN/eABJwkuSyn+h1lIHuV/tZUNcGXTyaWIr4=";
    };

    nativeBuildInputs = [ cmake ];
@ -52,7 +52,7 @@ stdenv.mkDerivation {
    owner = "daid";
    repo = "EmptyEpsilon";
    rev = "EE-${version.emptyepsilon}";
-    hash = "sha256-YTZliu1o3LFab43DqmSk/cifxRWZMPxdV4gNoNy8LEk=";
+    hash = "sha256-DxaasUyJa8n0ha8RqAfEnqCVELs5Or0zvIOgcK75TnU=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/eq/equibop/package.nix
+++ b/pkgs/by-name/eq/equibop/package.nix
@ -141,7 +141,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Custom Discord App aiming to give you better performance and improve linux support";
    homepage = "https://github.com/Equicord/Equibop";
-    changelog = "https://github.com/Equicord/Equibop/releases/tag/${finalAttrs.src.rev}";
+    changelog = "https://github.com/Equicord/Equibop/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.gpl3Only;
    maintainers = [
      lib.maintainers.NotAShelf
--- a/pkgs/by-name/fa/fahrplan/package.nix
+++ b/pkgs/by-name/fa/fahrplan/package.nix
@ -0,0 +1,36 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+}:
+python3.pkgs.buildPythonApplication rec {
+  pname = "fahrplan";
+  version = "1.1.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "dbrgn";
+    repo = "fahrplan";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-2QVaA2zqqFuxjkKbDXo+SNzkrDCxXiSYMUOftQ++wO4=";
+  };
+
+  build-system = with python3.pkgs; [
+    setuptools
+  ];
+
+  dependencies = with python3.pkgs; [
+    python-dateutil
+    requests
+    texttable
+  ];
+
+  meta = {
+    description = "Command line access to the SBB/CFF/FFS timetable with human readable argument parsing";
+    homepage = "https://github.com/dbrgn/fahrplan";
+    changelog = "https://github.com/dbrgn/fahrplan/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ p-h ];
+    mainProgram = "fahrplan";
+  };
+}
--- a/pkgs/by-name/fo/forgejo/generic.nix
+++ b/pkgs/by-name/fo/forgejo/generic.nix
@ -155,7 +155,7 @@ buildGoModule rec {
  meta = {
    description = "Self-hosted lightweight software forge";
    homepage = "https://forgejo.org";
-    changelog = "https://codeberg.org/forgejo/forgejo/releases/tag/${src.rev}";
+    changelog = "https://codeberg.org/forgejo/forgejo/releases/tag/v${version}";
    license = if lib.versionAtLeast version "9.0.0" then lib.licenses.gpl3Plus else lib.licenses.mit;
    maintainers = with lib.maintainers; [ emilylange urandom bendlas adamcstephens marie ];
    broken = stdenv.hostPlatform.isDarwin;
--- a/pkgs/by-name/gi/gitopper/package.nix
+++ b/pkgs/by-name/gi/gitopper/package.nix
@ -0,0 +1,54 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  git,
+  makeWrapper,
+}:
+let
+  pname = "gitopper";
+  version = "0.0.16";
+in
+buildGoModule {
+  inherit pname version;
+
+  src = fetchFromGitHub {
+    owner = "miekg";
+    repo = "gitopper";
+    rev = "v${version}";
+    hash = "sha256-EAOC54VtGx6axfty5m8JOebcayINTy4cP4NBo5+ioLk=";
+  };
+
+  ldflags = [ "-X main.Version=${version}" ];
+
+  vendorHash = "sha256-sxeN7nbNTGfD8ZgNQiEQdYl11rhOvPP8UrnYXs9Ljhc=";
+
+  nativeCheckInputs = [
+    makeWrapper
+    git
+  ];
+
+  checkFlags =
+    let
+      # Skip tests that does not works well inside an isolated environment
+      skippedTests = [
+        "TestInitialGitCheckout"
+        "TestHash"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  postInstall = ''
+    wrapProgram $out/bin/gitopper \
+      --suffix PATH : ${lib.makeBinPath [ git ]}
+  '';
+
+  meta = {
+    description = "Gitops for non-Kubernetes folks";
+    homepage = "https://github.com/miekg/gitopper/";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ luftmensch-luftmensch ];
+    mainProgram = "gitopper";
+  };
+}
--- a/pkgs/applications/misc/gnome-firmware/default.nix
+++ b/pkgs/applications/misc/gnome-firmware/default.nix
@ -1,33 +1,34 @@
-{ stdenv
-, lib
-, fetchFromGitLab
-, gitUpdater
-, appstream-glib
-, desktop-file-utils
-, fwupd
-, gettext
-, glib
-, gtk4
-, libadwaita
-, libxmlb
-, meson
-, ninja
-, pkg-config
-, systemd
-, help2man
-, wrapGAppsHook4
+{
+  stdenv,
+  lib,
+  fetchFromGitLab,
+  gitUpdater,
+  appstream-glib,
+  desktop-file-utils,
+  fwupd,
+  gettext,
+  glib,
+  gtk4,
+  libadwaita,
+  libxmlb,
+  meson,
+  ninja,
+  pkg-config,
+  systemd,
+  help2man,
+  wrapGAppsHook4,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-firmware";
-  version = "46.0";
+  version = "47.0";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "gnome-firmware";
-    rev = version;
-    sha256 = "sha256-tEMSlKsqqPMZA0Gr89+u3dmAmZ7ffQm/2i1AB93y05E=";
+    rev = finalAttrs.version;
+    sha256 = "sha256-dI9tE/I+14IhYZ+IDLErPunlT4L29AudbZXh0at4jKQ=";
  };

