Merge master into staging-next

2024-05-02 12:01:36 +00:00 · 2024-05-02 12:01:36 +00:00 · c4dfa193ac
commit c4dfa193ac
parent 172376596c 3be507be1e
77 changed files with 4964 additions and 15521 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1448,6 +1448,12 @@
    githubId = 5411704;
    name = "Manuel Sanchez Pinar";
  };
+  aos = {
+    email = "n@aos.sh";
+    github = "aos";
+    githubId = 25783780;
+    name = "aos";
+  };
  apeschar = {
    email = "albert@peschar.net";
    github = "apeschar";
@ -5792,6 +5798,15 @@
    githubId = 4576666;
    name = "Eliza Velasquez";
  };
+  eljamm = {
+    name = "Fedi Jamoussi";
+    email = "fedi.jamoussi@protonmail.ch";
+    github = "eljamm";
+    githubId = 83901271;
+    keys = [{
+      fingerprint = "FF59 E027 4EE2 E792 512B  BDC8 7630 FDF7 C8FB 1F3F";
+    }];
+  };
  elkowar = {
    email = "thereal.elkowar@gmail.com";
    github = "elkowar";
@ -7791,6 +7806,12 @@
    github = "HannahMR";
    githubId = 9088467;
  };
+  hannesgith = {
+    email = "nix@h-h.win";
+    github = "hannesgith";
+    githubId = 33062605;
+    name = "Hannes Hattenbach";
+  };
  hansjoergschurr = {
    email = "commits@schurr.at";
    github = "hansjoergschurr";
@ -15846,6 +15867,13 @@
    githubId = 4056630;
    name = "Patrick Steinhardt";
  };
+  pkulak = {
+    name = "Phil Kulak";
+    email = "phil@kulak.us";
+    matrix = "@phil:kulak.us";
+    github = "pkulak";
+    githubId = 502905;
+  };
  plabadens = {
    name = "Pierre Labadens";
    email = "labadens.pierre+nixpkgs@gmail.com";
@ -16512,6 +16540,11 @@
    githubId = 35229674;
    name = "Armin Rothfuss";
  };
+  r3n3gad3p3arl = {
+    github = "r3n3gad3p3arl";
+    githubId = 20760527;
+    name = "Madelyn";
+  };
  raboof = {
    email = "arnout@bzzt.net";
    matrix = "@raboof:matrix.org";
@ -16815,6 +16848,12 @@
    githubId = 18155001;
    name = "Gabe Dunn";
  };
+  redyf = {
+    email = "mateusalvespereira7@gmail.com";
+    github = "redyf";
+    githubId = 98139059;
+    name = "Mateus Alves";
+  };
  reedrw = {
    email = "reedrw5601@gmail.com";
    github = "reedrw";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -131,6 +131,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - [mautrix-meta](https://github.com/mautrix/meta), a Matrix <-> Facebook and Matrix <-> Instagram hybrid puppeting/relaybot bridge. Available as services.mautrix-meta

+- [Jottacloud Command-line Tool](https://docs.jottacloud.com/en/articles/1436834-jottacloud-command-line-tool), a CLI for the [Jottacloud](https://jottacloud.com/) cloud storage provider. Available as [user.services.jotta-cli](#opt-user.services.jotta-cli.enable).
+
 - [transfer-sh](https://github.com/dutchcoders/transfer.sh), a tool that supports easy and fast file sharing from the command-line. Available as [services.transfer-sh](#opt-services.transfer-sh.enable).

 - [FCast Receiver](https://fcast.org), an open-source alternative to Chromecast and AirPlay. Available as [programs.fcast-receiver](#opt-programs.fcast-receiver.enable).
@ -398,6 +400,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `services.zope2` has been removed as `zope2` is unmaintained and was relying on Python2.

+- `services.oauth2_proxy` was renamed to `services.oauth2-proxy`. Also the corresponding service, user and group were renamed.
+
 - `services.avahi.nssmdns` got split into `services.avahi.nssmdns4` and `services.avahi.nssmdns6` which enable the mDNS NSS switch for IPv4 and IPv6 respectively.
  Since most mDNS responders only register IPv4 addresses, most users want to keep the IPv6 support disabled to avoid long timeouts.

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1029,6 +1029,7 @@
  ./services/networking/jigasi.nix
  ./services/networking/jitsi-videobridge.nix
  ./services/networking/jool.nix
+  ./services/networking/jotta-cli.nix
  ./services/networking/kea.nix
  ./services/networking/keepalived/default.nix
  ./services/networking/keybase.nix
@ -1256,8 +1257,8 @@
  ./services/security/kanidm.nix
  ./services/security/munge.nix
  ./services/security/nginx-sso.nix
-  ./services/security/oauth2_proxy.nix
-  ./services/security/oauth2_proxy_nginx.nix
+  ./services/security/oauth2-proxy.nix
+  ./services/security/oauth2-proxy-nginx.nix
  ./services/security/opensnitch.nix
  ./services/security/pass-secret-service.nix
  ./services/security/physlock.nix
--- a/nixos/modules/services/backup/znapzend.nix
+++ b/nixos/modules/services/backup/znapzend.nix
@ -315,6 +315,14 @@ in
        '';
      };

+      mailErrorSummaryTo = mkOption {
+        type = singleLineStr;
+        default = "";
+        description = ''
+          Email address to send a summary to if "send task(s) failed".
+        '';
+      };
+
      noDestroy = mkOption {
        type = bool;
        default = false;
@ -455,6 +463,8 @@ in
              "--loglevel=${cfg.logLevel}"
              (optionalString cfg.noDestroy "--nodestroy")
              (optionalString cfg.autoCreation "--autoCreation")
+              (optionalString (cfg.mailErrorSummaryTo != "")
+                "--mailErrorSummaryTo=${cfg.mailErrorSummaryTo}")
              (optionalString (enabledFeatures != [])
                "--features=${concatStringsSep "," enabledFeatures}")
            ]; in "${pkgs.znapzend}/bin/znapzend ${args}";
--- a/nixos/modules/services/monitoring/parsedmarc.nix
+++ b/nixos/modules/services/monitoring/parsedmarc.nix
@ -301,7 +301,7 @@ in
              description = ''
                The addresses to send outgoing mail to.
              '';
-              apply = x: if x == [] then null else lib.concatStringsSep "," x;
+              apply = x: if x == [] || x == null then null else lib.concatStringsSep "," x;
            };
          };

@ -438,7 +438,7 @@ in
            ];
        dashboards.settings.providers = lib.mkIf cfg.provision.grafana.dashboard [{
          name = "parsedmarc";
-          options.path = "${pkgs.python3Packages.parsedmarc.dashboard}";
+          options.path = "${pkgs.parsedmarc.dashboard}";
        }];
      };
    };
@ -446,7 +446,7 @@ in
    services.parsedmarc.settings = lib.mkMerge [
      (lib.mkIf cfg.provision.elasticsearch {
        elasticsearch = {
-          hosts = [ "localhost:9200" ];
+          hosts = [ "http://localhost:9200" ];
          ssl = false;
        };
      })
@ -530,7 +530,7 @@ in
            MemoryDenyWriteExecute = true;
            LockPersonality = true;
            SystemCallArchitectures = "native";
-            ExecStart = "${pkgs.python3Packages.parsedmarc}/bin/parsedmarc -c /run/parsedmarc/parsedmarc.ini";
+            ExecStart = "${lib.getExe pkgs.parsedmarc} -c /run/parsedmarc/parsedmarc.ini";
          };
        };

--- a/nixos/modules/services/networking/jotta-cli.md
+++ b/nixos/modules/services/networking/jotta-cli.md
@ -0,0 +1,27 @@
+# Jottacloud Command-line Tool {#module-services-jotta-cli}
+
+The [Jottacloud Command-line Tool](https://docs.jottacloud.com/en/articles/1436834-jottacloud-command-line-tool) is a headless [Jottacloud](https://jottacloud.com) client.
+
+## Quick Start {#module-services-jotta-cli-quick-start}
+
+```nix
+{
+  user.services.jotta-cli.enable = true;
+}
+```
+
+This adds `jotta-cli` to `environment.systemPackages` and starts a user service that runs `jottad` with the default options.
+
+## Example Configuration {#module-services-jotta-cli-example-configuration}
+
+```nix
+user.services.jotta-cli = {
+  enable = true;
+  options = [ "slow" ];
+  package = pkgs.jotta-cli;
+};
+```
+
+This uses `jotta-cli` and `jottad` from the `pkgs.jotta-cli` package and starts `jottad` in low memory mode.
+
+`jottad` is also added to `environment.systemPackages`, so `jottad --help` can be used to explore options.
--- a/nixos/modules/services/networking/jotta-cli.nix
+++ b/nixos/modules/services/networking/jotta-cli.nix
@ -0,0 +1,43 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let cfg = config.user.services.jotta-cli;
+in {
+  options = {
+    user.services.jotta-cli = {
+
+      enable = mkEnableOption "Jottacloud Command-line Tool";
+
+      options = mkOption {
+        default = [ "stdoutlog" "datadir" "%h/.jottad/" ];
+        example = [ ];
+        type = with types; listOf str;
+        description = "Command-line options passed to jottad.";
+      };
+
+      package = lib.mkPackageOption pkgs "jotta-cli" { };
+    };
+  };
+  config = mkIf cfg.enable {
+    systemd.user.services.jottad = {
+
+      description = "Jottacloud Command-line Tool daemon";
+
+      serviceConfig = {
+        Type = "notify";
+        EnvironmentFile = "-%h/.config/jotta-cli/jotta-cli.env";
+        ExecStart = "${lib.getExe' cfg.package "jottad"} ${concatStringsSep " " cfg.options}";
+        Restart = "on-failure";
+      };
+
+      wantedBy = [ "default.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+    };
+    environment.systemPackages = [ pkgs.jotta-cli ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ evenbrenden ];
+  meta.doc = ./jotta-cli.md;
+}
--- a/nixos/modules/services/security/oauth2-proxy-nginx.nix
+++ b/nixos/modules/services/security/oauth2-proxy-nginx.nix
@ -1,56 +1,55 @@
 { config, lib, ... }:
-with lib;
 let
-  cfg = config.services.oauth2_proxy.nginx;
+  cfg = config.services.oauth2-proxy.nginx;
 in
 {
-  options.services.oauth2_proxy.nginx = {
-    proxy = mkOption {
-      type = types.str;
-      default = config.services.oauth2_proxy.httpAddress;
-      defaultText = literalExpression "config.services.oauth2_proxy.httpAddress";
+  options.services.oauth2-proxy.nginx = {
+    proxy = lib.mkOption {
+      type = lib.types.str;
+      default = config.services.oauth2-proxy.httpAddress;
+      defaultText = lib.literalExpression "config.services.oauth2-proxy.httpAddress";
      description = ''
-        The address of the reverse proxy endpoint for oauth2_proxy
+        The address of the reverse proxy endpoint for oauth2-proxy
      '';
    };

-    domain = mkOption {
-      type = types.str;
+    domain = lib.mkOption {
+      type = lib.types.str;
      description = ''
-        The domain under which the oauth2_proxy will be accesible and the path of cookies are set to.
+        The domain under which the oauth2-proxy will be accesible and the path of cookies are set to.
        This setting must be set to ensure back-redirects are working properly
-        if oauth2-proxy is configured with {option}`services.oauth2_proxy.cookie.domain`
-        or multiple {option}`services.oauth2_proxy.nginx.virtualHosts` that are not on the same domain.
+        if oauth2-proxy is configured with {option}`services.oauth2-proxy.cookie.domain`
+        or multiple {option}`services.oauth2-proxy.nginx.virtualHosts` that are not on the same domain.
      '';
    };

-    virtualHosts = mkOption {
+    virtualHosts = lib.mkOption {
      type = let
-        vhostSubmodule = types.submodule {
+        vhostSubmodule = lib.types.submodule {
          options = {
-            allowed_groups = mkOption {
-              type = types.nullOr (types.listOf types.str);
+            allowed_groups = lib.mkOption {
+              type = lib.types.nullOr (lib.types.listOf lib.types.str);
              description = "List of groups to allow access to this vhost, or null to allow all.";
              default = null;
            };
-            allowed_emails = mkOption {
-              type = types.nullOr (types.listOf types.str);
+            allowed_emails = lib.mkOption {
+              type = lib.types.nullOr (lib.types.listOf lib.types.str);
              description = "List of emails to allow access to this vhost, or null to allow all.";
              default = null;
            };
-            allowed_email_domains = mkOption {
-              type = types.nullOr (types.listOf types.str);
+            allowed_email_domains = lib.mkOption {
+              type = lib.types.nullOr (lib.types.listOf lib.types.str);
              description = "List of email domains to allow access to this vhost, or null to allow all.";
              default = null;
            };
          };
        };
-        oldType = types.listOf types.str;
+        oldType = lib.types.listOf lib.types.str;
        convertFunc = x:
-          lib.warn "services.oauth2_proxy.nginx.virtualHosts should be an attrset, found ${lib.generators.toPretty {} x}"
+          lib.warn "services.oauth2-proxy.nginx.virtualHosts should be an attrset, found ${lib.generators.toPretty {} x}"
          lib.genAttrs x (_: {});
-        newType = types.attrsOf vhostSubmodule;
-      in types.coercedTo oldType convertFunc newType;
+        newType = lib.types.attrsOf vhostSubmodule;
+      in lib.types.coercedTo oldType convertFunc newType;
      default = {};
      example = {
        "protected.foo.com" = {
@ -65,11 +64,11 @@ in
    };
  };

