Merge staging-next into staging

2024-08-01 12:01:44 +00:00 · 2024-08-01 12:01:44 +00:00 · b0709876cb
commit b0709876cb
parent 66ce57641f 02971c01cd
50 changed files with 870 additions and 565 deletions
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@ -489,6 +489,18 @@ let
        package = mkPackageOption pkgs.plasma5Packages "kwallet-pam" {
          pkgsText = "pkgs.plasma5Packages";
        };
+
+        forceRun = mkEnableOption null // {
+          description = ''
+            The `force_run` option is used to tell the PAM module for KWallet
+            to forcefully run even if no graphical session (such as a GUI
+            display manager) is detected. This is useful for when you are
+            starting an X Session or a Wayland Session from a TTY. If you
+            intend to log-in from a TTY, it is recommended that you enable
+            this option **and** ensure that `plasma-kwallet-pam.service` is
+            started by `graphical-session.target`.
+          '';
+        };
      };

      sssdStrictAccess = mkOption {
@ -861,7 +873,7 @@ let
            order = "user,group,default";
            debug = true;
          }; }
-          { name = "kwallet"; enable = cfg.kwallet.enable; control = "optional"; modulePath = "${cfg.kwallet.package}/lib/security/pam_kwallet5.so"; }
+          { name = "kwallet"; enable = cfg.kwallet.enable; control = "optional"; modulePath = "${cfg.kwallet.package}/lib/security/pam_kwallet5.so"; settings = lib.mkIf cfg.kwallet.forceRun { force_run = true; }; }
          { name = "gnome_keyring"; enable = cfg.enableGnomeKeyring; control = "optional"; modulePath = "${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so"; settings = {
            auto_start = true;
          }; }
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@ -139,9 +139,9 @@ let
                $0 = substr($0, 1, i-1) repl substr($0, i+length(find))
            }
            print
-          }' "${configFile}" > "${finalConfig}"
+          }' "${configFile}" > ${finalConfig}
        else
-          touch "${finalConfig}"
+          touch ${finalConfig}
        fi

        iface_args="-s ${optionalString cfg.dbusControlled "-u"} -D${cfg.driver} ${configStr}"
--- a/nixos/modules/services/web-apps/movim.nix
+++ b/nixos/modules/services/web-apps/movim.nix
@ -86,8 +86,8 @@ let
                  # `cfg.podConfig` to prevent confusing situtions where the
                  # values are rewritten on server reboot
                  ''
-                    substituteInPlace ${appDir}/app/widgets/AdminMain/adminmain.tpl \
-                      --replace-warn 'name="${k}"' 'name="${k}" disabled'
+                    substituteInPlace ${appDir}/app/Widgets/AdminMain/adminmain.tpl \
+                      --replace-warn 'name="${k}"' 'name="${k}" readonly'
                  '')
              [ ]
              cfg.podConfig));
--- a/nixos/modules/services/web-apps/pretix.nix
+++ b/nixos/modules/services/web-apps/pretix.nix
@ -249,7 +249,7 @@ in
            };

            host = mkOption {
-              type = with types; nullOr types.path;
+              type = with types; nullOr path;
              default = if cfg.settings.database.backend == "postgresql" then "/run/postgresql" else null;
              defaultText = literalExpression ''
                if config.services.pretix.settings..database.backend == "postgresql" then "/run/postgresql"
@ -535,7 +535,7 @@ in
          fi
        '';
        serviceConfig = {
-          TimeoutStartSec = "5min";
+          TimeoutStartSec = "15min";
          ExecStart = "${getExe' pythonEnv "gunicorn"} --bind unix:/run/pretix/pretix.sock ${cfg.gunicorn.extraArgs} pretix.wsgi";
          RuntimeDirectory = "pretix";
        };
--- a/pkgs/applications/audio/mympd/default.nix
+++ b/pkgs/applications/audio/mympd/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mympd";
-  version = "16.1.0";
+  version = "17.0.0";

  src = fetchFromGitHub {
    owner = "jcorporation";
    repo = "myMPD";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-fka7FQkJKHB2L28JzN1SOtmDkJvvox9dKguuh96lVo0=";
+    sha256 = "sha256-/8IDwzgZzf63MvXTBP2CoC5IHi7Umr3exU1/oDdadgk=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "cilium-cli";
-  version = "0.16.13";
+  version = "0.16.14";

  src = fetchFromGitHub {
    owner = "cilium";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-69LDIKaAJYbxTp0qBgfnE/YG6vnyN9/HgyxEBPqFY+4=";
+    hash = "sha256-VYfLy0vR3ON29EHUx1R2jF61+DbxH2RUsUQXFgxjMUU=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@ -21,11 +21,11 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "gajim";
-  version = "1.9.2";
+  version = "1.9.3";

  src = fetchurl {
    url = "https://gajim.org/downloads/${lib.versions.majorMinor version}/gajim-${version}.tar.gz";
-    hash = "sha256-nxSYXVliK+x3RbaXxZ2MA2PZ3bX6UYyctCKNCcdqPDM=";
+    hash = "sha256-TxWyUDoBvscKa2ogPrFlzLC2q+5RMyMnAiOpQdpFP4M=";
  };

  format = "pyproject";
--- a/pkgs/by-name/ca/cargo-make/package.nix
+++ b/pkgs/by-name/ca/cargo-make/package.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-make";
-  version = "0.37.14";
+  version = "0.37.15";

  src = fetchFromGitHub {
    owner = "sagiegurari";
    repo = "cargo-make";
    rev = version;
-    hash = "sha256-YyZF45Oi8sqTC/YM8F2dNBUI1rB0mPNeWMT7dYFWB5Q=";
+    hash = "sha256-sIiRlqUn59BxrvOs7N1es3vJVQRerV0EhNntuXXgPJA=";
  };

