Merge master into staging-next

2024-11-14 06:05:02 +00:00 · 2024-11-14 06:05:02 +00:00 · c79fde307d
commit c79fde307d
parent b50e7536f8 19d66fab29
105 changed files with 2669 additions and 4632 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4134,6 +4134,12 @@
    githubId = 43564;
    name = "Claes Holmerson";
  };
+  claha = {
+    email = "hallstrom.claes@gmail.com";
+    github = "claha";
+    githubId = 9336788;
+    name = "Claes Hallström";
+  };
  clebs = {
    email = "borja.clemente@gmail.com";
    github = "clebs";
@ -24175,7 +24181,7 @@
    githubId = 47071325;
  };
  ymstnt = {
-    name = "YMSTNT";
+    name = "ymstnt";
    github = "ymstnt";
    githubId = 21342713;
  };
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -197,6 +197,8 @@

 - [Zapret](https://github.com/bol-van/zapret), a DPI bypass tool. Available as [services.zapret](option.html#opt-services.zapret.enable).

+- [Glances](https://github.com/nicolargo/glances), an open-source system cross-platform monitoring tool. Available as [services.glances](option.html#opt-services.glances).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}

 - Nixpkgs now requires Nix 2.3.17 or newer to allow for zstd compressed binary artifacts.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -888,6 +888,7 @@
  ./services/monitoring/do-agent.nix
  ./services/monitoring/fusion-inventory.nix
  ./services/monitoring/gatus.nix
+  ./services/monitoring/glances.nix
  ./services/monitoring/goss.nix
  ./services/monitoring/grafana-agent.nix
  ./services/monitoring/grafana-image-renderer.nix
--- a/nixos/modules/services/monitoring/glances.md
+++ b/nixos/modules/services/monitoring/glances.md
@ -0,0 +1,20 @@
+# Glances {#module-serives-glances}
+
+Glances an Eye on your system. A top/htop alternative for GNU/Linux, BSD, Mac OS
+and Windows operating systems.
+
+Visit [the Glances project page](https://github.com/nicolargo/glances) to learn
+more about it.
+
+# Quickstart {#module-serives-glances-quickstart}
+
+Use the following configuration to start a public instance of Glances locally:
+
+```nix
+{
+  services.glances = {
+    enable = true;
+    openFirewall = true;
+  };
+};
+```
--- a/nixos/modules/services/monitoring/glances.nix
+++ b/nixos/modules/services/monitoring/glances.nix
@ -0,0 +1,110 @@
+{
+  pkgs,
+  config,
+  lib,
+  utils,
+  ...
+}:
+let
+  cfg = config.services.glances;
+
+  inherit (lib)
+    getExe
+    maintainers
+    mkEnableOption
+    mkOption
+    mkIf
+    mkPackageOption
+    ;
+
+  inherit (lib.types)
+    bool
+    listOf
+    port
+    str
+    ;
+
+  inherit (utils)
+    escapeSystemdExecArgs
+    ;
+
+in
+{
+  options.services.glances = {
+    enable = mkEnableOption "Glances";
+
+    package = mkPackageOption pkgs "glances" { };
+
+    port = mkOption {
+      description = "Port the server will isten on.";
+      type = port;
+      default = 61208;
+    };
+
+    openFirewall = mkOption {
+      description = "Open port in the firewall for glances.";
+      type = bool;
+      default = false;
+    };
+
+    extraArgs = mkOption {
+      type = listOf str;
+      default = [ "--webserver" ];
+      example = [
+        "--webserver"
+        "--disable-webui"
+      ];
+      description = ''
+        Extra command-line arguments to pass to glances.
+
+        See https://glances.readthedocs.io/en/latest/cmds.html for all available options.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services."glances" = {
+      description = "Glances";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        DynamicUser = true;
+        ExecStart = "${getExe cfg.package} --port ${toString cfg.port} ${escapeSystemdExecArgs cfg.extraArgs}";
+        Restart = "on-failure";
+
+        NoNewPrivileges = true;
+        ProtectSystem = "full";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        MemoryDenyWriteExecute = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+          "AF_UNIX"
+        ];
+        LockPersonality = true;
+        RestrictRealtime = true;
+        ProtectClock = true;
+        ReadWritePaths = [ "/var/log" ];
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+        SystemCallFilter = [ "@system-service" ];
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+  };
+
+  meta.maintainers = with maintainers; [ claha ];
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -383,6 +383,7 @@ in {
  gitolite = handleTest ./gitolite.nix {};
  gitolite-fcgiwrap = handleTest ./gitolite-fcgiwrap.nix {};
  glance = runTest ./glance.nix;
+  glances = runTest ./glances.nix;
  glusterfs = handleTest ./glusterfs.nix {};
  gnome = handleTest ./gnome.nix {};
  gnome-extensions = handleTest ./gnome-extensions.nix {};
--- a/nixos/tests/glances.nix
+++ b/nixos/tests/glances.nix
@ -0,0 +1,36 @@
+{ lib, ... }:
+
+{
+  name = "glances";
+
+  nodes = {
+    machine_default =
+      { pkgs, ... }:
+      {
+        services.glances = {
+          enable = true;
+        };
+      };
+
+    machine_custom_port =
+      { pkgs, ... }:
+      {
+        services.glances = {
+          enable = true;
+          port = 5678;
+        };
+      };
+  };
+
+  testScript = ''
+    machine_default.start()
+    machine_default.wait_for_unit("glances.service")
+    machine_default.wait_for_open_port(61208)
+
+    machine_custom_port.start()
+    machine_custom_port.wait_for_unit("glances.service")
+    machine_custom_port.wait_for_open_port(5678)
+  '';
+
+  meta.maintainers = [ lib.maintainers.claha ];
+}
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
@ -70,5 +70,6 @@ stdenv.mkDerivation rec {
    license = licenses.unfree;
    platforms = [ "x86_64-linux" ];
    maintainers = with maintainers; [ bfortz michalrus mrVanDalo ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
@ -116,5 +116,6 @@ stdenv.mkDerivation rec {
    license = licenses.unfree;
    platforms = [ "x86_64-linux" ];
    maintainers = with maintainers; [ bfortz michalrus mrVanDalo ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix
@ -131,5 +131,6 @@ stdenv.mkDerivation rec {
    license = licenses.unfree;
    platforms = [ "x86_64-linux" ];
    maintainers = with maintainers; [ bfortz michalrus mrVanDalo ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/applications/audio/pianoteq/default.nix
+++ b/pkgs/applications/audio/pianoteq/default.nix
@ -103,6 +103,7 @@ let
        inherit mainProgram;
        platforms = [ "x86_64-linux" "aarch64-linux" ];
        maintainers = with maintainers; [ mausch ners ];
+        sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
      };
    };