-  config.services.oauth2_proxy = mkIf (cfg.virtualHosts != [] && (hasPrefix "127.0.0.1:" cfg.proxy)) {
+  config.services.oauth2-proxy = lib.mkIf (cfg.virtualHosts != [] && (lib.hasPrefix "127.0.0.1:" cfg.proxy)) {
    enable = true;
  };

-  config.services.nginx = mkIf (cfg.virtualHosts != [] && config.services.oauth2_proxy.enable) (mkMerge ([
+  config.services.nginx = lib.mkIf (cfg.virtualHosts != [] && config.services.oauth2-proxy.enable) (lib.mkMerge ([
    {
      virtualHosts.${cfg.domain}.locations."/oauth2/" = {
        proxyPass = cfg.proxy;
@ -79,7 +78,7 @@ in
        '';
      };
    }
-  ] ++ optional (cfg.virtualHosts != []) {
+  ] ++ lib.optional (cfg.virtualHosts != []) {
    recommendedProxySettings = true; # needed because duplicate headers
  } ++ (lib.mapAttrsToList (vhost: conf: {
    virtualHosts.${vhost} = {
--- a/nixos/modules/services/security/oauth2-proxy.nix
+++ b/nixos/modules/services/security/oauth2-proxy.nix
@ -1,15 +1,12 @@
-# NixOS module for oauth2_proxy.
-
 { config, lib, pkgs, ... }:

-with lib;
 let
-  cfg = config.services.oauth2_proxy;
+  cfg = config.services.oauth2-proxy;

-  # oauth2_proxy provides many options that are only relevant if you are using
+  # oauth2-proxy provides many options that are only relevant if you are using
  # a certain provider. This set maps from provider name to a function that
  # takes the configuration and returns a string that can be inserted into the
-  # command-line to launch oauth2_proxy.
+  # command-line to launch oauth2-proxy.
  providerSpecificOptions = {
    azure = cfg: {
      azure-tenant = cfg.azure.tenant;
@ -73,28 +70,28 @@ let
  } // (getProviderOptions cfg cfg.provider) // cfg.extraConfig;

  mapConfig = key: attr:
-  optionalString (attr != null && attr != []) (
-    if isDerivation attr then mapConfig key (toString attr) else
-    if (builtins.typeOf attr) == "set" then concatStringsSep " "
-      (mapAttrsToList (name: value: mapConfig (key + "-" + name) value) attr) else
-    if (builtins.typeOf attr) == "list" then concatMapStringsSep " " (mapConfig key) attr else
-    if (builtins.typeOf attr) == "bool" then "--${key}=${boolToString attr}" else
+  lib.optionalString (attr != null && attr != []) (
+    if lib.isDerivation attr then mapConfig key (toString attr) else
+    if (builtins.typeOf attr) == "set" then lib.concatStringsSep " "
+      (lib.mapAttrsToList (name: value: mapConfig (key + "-" + name) value) attr) else
+    if (builtins.typeOf attr) == "list" then lib.concatMapStringsSep " " (mapConfig key) attr else
+    if (builtins.typeOf attr) == "bool" then "--${key}=${lib.boolToString attr}" else
    if (builtins.typeOf attr) == "string" then "--${key}='${attr}'" else
    "--${key}=${toString attr}");

-  configString = concatStringsSep " " (mapAttrsToList mapConfig allConfig);
+  configString = lib.concatStringsSep " " (lib.mapAttrsToList mapConfig allConfig);
 in
 {
-  options.services.oauth2_proxy = {
-    enable = mkEnableOption "oauth2_proxy";
+  options.services.oauth2-proxy = {
+    enable = lib.mkEnableOption "oauth2-proxy";

-    package = mkPackageOption pkgs "oauth2-proxy" { };
+    package = lib.mkPackageOption pkgs "oauth2-proxy" { };

    ##############################################
    # PROVIDER configuration
    # Taken from: https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go
-    provider = mkOption {
-      type = types.enum [
+    provider = lib.mkOption {
+      type = lib.types.enum [
        "adfs"
        "azure"
        "bitbucket"
@ -116,24 +113,24 @@ in
      '';
    };

-    approvalPrompt = mkOption {
-      type = types.enum ["force" "auto"];
+    approvalPrompt = lib.mkOption {
+      type = lib.types.enum ["force" "auto"];
      default = "force";
      description = ''
        OAuth approval_prompt.
      '';
    };

-    clientID = mkOption {
-      type = types.nullOr types.str;
+    clientID = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
      description = ''
        The OAuth Client ID.
      '';
      example = "123456.apps.googleusercontent.com";
    };

-    oidcIssuerUrl = mkOption {
-      type = types.nullOr types.str;
+    oidcIssuerUrl = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
      default = null;
      description = ''
        The OAuth issuer URL.
@ -141,15 +138,15 @@ in
      example = "https://login.microsoftonline.com/{TENANT_ID}/v2.0";
    };

-    clientSecret = mkOption {
-      type = types.nullOr types.str;
+    clientSecret = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
      description = ''
        The OAuth Client Secret.
      '';
    };

-    skipAuthRegexes = mkOption {
-     type = types.listOf types.str;
+    skipAuthRegexes = lib.mkOption {
+     type = lib.types.listOf lib.types.str;
     default = [];
     description = ''
       Skip authentication for requests matching any of these regular
@ -159,8 +156,8 @@ in

    # XXX: Not clear whether these two options are mutually exclusive or not.
    email = {
-      domains = mkOption {
-        type = types.listOf types.str;
+      domains = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
        default = [];
        description = ''
          Authenticate emails with the specified domains. Use
@ -168,8 +165,8 @@ in
        '';
      };

-      addresses = mkOption {
-        type = types.nullOr types.lines;
+      addresses = lib.mkOption {
+        type = lib.types.nullOr lib.types.lines;
        default = null;
        description = ''
          Line-separated email addresses that are allowed to authenticate.
@ -177,8 +174,8 @@ in
      };
    };

-    loginURL = mkOption {
-      type = types.nullOr types.str;
+    loginURL = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
      default = null;
      description = ''
        Authentication endpoint.
@ -190,8 +187,8 @@ in
      example = "https://provider.example.com/oauth/authorize";
    };

-    redeemURL = mkOption {
-      type = types.nullOr types.str;
+    redeemURL = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
      default = null;
      description = ''
        Token redemption endpoint.
@ -203,8 +200,8 @@ in
      example = "https://provider.example.com/oauth/token";
    };

-    validateURL = mkOption {
-      type = types.nullOr types.str;
+    validateURL = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
      default = null;
      description = ''
        Access token validation endpoint.
@ -216,10 +213,10 @@ in
      example = "https://provider.example.com/user/emails";
    };

-    redirectURL = mkOption {
+    redirectURL = lib.mkOption {
      # XXX: jml suspects this is always necessary, but the command-line
      # doesn't require it so making it optional.
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
      default = null;
      description = ''
        The OAuth2 redirect URL.
@ -228,16 +225,16 @@ in
    };

    azure = {
-      tenant = mkOption {
-        type = types.str;
+      tenant = lib.mkOption {
+        type = lib.types.str;
        default = "common";
        description = ''
          Go to a tenant-specific or common (tenant-independent) endpoint.
        '';
      };

-      resource = mkOption {
-        type = types.str;
+      resource = lib.mkOption {
+        type = lib.types.str;
        description = ''
          The resource that is protected.
        '';
@ -245,8 +242,8 @@ in
    };

    google = {
-      adminEmail = mkOption {
-        type = types.str;
+      adminEmail = lib.mkOption {
+        type = lib.types.str;
        description = ''
          The Google Admin to impersonate for API calls.

@ -258,16 +255,16 @@ in
        '';
      };

-      groups = mkOption {
-        type = types.listOf types.str;
+      groups = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
        default = [];
        description = ''
          Restrict logins to members of these Google groups.
        '';
      };

-      serviceAccountJSON = mkOption {
-        type = types.path;
+      serviceAccountJSON = lib.mkOption {
+        type = lib.types.path;
        description = ''
          The path to the service account JSON credentials.
        '';
@ -275,16 +272,16 @@ in
    };

    github = {
-      org = mkOption {
-        type = types.nullOr types.str;
+      org = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
        default = null;
        description = ''
          Restrict logins to members of this organisation.
        '';
      };

-      team = mkOption {
-        type = types.nullOr types.str;
+      team = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
        default = null;
        description = ''
          Restrict logins to members of this team.
@ -295,8 +292,8 @@ in

    ####################################################
    # UPSTREAM Configuration
-    upstream = mkOption {
-      type = with types; coercedTo str (x: [x]) (listOf str);
+    upstream = lib.mkOption {
+      type = with lib.types; coercedTo str (x: [x]) (listOf str);
      default = [];
      description = ''
        The http url(s) of the upstream endpoint or `file://`
@ -304,40 +301,40 @@ in
      '';
    };

-    passAccessToken = mkOption {
-      type = types.bool;
+    passAccessToken = lib.mkOption {
+      type = lib.types.bool;
      default = false;
      description = ''
        Pass OAuth access_token to upstream via X-Forwarded-Access-Token header.
      '';
    };

-    passBasicAuth = mkOption {
-      type = types.bool;
+    passBasicAuth = lib.mkOption {
+      type = lib.types.bool;
      default = true;
      description = ''
        Pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream.
      '';
    };

-    basicAuthPassword = mkOption {
-      type = types.nullOr types.str;
+    basicAuthPassword = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
      default = null;
      description = ''
        The password to set when passing the HTTP Basic Auth header.
      '';
    };

-    passHostHeader = mkOption {
-      type = types.bool;
+    passHostHeader = lib.mkOption {
+      type = lib.types.bool;
      default = true;
      description = ''
        Pass the request Host Header to upstream.
      '';
    };

-    signatureKey = mkOption {
-      type = types.nullOr types.str;
+    signatureKey = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
      default = null;
      description = ''
        GAP-Signature request signature key.
@ -346,8 +343,8 @@ in
    };

    cookie = {
-      domain = mkOption {
-        type = types.nullOr types.str;
+      domain = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
        default = null;
        description = ''
          Optional cookie domains to force cookies to (ie: `.yourcompany.com`).
@ -357,33 +354,33 @@ in
        example = ".yourcompany.com";
      };

-      expire = mkOption {
-        type = types.str;
+      expire = lib.mkOption {
+        type = lib.types.str;
        default = "168h0m0s";
        description = ''
          Expire timeframe for cookie.
        '';
      };

-      httpOnly = mkOption {
-        type = types.bool;
+      httpOnly = lib.mkOption {
+        type = lib.types.bool;
        default = true;
        description = ''
          Set HttpOnly cookie flag.
        '';
      };

-      name = mkOption {
-        type = types.str;
+      name = lib.mkOption {
+        type = lib.types.str;
        default = "_oauth2_proxy";
        description = ''
          The name of the cookie that the oauth_proxy creates.
        '';
      };

-      refresh = mkOption {
+      refresh = lib.mkOption {
        # XXX: Unclear what the behavior is when this is not specified.
-        type = types.nullOr types.str;
+        type = lib.types.nullOr lib.types.str;
        default = null;
        description = ''
          Refresh the cookie after this duration; 0 to disable.
@ -391,15 +388,15 @@ in
        example = "168h0m0s";
      };

-      secret = mkOption {
-        type = types.nullOr types.str;
+      secret = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
        description = ''
          The seed string for secure cookies.
        '';
      };

-      secure = mkOption {
-        type = types.bool;
+      secure = lib.mkOption {
+        type = lib.types.bool;
        default = true;
        description = ''
          Set secure (HTTPS) cookie flag.
@ -410,8 +407,8 @@ in
    ####################################################
    # OAUTH2 PROXY configuration

-    httpAddress = mkOption {
-      type = types.str;
+    httpAddress = lib.mkOption {
+      type = lib.types.str;
      default = "http://127.0.0.1:4180";
      description = ''
        HTTPS listening address.  This module does not expose the port by
@ -421,8 +418,8 @@ in
    };

    htpasswd = {
-      file = mkOption {
-        type = types.nullOr types.path;
+      file = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
        default = null;
        description = ''
          Additionally authenticate against a htpasswd file. Entries must be
@ -430,8 +427,8 @@ in
        '';
      };

-      displayForm = mkOption {
-        type = types.bool;
+      displayForm = lib.mkOption {
+        type = lib.types.bool;
        default = true;
        description = ''
          Display username / password login form if an htpasswd file is provided.
@ -439,16 +436,16 @@ in
      };
    };

-    customTemplatesDir = mkOption {
-      type = types.nullOr types.path;
+    customTemplatesDir = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
      default = null;
      description = ''
        Path to custom HTML templates.
      '';
    };

-    reverseProxy = mkOption {
-      type = types.bool;
+    reverseProxy = lib.mkOption {
+      type = lib.types.bool;
      default = false;
      description = ''
        In case when running behind a reverse proxy, controls whether headers
@ -458,8 +455,8 @@ in
      '';
    };

-    proxyPrefix = mkOption {
-      type = types.str;
+    proxyPrefix = lib.mkOption {
+      type = lib.types.str;
      default = "/oauth2";
      description = ''
        The url root path that this proxy should be nested under.
@ -467,30 +464,30 @@ in
    };

    tls = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
        default = false;
        description = ''
          Whether to serve over TLS.
        '';
      };

-      certificate = mkOption {
-        type = types.path;
+      certificate = lib.mkOption {
+        type = lib.types.path;
        description = ''
          Path to certificate file.
        '';
      };

-      key = mkOption {
-        type = types.path;
+      key = lib.mkOption {
+        type = lib.types.path;
        description = ''
          Path to private key file.
        '';
      };

-      httpsAddress = mkOption {
-        type = types.str;
+      httpsAddress = lib.mkOption {
+        type = lib.types.str;
        default = ":443";
        description = ''
          `addr:port` to listen on for HTTPS clients.
@ -502,8 +499,8 @@ in
      };
    };