-  cargoHash = "sha256-tidV2mZgrJCokeUVKYQKlYENm7v362sGsi2Eb0vLNJ8=";
+  cargoHash = "sha256-MvCGdlEevHND7buW+JuAyH6gRck5ppSAq9xylXSgm5w=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/gl/glsl_analyzer/package.nix
+++ b/pkgs/by-name/gl/glsl_analyzer/package.nix
@ -1,25 +1,22 @@
 { lib
-, pkgs
+, stdenv
 , fetchFromGitHub
-, zig_0_12
-, darwin
+, zig_0_13
 }:

-let stdenv = if pkgs.stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else pkgs.stdenv; in
-
 stdenv.mkDerivation (finalAttrs: {
  pname = "glsl_analyzer";
-  version = "1.4.5";
+  version = "1.5.1";

  src = fetchFromGitHub {
    owner = "nolanderc";
    repo = "glsl_analyzer";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-+eYBw/F1RzI5waAkLgbV0J/Td91hbNcAtHcisQaL82k=";
+    hash = "sha256-AIzk05T8JZn8HWSI6JDFUIYl4sutd3HR3Zb+xmJll0g=";
  };

  nativeBuildInputs = [
-    zig_0_12.hook
+    zig_0_13.hook
  ];

  postPatch = ''
--- a/pkgs/by-name/gr/grype/package.nix
+++ b/pkgs/by-name/gr/grype/package.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "grype";
-  version = "0.79.3";
+  version = "0.79.4";

  src = fetchFromGitHub {
    owner = "anchore";
    repo = "grype";
    rev = "refs/tags/v${version}";
-    hash = "sha256-EAolb8r4n0r9SC7eh4wogHIM3iYgf9lKRFHryD4hhGc=";
+    hash = "sha256-h9XqqT4cyOxfAdQuG3DcLQLLXgjrRNjdwmE7eaeLxbg=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -30,7 +30,7 @@ buildGoModule rec {

  proxyVendor = true;

-  vendorHash = "sha256-/SbEc2YEXwBqR8PPnPj8Q3lDGMp/Kpib8E4lUzFGGV8=";
+  vendorHash = "sha256-qlkGNQC1MUkRg+coKruEwyu3hBrYgILaj8IOhOj7nAc=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/mo/movim/package.nix
+++ b/pkgs/by-name/mo/movim/package.nix
@ -38,13 +38,13 @@ let
 in
 php.buildComposerProject (finalAttrs: {
  pname = "movim";
-  version = "0.25.1";
+  version = "0.26";

  src = fetchFromGitHub {
    owner = "movim";
    repo = "movim";
    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-VshDFHDCfemHS/TN5qEe8CGizZksf44xENSmvX44uAc=";
+    hash = "sha256-ffAA4aDcjJSuqBIqI6b36daAp7UWj+FpWxYiY+c+f5Q=";
  };

  php = php.buildEnv ({
@ -67,17 +67,17 @@ php.buildComposerProject (finalAttrs: {
  # pinned commonmark
  composerStrictValidation = false;

-  vendorHash = "sha256-nxbsw0re/7zKhpWxtA8JAf7JL3RLghqaYsi4rkM6VZg=";
+  vendorHash = "sha256-4KNGWI4hvlDnIxo9nh/hytxkk+KVxjB8uF/HB88XPwQ=";

  postPatch = ''
    # Our modules are already wrapped, removes missing *.so warnings;
    # replacing `$configuration` with actually-used flags.
    substituteInPlace src/Movim/Daemon/Session.php \
-      --replace-fail "exec php ' . \$configuration " "exec php -dopcache.enable=1 -dopcache.enable_cli=1 ' "
+      --replace-fail \
+        "'exec ' . PHP_BINARY . ' ' . \$configuration . '" \
+        "'exec ' . PHP_BINARY . ' -dopcache.enable=1 -dopcache.enable_cli=1 ' . '"

    # Point to PHP + PHP INI in the Nix store
-    substituteInPlace src/Movim/{Console/DaemonCommand.php,Daemon/Session.php} \
-      --replace-fail "exec php " "exec ${lib.getExe finalAttrs.php} "
    substituteInPlace src/Movim/Console/DaemonCommand.php \
      --replace-fail "<info>php vendor/bin/phinx migrate</info>" \
        "<info>${lib.getBin finalAttrs.php} vendor/bin/phinx migrate</info>" \
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@ -40,13 +40,13 @@ let
  };

  pname = "pretix";
-  version = "2024.6.0";
+  version = "2024.7.0";

  src = fetchFromGitHub {
    owner = "pretix";
    repo = "pretix";
    rev = "refs/tags/v${version}";
-    hash = "sha256-erI3Ai6zwNSvMiF3YKfnU9ePb9R92rfi5rsxfAOh6EQ=";
+    hash = "sha256-08ykuFPcG3WvinJd9zadirXFqsMt9GbdOGU2CGbW7ls=";
  };

  npmDeps = buildNpmPackage {
@ -54,7 +54,7 @@ let
    inherit version src;

    sourceRoot = "${src.name}/src/pretix/static/npm_dir";
-    npmDepsHash = "sha256-//CLPnx5eUxIHIUGc7x2UF8qsfAYRtvHbHXSDNtI/eI=";
+    npmDepsHash = "sha256-BfvKuwB5VLX09Lxji+EpMBvZeKTIQvptVtrHSRYY+14=";

    dontBuild = true;