--- a/pkgs/applications/editors/android-studio/common.nix
+++ b/pkgs/applications/editors/android-studio/common.nix
@ -294,6 +294,7 @@ let
        dev = stable;
      }."${channel}";
      mainProgram = pname;
+      sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
    };
  }
  ''
--- a/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix
@ -129,5 +129,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
      "x86_64-linux"
      "aarch64-linux"
    ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/applications/system/glances/default.nix
+++ b/pkgs/applications/system/glances/default.nix
@ -8,6 +8,8 @@
  packaging,
  psutil,
  setuptools,
+  pydantic,
+  nixosTests,
  # Optional dependencies:
  fastapi,
  jinja2,
@ -69,6 +71,10 @@ buildPythonApplication rec {
    prometheus-client
  ] ++ lib.optional stdenv.hostPlatform.isLinux hddtemp;

+  passthru.tests = {
+    service = nixosTests.glances;
+  };
+
  meta = {
    homepage = "https://nicolargo.github.io/glances/";
    description = "Cross-platform curses-based monitoring tool";
--- a/pkgs/applications/virtualization/lima/default.nix
+++ b/pkgs/applications/virtualization/lima/default.nix
@ -4,32 +4,33 @@
 , fetchFromGitHub
 , installShellFiles
 , qemu
-, xcbuild
 , sigtool
 , makeWrapper
+, nix-update-script
+, apple-sdk_15
 }:

 buildGoModule rec {
  pname = "lima";
-  version = "0.22.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "lima-vm";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-ZX2FSZz9q56zWPSHPvXUOf2lzBupjgdTXgWpH1SBJY8=";
+    sha256 = "sha256-XYB8Nxbs76xmiiZ7IYfgn+UgUr6CLOalQrl6Ibo+DRc=";
  };

-  vendorHash = "sha256-P0Qnfu/cqLveAwz9jf/wTXxkoh0jvazlE5C/PcUrWsA=";
+  vendorHash = "sha256-nNSBwvhKSWs6to37+RLziYQqVOYfvjYib3fRRALACho=";

  nativeBuildInputs = [ makeWrapper installShellFiles ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild.xcrun sigtool ];
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ sigtool ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_15 ];