-    requestLogging = mkOption {
-      type = types.bool;
+    requestLogging = lib.mkOption {
+      type = lib.types.bool;
      default = true;
      description = ''
        Log requests to stdout.
@ -514,42 +511,42 @@ in
    # UNKNOWN

    # XXX: Is this mandatory? Is it part of another group? Is it part of the provider specification?
-    scope = mkOption {
+    scope = lib.mkOption {
      # XXX: jml suspects this is always necessary, but the command-line
      # doesn't require it so making it optional.
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
      default = null;
      description = ''
        OAuth scope specification.
      '';
    };

-    profileURL = mkOption {
-      type = types.nullOr types.str;
+    profileURL = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
      default = null;
      description = ''
        Profile access endpoint.
      '';
    };

-    setXauthrequest = mkOption {
-      type = types.nullOr types.bool;
+    setXauthrequest = lib.mkOption {
+      type = lib.types.nullOr lib.types.bool;
      default = false;
      description = ''
        Set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode). Setting this to 'null' means using the upstream default (false).
      '';
    };

-    extraConfig = mkOption {
+    extraConfig = lib.mkOption {
      default = {};
-      type = types.attrsOf types.anything;
+      type = lib.types.attrsOf lib.types.anything;
      description = ''
        Extra config to pass to oauth2-proxy.
      '';
    };

-    keyFile = mkOption {
-      type = types.nullOr types.path;
+    keyFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
      default = null;
      description = ''
        oauth2-proxy allows passing sensitive configuration via environment variables.
@ -557,28 +554,30 @@ in
        OAUTH2_PROXY_CLIENT_SECRET=asdfasdfasdf.apps.googleuserscontent.com
        and specify the path here.
      '';
-      example = "/run/keys/oauth2_proxy";
+      example = "/run/keys/oauth2-proxy";
    };
-
  };

-  config = mkIf cfg.enable {
+  imports = [
+    (lib.mkRenamedOptionModule [ "services" "oauth2_proxy" ] [ "services" "oauth2-proxy" ])
+  ];

-    services.oauth2_proxy = mkIf (cfg.keyFile != null) {
-      clientID = mkDefault null;
-      clientSecret = mkDefault null;
-      cookie.secret = mkDefault null;
+  config = lib.mkIf cfg.enable {
+    services.oauth2-proxy = lib.mkIf (cfg.keyFile != null) {
+      clientID = lib.mkDefault null;
+      clientSecret = lib.mkDefault null;
+      cookie.secret = lib.mkDefault null;
    };

-    users.users.oauth2_proxy = {
+    users.users.oauth2-proxy = {
      description = "OAuth2 Proxy";
      isSystemUser = true;
-      group = "oauth2_proxy";
+      group = "oauth2-proxy";
    };

-    users.groups.oauth2_proxy = {};
+    users.groups.oauth2-proxy = {};

-    systemd.services.oauth2_proxy = {
+    systemd.services.oauth2-proxy = {
      description = "OAuth2 Proxy";
      path = [ cfg.package ];
      wantedBy = [ "multi-user.target" ];
@ -586,10 +585,10 @@ in
      after = [ "network-online.target" ];

      serviceConfig = {
-        User = "oauth2_proxy";
+        User = "oauth2-proxy";
        Restart = "always";
        ExecStart = "${cfg.package}/bin/oauth2-proxy ${configString}";
-        EnvironmentFile = mkIf (cfg.keyFile != null) cfg.keyFile;
+        EnvironmentFile = lib.mkIf (cfg.keyFile != null) cfg.keyFile;
      };
    };

--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@ -82,7 +82,9 @@ in rec {
        (onFullSupported "nixos.tests.gitlab")
        (onFullSupported "nixos.tests.gnome")
        (onFullSupported "nixos.tests.gnome-xorg")
-        (onSystems ["x86_64-linux"] "nixos.tests.hibernate")
+        # FIXME: broken by QEMU 8.2.3 upgrade, reenable when fixed
+        # Upstream issue: https://gitlab.com/qemu-project/qemu/-/issues/2321
+        # (onSystems ["x86_64-linux"] "nixos.tests.hibernate")
        (onFullSupported "nixos.tests.i3wm")
        (onSystems ["x86_64-linux"] "nixos.tests.installer.btrfsSimple")
        (onSystems ["x86_64-linux"] "nixos.tests.installer.btrfsSubvolDefault")
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -451,6 +451,7 @@ in {
  jirafeau = handleTest ./jirafeau.nix {};
  jitsi-meet = handleTest ./jitsi-meet.nix {};
  jool = import ./jool.nix { inherit pkgs runTest; };
+  jotta-cli = handleTest ./jotta-cli.nix {};
  k3s = handleTest ./k3s {};
  kafka = handleTest ./kafka.nix {};
  kanidm = handleTest ./kanidm.nix {};
--- a/nixos/tests/jotta-cli.nix
+++ b/nixos/tests/jotta-cli.nix
@ -0,0 +1,25 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+
+  name = "jotta-cli";
+  meta.maintainers = with pkgs.lib.maintainers; [ evenbrenden ];
+
+  nodes.machine = { pkgs, ... }: {
+    user.services.jotta-cli.enable = true;
+    imports = [ ./common/user-account.nix ];
+  };
+
+  testScript = { nodes, ... }:
+    let uid = toString nodes.machine.users.users.alice.uid;
+    in ''
+      machine.start()
+
+      machine.succeed("loginctl enable-linger alice")
+      machine.wait_for_unit("user@${uid}.service")
+
+      machine.wait_for_unit("jottad.service", "alice")
+      machine.wait_for_open_unix_socket("/run/user/${uid}/jottad/jottad.socket")
+
+      # "jotta-cli version" should fail if jotta-cli cannot connect to jottad
+      machine.succeed('XDG_RUNTIME_DIR=/run/user/${uid} su alice -c "jotta-cli version"')
+    '';
+})
--- a/nixos/tests/kanidm.nix
+++ b/nixos/tests/kanidm.nix
@ -76,14 +76,17 @@ import ./make-test-python.nix ({ pkgs, ... }:
        with subtest("Test LDAP interface"):
            server.succeed("ldapsearch -H ldaps://${serverDomain}:636 -b '${ldapBaseDN}' -x '(name=test)'")

-        with subtest("Test CLI login"):
-            client.succeed("kanidm login -D anonymous")
-            client.succeed("kanidm self whoami | grep anonymous@${serverDomain}")
-            client.succeed("kanidm logout")
-
        with subtest("Recover idm_admin account"):
            idm_admin_password = server.succeed("su - kanidm -c 'kanidmd recover-account -c ${serverConfigFile} idm_admin 2>&1 | rg -o \'[A-Za-z0-9]{48}\' '").strip().removeprefix("'").removesuffix("'")

+        with subtest("Test CLI login"):
+            client.wait_until_tty_matches("1", "login: ")
+            client.send_chars("root\n")
+            client.send_chars("kanidm login -D idm_admin\n")
+            client.wait_until_tty_matches("1", "Enter password: ")
+            client.send_chars(f"{idm_admin_password}\n")
+            client.wait_until_tty_matches("1", "Login Success for idm_admin")
+
        with subtest("Test unixd connection"):
            client.wait_for_unit("kanidm-unixd.service")
            client.wait_for_file("/run/kanidm-unixd/sock")
@ -92,12 +95,6 @@ import ./make-test-python.nix ({ pkgs, ... }:
        with subtest("Test user creation"):
            client.wait_for_unit("getty@tty1.service")
            client.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
-            client.wait_until_tty_matches("1", "login: ")
-            client.send_chars("root\n")
-            client.send_chars("kanidm login -D idm_admin\n")
-            client.wait_until_tty_matches("1", "Enter password: ")
-            client.send_chars(f"{idm_admin_password}\n")
-            client.wait_until_tty_matches("1", "Login Success for idm_admin")
            client.succeed("kanidm person create testuser TestUser")
            client.succeed("kanidm person posix set --shell \"$SHELL\" testuser")
            client.send_chars("kanidm person posix set-password testuser\n")
--- a/pkgs/applications/audio/qpwgraph/default.nix
+++ b/pkgs/applications/audio/qpwgraph/default.nix
@ -13,14 +13,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "qpwgraph";
-  version = "0.6.3";
+  version = "0.7.1";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "rncbc";
    repo = "qpwgraph";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-mTWmXHC9KkXgUIO5CIcGOoYYLx+5si/LETSmHFhmrRE=";
+    sha256 = "sha256-mtW+dbjdp7as0N5+iacMSNrJ4jm8HWYqJP6G+lutucc=";
  };

  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
--- a/pkgs/applications/networking/cluster/helm/plugins/default.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/default.nix
@ -1,17 +1,17 @@
 { callPackage }:

 {
+  helm-cm-push = callPackage ./helm-cm-push.nix { };

  helm-diff = callPackage ./helm-diff.nix { };

  helm-git = callPackage ./helm-git.nix { };

-  helm-cm-push = callPackage ./helm-cm-push.nix { };
+  helm-mapkubeapis = callPackage ./helm-mapkubeapis.nix { };

  helm-s3 = callPackage ./helm-s3.nix { };

  helm-secrets = callPackage ./helm-secrets.nix { };

  helm-unittest = callPackage ./helm-unittest.nix { };
-
 }
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-mapkubeapis.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-mapkubeapis.nix
@ -0,0 +1,34 @@
+{ buildGoModule, fetchFromGitHub, lib }:
+
+buildGoModule rec {
+  pname = "helm-mapkubeapis";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "helm";
+    repo = "helm-mapkubeapis";
+    rev = "v${version}";
+    hash = "sha256-6NeePXTdp5vlBLfIlWeXQZMZ0Uz/e1ZCgZmJvBJfaFw=";
+  };
+
+  vendorHash = "sha256-rVrQqeakPQl3rjzmqzHw74ffreLEVzP153wWJ8TEOIM=";
+
+  # NOTE: Remove the install and upgrade hooks.
+  postPatch = ''
+    sed -i '/^hooks:/,+2 d' plugin.yaml
+  '';
+
+  postInstall = ''
+    install -dm755 $out/helm-mapkubeapis
+    mv $out/bin $out/helm-mapkubeapis/
+    install -m644 -Dt $out/helm-mapkubeapis/config/ config/Map.yaml
+    install -m644 -Dt $out/helm-mapkubeapis plugin.yaml
+  '';
+
+  meta = {
+    description = "A Helm plugin which maps deprecated or removed Kubernetes APIs in a release to supported APIs";
+    homepage = "https://github.com/helm/helm-mapkubeapis";
+    license = with lib.licenses; [ asl20 ];
+    maintainers = with lib.maintainers; [ aos ];
+  };
+}
--- a/pkgs/applications/video/mpv/scripts/default.nix
+++ b/pkgs/applications/video/mpv/scripts/default.nix
@ -75,6 +75,7 @@ let
    modernx-zydezu = callPackage ./modernx-zydezu.nix { };
    mpris = callPackage ./mpris.nix { };
    mpv-cheatsheet = callPackage ./mpv-cheatsheet.nix { };
+    mpv-notify-send = callPackage ./mpv-notify-send.nix { };
    mpv-osc-modern = callPackage ./mpv-osc-modern.nix { };
    mpv-playlistmanager = callPackage ./mpv-playlistmanager.nix { };
    mpv-slicing = callPackage ./mpv-slicing.nix { };
--- a/pkgs/applications/video/mpv/scripts/mpv-notify-send.nix
+++ b/pkgs/applications/video/mpv/scripts/mpv-notify-send.nix
@ -0,0 +1,39 @@
+{ lib
+, buildLua
+, fetchFromGitHub
+, fetchpatch
+, unstableGitUpdater
+, libnotify }:
+
+buildLua rec {
+  pname = "mpv-notify-send";
+  version = "0-unstable-2020-02-24";
+
+  src = fetchFromGitHub {
+    owner = "emilazy";
+    repo = pname;
+    rev = "a2bab8b2fd8e8d14faa875b5cc3a73f1276cd88a";
+    sha256 = "sha256-EwVkhyB87TJ3i9xJmmZMSTMUKvfbImI1S+y1vgRWbDk=";
+  };
+
+  patches = [
+    # show title of online videos instead of url
+    (fetchpatch {
+      url = "https://github.com/emilazy/mpv-notify-send/pull/6.patch";
+      hash = "sha256-7aXQ8qeqG4yX0Uyn09xCIESnwPZsb6Frd7C49XgbpFw=";
+    })
+  ];
+
+  passthru.extraWrapperArgs = [
+    "--prefix" "PATH" ":" (lib.makeBinPath libnotify)
+  ];
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "A Lua script for mpv to send notifications with notify-send";
+    homepage = "https://github.com/emilazy/mpv-notify-send";
+    license = licenses.wtfpl;
+    maintainers = with maintainers; [ r3n3gad3p3arl ];
+  };
+}
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@ -15,13 +15,13 @@

 buildGoModule rec {
  pname = "cri-o";
-  version = "1.29.3";
+  version = "1.29.4";

  src = fetchFromGitHub {
    owner = "cri-o";
    repo = "cri-o";
    rev = "v${version}";
-    hash = "sha256-JJuqYC4GAZqXyyAjVoPipnGjRGbVx1rfH4UrtIOP7cc=";
+    hash = "sha256-bF9hvKKwhsmX606Jk34qn32JklUrG939BW2x4tbknjo=";
  };
  vendorHash = null;