@ -76,6 +76,26 @@ python.pkgs.buildPythonApplication rec {
    # Discover pretix.plugin entrypoints during build and add them into
    # INSTALLED_APPS, so that their static files are collected.
    ./plugin-build.patch
+
+    # https://github.com/pretix/pretix/pull/4362
+    # Fix TOCTOU race in directory creation
+    ./pr4362.patch
+  ];
+
+  pythonRelaxDeps = [
+    "bleach"
+    "importlib-metadata"
+    "pillow"
+    "protobuf"
+    "python-bidi"
+    "requests"
+    "sentry-sdk"
+  ];
+
+  pythonRemoveDeps = [
+    "phonenumberslite" # we provide phonenumbers instead
+    "psycopg2-binary" # we provide psycopg2 instead
+    "vat-moss-forked" # we provide a patched vat-moss package
  ];

  postPatch = ''
@ -88,22 +108,8 @@ python.pkgs.buildPythonApplication rec {
    sed -i "/setuptools-rust/d" pyproject.toml

    substituteInPlace pyproject.toml \
-      --replace-fail phonenumberslite phonenumbers \
-      --replace-fail psycopg2-binary psycopg2 \
-      --replace-fail vat_moss_forked==2020.3.20.0.11.0 vat-moss \
-      --replace-fail "bleach==5.0.*" bleach \
-      --replace-fail "djangorestframework==3.15.*" djangorestframework \
-      --replace-fail "django-compressor==4.5" django-compressor \
-      --replace-fail "dnspython==2.6.*" dnspython \
-      --replace-fail "importlib_metadata==7.*" importlib_metadata \
-      --replace-fail "markdown==3.6" markdown \
-      --replace-fail "protobuf==5.27.*" protobuf \
-      --replace-fail "pycryptodome==3.20.*" pycryptodome \
-      --replace-fail "pypdf==4.2.*" pypdf \
-      --replace-fail "python-dateutil==2.9.*" python-dateutil \
-      --replace-fail "requests==2.31.*" "requests" \
-      --replace-fail "sentry-sdk==2.5.*" "sentry-sdk>=2" \
-      --replace-fail "stripe==7.9.*" stripe
+      --replace-fail '"backend"' '"setuptools.build_meta"' \
+      --replace-fail 'backend-path = ["_build"]' ""
  '';

  build-system = with python.pkgs; [
--- a/pkgs/by-name/pr/pretix/plugins/default.nix
+++ b/pkgs/by-name/pr/pretix/plugins/default.nix
@ -10,4 +10,6 @@
  reluctant-stripe = callPackage ./reluctant-stripe.nix { };

  stretchgoals = callPackage ./stretchgoals.nix { };
+
+  zugferd = callPackage ./zugferd.nix { };
 }
--- a/pkgs/by-name/pr/pretix/plugins/zugferd.nix
+++ b/pkgs/by-name/pr/pretix/plugins/zugferd.nix
@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pretix-plugin-build,
+  setuptools,
+  drafthorse,
+  ghostscript_headless,
+}:
+
+buildPythonPackage rec {
+  pname = "pretix-zugferd";
+  version = "2.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pretix";
+    repo = "pretix-zugferd";
+    rev = "v${version}";
+    hash = "sha256-ozFDNIA+0feHrHHvxcf+6Jh4L83svmPEE/rerd4Yim8=";
+  };
+
+  postPatch = ''
+    substituteInPlace pretix_zugferd/invoice.py \
+      --replace-fail 'fallback="gs"' 'fallback="${lib.getExe ghostscript_headless}"'
+  '';
+
+  pythonRelaxDeps = [ "drafthorse" ];
+
+  build-system = [
+    pretix-plugin-build
+    setuptools
+  ];
+
+  dependencies = [ drafthorse ];
+
+  doCheck = false; # no tests
+
+  pythonImportsCheck = [ "pretix_zugferd" ];
+
+  meta = with lib; {
+    description = "Annotate pretix' invoices with ZUGFeRD data";
+    homepage = "https://github.com/pretix/pretix-zugferd";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
--- a/pkgs/by-name/pr/pretix/pr4362.patch
+++ b/pkgs/by-name/pr/pretix/pr4362.patch
@ -0,0 +1,50 @@
+From 5688f3624005d02803f2a434db025f367b4963d3 Mon Sep 17 00:00:00 2001
+From: Martin Weinelt <hexa@darmstadt.ccc.de>
+Date: Thu, 1 Aug 2024 02:39:59 +0200
+Subject: [PATCH] Prevent race condition in directory creation
+
+Checking whether a path does not exist before trying to create it does
+not follow the Python paradigm of asking for forgiveness, rather than
+permission, and opens up a time-of-check to time-of-use race.
+---
+ src/pretix/settings.py | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/src/pretix/settings.py b/src/pretix/settings.py
+index 81ff644be..854187f05 100644
+--- a/src/pretix/settings.py
+++ b/src/pretix/settings.py
+@@ -37,6 +37,7 @@ import configparser
+ import logging
+ import os
+ import sys
+from contextlib import suppress
+ from json import loads
+ from urllib.parse import urlparse
+ 
+@@ -70,14 +71,14 @@ MEDIA_ROOT = os.path.join(DATA_DIR, 'media')
+ PROFILE_DIR = os.path.join(DATA_DIR, 'profiles')
+ CACHE_DIR = config.get('pretix', 'cachedir', fallback=os.path.join(DATA_DIR, 'cache'))
+ 
+-if not os.path.exists(DATA_DIR):
+-    os.mkdir(DATA_DIR)
+-if not os.path.exists(LOG_DIR):
+-    os.mkdir(LOG_DIR)
+-if not os.path.exists(MEDIA_ROOT):
+-    os.mkdir(MEDIA_ROOT)
+-if not os.path.exists(CACHE_DIR):
+-    os.mkdir(CACHE_DIR)
+def mkdir(path):
+    with suppress(FileExistsError):
+        os.mkdir(path)
+
+mkdir(DATA_DIR)
+mkdir(LOG_DIR)
+mkdir(MEDIA_ROOT)
+mkdir(CACHE_DIR)
+ 
+ if config.has_option('django', 'secret'):
+     SECRET_KEY = config.get('django', 'secret')
+-- 
+2.45.2
+
--- a/pkgs/by-name/pr/progress-tracker/package.nix
+++ b/pkgs/by-name/pr/progress-tracker/package.nix
@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "progress-tracker";
-  version = "1.5.2";
+  version = "1.6";