-  # clean fails with read only vendor dir
  postPatch = ''
    substituteInPlace Makefile \
-      --replace 'binaries: clean' 'binaries:' \
-      --replace 'codesign --entitlements vz.entitlements -s -' 'codesign --force --entitlements vz.entitlements -s -'
+      --replace-fail 'codesign -f -v --entitlements vz.entitlements -s -' 'codesign -f --entitlements vz.entitlements -s -'
  '';

  # It attaches entitlements with codesign and strip removes those,
@ -57,9 +58,11 @@ buildGoModule rec {

  doInstallCheck = true;
  installCheckPhase = ''
-    USER=nix $out/bin/limactl validate examples/default.yaml
+    USER=nix $out/bin/limactl validate templates/default.yaml
  '';

+  passthru.updateScript = nix-update-script { };
+
  meta = with lib; {
    homepage = "https://github.com/lima-vm/lima";
    description = "Linux virtual machines (on macOS, in most cases)";
--- a/pkgs/applications/window-managers/i3/default.nix
+++ b/pkgs/applications/window-managers/i3/default.nix
@ -1,40 +1,101 @@
-{ fetchurl, lib, stdenv, pkg-config, makeWrapper, meson, ninja, installShellFiles, libxcb, xcbutilkeysyms
-, xcbutil, xcbutilwm, xcbutilxrm, libstartup_notification, libX11, pcre2, libev
-, yajl, xcb-util-cursor, perl, pango, perlPackages, libxkbcommon
-, xorgserver, xvfb-run, xdotool, xorg, which
-, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, findXMLCatalogs
-, nixosTests
+{
+  fetchFromGitHub,
+  lib,
+  stdenv,
+  pkg-config,
+  makeWrapper,
+  meson,
+  ninja,
+  installShellFiles,
+  libxcb,
+  xcbutilkeysyms,
+  xcbutil,
+  xcbutilwm,
+  xcbutilxrm,
+  libstartup_notification,
+  libX11,
+  pcre2,
+  libev,
+  yajl,
+  xcb-util-cursor,
+  perl,
+  pango,
+  perlPackages,
+  libxkbcommon,
+  xorgserver,
+  xvfb-run,
+  xdotool,
+  xorg,
+  which,
+  asciidoc,
+  xmlto,
+  docbook_xml_dtd_45,
+  docbook_xsl,
+  findXMLCatalogs,
+  nixosTests,
+  nix-update-script,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "i3";
-  version = "4.23";
+  version = "4.24";

-  src = fetchurl {
-    url = "https://i3wm.org/downloads/${pname}-${version}.tar.xz";
-    sha256 = "sha256-YQJqcZbJE50POq3ScZfosyDFduOkUOAddMGspIQETEY=";
+  src = fetchFromGitHub {
+    owner = "i3";
+    repo = "i3";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-2tuhfB/SMN+osCBfZtw/yDPhNNEhBH4Qo6dexpqVWYk=";
  };

  nativeBuildInputs = [
-    pkg-config makeWrapper meson ninja installShellFiles perl
-    asciidoc xmlto docbook_xml_dtd_45 docbook_xsl findXMLCatalogs
+    pkg-config
+    makeWrapper
+    meson
+    ninja
+    installShellFiles
+    perl
+    asciidoc
+    xmlto
+    docbook_xml_dtd_45
+    docbook_xsl
+    findXMLCatalogs
  ];

  mesonFlags = [
-    "-Ddocs=true"
-    "-Dmans=true"
+    (lib.mesonBool "docs" true)
+    (lib.mesonBool "mans" true)
  ];