--- a/pkgs/build-support/php/hooks/composer-install-hook.sh
+++ b/pkgs/build-support/php/hooks/composer-install-hook.sh
@ -27,9 +27,9 @@ composerInstallConfigureHook() {
        setComposeRootVersion

        composer \
-            --no-ansi \
            --no-install \
            --no-interaction \
+            --no-progress \
            ${composerNoDev:+--no-dev} \
            ${composerNoPlugins:+--no-plugins} \
            ${composerNoScripts:+--no-scripts} \
@ -104,8 +104,8 @@ composerInstallInstallHook() {
    # Finally, run `composer install` to install the dependencies and generate
    # the autoloader.
    composer \
-      --no-ansi \
      --no-interaction \
+      --no-progress \
      ${composerNoDev:+--no-dev} \
      ${composerNoPlugins:+--no-plugins} \
      ${composerNoScripts:+--no-scripts} \
@ -117,8 +117,9 @@ composerInstallInstallHook() {

    # Create symlinks for the binaries.
    jq -r -c 'try (.bin[] | select(test(".bat$")? | not) )' composer.json | while read -r bin; do
-        mkdir -p "$out"/share/php/"${pname}" "$out"/bin
-        makeWrapper "$out"/share/php/"${pname}"/"$bin" "$out"/bin/"$(basename "$bin")"
+        echo -e "\e[32mCreating symlink ${bin}...\e[0m"
+        mkdir -p "$out"/bin
+        ln -s "$out"/share/php/"${pname}"/"$bin" "$out"/bin/"$(basename "$bin")"
    done

    echo "Finished composerInstallInstallHook"
--- a/pkgs/build-support/php/hooks/composer-repository-hook.sh
+++ b/pkgs/build-support/php/hooks/composer-repository-hook.sh
@ -23,9 +23,9 @@ composerRepositoryConfigureHook() {
        setComposeRootVersion

        composer \
-            --no-ansi \
            --no-install \
            --no-interaction \
+            --no-progress \
            ${composerNoDev:+--no-dev} \
            ${composerNoPlugins:+--no-plugins} \
            ${composerNoScripts:+--no-scripts} \
--- a/pkgs/build-support/php/hooks/default.nix
+++ b/pkgs/build-support/php/hooks/default.nix
@ -4,7 +4,6 @@
 , jq
 , writeShellApplication
 , moreutils
-, makeBinaryWrapper
 , cacert
 , buildPackages
 }:
@ -29,7 +28,7 @@ in
  composerInstallHook = makeSetupHook
    {
      name = "composer-install-hook.sh";
-      propagatedBuildInputs = [ jq makeBinaryWrapper moreutils cacert ];
+      propagatedBuildInputs = [ jq moreutils cacert ];
      substitutions = {
        # Specify the stdenv's `diff` by abspath to ensure that the user's build
        # inputs do not cause us to find the wrong `diff`.
--- a/pkgs/by-name/ar/arrpc/package.nix
+++ b/pkgs/by-name/ar/arrpc/package.nix
@ -3,18 +3,18 @@
 , fetchFromGitHub
 }: buildNpmPackage rec {
  pname = "arrpc";
-  version = "3.3.1";
+  version = "3.4.0";

  src = fetchFromGitHub {
    owner = "OpenAsar";
    repo = "arrpc";
    # Release commits are not tagged
-    # release: 3.3.0
-    rev = "b4796fffe3bf1b1361cc4781024349f7a4f9400e";
-    hash = "sha256-iEfV85tRl2KyjodoaSxVHiqweBpLeiCAYWc8+afl/sA=";
+    # release: 3.4.0
+    rev = "cca93db585dedf8acc1423f5e2db215de95c4c3b";
+    hash = "sha256-SeegrCgbjfVxG/9xfOcdfbVdDssZOhjBRnDipu6L7Wg=";
  };

-  npmDepsHash = "sha256-YlSUGncpY0MyTiCfZcPsfcNx3fR+SCtkOFWbjOPLUzk=";
+  npmDepsHash = "sha256-S9cIyTXqCp8++Yj3VjBbcStOjzjgd0Cq7KL7NNzZFpY=";

  dontNpmBuild = true;

--- a/pkgs/by-name/at/athens/package.nix
+++ b/pkgs/by-name/at/athens/package.nix
@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
  pname = "athens";
-  version = "0.13.3";
+  version = "0.14.0";

  src = fetchFromGitHub {
    owner = "gomods";
    repo = "athens";
    rev = "v${version}";
-    hash = "sha256-psO3x8xLWGSlsZT2HiAvYWP1rCvbWUx+WoJ4eves9lw=";
+    hash = "sha256-5E9jBV+m19AUtSTpTlkCx8JUHwlcM2pgSGfo4zPqDNk=";
  };

-  vendorHash = "sha256-hk0hmkmhRPRbh2Yqf1lYei6iiKUurMfc1Y3VPNStcBs=";
+  vendorHash = "sha256-LajNPzGbWqW+9aqiquk2LvSUjKwi1gbDY4cKXmn3PWk=";

  CGO_ENABLED = "0";
  ldflags = [ "-s" "-w" "-X github.com/gomods/athens/pkg/build.version=${version}" ];
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@ -17,16 +17,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "eza";
-  version = "0.18.13";
+  version = "0.18.14";

  src = fetchFromGitHub {
    owner = "eza-community";
    repo = "eza";
    rev = "v${version}";
-    hash = "sha256-dUWkszQs/MMb6Pq0Ci4vPgHe6qz7X4GBkRxSxehMKiQ=";
+    hash = "sha256-rbaKDOxHttE4SgQdExO8mlgzM0+xpWl/fL39nPinK/o=";
  };

-  cargoHash = "sha256-MSVneRJcY2XLb5A1/oOELm2FQj+7NDmINTYRrTVD4bI=";
+  cargoHash = "sha256-D0h39p8vV9Vm/UgjtgpRnqaxq4l0OrGxN/1MRpUds2g=";

  nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
  buildInputs = [ zlib ]
--- a/pkgs/by-name/ka/kanidm/package.nix
+++ b/pkgs/by-name/ka/kanidm/package.nix
@ -5,6 +5,7 @@
 , rustPlatform
 , fetchFromGitHub
 , installShellFiles
+, nix-update-script
 , pkg-config
 , udev
 , openssl
@ -19,23 +20,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "kanidm";
-  version = "1.1.0-rc.16";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
-    # Latest revision of 1.1.0-rc.16 stable branch
-    rev = "e51d0dee44ecabbf7be9e855753453bb2f61cced";
-    hash = "sha256-YgrlmSrjOzn/oFWmYy/71xwcq53lJbmiLIFzn2sIFAk=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Clg9jQgKvWP9LniHmNq+WjRmEOzJGfuCU2K9ActZhzo=";
  };

-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "base64urlsafedata-0.1.3" = "sha256-lYVWuKqF4c34LpFmTIg98TEXIlP4dHen0XkGnLOiq8Q=";
-      "sshkeys-0.3.2" = "sha256-CNG9HW8kSwezAdIYW+CR5rqFfmuso4R0+m4OpIyXbSM=";
-    };
-  };
+  cargoHash = "sha256-m3H2mQm+k6vFH+nP+hWl07Z7NJKJlt1E4eRDRA2Z0+o=";

  KANIDM_BUILD_PROFILE = "release_nixos_${arch}";

@ -87,7 +81,13 @@ rustPlatform.buildRustPackage rec {
    mv $out/lib/libpam_kanidm.so $out/lib/pam_kanidm.so
  '';

-  passthru.tests = { inherit (nixosTests) kanidm; };
+  passthru = {
+    tests = {
+      inherit (nixosTests) kanidm;
+    };
+
+    updateScript = nix-update-script { };
+  };

  meta = with lib; {
    changelog = "https://github.com/kanidm/kanidm/releases/tag/v${version}";
@ -95,6 +95,6 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/kanidm/kanidm";
    license = licenses.mpl20;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ erictapen Flakebi ];
+    maintainers = with maintainers; [ adamcstephens erictapen Flakebi ];
  };
 }
--- a/pkgs/by-name/ki/ki/package.nix
+++ b/pkgs/by-name/ki/ki/package.nix
@ -0,0 +1,69 @@
+{ lib
+, fetchFromGitHub
+, python3Packages
+, cmake
+, anki
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "ki";
+  version = "0-unstable-2023-11-08";
+
+  pyproject = true;
+
+  disabled = python3Packages.pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "langfield";
+    repo = pname;
+    rev = "eb32fbd3229dc1a60bcc76a937ad63f3eb869f65";
+    sha256 = "sha256-5mQhJhvJQC9835goL3t3DRbD+c4P3KxnOflxvqmxL58=";
+  };
+
+  patches = [
+    ./update-to-newer-anki-versions.patch
+    ./replace-deprecated-distutils-with-setuptools.patch
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  propagatedBuildInputs = with python3Packages; [
+    beartype
+    click
+    colorama
+    git-filter-repo
+    gitpython
+    lark
+    tqdm
+    whatthepatch
+  ] ++ [
+    anki
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    bitstring
+    checksumdir
+    gitpython
+    loguru
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # requires git to not be in path, but git is needed for other tests
+    "test_clone_cleans_up_on_error"
+    "test_clone_clean_up_preserves_directories_that_exist_a_priori"
+  ];
+
+  dontCheckRuntimeDeps = true;
+
+  # CMake needs to be run by pyproject rather than by its hook
+  dontConfigure = true;
+
+  meta = with lib; {
+    description = "Version control for Anki collections";
+    homepage = "https://github.com/langfield/ki";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ eljamm ];
+  };
+}
--- a/pkgs/by-name/ki/ki/replace-deprecated-distutils-with-setuptools.patch
+++ b/pkgs/by-name/ki/ki/replace-deprecated-distutils-with-setuptools.patch
@ -0,0 +1,13 @@
+diff --git a/tests/test_integration.py b/tests/test_integration.py
+index 93d3661..ef24fca 100644
+--- a/tests/test_integration.py
+++ b/tests/test_integration.py
+@@ -7,7 +7,7 @@ import sqlite3
+ import tempfile
+ import subprocess
+ from pathlib import Path
+-from distutils.dir_util import copy_tree
+from setuptools._distutils.dir_util import copy_tree
+ from importlib.metadata import version
+ 
+ import git
--- a/pkgs/by-name/ki/ki/update-to-newer-anki-versions.patch
+++ b/pkgs/by-name/ki/ki/update-to-newer-anki-versions.patch
@ -0,0 +1,141 @@
+diff --git a/ki/__init__.py b/ki/__init__.py
+index 3f29c1a..f4ad950 100644
+--- a/ki/__init__.py
+++ b/ki/__init__.py
+@@ -1321,7 +1321,7 @@ def _clone1(collection: str, directory: str = "") -> git.Repo:
+     try:
+         col = M.collection(col_file)
+         _, _ = _clone2(col, targetdir, msg="Initial commit", silent=False)
+-        col.close(save=False)
+        col.close()
+         kirepo: KiRepo = M.kirepo(targetdir)
+         kirepo.repo.create_tag(LCA)
+         kirepo.repo.close()
+@@ -1404,11 +1404,11 @@ def _pull1() -> None:
+     hashes = list(filter(lambda l: l != "", hashes))
+     if md5sum in hashes[-1]:
+         echo("ki pull: up to date.")
+-        col.close(save=False)
+        col.close()
+         return
+ 
+     col = _pull2(kirepo, col)
+-    col.close(save=False)
+    col.close()
+ 
+ 
+ @beartype
+@@ -1545,7 +1545,7 @@ def _push() -> PushResult:
+     # If there are no changes, quit.
+     if len(set(deltas)) == 0:
+         echo("ki push: up to date.")
+-        col.close(save=False)
+        col.close()
+         return PushResult.UP_TO_DATE
+ 
+     echo(f"Pushing to '{kirepo.col_file}'")
+@@ -1603,7 +1603,7 @@ def write_collection(
+     do(warn, F.cat(map(push_note(tempcol, timestamp_ns, guids, new_nids), decknotes)))
+ 
+     # It is always safe to save changes to the DB, since the DB is a copy.
+-    tempcol.close(save=True)
+    tempcol.close()
+ 
+     # Backup collection file and overwrite collection.
+     backup(kirepo)
+@@ -1621,7 +1621,7 @@ def write_collection(
+     renames = filter(lambda a: a.file.name != a.new_name, map(addmedia(col), mbytes))
+     warnings = map(lambda r: RenamedMediaFileWarning(r.file.name, r.new_name), renames)
+     do(warn, warnings)
+-    col.close(save=True)
+    col.close()
+ 
+     # Append and commit collection checksum to hashes file.
+     append_md5sum(kirepo.ki, kirepo.col_file.name, F.md5(kirepo.col_file))
+diff --git a/tests/test_integration.py b/tests/test_integration.py
+index e046b8c..93d3661 100644
+--- a/tests/test_integration.py
+++ b/tests/test_integration.py
+@@ -320,7 +320,7 @@ def test_clone_generates_deck_tree_correctly():
+     # Create empty decks.
+     col = opencol(a)
+     do(col.decks.id, [":a:::b:", "blank::blank", "blank::Hello"])
+-    col.close(save=True)
+    col.close()
+ 
+     os.chdir(F.mkdtemp())
+     clone(a)
+@@ -401,7 +401,7 @@ def test_clone_writes_media_files():
+     a: File = mkcol([("Basic", ["Default"], 1, ["a", "b[sound:1sec.mp3]"])])
+     col = opencol(a)
+     col.media.add_file(DATA / "media/1sec.mp3")
+-    col.close(save=True)
+    col.close()
+     clone(a)
+     assert (Path(MEDIA) / "1sec.mp3").is_file()
+ 
+@@ -883,7 +883,7 @@ def test_push_writes_media():
+     write_basic("Default", ("air", '<img src="bullhorn-lg.png">'))
+     col = opencol(a)
+     col.media.add_file(DATA / "media/bullhorn-lg.png")
+-    col.close(save=True)
+    col.close()
+     F.commitall(repo, ".")
+     repo.close()
+     out = push()
+@@ -987,7 +987,7 @@ def test_push_doesnt_unnecessarily_deduplicate_notetypes():
+ 
+     col = opencol(a)
+     models = col.models.all_names_and_ids()
+-    col.close(save=False)
+    col.close()
+ 
+     # Remove a note.
+     assert os.path.isfile("Default/a.md")
+@@ -1012,7 +1012,7 @@ def test_push_doesnt_unnecessarily_deduplicate_notetypes():
+ 
+     col = opencol(a)
+     assert len(models) == len(col.models.all_names_and_ids())
+-    col.close(save=False)
+    col.close()
+ 
+ 
+ def test_push_is_nontrivial_when_pushed_changes_are_reverted_in_repository():
+diff --git a/tests/test_ki.py b/tests/test_ki.py
+index 5270b56..e5f3297 100644
+--- a/tests/test_ki.py
+++ b/tests/test_ki.py
+@@ -482,7 +482,7 @@ def mkcol(ns: List[NoteSpec]) -> File:
+     file = F.touch(F.mkdtemp(), "a.anki2")
+     col = opencol(file)
+     do(addnote(col), ns)
+-    col.close(save=True)
+    col.close()
+     return F.chk(file)
+ 
+ 
+@@ -491,7 +491,7 @@ def rm(f: File, nid: int) -> File:
+     """Remove note with given `nid`."""
+     col = opencol(f)
+     col.remove_notes([nid])
+-    col.close(save=True)
+    col.close()
+     return f
+ 
+ 
+@@ -514,7 +514,7 @@ def edit(f: File, spec: NoteSpec) -> File:
+     """Edit a note with specified nid."""
+     col = opencol(f)
+     editnote(col, spec)
+-    col.close(save=True)
+    col.close()
+     return f
+ 
+ 
+@@ -531,7 +531,7 @@ def editcol(
+     do(addnote(col), adds)
+     do(editnote(col), edits)
+     col.remove_notes(deletes)
+-    col.close(save=True)
+    col.close()
+     return f
--- a/pkgs/by-name/li/license-go/package.nix
+++ b/pkgs/by-name/li/license-go/package.nix
@ -0,0 +1,36 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+let
+  version = "5.0.4";
+in
+buildGoModule {
+  pname = "license-go";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "nishanths";
+    repo = "license";
+    rev = "v${version}";
+    hash = "sha256-Rz/eIGa3xLjirPMOs4otfmwy4OzJgopKPbka2OKt8Fo=";
+  };
+
+  vendorHash = "sha256-kx3lPhmEo515sHgHBqDC6udz6xkZvB+nn6x3/JaBHbo=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+    "-X main.builtBy=nixpkgs"
+  ];
+
+  meta = {
+    description = "Command line license text generator";
+    homepage = "https://github.com/nishanths/license";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ uncenter ];
+    mainProgram = "license";
+  };
+}
--- a/pkgs/by-name/ma/maltego/package.nix
+++ b/pkgs/by-name/ma/maltego/package.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "maltego";
-  version = "4.6.0";
+  version = "4.7.0";