  src = fetchFromGitHub {
    owner = "smolBlackCat";
    repo = "progress-tracker";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-SM68TPxCMmLELKuryx4jde9TeK4mxfSrZ+uE/lFdP7M=";
+    hash = "sha256-uUw3+BJWRoCT1VH27SZBEBRsEbbpaP4IahKonfSOyeM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/si/signaturepdf/package.nix
+++ b/pkgs/by-name/si/signaturepdf/package.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "signaturepdf";
-  version = "1.5.1";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "24eme";
    repo = "${pname}";
    rev = "v${version}";
-    hash = "sha256-5isvVyT8s2ZAhLP4x/jjxDssBQ2WAvYDkGOWf3NcjHM=";
+    hash = "sha256-lDvPPnwMKtM/ZxY6ei5GH7qFrZtRPrbZbi+csfL80jE=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/st/stackit-cli/package.nix
+++ b/pkgs/by-name/st/stackit-cli/package.nix
@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "stackit-cli";
-  version = "0.9.1";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "stackitcloud";
    repo = "stackit-cli";
    rev = "v${version}";
-    hash = "sha256-lw3KzARVkKrFs8Ql+WlA2LJNj6x6f8+/+XnyLnQwxw4=";
+    hash = "sha256-+kIfw2lCRaQcpz4UUCZt6wTthF/otgma9JTQx3n+N5c=";
  };

-  vendorHash = "sha256-0cwkFDUKjwEHY5fT1pUJIWEZaGhDm3pEqtC+hDZjE0g=";
+  vendorHash = "sha256-1jUfhLodmJhV5X1EkRgOJ8jQF83Lu+8U+tC8tDoyCdk=";

  subPackages = [ "." ];

--- a/pkgs/by-name/yg/yggstack/package.nix
+++ b/pkgs/by-name/yg/yggstack/package.nix
@ -0,0 +1,36 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "yggstack";
+  version = "0-unstable-2024-07-26";
+
+  src = fetchFromGitHub {
+    owner = "yggdrasil-network";
+    repo = "yggstack";
+    rev = "5a87e43f9a7a0efdb20c9bc9a2e342c335a8767b";
+    sha256 = "sha256-1/Tr4LYXO+GIDzVAjFmPPsXD6X9ZKs1lFpLy4K4zeMw=";
+  };
+
+  vendorHash = "sha256-Sw9FCeZ6kIaEuxJ71XnxbbTdknBomxFuEeEyCSXeJcM=";
+
+  ldflags = [
+    "-X github.com/yggdrasil-network/yggdrasil-go/src/version.buildVersion=${version}"
+    "-X github.com/yggdrasil-network/yggdrasil-go/src/version.buildName=${pname}"
+    "-X github.com/yggdrasil-network/yggdrasil-go/src/config.defaultAdminListen=unix:///var/run/yggdrasil/yggdrasil.sock"
+    "-s"
+    "-w"
+  ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Yggdrasil as SOCKS proxy / port forwarder";
+    homepage = "https://yggdrasil-network.github.io/";
+    license = licenses.lgpl3;
+    maintainers = with maintainers; [ ehmry ];
+  };
+}
--- a/pkgs/by-name/ze/zed-editor/Cargo.lock
+++ b/pkgs/by-name/ze/zed-editor/Cargo.lock
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@ -35,13 +35,13 @@ assert withGLES -> stdenv.isLinux;

 rustPlatform.buildRustPackage rec {
  pname = "zed";
-  version = "0.145.1";
+  version = "0.146.3";

  src = fetchFromGitHub {
    owner = "zed-industries";
    repo = "zed";
    rev = "refs/tags/v${version}";
-    hash = "sha256-fO1VT2LiZa9XkQxP7QcEG9uCTtEm3soces7FCFwosbU=";
+    hash = "sha256-7KDoJ9yEZkPl6PBYXLQ+c+pnJk50LOn3qxBjBEq8nFY=";
    fetchSubmodules = true;
  };

@ -50,13 +50,11 @@ rustPlatform.buildRustPackage rec {
    outputHashes = {
      "alacritty_terminal-0.24.1-dev" = "sha256-aVB1CNOLjNh6AtvdbomODNrk00Md8yz8QzldzvDo1LI=";
      "async-pipe-0.1.3" = "sha256-g120X88HGT8P6GNCrzpS5SutALx5H+45Sf4iSSxzctE=";
-      "blade-graphics-0.4.0" = "sha256-c0KhzG/FCpAyiafGZTbxDMz1ktCTURNDxO3fkB16nUw=";
+      "blade-graphics-0.4.0" = "sha256-o3iYBrHcLXSrdvd0J/LXJb7VkTcFyB/S2Nk9WrmZupI=";
      "cosmic-text-0.11.2" = "sha256-TLPDnqixuW+aPAhiBhSvuZIa69vgV3xLcw32OlkdCcM=";
-      "font-kit-0.11.0" = "sha256-+4zMzjFyMS60HfLMEXGfXqKn6P+pOngLA45udV09DM8=";
+      "font-kit-0.14.1" = "sha256-qUKvmi+RDoyhMrZ7T6SoVAyMc/aasQ9Y/okzre4SzXo=";
      "lsp-types-0.95.1" = "sha256-N4MKoU9j1p/Xeowki/+XiNQPwIcTm9DgmfM/Eieq4js=";
-      "naga-0.20.0" = "sha256-07lLKQLfWYyOwWmvzFQ0vMeuC5pxmclz6Ub72ooSmwk=";
      "nvim-rs-0.6.0-pre" = "sha256-bdWWuCsBv01mnPA5e5zRpq48BgOqaqIcAu+b7y1NnM8=";
-      "pathfinder_simd-0.5.3" = "sha256-94/qS5d0UKYXAdx+Lswj6clOTuuK2yxqWuhpYZ8x1nI=";
      "tree-sitter-0.20.100" = "sha256-xZDWAjNIhWC2n39H7jJdKDgyE/J6+MAVSa8dHtZ6CLE=";
      "tree-sitter-go-0.20.0" = "sha256-/mE21JSa3LWEiOgYPJcq0FYzTbBuNwp9JdZTZqmDIUU=";
      "tree-sitter-gowork-0.0.1" = "sha256-lM4L4Ap/c8uCr4xUw9+l/vaGb3FxxnuZI0+xKYFDPVg=";
@ -142,6 +140,9 @@ rustPlatform.buildRustPackage rec {
  checkFlags = lib.optionals stdenv.hostPlatform.isLinux [
    # Fails on certain hosts (including Hydra) for unclear reason
    "--skip=test_open_paths_action"
+
+    # Flaky: unreliably fails on certain hosts (including Hydra)
+    "--skip=zed::tests::test_window_edit_state_restoring_enabled"
  ];

  installPhase = ''
--- a/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-screenshooter/default.nix
@ -7,7 +7,6 @@
 , libXext
 , libXfixes
 , libXtst
-, libxml2
 , libxfce4ui
 , libxfce4util
 , wayland
@ -23,10 +22,10 @@
 mkXfceDerivation {
  category = "apps";
  pname = "xfce4-screenshooter";
-  version = "1.11.0";
+  version = "1.11.1";
  odd-unstable = false;