  nativeBuildInputs = [
@ -66,4 +67,4 @@ stdenv.mkDerivation rec {
    maintainers = teams.gnome.members;
    platforms = platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/gr/gruvbox-kvantum/package.nix
+++ b/pkgs/by-name/gr/gruvbox-kvantum/package.nix
@ -0,0 +1,47 @@
+{
+  stdenvNoCC,
+  fetchFromGitHub,
+  lib,
+  variant ? "Gruvbox-Dark-Brown",
+}:
+let
+  pname = "gruvbox-kvantum";
+in
+lib.checkListOfEnum "${pname}: variant"
+  [
+    "Gruvbox-Dark-Blue"
+    "Gruvbox-Dark-Brown"
+    "Gruvbox-Dark-Green"
+    "Gruvbox_Light_Blue"
+    "Gruvbox_Light_Brown"
+    "Gruvbox_Light_Green"
+  ]
+  [ variant ]
+
+  stdenvNoCC.mkDerivation
+  {
+    inherit pname;
+    version = "1.1";
+
+    src = fetchFromGitHub {
+      owner = "sachnr";
+      repo = "gruvbox-kvantum-themes";
+      rev = "f47670be407c1f07c64890ad53884ee9977a7db1";
+      sha256 = "sha256-u2J4Zf9HuMjNCt3qVpgEffkytl/t277FzOvWL8Nm8os=";
+    };
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/share/Kvantum
+      cp -a "${variant}" $out/share/Kvantum
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "Gruvbox themes for kvantum";
+      homepage = "https://github.com/sachnr/gruvbox-kvantum-themes";
+      license = lib.licenses.gpl3;
+      platforms = lib.platforms.linux;
+      maintainers = with lib.maintainers; [ istudyatuni ];
+    };
+  }
--- a/pkgs/by-name/ho/hof/package.nix
+++ b/pkgs/by-name/ho/hof/package.nix
@ -1,23 +1,24 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, installShellFiles
+{
+  lib,
+  buildGo122Module,
+  fetchFromGitHub,
+  installShellFiles,
 }:

-buildGoModule rec {
+buildGo122Module rec {
  pname = "hof";
-  version = "0.6.9-beta.1";
+  version = "0.6.9";

  src = fetchFromGitHub {
    owner = "hofstadter-io";
    repo = "hof";
    rev = "v${version}";
-    hash = "sha256-4yVP6DRHrsp52VxBhr7qppPhInYEsvPbIfxxQcRwHTw=";
+    hash = "sha256-okY+CkPnlndy5H4M1+T1CY21+63+KPBinHoa5+8kQ2M=";
  };

  nativeBuildInputs = [ installShellFiles ];