  src = fetchzip {
    url = "https://downloads.maltego.com/maltego-v4/linux/Maltego.v${finalAttrs.version}.linux.zip";
-    hash = "sha256-q+1RYToZtBxAIDSiUWf3i/3GBBDwh6NWteHiK4VM1HY=";
+    hash = "sha256-dPpkIoWK/mzC9wD+3QTNv3tYG27QVgCxtAymkwjIwUY=";
  };

  postPatch = ''
--- a/pkgs/by-name/mi/minijinja/package.nix
+++ b/pkgs/by-name/mi/minijinja/package.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "minijinja";
-  version = "1.0.21";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "mitsuhiko";
    repo = "minijinja";
    rev = version;
-    hash = "sha256-P18zqKbr7kWU2B9b6MNdL0Z281174NHTGvo38J/wSEo=";
+    hash = "sha256-6TUi9YY/CtxaFpW8itAiXDFYRet56y6h+okc3cNKzdk=";
  };

-  cargoHash = "sha256-nemZUNF1tHbXopIsvqFI/MIKrZcXj6YQF0WNxBkE310=";
+  cargoHash = "sha256-QNGdJg+6mUhWTvLSuLRnPFe2F42UDGnYPEqlVr7jF3s=";

  # The tests relies on the presence of network connection
  doCheck = false;
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "namespace-cli";
-  version = "0.0.359";
+  version = "0.0.360";

  src = fetchFromGitHub {
    owner = "namespacelabs";
    repo = "foundation";
    rev = "v${version}";
-    hash = "sha256-zLEaQmZKDwTRR6Zi/thCtVu+jJONGouaVOcxKBBIkt4=";
+    hash = "sha256-HuicX6g5+TfctiF4/N7uSQtkzzx9y2dnfn0ef+p1nRc=";
  };

  vendorHash = "sha256-72cHswoTZszo42NOrPNuokDlqoJ3/YEhGe+rQSKvgAw=";
--- a/pkgs/by-name/oc/ocenaudio/package.nix
+++ b/pkgs/by-name/oc/ocenaudio/package.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "ocenaudio";
-  version = "3.13.5";
+  version = "3.13.8";

  src = fetchurl {
    url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=v${version}";
-    hash = "sha256-9eDDllf6D2hAhjztPhi1MrUky7zQfiE4uLAbfRDx+7s=";
+    hash = "sha256-GKNho2xV6Lc4U5Ys4j+ZiGxE8irolcrTttN3PG1S2Ug=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pa/parsedmarc/package.nix
+++ b/pkgs/by-name/pa/parsedmarc/package.nix
@ -0,0 +1,41 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      # https://github.com/domainaware/parsedmarc/issues/464
+      msgraph-core = super.msgraph-core.overridePythonAttrs (old: rec {
+        version = "0.2.2";
+
+        src = fetchFromGitHub {
+          owner = "microsoftgraph";
+          repo = "msgraph-sdk-python-core";
+          rev = "v${version}";
+          hash = "sha256-eRRlG3GJX3WeKTNJVWgNTTHY56qiUGOlxtvEZ2xObLA=";
+        };
+
+        nativeBuildInputs = with self; [
+          flit-core
+        ];
+
+        propagatedBuildInputs = with self; [
+          requests
+        ];
+
+        nativeCheckInputs = with self; [
+          pytestCheckHook
+          responses
+        ];
+
+        disabledTestPaths = [
+          "tests/integration"
+        ];
+
+        pythonImportsCheck = [ "msgraph.core" ];
+      });
+    };
+  };
+in with python.pkgs; toPythonApplication parsedmarc
--- a/pkgs/by-name/po/pom/package.nix
+++ b/pkgs/by-name/po/pom/package.nix
@ -0,0 +1,25 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "pom";
+  version = "0-unstable-2024-04-29";
+
+  src = fetchFromGitHub {
+    owner = "maaslalani";
+    repo = "pom";
+    rev = "a8a2da7043f222b9c849d1ea93726433980469c0";
+    hash = "sha256-EAt0Q0gSHngQj2G4qYM3zhUGkl/vqa7J36iajlH4dzs=";
+  };
+
+  vendorHash = "sha256-2ghUITtL6RDRVqAZZ+PMj4sYDuh4VaKtGT11eSMlBiA=";
+
+  ldflags = [ "-s" "-w" "-X=main.Version=${version}" ];
+
+  meta = with lib; {
+    description = "Pomodoro timer in your terminal";
+    homepage = "https://github.com/maaslalani/pom";
+    license = licenses.mit;
+    maintainers = with maintainers; [ maaslalani redyf  ];
+    mainProgram = "pom";
+  };
+}
--- a/pkgs/by-name/py/pyprland/package.nix
+++ b/pkgs/by-name/py/pyprland/package.nix
@ -2,7 +2,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "pyprland";
-  version = "2.2.12";
+  version = "2.2.15";
  format = "pyproject";

  disabled = python3Packages.pythonOlder "3.10";
@ -10,8 +10,8 @@ python3Packages.buildPythonApplication rec {
  src = fetchFromGitHub {
    owner = "hyprland-community";
    repo = "pyprland";
-    rev = "refs/tags/${version}";
-    hash = "sha256-SVly20/+67d0Rr2SuM1n/JfT1SlyKdKRBLDx2okCZRY=";
+    rev = version;
+    hash = "sha256-ju/Xa3s0engE09q9EtKK/zhgimMmlTPXJrpwWQqUFLs=";
  };

  nativeBuildInputs = with python3Packages; [ poetry-core ];
@ -53,12 +53,12 @@ python3Packages.buildPythonApplication rec {
    "pyprland.plugins.workspaces_follow_focus"
  ];

-  meta = with lib; {
+  meta = {
    mainProgram = "pypr";
    description = "An hyperland plugin system";
    homepage = "https://github.com/hyprland-community/pyprland";
-    license = licenses.mit;
-    maintainers = with maintainers; [ iliayar ];
-    platforms = platforms.linux;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ iliayar johnrtitor ];
+    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/by-name/re/redocly-cli/package.nix
+++ b/pkgs/by-name/re/redocly-cli/package.nix
@ -2,20 +2,22 @@
 , buildNpmPackage
 , fetchFromGitHub
 , makeWrapper
+, redocly
+, testers
 }:

 buildNpmPackage rec {
-  pname = "redocly-cli";
-  version = "1.6.0";
+  pname = "redocly";
+  version = "1.12.0";

  src = fetchFromGitHub {
    owner = "Redocly";
    repo = "redocly-cli";
    rev = "@redocly/cli@${version}";
-    hash = "sha256-xoehTTpXT/9tlL0VoDQwKbyUnNGeMyH+VBIVLiz69ko=";
+    hash = "sha256-KfNwBRGDFNMsba+yjwUHiiO2BJbIl4pW1b3cvLBe+lk=";
  };

-  npmDepsHash = "sha256-9fI9P96iNmHrhjbgjePpRnknFe3yIjkirOoIMkVGkH4=";
+  npmDepsHash = "sha256-I3cxMw9zOZb9sfP8UUoHc1UJ0RpDqVn9D29arSdNob4=";

  npmBuildScript = "prepare";

@ -32,24 +34,25 @@ buildNpmPackage rec {

    mkdir $out/bin
    makeWrapper $out/lib/node_modules/@redocly/cli/node_modules/@redocly/cli/bin/cli.js \
-      $out/bin/redocly-cli \
+      $out/bin/redocly \
      --set-default REDOCLY_TELEMETRY off \
      --set-default CI true # Silence update messages
+
+    # Symlink for backwards compatibility. Remove after 24.05.
+    ln -s $out/bin/redocly $out/bin/redocly-cli
  '';

-  installCheckPhase = ''
-    runHook preInstallCheck
-    $out/bin/redocly-cli --version
-    runHook postInstallCheck
-  '';
-
-  doInstallCheck = true;
+  passthru = {
+    tests.version = testers.testVersion {
+      package = redocly;
+    };
+  };