-  sha256 = "sha256-DMLGaDHmwDDHvOMev/QKvmDr6AQ6Qnzxf3YCbf0/nXg=";
+  sha256 = "sha256-/N79YK233k9rVg5fGr27b8AZD9bCXllNQvrN4ghir/M=";

  nativeBuildInputs = [
    wayland-scanner
@ -39,7 +38,6 @@ mkXfceDerivation {
    libXext
    libXfixes
    libXtst
-    libxml2
    libxfce4ui
    libxfce4util
    wayland
--- a/pkgs/desktops/xfce/core/thunar/default.nix
+++ b/pkgs/desktops/xfce/core/thunar/default.nix
@ -23,9 +23,9 @@
 let unwrapped = mkXfceDerivation {
  category = "xfce";
  pname = "thunar";
-  version = "4.18.10";
+  version = "4.18.11";

-  sha256 = "sha256-jne+jETPmM6VksdwJAxruji/GKH42iftWm74Ok9qX44=";
+  sha256 = "sha256-B417gkrU9EG4ZsEdeuH8P2v4FqYUiTwqgKcO4cSi4SI=";

  nativeBuildInputs = [
    docbook_xsl
@ -60,6 +60,13 @@ let unwrapped = mkXfceDerivation {
    sed -i -e 's|thunar_dialogs_show_insecure_program (parent, _(".*"), file, exec)|1|' thunar/thunar-file.c
  '';

+  preFixup = ''
+    gappsWrapperArgs+=(
+      # https://github.com/NixOS/nixpkgs/issues/329688
+      --prefix PATH : ${lib.makeBinPath [ exo ]}
+    )
+  '';
+
  meta = with lib; {
    description = "Xfce file manager";
    mainProgram = "thunar";
--- a/pkgs/development/compilers/llvm/common/bolt/default.nix
+++ b/pkgs/development/compilers/llvm/common/bolt/default.nix
@ -0,0 +1,76 @@
+{
+  lib,
+  stdenv,
+  llvm_meta,
+  monorepoSrc,
+  runCommand,
+  cmake,
+  libxml2,
+  libllvm,
+  libclang,
+  version,
+  python3,
+  buildLlvmTools,
+  patches ? [ ],
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bolt";
+  inherit version patches;
+
+  # Blank llvm dir just so relative path works
+  src = runCommand "bolt-src-${finalAttrs.version}" { } ''
+    mkdir $out
+    cp -r ${monorepoSrc}/cmake "$out"
+    cp -r ${monorepoSrc}/${finalAttrs.pname} "$out"
+    cp -r ${monorepoSrc}/third-party "$out"
+
+    # tablegen stuff, probably not the best way but it works...
+    cp -r ${monorepoSrc}/llvm/ "$out"
+    chmod -R +w $out/llvm
+  '';
+
+  sourceRoot = "${finalAttrs.src.name}/bolt";
+
+  nativeBuildInputs = [
+    cmake
+    python3
+  ];
+
+  buildInputs = [
+    libllvm
+    libclang
+    libxml2
+  ];
+
+  cmakeFlags = lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    (lib.cmakeFeature "LLVM_TABLEGEN_EXE" "${buildLlvmTools.llvm}/bin/llvm-tblgen")
+  ];
+
+  postUnpack = ''
+    chmod -R u+w -- $sourceRoot/..
+  '';
+
+  prePatch = ''
+    cd ..
+  '';
+
+  postPatch = ''
+    cd bolt
+  '';
+
+  postInstall = ''
+    mkdir -p $dev/lib
+    mv $out/lib/libLLVMBOLT*.a $dev/lib
+  '';
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  meta = llvm_meta // {
+    homepage = "https://github.com/llvm/llvm-project/tree/main/bolt";
+    description = "LLVM post-link optimizer.";
+  };
+})
--- a/pkgs/development/compilers/llvm/common/default.nix
+++ b/pkgs/development/compilers/llvm/common/default.nix
@ -633,6 +633,16 @@ let
      mlir = callPackage ./mlir { };
      libclc = callPackage ./libclc.nix { };
    }
+    // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "19") {
+      bolt = callPackage ./bolt {
+        patches = lib.optionals (lib.versions.major metadata.release_version == "19") [
+          (fetchpatch {
+            url = "https://github.com/llvm/llvm-project/commit/abc2eae68290c453e1899a94eccc4ed5ea3b69c1.patch";
+            hash = "sha256-oxCxOjhi5BhNBEraWalEwa1rS3Mx9CuQgRVZ2hrbd7M=";
+          })
+        ];
+      };
+    }
  );