-  vendorHash = "sha256-cDUcYwcxPn+9TEP5lhVJXofijCZX94Is+Qt41PqUgjI=";
+  vendorHash = "sha256-SmUEVWIyV6k5Lu5zeKGqpij3zUNRZQmIgtf8/Hf7UUs=";

  subPackages = [ "./cmd/hof/main.go" ];

--- a/pkgs/by-name/ic/icloudpd/package.nix
+++ b/pkgs/by-name/ic/icloudpd/package.nix
@ -9,7 +9,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "icloudpd";
-  version = "1.24.0";
+  version = "1.24.3";
  pyproject = true;

  src = fetchFromGitHub {
@ -72,8 +72,11 @@ python3Packages.buildPythonApplication rec {

  preBuild = ''
    substituteInPlace pyproject.toml \
-      --replace "setuptools==69.0.2" "setuptools" \
-      --replace "wheel==0.42.0" "wheel"
+      --replace-fail "setuptools==69.0.2" "setuptools" \
+      --replace-fail "wheel==0.42.0" "wheel"
+
+    substituteInPlace src/foundation/__init__.py \
+      --replace-fail "0.0.1" "${version}"
  '';

  meta = with lib; {
--- a/pkgs/by-name/in/infrastructure-agent/package.nix
+++ b/pkgs/by-name/in/infrastructure-agent/package.nix
@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule rec {
+  pname = "infrastructure-agent";
+  version = "1.57.2";
+
+  src = fetchFromGitHub {
+    owner = "newrelic";
+    repo = "infrastructure-agent";
+    rev = version;
+    hash = "sha256-74aBFGBrrEiqAVG3kVYLOz3P4VTCw4G3vV/iBucFPYs=";
+  };
+
+  vendorHash = "sha256-0WLL15CXRi/flp4EV3Qt0wO1VaUmAokzsChpiqjs+YQ=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.buildVersion=${version}"
+    "-X main.gitCommit=${src.rev}"
+  ];
+
+  CGO_ENABLED = if stdenv.hostPlatform.isDarwin then "1" else "0";
+
+  subPackages = [
+    "cmd/newrelic-infra"
+    "cmd/newrelic-infra-ctl"
+    "cmd/newrelic-infra-service"
+  ];
+
+  meta = {
+    description = "New Relic Infrastructure Agent";
+    homepage = "https://github.com/newrelic/infrastructure-agent.git";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ davsanchez ];
+    mainProgram = "newrelic-infra";
+  };
+}
--- a/pkgs/by-name/it/it-tools/package.nix
+++ b/pkgs/by-name/it/it-tools/package.nix
@ -0,0 +1,52 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  nodejs,
+  pnpm_8,
+}:
+stdenv.mkDerivation rec {
+  pname = "it-tools";
+  version = "2024.10.22-7ca5933";
+
+  src = fetchFromGitHub {
+    owner = "CorentinTh";
+    repo = "it-tools";
+    rev = "v${version}";
+    hash = "sha256-SQAZv+9tINRH10lewcuv8G2qwfulLOP8sGjX47LxeUk=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm_8.configHook
+  ];
+
+  pnpmDeps = pnpm_8.fetchDeps {
+    inherit pname version src;
+    hash = "sha256-m1eXBE5rakcq8NGnPC9clAAvNJQrN5RuSQ94zfgGZxw=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    cp -R ./dist/* $out/lib/
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Self-hostable website containing handy tools for developers, with great UX";
+    homepage = "https://it-tools.tech/";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ akotro ];
+  };
+}
--- a/pkgs/by-name/je/jellyfin-rpc/package.nix
+++ b/pkgs/by-name/je/jellyfin-rpc/package.nix
@ -0,0 +1,39 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "jellyfin-rpc";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "Radiicall";
+    repo = "jellyfin-rpc";
+    rev = "refs/tags/${version}";
+    hash = "sha256-sr82lTOr6RUvYD0CVZMyyRAFjai1oLnRWIszuu7/jE0=";
+  };
+
+  cargoHash = "sha256-KHbYM7aWgch+DWF46DpFCCt7JoKR0sasuFO3xPOytWA=";
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Displays the content you're currently watching on Discord";
+    homepage = "https://github.com/Radiicall/jellyfin-rpc";
+    changelog = "https://github.com/Radiicall/jellyfin-rpc/releases/tag/${version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ getchoo ];
+    mainProgram = "jellyfin-rpc";
+  };
+}
--- a/pkgs/by-name/je/jellyfin-web/package.nix
+++ b/pkgs/by-name/je/jellyfin-web/package.nix
@ -1,7 +1,6 @@
 {
  lib,
  stdenv,
-  overrideSDK,
  fetchFromGitHub,
  buildNpmPackage,
  jellyfin,
@ -10,22 +9,10 @@
  xcbuild,
  pango,
  giflib,
-  darwin,
+  apple-sdk_11,
+  darwinMinVersionHook,
 }:
-let
-  # node-canvas builds code that requires aligned_alloc,
-  # which on Darwin requires at least the 10.15 SDK
-  stdenv' =
-    if stdenv.hostPlatform.isDarwin then
-      overrideSDK stdenv {
-        darwinMinVersion = "10.15";
-        darwinSdkVersion = "11.0";
-      }
-    else
-      stdenv;
-  buildNpmPackage' = buildNpmPackage.override { stdenv = stdenv'; };
-in
-buildNpmPackage' rec {
+buildNpmPackage rec {
  pname = "jellyfin-web";
  version = "10.10.0";