  meta = {
-    description = "Redocly CLI makes OpenAPI easy. Lint/validate to any standard, generate beautiful docs, and more.";
+    description = "Makes OpenAPI easy. Lint/validate to any standard, generate beautiful docs, and more";
    homepage = "https://github.com/Redocly/redocly-cli";
    license = lib.licenses.mit;
-    mainProgram = "redocly-cli";
+    mainProgram = "redocly";
    maintainers = with lib.maintainers; [ szlend ];
  };
 }
--- a/pkgs/by-name/ri/river-filtile/package.nix
+++ b/pkgs/by-name/ri/river-filtile/package.nix
@ -0,0 +1,31 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "river-filtile";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "pkulak";
+    repo = "filtile";
+    rev = "v${version}";
+    hash = "sha256-wBU4CX6KGnTvrBsXvFAlRrvDqvHHbAlVkDqTCJx90G8=";
+  };
+
+  cargoHash = "sha256-W5e19gzkZZjTTSZdww2x7M0LnR/gClQxMeAiDITO3HY=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  meta = with lib; {
+    description = "A layout manager for the River window manager";
+    homepage = "https://github.com/pkulak/filtile";
+    license = licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ pkulak ];
+    mainProgram = "filtile";
+  };
+}
--- a/pkgs/by-name/va/vale-ls/package.nix
+++ b/pkgs/by-name/va/vale-ls/package.nix
@ -0,0 +1,61 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, rustPlatform
+, pkg-config
+, openssl
+, darwin
+, vale
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "vale-ls";
+  version = "0.3.7-unstable-2024-03-13";
+
+  src = fetchFromGitHub {
+    owner = "errata-ai";
+    repo = "vale-ls";
+    rev = "473e16bc88ec48b35e2bd208adc174878c4d5396";
+    hash = "sha256-ywJsnWMc9NSjYjsK6SXdMAQl+hcP+KQ7Xp1A99aeqAg=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.bindgenHook
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    SystemConfiguration
+  ]);
+
+  checkFlags = [
+    # The following tests are reaching to the network.
+    "--skip=vale::tests"
+  ] ++ lib.optionals (stdenv.isLinux && stdenv.isAarch64) [
+    # This test does not account for the existence of aarch64-linux machines,
+    # despite upstream shipping artifacts for that architecture
+    "--skip=utils::tests::arch"
+  ];
+
+  env.OPENSSL_NO_VENDOR = true;
+
+  cargoHash = "sha256-ifKdSTmVWfDZF5Kn9b5JpzDxa160oRTfzjvxeL9POBg=";
+
+  postInstall = ''
+    wrapProgram $out/bin/vale-ls \
+      --prefix PATH : ${lib.makeBinPath [ vale ]}
+  '';
+
+  meta = with lib; {
+    description = "LSP implementation for the Vale command-line tool";
+    homepage = "https://github.com/errata-ai/vale-ls";
+    license = licenses.mit;
+    mainProgram = "vale-ls";
+    maintainers = with maintainers; [ foo-dogsquared jansol ];
+  };
+}
+
--- a/pkgs/by-name/vd/vdhcoapp/ffmpeg-filepicker.patch
+++ b/pkgs/by-name/vd/vdhcoapp/ffmpeg-filepicker.patch
@ -0,0 +1,46 @@
+diff --git a/src/converter.js b/src/converter.js
+index af7b4c3..20da407 100644
+--- a/src/converter.js
+++ b/src/converter.js
+@@ -1,4 +1,4 @@
+-import open from 'open';
+const open = import('open');
+ 
+ const os = require("os");
+ const path = require('path');
+@@ -9,9 +9,9 @@ const rpc = require('./weh-rpc');
+ 
+ const exec_dir = path.dirname(process.execPath);
+ 
+-const ffmpeg = findExecutableFullPath("ffmpeg", exec_dir);
+-const ffprobe = findExecutableFullPath("ffprobe", exec_dir);
+-const filepicker = findExecutableFullPath("filepicker", exec_dir);
+const ffmpeg = "@ffmpeg@/bin/ffmpeg";
+const ffprobe = "@ffmpeg@/bin/ffprobe";
+const filepicker = "@filepicker@";
+ 
+ if (!fileExistsSync(ffmpeg)) {
+   logger.error("ffmpeg not found. Install ffmpeg and make sure it's in your path.");
+diff --git a/src/main.js b/src/main.js
+index 47b92de..e2e9402 100644
+--- a/src/main.js
+++ b/src/main.js
+@@ -1,4 +1,4 @@
+-const config = require('config.json');
+const config = require('./config.json');
+ const converter = require('./converter');
+ const os = require("os");
+ 
+diff --git a/src/native-autoinstall.js b/src/native-autoinstall.js
+index 556a22b..c729568 100644
+--- a/src/native-autoinstall.js
+++ b/src/native-autoinstall.js
+@@ -1,7 +1,7 @@
+ const os = require("os");
+ const path = require("path");
+ const { spawn, exec } = require('child_process');
+-const config = require('config.json');
+const config = require('./config.json');
+ 
+ let fs;
+ if (process.versions.node.startsWith("10")) {
--- a/pkgs/by-name/vd/vdhcoapp/filepicker.nix
+++ b/pkgs/by-name/vd/vdhcoapp/filepicker.nix
@ -0,0 +1,40 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, atk
+, gtk3
+, glib
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "filepicker";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "paulrouget";
+    repo = "static-filepicker";
+    rev = "v${version}";
+    hash = "sha256-7sRzf3SA9RSBf4O36olXgka8c6Bufdb0qsuTofVe55s=";
+  };
+
+  cargoHash = "sha256-aal7ppFkCpNc+QTS4Qklsb9WfJ65QqG6p1eOskiX+/Q=";
+
+  buildInputs = [
+    atk
+    gtk3
+    glib
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  meta = with lib; {
+    description = "File picker used by VDHCoApp";
+    homepage = "https://github.com/paulrouget/static-filepicker";
+    license = licenses.gpl2;
+    mainProgram = "filepicker";
+    maintainers = with maintainers; [ hannesgith ];
+  };
+}
--- a/pkgs/by-name/vd/vdhcoapp/package.nix
+++ b/pkgs/by-name/vd/vdhcoapp/package.nix
@ -0,0 +1,83 @@
+{ lib
+, fetchFromGitHub
+, buildNpmPackage
+, nodejs
+, ffmpeg
+, callPackage
+, substituteAll
+, makeWrapper
+, toml2json
+, jq
+}:
+buildNpmPackage rec {
+  pname = "vdhcoapp";
+  version = "2.0.19";
+
+  src = fetchFromGitHub {
+    owner = "aclap-dev";
+    repo = "vdhcoapp";
+    rev = "v${version}";
+    hash = "sha256-8xeZvqpRq71aShVogiwlVD3gQoPGseNOmz5E3KbsZxU=";
+  };
+
+  sourceRoot = "${src.name}/app";
+  npmDepsHash = "sha256-E032U2XZdyTER6ROkBosOTn7bweDXHl8voC3BQEz8Wg=";
+  dontNpmBuild = true;
+
+  nativeBuildInputs = [
+    makeWrapper
+    toml2json
+    jq
+  ];
+
+  patches = [
+    (substituteAll {
+      src = ./ffmpeg-filepicker.patch;
+      inherit ffmpeg;
+      filepicker = lib.getExe (callPackage ./filepicker.nix {});
+    })
+  ];
+
+  postPatch = ''
+    # Cannot use patch, setting placeholder here
+    substituteInPlace src/native-autoinstall.js \
+      --replace process.execPath "\"${placeholder "out"}/bin/vdhcoapp\""
+  '';
+
+  preBuild = ''
+    toml2json --pretty ../config.toml > src/config.json
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/opt/vdhcoapp
+    cp -r . "$out/opt/vdhcoapp"
+
+    makeWrapper ${nodejs}/bin/node $out/bin/vdhcoapp \
+      --add-flags $out/opt/vdhcoapp/src/main.js
+
+    generateManifest() {
+      type=$1
+      outputFolder=$2
+      mkdir -p $outputFolder
+      manifestName=$(jq -r '.meta.id' src/config.json).json
+      jq '.store.'$type'.manifest * (.meta | with_entries(select (.key == "description")) * {"name": .id}) * {"path" : "${placeholder "out"}/bin/vdhcoapp"}' src/config.json > $outputFolder/$manifestName
+    }
+
+    generateManifest google $out/etc/opt/chrome/native-messaging-hosts
+    generateManifest google $out/etc/chromium/native-messaging-hosts
+    generateManifest mozilla $out/lib/mozilla/native-messaging-hosts
+    generateManifest google $out/etc/opt/edge/native-messaging-hosts
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Companion application for the Video DownloadHelper browser add-on";
+    homepage = "https://www.downloadhelper.net/";
+    license = licenses.gpl2;
+    platforms = lib.platforms.linux;
+    maintainers = with maintainers; [ hannesgith ];
+    mainProgram = "vdhcoapp";
+  };
+}
--- a/pkgs/by-name/ve/vesktop/package.nix
+++ b/pkgs/by-name/ve/vesktop/package.nix
@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "vesktop";
-  version = "1.5.1";
+  version = "1.5.2";

  src = fetchFromGitHub {
    owner = "Vencord";
    repo = "Vesktop";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-OyAGzlwwdEKBbJJ7h3glwx/THy2VvUn/kA/Df3arWQU=";
+    hash = "sha256-cZOyydwpIW9Xq716KVi1RGtSlgVnOP3w8vXDwouS70E=";
  };

  # NOTE: This requires pnpm 8.10.0 or newer
@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
      dontBuild = true;
      dontFixup = true;
      outputHashMode = "recursive";
-      outputHash = "sha256-JLjJZYFMH4YoIFuyXbGUp6lIy+VlYZtmwk2+oUwtTxQ=";
+      outputHash = "sha256-6ezEBeYmK5va3gCh00YnJzZ77V/Ql7A3l/+csohkz68=";
    };

  nativeBuildInputs = [
--- a/pkgs/applications/editors/vis/default.nix
+++ b/pkgs/applications/editors/vis/default.nix
@ -9,11 +9,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "vis";
-  version  = "0.8";
+  version  = "0.9";

  src = fetchFromGitHub {
    rev = "v${version}";
-    sha256 = "sha256-XvWj6fZxzXeRA5oCAqIIwlfjrJcHnDrjeiPExEQKSkY=";
+    sha256 = "sha256-SYM3zlzhp3NdyOjtXc+pOiWY4/WA/Ax+qAWe18ggq3g=";
    repo = "vis";
    owner = "martanne";
  };
--- a/pkgs/development/libraries/mongoc/default.nix
+++ b/pkgs/development/libraries/mongoc/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "mongoc";
-  version = "1.26.2";
+  version = "1.27.0";

  src = fetchFromGitHub {
    owner = "mongodb";
    repo = "mongo-c-driver";
    rev = "refs/tags/${version}";
-    hash = "sha256-4+PXvWYEy4Bi+qpyp7PvqtsOxJuYhjiHrmwmdn5RiX8=";
+    hash = "sha256-P0Mavs09FUmHxRYx/70wtjswWnrkQIo0+NrYtW4KJXo=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/ndi/default.nix
+++ b/pkgs/development/libraries/ndi/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, requireFile, avahi, obs-studio-plugins }:
+{ lib, stdenv, fetchurl, avahi, obs-studio-plugins }:

 let
  versionJSON = lib.importJSON ./version.json;
@ -15,20 +15,10 @@ stdenv.mkDerivation rec {
  majorVersion = builtins.head (builtins.splitVersion version);
  installerName = "Install_NDI_SDK_v${majorVersion}_Linux";

-  src = requireFile rec {
-    name    = "${installerName}.tar.gz";
-    sha256  = versionJSON.hash;
-    message = ''
-      In order to use NDI SDK version ${version}, you need to comply with
-      NewTek's license and download the appropriate Linux tarball from:
-
-        ${meta.homepage}
-
-      Once you have downloaded the file, please use the following command and
-      re-run the installation:
-
-        \$ nix-prefetch-url file://\$PWD/${name}
-    '';
+  src = fetchurl {
+    name = "${pname}-${version}.tar.gz";
+    url = "https://downloads.ndi.tv/SDK/NDI_SDK_Linux/${installerName}.tar.gz";
+    hash = versionJSON.hash;
  };

  buildInputs = [ avahi ];
@ -52,6 +42,8 @@ stdenv.mkDerivation rec {
      if [ -L "$i" ]; then continue; fi
      patchelf --set-rpath "${avahi}/lib:${stdenv.cc.libc}/lib" "$i"
    done
+    rm $out/bin/libndi.so.${majorVersion}
+    ln -s $out/lib/libndi.so.${version} $out/bin/libndi.so.${majorVersion}
    mv include examples $out/
    mkdir -p $out/share/doc/${pname}-${version}
    mv licenses $out/share/doc/${pname}-${version}/licenses
--- a/pkgs/development/libraries/ndi/version.json
+++ b/pkgs/development/libraries/ndi/version.json
@ -1 +1 @@
-{"hash": "sha256:4ff4b92f2c5f42d234aa7d142e2de7e9b045c72b46ad5149a459d48efd9218de", "version": "5.6.0"}
+{"hash": "sha256:0wh5bqy9xx08wnfah92pgs4f6xn6mwfyhwdzbhf5ghkbw8pc7z0w", "version": "5.6.1"}
--- a/pkgs/development/python-modules/flynt/default.nix
+++ b/pkgs/development/python-modules/flynt/default.nix
@ -1,34 +1,48 @@
-{ lib
-, buildPythonPackage
-, pythonOlder
-, fetchFromGitHub
-, astor
-, pytestCheckHook
+{
+  astor,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  lib,
+  pytestCheckHook,
+  pythonOlder,
+  tomli,
 }:

 buildPythonPackage rec {
  pname = "flynt";
-  version = "0.66";
-  format = "setuptools";
+  version = "1.0.1";
+  pyproject = true;

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "ikamensh";
    repo = "flynt";
-    rev = version;
-    hash = "sha256-DV433wqLjF5k4g8J7rj5gZfaw+Y4/TDOoFKo3eKDjZ4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-UHY4UDBHcP3ARikktIehSUD3Dx8A0xpOnfKWWrLCsOY=";
  };

-  propagatedBuildInputs = [ astor ];
+  build-system = [ hatchling ];
+
+  propagatedBuildInputs = [ astor ] ++ lib.optionals (pythonOlder "3.11") [ tomli ];

  nativeCheckInputs = [ pytestCheckHook ];

+  pythonImportsCheck = [ "flynt" ];
+
+  disabledTests = [
+    # AssertionError
+    "test_fstringify"
+    "test_mixed_quote_types_unsafe"
+  ];
+
  meta = with lib; {
-    description = "command line tool to automatically convert a project's Python code from old format style strings into Python 3.6+'s f-strings";
-    mainProgram = "flynt";
+    description = "Tool to automatically convert old string literal formatting to f-strings";
    homepage = "https://github.com/ikamensh/flynt";
+    changelog = "https://github.com/ikamensh/flynt/blob/${version}/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with maintainers; [ cpcloud ];
+    mainProgram = "flynt";
  };
 }
--- a/pkgs/development/python-modules/parsedmarc/default.nix
+++ b/pkgs/development/python-modules/parsedmarc/default.nix
@ -24,11 +24,12 @@
 , mailsuite
 , msgraph-core
 , nixosTests
+, opensearch-py
 , publicsuffixlist
 , pythonOlder
+, pythonRelaxDepsHook
 , requests
 , tqdm
-, urllib3
 , xmltodict
 }:

@ -50,14 +51,14 @@ buildPythonPackage rec {
    hash = "sha256-OBxiaXB8NKNMviRI19rYYJxpnfnaEL3zSPmYB4urIug=";
  };

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "elasticsearch<7.14.0" "elasticsearch" \
-      --replace "elasticsearch-dsl==7.4.0" "elasticsearch-dsl"
-  '';
-
  nativeBuildInputs = [
    hatchling
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "elasticsearch"
+    "elasticsearch-dsl"
  ];

  propagatedBuildInputs = [
@ -84,8 +85,8 @@ buildPythonPackage rec {
    publicsuffixlist
    requests
    tqdm
-    urllib3
    xmltodict
+    opensearch-py
  ];