  libraries = lib.makeExtensible (
--- a/pkgs/development/coq-modules/coquelicot/default.nix
+++ b/pkgs/development/coq-modules/coquelicot/default.nix
@ -7,13 +7,14 @@ mkCoqDerivation {
  domain = "gitlab.inria.fr";
  inherit version;
  defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.12" "8.19"; out = "3.4.1"; }
+    { case = range "8.12" "8.20"; out = "3.4.2"; }
    { case = range "8.12" "8.18"; out = "3.4.0"; }
    { case = range "8.12" "8.17"; out = "3.3.0"; }
    { case = range "8.8" "8.16"; out = "3.2.0"; }
    { case = range "8.8" "8.13"; out = "3.1.0"; }
    { case = range "8.5" "8.9";  out = "3.0.2"; }
  ] null;
+  release."3.4.2".sha256 = "sha256-aBTF8ZKu67Rb3ryCqFyejUXf/65KgG8i5je/ZMFSrj4=";
  release."3.4.1".sha256 = "sha256-REhvIBl3EaL8CQqI34Gn7Xjf9NhPI3nrUAO26pSLbm0=";
  release."3.4.0".sha256 = "sha256-LIj2SwTvVBxSAO58VYCQix/uxQQe8ey6hqFOSh3PNcg=";
  release."3.3.1".sha256 = "sha256-YCvd4aIt2BxLKBYSWzN7aqo0AuY7z8oADmKvybhYBQI=";
--- a/pkgs/development/coq-modules/reglang/default.nix
+++ b/pkgs/development/coq-modules/reglang/default.nix
@ -12,7 +12,7 @@ mkCoqDerivation {

  inherit version;
  defaultVersion = with lib.versions; lib.switch [ coq.coq-version mathcomp.version ] [
-    { cases = [ (range "8.16" "8.19") (isGe "2.0.0") ]; out = "1.2.1"; }
+    { cases = [ (range "8.16" "8.20") (isGe "2.0.0") ]; out = "1.2.1"; }
    { cases = [ (range "8.16" "8.18") (range "2.0.0" "2.1.0") ]; out = "1.2.0"; }
    { cases = [ (range "8.10" "8.20") (isLt "2.0.0") ]; out = "1.1.3"; }
  ] null;
--- a/pkgs/development/python-modules/aioopenexchangerates/default.nix
+++ b/pkgs/development/python-modules/aioopenexchangerates/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "aioopenexchangerates";
-  version = "0.4.13";
+  version = "0.4.14";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "MartinHjelmare";
    repo = "aioopenexchangerates";
    rev = "refs/tags/v${version}";
-    hash = "sha256-xVEyBE33gncw1h0/T7UJap8jd2KELBHSIlNE13YfIZA=";
+    hash = "sha256-tQPLGtz6lqwa61tpAm+O3+5EM9zJqZEyWh5TPHXBlag=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/censys/default.nix
+++ b/pkgs/development/python-modules/censys/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "censys";
-  version = "2.2.12";
+  version = "2.2.13";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "censys";
    repo = "censys-python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Gw3JbAdg/ObWdD6vl8Wuct6VCcP4GAZbiesXSSnW1Mg=";
+    hash = "sha256-ejAgPSHeE2842WvGjH+2HbaA7HoNDuIGNvmqXgCjuLE=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/django-hijack/default.nix
+++ b/pkgs/development/python-modules/django-hijack/default.nix
@ -21,14 +21,14 @@

 buildPythonPackage rec {
  pname = "django-hijack";
-  version = "3.5.4";
+  version = "3.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "django-hijack";
    repo = "django-hijack";
    rev = "refs/tags/${version}";
-    hash = "sha256-d8rKn4Hab7y/e/VLhVfr3A3TUhoDtjP7RhCj+o6IbyE=";
+    hash = "sha256-uece+tR3Nd32nfKn1gtcWqckN4z5iUP+C0dJxyDPXBA=";
  };

  postPatch = ''
@ -58,7 +58,7 @@ buildPythonPackage rec {
  ];

  preCheck = ''
-    export DJANGO_SETTINGS_MODULE=hijack.tests.test_app.settings
+    export DJANGO_SETTINGS_MODULE=tests.test_app.settings
  '';

  # needed for npmDeps update
--- a/pkgs/development/python-modules/drafthorse/default.nix
+++ b/pkgs/development/python-modules/drafthorse/default.nix
@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  lxml,
+  pypdf,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "drafthorse";
+  version = "2.4.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pretix";
+    repo = "python-drafthorse";
+    rev = version;
+    hash = "sha256-3W5rQ0YhyhIoZ+KsaOjlEJOrcoejPoTIJaylK7DOwKc=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    lxml
+    pypdf
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "drafthorse" ];
+
+  meta = with lib; {
+    description = "Pure-python ZUGFeRD implementation";
+    homepage = "https://github.com/pretix/python-drafthorse";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
--- a/pkgs/development/python-modules/jsonslicer/default.nix
+++ b/pkgs/development/python-modules/jsonslicer/default.nix
@ -2,26 +2,33 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  gitUpdater,
+  setuptools,
  pkg-config,
  yajl,
 }:

 buildPythonPackage rec {
  pname = "jsonslicer";
-  version = "0.1.7";
-  format = "setuptools";
+  version = "0.1.8";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "AMDmi3";
    repo = "jsonslicer";
    rev = version;
-    hash = "sha256-uKIe/nJLCTe8WFIMB7+g3c0Yv3addgZEKYaBI6EpBSY=";
+    hash = "sha256-nPifyqr+MaFqoCYFbFSSBDjvifpX0CFnHCdMCvhwYTA=";
  };

-  nativeBuildInputs = [ pkg-config ];
+  build-system = [
+    setuptools
+    pkg-config
+  ];

  buildInputs = [ yajl ];

+  passthru.updateScript = gitUpdater { };
+
  meta = with lib; {
    description = "Stream JSON parser for Python";
    homepage = "https://github.com/AMDmi3/jsonslicer";
--- a/pkgs/development/python-modules/python-bidi/default.nix
+++ b/pkgs/development/python-modules/python-bidi/default.nix
@ -1,21 +1,39 @@
 {
  lib,
  buildPythonPackage,
-  fetchPypi,
-  six,
+  fetchFromGitHub,
+  rustPlatform,
+  pytestCheckHook,
 }:

 buildPythonPackage rec {
  pname = "python-bidi";
-  version = "0.4.2";
-  format = "setuptools";
+  version = "0.6.0";
+  pyproject = true;