@ -56,7 +43,10 @@ buildNpmPackage' rec {
    [ pango ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
      giflib
-      darwin.apple_sdk.frameworks.CoreText
+      apple-sdk_11
+      # node-canvas builds code that requires aligned_alloc,
+      # which on Darwin requires at least the 10.15 SDK
+      (darwinMinVersionHook "10.15")
    ];

  installPhase = ''
--- a/pkgs/by-name/ju/junest/package.nix
+++ b/pkgs/by-name/ju/junest/package.nix
@ -14,11 +14,17 @@ stdenvNoCC.mkDerivation rec {
  dontBuild = true;

  installPhase = ''
+    runHook preInstall
+
    mkdir -p $out/bin
    mkdir -p $out/lib
    cp -r $src/bin/ $out/
    cp -r $src/lib/ $out/
+    # cp -r $src/VERSION $out/
+    substituteInPlace $out/bin/junest --replace-fail '$(cat "$JUNEST_BASE"/VERSION)' ${version}
    substituteInPlace $out/lib/core/common.sh --replace-fail "wget" ${lib.getExe wget}
+
+    runHook postInstall
  '';

  meta = {
--- a/pkgs/by-name/ka/kanidm/package.nix
+++ b/pkgs/by-name/ka/kanidm/package.nix
@ -28,16 +28,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "kanidm";
-  version = "1.4.0";
+  version = "1.4.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-hRYHr4r3+LRiaZoJgs3MA5YtDEoKyeg/ohPAIw3OMyo=";
+    hash = "sha256-cL1XV9UeoRxl7RPZzeeLtgyNjXxeFwpzapnuS292yc4=";
  };

-  cargoHash = "sha256-DfTalKTOiReQCreAzbkSjbhMSW5cdOGGg04i/QKPonE=";
+  cargoHash = "sha256-c6HeE0971mBIN9NR7knu8SN0Z2W/u1rvIsE6ZCiHBEs=";

  KANIDM_BUILD_PROFILE = "release_nixos_${arch}";

--- a/pkgs/by-name/ko/komac/package.nix
+++ b/pkgs/by-name/ko/komac/package.nix
@ -67,7 +67,7 @@ rustPlatform.buildRustPackage {
  meta = {
    description = "Community Manifest Creator for WinGet";
    homepage = "https://github.com/russellbanks/Komac";
-    changelog = "https://github.com/russellbanks/Komac/releases/tag/${src.rev}";
+    changelog = "https://github.com/russellbanks/Komac/releases/tag/v${version}";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [
      kachick
--- a/Show More
+++ b/Show More