  # no tests on PyPI, no tags on GitHub
@ -108,5 +109,7 @@ buildPythonPackage rec {
    license = licenses.asl20;
    maintainers = with maintainers; [ talyz ];
    mainProgram = "parsedmarc";
+    # https://github.com/domainaware/parsedmarc/issues/464
+    broken = lib.versionAtLeast msgraph-core.version "1.0.0";
  };
 }
--- a/pkgs/development/python-modules/pyvista/default.nix
+++ b/pkgs/development/python-modules/pyvista/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "pyvista";
-  version = "0.43.5";
+  version = "0.43.6";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-twcsOG/iHZGMBrGcpF5jEJB8CoKIBcO711t7sXJT214=";
+    hash = "sha256-EhhnX7r8yHynEVahMSB6LxCAquQcUF4cI0S4oW+IZ/Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/sanix/default.nix
+++ b/pkgs/development/python-modules/sanix/default.nix
@ -0,0 +1,42 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, requests
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "sanix";
+  version = "1.0.6";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchFromGitHub {
+    owner = "tomaszsluszniak";
+    repo = "sanix_py";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-D2w3hmL8ym63liWOYdZS4ry3lJ0utbbYGagWoOTT1TQ=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    requests
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "sanix" ];
+
+  meta = with lib; {
+    description = "Module to get measurements data from Sanix devices";
+    homepage = "https://github.com/tomaszsluszniak/sanix_py";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/uart-devices/default.nix
+++ b/pkgs/development/python-modules/uart-devices/default.nix
@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, pytest-asyncio
+, pythonOlder
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "uart-devices";
+  version = "0.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "bdraco";
+    repo = "uart-devices";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-rmOWyTdOwnlr8Rwsvd2oeZq79LuGVJDAkIW2/9gGrKQ=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "-Wdefault --cov=uart_devices --cov-report=term-missing:skip-covered" ""
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "uart_devices" ];
+
+  meta = with lib; {
+    description = "UART Devices for Linux";
+    homepage = "https://github.com/bdraco/uart-devices";
+    changelog = "https://github.com/bdraco/uart-devices/blob/${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/python-modules/upb-lib/default.nix
+++ b/pkgs/development/python-modules/upb-lib/default.nix
@ -1,37 +1,51 @@
 { lib
 , buildPythonPackage
+, fetchFromGitHub
+, pyserial-asyncio-fast
+, pytestCheckHook
 , pythonOlder
-, fetchPypi
-, pyserial-asyncio
 , pytz
+, poetry-core
 }:

 buildPythonPackage rec {
  pname = "upb-lib";
-  version = "0.5.4";
-  format = "setuptools";
+  version = "0.5.6";
+  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.11";

-  src = fetchPypi {
-    pname = "upb_lib";
-    inherit version;
-    hash = "sha256-KEnSADj+sQtz37Xbi6fXoe2TN+F5Z9SYnlvCgXtxVnk=";
+  src = fetchFromGitHub {
+    owner = "gwww";
+    repo = "upb-lib";
+    rev = "refs/tags/${version}";
+    hash = "sha256-e8LYywKA5lNZ4UYFZTwcfePDWB4cTNz38Tiy4xzOxOs=";
  };

-  propagatedBuildInputs = [
-    pyserial-asyncio
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    pyserial-asyncio-fast
    pytz
  ];

-  # no tests on PyPI, no tags on GitHub
-  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];

  pythonImportsCheck = [ "upb_lib" ];

+  disabledTests = [
+    # AssertionError
+    "test_create_control_word_all"
+  ];
+
  meta = with lib; {
    description = "Library for interacting with UPB PIM";
    homepage = "https://github.com/gwww/upb-lib";
+    changelog = "https://github.com/gwww/upb-lib/releases/tag/${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ dotlambda ];
  };
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@ -308,6 +308,7 @@ let
    FactoMineR = [ self.car ];
    pander = [ self.codetools ];
    rmsb = [ self.rstantools ];
+    gastempt = [ self.rstantools ];
    interactiveDisplay = [ self.BiocManager ];
  };

@ -566,6 +567,7 @@ let
    RMark = [ pkgs.which ];
    RPushbullet = [ pkgs.which ];
    stpphawkes = [ pkgs.gsl ];
+    registr = with pkgs; [ icu.dev zlib.dev bzip2.dev xz.dev ];
    RCurl = [ pkgs.curl.dev ];
    R2SWF = [ pkgs.pkg-config ];
    rDEA = [ pkgs.glpk ];
@ -706,9 +708,11 @@ let
    RcppCWB = with pkgs; [ pcre.dev glib.dev ];
    redux = [ pkgs.hiredis ];
    RmecabKo = [ pkgs.mecab ];
+    markets = [ pkgs.gsl ];
    PoissonBinomial = [ pkgs.fftw.dev ];
    poisbinom = [ pkgs.fftw.dev ];
    PoissonMultinomial = [ pkgs.fftw.dev ];
+    psbcGroup = [ pkgs.gsl.dev ];
    rrd = [ pkgs.rrdtool ];
    flowWorkspace = [ pkgs.zlib.dev ];
    RITCH = [ pkgs.zlib.dev ];
@ -933,6 +937,7 @@ let
    "aroma_affymetrix"
    "aroma_cn"
    "aroma_core"
+    "ceramic"
    "connections"
    "csodata"
    "DiceView"
@ -966,6 +971,9 @@ let
    "Quartet"
    "ShinyQuickStarter"
    "TIN"
+    "cfdnakit"
+    "CaDrA"
+    "GNOSIS"
    "TotalCopheneticIndex"
    "TreeDist"
    "biocthis"
@ -995,6 +1003,8 @@ let
    "PhIPData" # tries to download something from a DB
    "RBioFormats" # tries to download jar during load test
    "pbdMPI"   # tries to run MPI processes
+    "CTdata" # tries to connect to ExperimentHub
+    "rfaRm" # tries to connect to Ebi
    "data_table" # fails to rename shared library before check
    "coMethDMR" # tries to connect to ExperimentHub
    "multiMiR" # tries to connect to DB
--- a/pkgs/development/tools/go-toml/default.nix
+++ b/pkgs/development/tools/go-toml/default.nix
@ -4,7 +4,7 @@
  fetchFromGitHub,
 }:
 let
-  version = "2.2.1";
+  version = "2.2.2";
 in
 buildGoModule {
  pname = "go-toml";
@ -14,7 +14,7 @@ buildGoModule {
    owner = "pelletier";
    repo = "go-toml";
    rev = "v${version}";
-    sha256 = "sha256-DAtp9ovl6cny0rom80aK+bGe9U/p6zmTQo1Z3MscCjg=";
+    sha256 = "sha256-Z17977v2qMdf/e6iHEuRyCuC//HeFF8tkLt2P8Z/NT4=";
  };

  vendorHash = "sha256-4t/ft3XTfc7yrsFVMSfjdCur8QULho3NI2ym6gqjexI=";
--- a/pkgs/development/tools/misc/act/default.nix
+++ b/pkgs/development/tools/misc/act/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "act";
-  version = "0.2.61";
+  version = "0.2.62";

  src = fetchFromGitHub {
    owner = "nektos";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-X2Um6z3BXhshNGTwih/mvXigCplzUr+mVOn0SZ7RESA=";
+    hash = "sha256-zHtRdwBqwQMW/M4TYA609beCrC5B4hyhtcptJSbN6M8=";
  };

-  vendorHash = "sha256-HtCHAMcTFQS8YWjWt9LEHkhZBE8XDF4YOcGBFv0e5l0=";
+  vendorHash = "sha256-+hK1qG0p7MSYACkvzTnuPvlccbHNJRRZdC/LAM1Cp2k=";

  doCheck = false;

--- a/pkgs/os-specific/linux/cpupower/default.nix
+++ b/pkgs/os-specific/linux/cpupower/default.nix
@ -39,6 +39,7 @@ stdenv.mkDerivation {
    description = "Tool to examine and tune power saving features";
    homepage = "https://www.kernel.org/";
    license = licenses.gpl2;
+    mainProgram = "cpupower";
    platforms = platforms.linux;
  };
 }
--- a/pkgs/servers/kanidm/Cargo.lock
+++ b/pkgs/servers/kanidm/Cargo.lock
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@ -21,16 +21,16 @@ let
 in
 buildGoModule rec {
  pname = "minio";
-  version = "2024-04-18T19-09-19Z";
+  version = "2024-04-28T17-53-50Z";

  src = fetchFromGitHub {
    owner = "minio";
    repo = "minio";
    rev = "RELEASE.${version}";
-    hash = "sha256-yfVB9CTNg/Vv2j3q3vMU2rwtT6R1laA9MNhcpUKSg2U=";
+    hash = "sha256-PjZYi1JiXQDaQw6z2OCblzCvvT3cOLa80sgFUTHofVY=";
  };

-  vendorHash = "sha256-FMLxXwB1lSzV8C+tJZYhZHJbaKQ3xDhtHfc68ZIJFyw=";
+  vendorHash = "sha256-pPIcH2I/0792iXLMveZIRSBFKCnvraCyBUutREwTig0=";

  doCheck = false;

--- a/pkgs/servers/sql/mariadb/galera/default.nix
+++ b/pkgs/servers/sql/mariadb/galera/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "mariadb-galera";
-  version = "26.4.17";
+  version = "26.4.18";

  src = fetchFromGitHub {
    owner = "codership";
    repo = "galera";
    rev = "release_${version}";
-    hash = "sha256-XcaHg0mqCGqP7VYb4jLSxuNxmBXJv2ivA/1spMyT4Tg=";
+    hash = "sha256-JZMw9P+70c6m1zxaQLn0N46jL+P71cvyROekjoc5/Kk=";
    fetchSubmodules = true;
  };

--- a/pkgs/servers/unifi/default.nix
+++ b/pkgs/servers/unifi/default.nix
@ -52,7 +52,7 @@ in rec {
  };

  unifi8 = generic {
-    version = "8.1.113";
-    sha256 = "sha256-1knm+l8MSb7XKq2WIbehAnz7loRPjgnc+R98zpWKEAE=";
+    version = "8.1.127";
+    sha256 = "sha256-7Xg4I0Kuvta4oKzkduCda7aonTFzutrQJK03FLqM0KE=";
  };
 }
--- a/pkgs/servers/web-apps/moodle/default.nix
+++ b/pkgs/servers/web-apps/moodle/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, writeText, plugins ? [ ], nixosTests }:

 let
-  version = "4.3.3";
+  version = "4.4";

  versionParts = lib.take 2 (lib.splitVersion version);
  # 4.2 -> 402, 3.11 -> 311
@ -15,7 +15,7 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://download.moodle.org/download.php/direct/stable${stableVersion}/${pname}-${version}.tgz";
-    hash = "sha256-yFrD277bO25O5GeXVG4VhKO/oH9dsgqoTsrlMZoXHbI=";
+    hash = "sha256-IW47IWtdbkBk8gw6eEQb/C9/BRwDbJpirXncGGDy3+s=";
  };

  phpConfig = writeText "config.php" ''
--- a/pkgs/servers/web-apps/outline/default.nix
+++ b/pkgs/servers/web-apps/outline/default.nix
@ -3,6 +3,7 @@
 , fetchFromGitHub
 , fetchYarnDeps
 , makeWrapper
+, prefetch-yarn-deps
 , fixup-yarn-lock
 , nodejs
 , yarn
@ -11,21 +12,21 @@

 stdenv.mkDerivation rec {
  pname = "outline";
-  version = "0.75.2";
+  version = "0.76.0";

  src = fetchFromGitHub {
    owner = "outline";
    repo = "outline";
    rev = "v${version}";
-    hash = "sha256-jK1jZ9NyBl3Dioh/7gXWx6XyyI6xJKt2a/XXzbhllZM=";
+    hash = "sha256-pTu1/7hEYvo/6MuN0yC+nrPCwUYqvcc2hZuiPtVFlwU=";
  };

-  nativeBuildInputs = [ makeWrapper fixup-yarn-lock ];
+  nativeBuildInputs = [ makeWrapper prefetch-yarn-deps fixup-yarn-lock ];
  buildInputs = [ yarn nodejs ];

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = "${src}/yarn.lock";
-    hash = "sha256-8CfaP5T/pf/xq1lOfdOW4n2m12QLnkLFynHABjZwNiY=";
+    hash = "sha256-10kqC4A9OFrpZzTBJIZ6I5TCOVgpX+h+hwfOWhXdhHs=";
  };

  configurePhase = ''
--- a/pkgs/tools/admin/synapse-admin/default.nix
+++ b/pkgs/tools/admin/synapse-admin/default.nix
@ -3,16 +3,17 @@
 , fetchYarnDeps
 , mkYarnPackage
 , baseUrl ? null
+, writeShellScriptBin
 }:

 mkYarnPackage rec {
  pname = "synapse-admin";
-  version = "0.8.7";
+  version = "0.10.0";
  src = fetchFromGitHub {
    owner = "Awesome-Technologies";
    repo = pname;
    rev = version;
-    sha256 = "sha256-kvQBzrCu1sgDccKhr0i2DgDmO5z6u6s+vw5KymttoK4=";
+    sha256 = "sha256-3MC5PCEwYfZzJy9AW9nHTpvU49Lk6wbYC4Rcv9J9MEg=";
  };

  yarnLock = ./yarn.lock;
@ -20,9 +21,13 @@ mkYarnPackage rec {

  offlineCache = fetchYarnDeps {
    inherit yarnLock;
-    hash = "sha256-f0ilsF3lA+134qUaX96mdntjpR4gRlmtRIh/xEFhtXQ=";
+    hash = "sha256-vpCwPL1B+hbIaVSHtlkGjPAteu9BFNNmCTE66CSyFkg=";
  };