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "U0f3HoKz6Zdtxlfwne0r/jm6jWd3yoGlssVsMBIcSW4=";
+  src = fetchFromGitHub {
+    owner = "MeirKriheli";
+    repo = "python-bidi";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-LrXt9qaXfy8Rn9HjU4YSTFT4WsqzwCgh0flcxXOTF6E=";
  };

-  propagatedBuildInputs = [ six ];
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-34R8T8cXiX1iRx/Zb51Eb/nf0wLpN38hz0VnsmzPzws=";
+  };
+
+  build-system = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  preCheck = ''
+    rm -rf bidi
+  '';
+
+  nativeCheckInputs = [ pytestCheckHook ];

  meta = with lib; {
    homepage = "https://github.com/MeirKriheli/python-bidi";
--- a/pkgs/development/python-modules/python-kasa/default.nix
+++ b/pkgs/development/python-modules/python-kasa/default.nix
@ -22,7 +22,7 @@

 buildPythonPackage rec {
  pname = "python-kasa";
-  version = "0.7.0.5";
+  version = "0.7.1";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -31,7 +31,7 @@ buildPythonPackage rec {
    owner = "python-kasa";
    repo = "python-kasa";
    rev = "refs/tags/${version}";
-    hash = "sha256-ITXezc6m7ocOqSHTVP583lZZmYaZQn9nQSErEB9fV/M=";
+    hash = "sha256-ASS84thd54R1Z7+J7nMfUOPmQtJoybWis7C2US/mORs=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@ -63,14 +63,14 @@

 buildPythonPackage rec {
  pname = "sentry-sdk";
-  version = "2.11.0";
+  version = "2.12.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "getsentry";
    repo = "sentry-python";
    rev = version;
-    hash = "sha256-ajinOND8MC9Z69WPxF65wjOmJfU5CZUzTRWJwLLh/OQ=";
+    hash = "sha256-34/QDus1KKCD2fe0ZTmgB1hTqMC7M6/fuuqKYRRsJ2E=";
  };

  postPatch = ''
@ -189,6 +189,7 @@ buildPythonPackage rec {
    "test_auto_session_tracking_with_aggregates"
    # timing sensitive
    "test_profile_captured"
+    "test_continuous_profiler_manual_start_and_stop"
  ];

  pythonImportsCheck = [ "sentry_sdk" ];
--- a/pkgs/development/python-modules/weaviate-client/default.nix
+++ b/pkgs/development/python-modules/weaviate-client/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "weaviate-client";
-  version = "4.6.7";
+  version = "4.7.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "weaviate";
    repo = "weaviate-python-client";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Y+KX9ZJhQgXGdweLtnh7vQO7U7WBvT9RR94ro9kw7qg=";
+    hash = "sha256-JgnasbhAcdJwa3lpdID+B3Iwuc9peRQZBAC7tBBm54c=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/webauthn/default.nix
+++ b/pkgs/development/python-modules/webauthn/default.nix
@ -2,8 +2,10 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  setuptools,
  asn1crypto,
  cbor2,
+  cryptography,
  pythonOlder,
  pyopenssl,
  pytestCheckHook,
@ -11,8 +13,8 @@

 buildPythonPackage rec {
  pname = "webauthn";
-  version = "2.1.0";
-  format = "setuptools";
+  version = "2.2.0";
+  pyproject = true;

  disabled = pythonOlder "3.8";

@ -20,12 +22,15 @@ buildPythonPackage rec {
    owner = "duo-labs";
    repo = "py_webauthn";
    rev = "refs/tags/v${version}";
-    hash = "sha256-AfQ3lt0WvoThU5kCE7MzhAXwbqmNaCrUqOMWI937hO4=";
+    hash = "sha256-NBCR5GwmXA6COP9NOYnoD3l1vuOpym/kyNawd8FstLc=";
  };

+  build-system = [ setuptools ];
+
  propagatedBuildInputs = [
    asn1crypto
    cbor2
+    cryptography
    pyopenssl
  ];

@ -35,7 +40,7 @@ buildPythonPackage rec {

  disabledTests = [
    # TypeError: X509StoreContextError.__init__() missing 1 required...
-    "test_throws_on_bad_root_cert"
+    #"test_throws_on_bad_root_cert"
  ];

  meta = with lib; {
--- a/pkgs/development/tools/rust/cargo-component/default.nix
+++ b/pkgs/development/tools/rust/cargo-component/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-component";
-  version = "0.14.0";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = "cargo-component";
    rev = "v${version}";
-    hash = "sha256-+fCK+PnZHjXWMfk2g2d4ecVPM3l+tAnbrNAOSNogpko=";
+    hash = "sha256-jdGNZg/LXOoudxVhJbFeWEC9L3s0HW1S4nhfsGR4mEI=";
  };

-  cargoHash = "sha256-8B/xpwxeJgNWfvTAQ4kXdvLK8amVNJeeDFBeJZNWbH0=";
+  cargoHash = "sha256-YW++YcpQM1Al7qD+KoVJitfK41i59sLjb3edBge1cvA=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/development/tools/rust/cargo-modules/default.nix
+++ b/pkgs/development/tools/rust/cargo-modules/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-modules";
-  version = "0.16.6";
+  version = "0.16.8";

  src = fetchFromGitHub {
    owner = "regexident";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-noUlwAoJMDim1TI3aiacLtOXsHd2IEZbrjYQoeoo7yM=";
+    hash = "sha256-F1hVKktU9zhdxXWhpLgymehJQlOX6WbXL2cqQGB+Y5k=";
  };