+  nativeBuildInputs = [
+    (writeShellScriptBin "git" "echo ${version}")
+  ];
+
  NODE_ENV = "production";
  ${if baseUrl != null then "REACT_APP_SERVER" else null} = baseUrl;

@ -33,12 +38,7 @@ mkYarnPackage rec {
    runHook preBuild

    export HOME=$(mktemp -d)
-    pushd deps/synapse-admin
-    mv node_modules node_modules.bak
-    cp -r $(readlink -f node_modules.bak) node_modules
-    chmod +w node_modules
    yarn --offline run build
-    popd

    runHook postBuild
  '';
@ -46,8 +46,7 @@ mkYarnPackage rec {
  distPhase = ''
    runHook preDist

-    mkdir -p $out
-    cp -r deps/synapse-admin/build/* $out
+    cp -r deps/synapse-admin/dist $out

    runHook postDist
  '';
--- a/pkgs/tools/admin/synapse-admin/package.json
+++ b/pkgs/tools/admin/synapse-admin/package.json
@ -1,7 +1,8 @@
 {
  "name": "synapse-admin",
-  "version": "0.8.5",
+  "version": "0.10.0",
  "description": "Admin GUI for the Matrix.org server Synapse",
+  "type": "module",
  "author": "Awesome Technologies Innovationslabor GmbH",
  "license": "Apache-2.0",
  "homepage": ".",
@ -10,48 +11,71 @@
    "url": "https://github.com/Awesome-Technologies/synapse-admin"
  },
  "devDependencies": {
-    "@testing-library/jest-dom": "^5.16.5",
-    "@testing-library/react": "^11.2.6",
-    "@testing-library/user-event": "^14.4.3",
-    "eslint": "^8.32.0",
-    "eslint-config-prettier": "^8.3.0",
+    "@babel/preset-env": "^7.24.4",
+    "@babel/preset-react": "^7.24.1",
+    "@testing-library/jest-dom": "^6.0.0",
+    "@testing-library/react": "^15.0.2",
+    "@testing-library/user-event": "^14.5.2",
+    "@vitejs/plugin-react": "^4.0.0",
+    "babel-jest": "^29.7.0",
+    "eslint": "^8.57.0",
+    "eslint-config-prettier": "^9.1.0",
    "eslint-config-react-app": "^7.0.1",
-    "eslint-plugin-prettier": "^4.2.1",
+    "eslint-plugin-prettier": "^5.1.3",
+    "jest": "^29.7.0",
+    "jest-environment-jsdom": "^29.7.0",
    "jest-fetch-mock": "^3.0.3",
-    "prettier": "^2.2.0",
-    "ra-test": "^3.15.0"
+    "prettier": "^3.2.5",
+    "react-test-renderer": "^18.2.0",
+    "vite": "^5.0.0",
+    "vite-plugin-version-mark": "^0.0.13"
  },
  "dependencies": {
-    "@emotion/react": "^11.7.1",
-    "@emotion/styled": "^11.6.0",
-    "@mui/icons-material": "^5.3.1",
-    "@mui/material": "^5.4.0",
-    "papaparse": "^5.2.0",
-    "prop-types": "^15.7.2",
-    "ra-language-chinese": "^2.0.10",
-    "ra-language-french": "^4.2.0",
-    "ra-language-german": "^3.13.4",
-    "react": "^17.0.0",
-    "react-admin": "^3.19.7",
-    "react-dom": "^17.0.2",
-    "react-scripts": "^5.0.1"
+    "@haleos/ra-language-german": "^1.0.0",
+    "@haxqer/ra-language-chinese": "^4.16.2",
+    "@mui/icons-material": "^5.15.15",
+    "@mui/material": "^5.15.15",
+    "@mui/styles": "^5.15.15",
+    "papaparse": "^5.4.1",
+    "ra-language-farsi": "^4.2.0",
+    "ra-language-french": "^4.16.15",
+    "ra-language-italian": "^3.13.1",
+    "react": "^18.0.0",
+    "react-admin": "^4.16.15",
+    "react-dom": "^18.0.0"
  },
  "scripts": {
-    "start": "REACT_APP_VERSION=$(git describe --tags) react-scripts start",
-    "build": "REACT_APP_VERSION=$(git describe --tags) react-scripts build",
+    "start": "vite serve",
+    "build": "vite build",
    "fix:other": "yarn prettier --write",
    "fix:code": "yarn test:lint --fix",
    "fix": "yarn fix:code && yarn fix:other",
    "prettier": "prettier --ignore-path .gitignore \"**/*.{js,jsx,json,md,scss,yaml,yml}\"",
-    "test:code": "react-scripts test",
+    "test:code": "jest",
    "test:lint": "eslint --ignore-path .gitignore --ext .js,.jsx .",
    "test:style": "yarn prettier --list-different",
-    "test": "yarn test:style && yarn test:lint && yarn test:code",
-    "eject": "react-scripts eject"
+    "test": "yarn test:style && yarn test:lint && yarn test:code"
+  },
+  "babel": {
+    "presets": [
+      "@babel/preset-env",
+      [
+        "@babel/preset-react",
+        {
+          "runtime": "automatic"
+        }
+      ]
+    ]
  },
  "eslintConfig": {
    "extends": "react-app"
  },
+  "jest": {
+    "testEnvironment": "jsdom",
+    "setupFilesAfterEnv": [
+      "<rootDir>/src/setupTests.js"
+    ]
+  },
  "browserslist": {
    "production": [
      ">0.2%",
--- a/pkgs/tools/admin/synapse-admin/yarn.lock
+++ b/pkgs/tools/admin/synapse-admin/yarn.lock
--- a/pkgs/tools/misc/usbimager/default.nix
+++ b/pkgs/tools/misc/usbimager/default.nix
@ -29,6 +29,11 @@ stdenv.mkDerivation rec {
      -e 's|install -m 2755 -g $(GRP)|install |g' Makefile
  '';

+  postInstall = ''
+    substituteInPlace $out/share/applications/usbimager.desktop \
+      --replace-fail "Exec=/usr/bin/usbimager" "Exec=usbimager"
+  '';
+
  dontConfigure = true;

  makeFlags =  [ "PREFIX=$(out)" ]
--- a/pkgs/tools/misc/zellij/default.nix
+++ b/pkgs/tools/misc/zellij/default.nix
@ -16,16 +16,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "zellij";
-  version = "0.40.0";
+  version = "0.40.1";

  src = fetchFromGitHub {
    owner = "zellij-org";
    repo = "zellij";
    rev = "v${version}";
-    hash = "sha256-1z7qIgjElE9gw0lY+A17gsYIcnKRceZTFnRd8fMeBg8=";
+    hash = "sha256-n8cwsCeKWzTw/psvLL3chBr8EcwGoeKB8JeiLSLna1k=";
  };

-  cargoHash = "sha256-KXXldWtcUsdbDsWd66Q1TbaClfr+Uo8f6gCi1exNIRc=";
+  cargoHash = "sha256-TyIQaovmpiu7USURA//+IQWNT95rrVk0x9TRspXYUNk=";

  nativeBuildInputs = [
    mandown
--- a/pkgs/tools/networking/goimapnotify/default.nix
+++ b/pkgs/tools/networking/goimapnotify/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "goimapnotify";
-  version = "2.3.12";
+  version = "2.3.15";

  src = fetchFromGitLab {
    owner = "shackra";
    repo = "goimapnotify";
    rev = version;
-    sha256 = "sha256-H1psA73ZBz4ZCFWGpiAXQ3bDLVH3jPnyOvPtUdsO6BA=";
+    sha256 = "sha256-da2Q+glDVWSf574pks6UzvQyzKAU+81ypy5H968Y7HE=";
  };

  vendorHash = "sha256-DphGe9jbKo1aIfpF5kRYNSn/uIYHaRMrygda5t46svw=";
--- a/pkgs/tools/networking/netbird/default.nix
+++ b/pkgs/tools/networking/netbird/default.nix
@ -31,16 +31,16 @@ let
 in
 buildGoModule rec {
  pname = "netbird";
-  version = "0.27.3";
+  version = "0.27.4";

  src = fetchFromGitHub {
    owner = "netbirdio";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Df30R6/dKihB1F3NR9zH4AFe7IozN27xaGMe6M7hoDA=";
+    hash = "sha256-+IcgzwLUA8OIa9od5LkGnI05FTbxC8PmOf8s5+akTrk=";
  };

-  vendorHash = "sha256-HJEZ1VrKS1MXKtpDjVorMiecb94+f1mBWPkWng4YqZk=";
+  vendorHash = "sha256-LPq6ovulE+xdoRaQpwA0mNqw3kFxMs/am1ucO8UmDtU=";

  nativeBuildInputs = [ installShellFiles ] ++ lib.optional ui pkg-config;

--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@ -181,7 +181,7 @@ in lib.makeExtensible (self: ({
    };
  };

-  latest = self.nix_2_21;
+  latest = self.nix_2_22;

  # The minimum Nix version supported by Nixpkgs
  # Note that some functionality *might* have been backported into this Nix version,
--- a/pkgs/tools/text/vale/default.nix
+++ b/pkgs/tools/text/vale/default.nix
@ -10,7 +10,7 @@

 buildGoModule rec {
  pname = "vale";
-  version = "3.4.1";
+  version = "3.4.2";

  subPackages = [ "cmd/vale" ];

@ -18,10 +18,10 @@ buildGoModule rec {
    owner = "errata-ai";
    repo = "vale";
    rev = "v${version}";
-    hash = "sha256-fD2KBKDfKTNYuzP/zKkAx9h/HMxOlAyiWtp9EsWxop8=";
+    hash = "sha256-9923mmZZmg08Zq+Vbt4zus0UvmsTJ/r1ddVdeOB7yJU=";
  };

-  vendorHash = "sha256-HMzFLSmO6sBDNU89UoIvHcPPd3ubpti2ii4sFMKUDmI=";
+  vendorHash = "sha256-4GtMKhxGkNwF6ydFE708SbzBm9mwCDKtINljTQXwz2c=";

  ldflags = [ "-s" "-w" "-X main.version=${version}" ];

--- a/pkgs/tools/virtualization/jumppad/default.nix
+++ b/pkgs/tools/virtualization/jumppad/default.nix
@ -2,18 +2,21 @@

 buildGoModule rec {
  pname = "jumppad";
-  version = "0.5.59";
+  version = "0.11.1";

  src = fetchFromGitHub {
    owner = "jumppad-labs";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-ObDbZ3g+BtH8JCqLIa+gR69GowZA8T9HMPuKNDgW3uA=";
+    repo = "jumppad";
+    rev = version;
+    hash = "sha256-8oynWGvWRqXcIBpgLEpFFDwPCbyePXJmFC8xgKPaN9Q=";
  };
-  vendorHash = "sha256-9DLDc6zI0BYd2AK9xwqFNJTFdKXagkdPwczLhCvud94=";
+  vendorHash = "sha256-39CORZ5qqbMJuTzYt1sKbHPPYkQEwQWSIQ4hWqdUFmk=";
+
+  subPackages = [ "." ];

  ldflags = [
-    "-s" "-w" "-X main.version=${version}"
+    "-s"
+    "-X main.version=${version}"
  ];

  # Tests require a large variety of tools and resources to run including
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -1073,6 +1073,7 @@ mapAliases ({
  rccl = throw "'rccl' has been replaced with 'rocmPackages.rccl'"; # Added 2023-10-08
  rdc = throw "'rdc' has been replaced with 'rocmPackages.rdc'"; # Added 2023-10-08
  readline63 = throw "'readline63' has been replaced with 'readline'"; # Added 2024-02-10
+  redocly-cli = redocly; # Added 2024-04-14
  redpanda = redpanda-client; # Added 2023-10-14
  restya-board = throw "'restya-board' has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2024-01-22
  retdec-full = throw "'retdec-full' is no longer needed, please use 'retdec'"; # Added 2024-02-05
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -25950,8 +25950,6 @@ with pkgs;

  kamailio = callPackage ../servers/sip/kamailio { };

-  kanidm = callPackage ../servers/kanidm { };
-
  kapowbang = callPackage ../servers/kapowbang { };

  keycloak = callPackage ../servers/keycloak { };
@ -35344,8 +35342,6 @@ with pkgs;

  neovim-remote = callPackage ../applications/editors/neovim/neovim-remote.nix { };

-  vis = callPackage ../applications/editors/vis { };
-
  viw = callPackage ../applications/editors/viw { };

  virter = callPackage ../applications/virtualization/virter { };
@ -40009,8 +40005,6 @@ with pkgs;

  OSCAR = qt5.callPackage ../applications/misc/OSCAR { };

-  parsedmarc = with python3Packages; toPythonApplication parsedmarc;
-
  pgmanage = callPackage ../applications/misc/pgmanage { };

  pgadmin4 = callPackage ../tools/admin/pgadmin { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -13501,6 +13501,8 @@ self: super: with self; {

  sanic-testing = callPackage ../development/python-modules/sanic-testing { };

+  sanix = callPackage ../development/python-modules/sanix { };
+
  sansio-multipart = callPackage ../development/python-modules/sansio-multipart { };

  sarif-om = callPackage ../development/python-modules/sarif-om { };
@ -16299,6 +16301,8 @@ self: super: with self; {

  uarray = callPackage ../development/python-modules/uarray { };

+  uart-devices = callPackage ../development/python-modules/uart-devices { };
+
  uasiren = callPackage ../development/python-modules/uasiren { };

  ubelt = callPackage ../development/python-modules/ubelt { };