-  cargoHash = "sha256-EbhLIVe9FizxNmyoEo3b/IZQ6jbL6vQUunFzfM2QRL8=";
+  cargoHash = "sha256-j3AYWKq7SrlNlsY7A80iwcWKW8wi6hx0U9UwDIQkXZs=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.CoreServices
--- a/pkgs/misc/ghostscript/default.nix
+++ b/pkgs/misc/ghostscript/default.nix
@ -192,7 +192,7 @@ stdenv.mkDerivation rec {
    '';
    license = lib.licenses.agpl3Plus;
    platforms = lib.platforms.all;
-    maintainers = [ lib.maintainers.viric ];
+    maintainers = [ lib.maintainers.tobim ];
    mainProgram = "gs";
  };
 }
--- a/pkgs/os-specific/linux/kernel/perf/default.nix
+++ b/pkgs/os-specific/linux/kernel/perf/default.nix
@ -177,7 +177,7 @@ stdenv.mkDerivation {
    homepage = "https://perf.wiki.kernel.org/";
    description = "Linux tools to profile with performance counters";
    mainProgram = "perf";
-    maintainers = with maintainers; [ viric ];
+    maintainers = with maintainers; [ tobim ];
    platforms = platforms.linux;
    broken = kernel.kernelOlder "5";
  };
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@ -8,7 +8,7 @@ assert enablePython -> swig != null && python3 != null;

 with lib;

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (rec {
  pname = "libselinux";
  version = "3.6";
  inherit (libsepol) se_url;
@ -96,4 +96,6 @@ stdenv.mkDerivation rec {
  meta = removeAttrs libsepol.meta ["outputsToInstall"] // {
    description = "SELinux core library";
  };
-}
+} // lib.optionalAttrs (stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17") {
+  NIX_LDFLAGS = "--undefined-version";
+})
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@ -70,6 +70,7 @@
 , libpwquality
 , qrencode
 , libarchive
+, llvmPackages

  # the (optional) BPF feature requires bpftool, libbpf, clang and llvm-strip to
  # be available during build time.
@ -370,6 +371,9 @@ stdenv.mkDerivation (finalAttrs: {
    ++ lib.optionals withPasswordQuality [ libpwquality ]
    ++ lib.optionals withQrencode [ qrencode ]
    ++ lib.optionals withLibarchive [ libarchive ]
+    ++ lib.optional (withBootloader && stdenv.targetPlatform.useLLVM or false) (llvmPackages.compiler-rt.override {
+      doFakeLibgcc = true;
+    })
  ;

  mesonBuildType = "release";
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/mushroom/default.nix
@ -5,16 +5,16 @@

 buildNpmPackage rec {
  pname = "mushroom";
-  version = "3.6.4";
+  version = "4.0.0";

  src = fetchFromGitHub {
    owner = "piitaya";
    repo = "lovelace-mushroom";
    rev = "v${version}";
-    hash = "sha256-0ck+TjNtu0XfYIYifBH/psPPynnNHIvTXPTxVyaXWv4=";
+    hash = "sha256-yoSMwNrldDfFfJWyGBZ+bJjIGYUl3FZEQ5EvLG7XzVw=";
  };

-  npmDepsHash = "sha256-k7g45qLhKXwKaoDbnHGAevW6rgDfvs7F4hlVvHzdFJE=";
+  npmDepsHash = "sha256-3N/tsv/mtq4r9tWldxu6MIHkkfsmaU6omgtG0hIadXA=";

  installPhase = ''
    runHook preInstall
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@ -11,19 +11,19 @@

 buildGoModule rec {
  pname = "trivy";
-  version = "0.53.0";
+  version = "0.54.1";

  src = fetchFromGitHub {
    owner = "aquasecurity";
    repo = "trivy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-DzCPJU99cLDnVGsFImy2lQX2WBXXMaiF3dM8P/ZIdvA=";
+    hash = "sha256-lzLwIa+JCqQQSpA0AFyikpODb6u9oSaEqGGx0ckL+V8=";
  };

  # Hash mismatch on across Linux and Darwin
  proxyVendor = true;

-  vendorHash = "sha256-QRdXhISiTVFWn54qYT+0hXMr2RYkRAV29HFv3zUPeHE=";
+  vendorHash = "sha256-TSnwCulL4aI/SgL+WKoLwAnmKrUAfXgl+EV/HFt4j1U=";

  subPackages = [ "cmd/trivy" ];

--- a/pkgs/tools/filesystems/btrfs-progs/default.nix
+++ b/pkgs/tools/filesystems/btrfs-progs/default.nix
@ -10,11 +10,11 @@

 stdenv.mkDerivation rec {
  pname = "btrfs-progs";
-  version = "6.9.2";
+  version = "6.10";

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    hash = "sha256-Q4ZbsnLcCrJYXeNgVDTYG6IXV48Il79wDNNsFKxAZSo=";
+    hash = "sha256-M4KoTj/P4f/eoHphqz9OhmZdOPo18fNFSNXfhnQj4N8=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@ -270,8 +270,6 @@ python.pkgs.buildPythonApplication rec {

      # Fails because it fails to determine llvm version
      "test_item3_deflate_llvm_bitcode"
-      # Fails ever since an update to imagemagick
-      "test_has_visuals"
    ]
    ++ lib.optionals stdenv.isDarwin [
      # Disable flaky tests on Darwin
--- a/pkgs/tools/system/logrotate/default.nix
+++ b/pkgs/tools/system/logrotate/default.nix
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/logrotate/logrotate";
    description = "Rotates and compresses system logs";
    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.viric ];
+    maintainers = [ maintainers.tobim ];
    platforms = platforms.all;
    mainProgram = "logrotate";
  };
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -15995,6 +15995,7 @@ with pkgs;
    lld_19 = llvmPackages_19.lld;
    lldb_19 = llvmPackages_19.lldb;
    llvm_19 = llvmPackages_19.llvm;
+    bolt_19 = llvmPackages_19.bolt;

    llvmPackages_git = llvmPackagesSet.git;
  }) llvmPackages_13
@ -16012,6 +16013,7 @@ with pkgs;
    lld_19
    lldb_19
    llvm_19
+    bolt_19
    llvmPackages_git;

  lorri = callPackage ../tools/misc/lorri {
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -3617,6 +3617,8 @@ self: super: with self; {

  dploot = callPackage ../development/python-modules/dploot { };

+  drafthorse = callPackage ../development/python-modules/drafthorse { };
+
  draftjs-exporter = callPackage ../development/python-modules/draftjs-exporter { };

  dragonfly = callPackage ../development/python-modules/dragonfly { };