-  buildInputs = [
-    libxcb xcbutilkeysyms xcbutil xcbutilwm xcbutilxrm libxkbcommon
-    libstartup_notification libX11 pcre2 libev yajl xcb-util-cursor perl pango
-    perlPackages.AnyEventI3 perlPackages.X11XCB perlPackages.IPCRun
-    perlPackages.ExtUtilsPkgConfig perlPackages.InlineC
-  ] ++ lib.optionals doCheck [
-    xorgserver xvfb-run xdotool xorg.setxkbmap xorg.xrandr which
-  ];
-
-  configureFlags = [ "--disable-builddir" ];
+  buildInputs =
+    [
+      libxcb
+      xcbutilkeysyms
+      xcbutil
+      xcbutilwm
+      xcbutilxrm
+      libxkbcommon
+      libstartup_notification
+      libX11
+      pcre2
+      libev
+      yajl
+      xcb-util-cursor
+      perl
+      pango
+      perlPackages.AnyEventI3
+      perlPackages.X11XCB
+      perlPackages.IPCRun
+      perlPackages.ExtUtilsPkgConfig
+      perlPackages.InlineC
+    ]
+    ++ lib.optionals finalAttrs.doCheck [
+      xorgserver
+      xvfb-run
+      xdotool
+      xorg.setxkbmap
+      xorg.xrandr
+      which
+    ];

  postPatch = ''
    patchShebangs .
@ -43,7 +104,7 @@ stdenv.mkDerivation rec {
    # patchShebangs can't replace a shebang in the middle of a file.
    if [ -f testcases/t/318-i3-dmenu-desktop.t ]; then
      substituteInPlace testcases/t/318-i3-dmenu-desktop.t \
-        --replace-fail "#!/usr/bin/env perl" "#!${perl}/bin/perl"
+        --replace-fail "#!/usr/bin/env perl" "#!${lib.getExe perl}"
    fi
  '';

@ -51,6 +112,8 @@ stdenv.mkDerivation rec {
  doCheck = stdenv.hostPlatform.isLinux;

  checkPhase = ''
+    runHook preCheck
+
    test_failed=
    # "| cat" disables fancy progress reporting which makes the log unreadable.
    ./complete-run.pl -p 1 --keep-xserver-output | cat || test_failed="complete-run.pl returned $?"
@ -66,6 +129,8 @@ stdenv.mkDerivation rec {
      echo "===== End of test log ====="
      false
    fi
+
+    runHook postCheck
  '';

  postInstall = ''
@ -79,16 +144,23 @@ stdenv.mkDerivation rec {

  separateDebugInfo = true;

-  passthru.tests = { inherit (nixosTests) i3wm; };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      inherit (nixosTests) i3wm;
+    };
+  };

-
-  meta = with lib; {
+  meta = {
    description = "Tiling window manager";
-    homepage    = "https://i3wm.org";
-    maintainers = with maintainers; [ modulistic fpletz ];
+    homepage = "https://i3wm.org";
+    maintainers = with lib.maintainers; [
+      modulistic
+      fpletz
+    ];
    mainProgram = "i3";
-    license     = licenses.bsd3;
-    platforms   = platforms.all;
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.unix;

    longDescription = ''
      A tiling window manager primarily targeted at advanced users and
@ -98,5 +170,4 @@ stdenv.mkDerivation rec {
      UTF-8 clean.
    '';
  };
-
-}
+})
--- a/pkgs/by-name/ag/age-plugin-yubikey/package.nix
+++ b/pkgs/by-name/ag/age-plugin-yubikey/package.nix
@ -5,6 +5,7 @@
 , pkg-config
 , openssl
 , pcsclite
+, apple-sdk_11
 }:

 rustPlatform.buildRustPackage rec {
@ -32,7 +33,8 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [
    openssl
  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [ pcsclite ];
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ pcsclite ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_11 ];

  meta = with lib; {
    description = "YubiKey plugin for age";
--- a/pkgs/by-name/an/anytype/package.nix
+++ b/pkgs/by-name/an/anytype/package.nix
@ -2,11 +2,11 @@

 let
  pname = "anytype";
-  version = "0.43.1";
+  version = "0.43.4";
  name = "Anytype-${version}";
  src = fetchurl {
    url = "https://github.com/anyproto/anytype-ts/releases/download/v${version}/${name}.AppImage";
-    hash = "sha256-9CjzFJcMiEGods2Ulm4Ow3lIBXc7HPcWMUFM4cG7GuM=";
+    hash = "sha256-2/+bLRx+iVTBDAH599+TpLquq/z/2FFJ5i6Mz8u4HuM=";
  };
  appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in appimageTools.wrapType2 {
--- a/pkgs/by-name/ba/banana-accounting/package.nix
+++ b/pkgs/by-name/ba/banana-accounting/package.nix
@ -56,5 +56,6 @@ stdenv.mkDerivation {
    license = licenses.unfree;
    platforms = [ "x86_64-linux" ];
    maintainers = with maintainers; [ jacg ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/by-name/bi/binary/package.nix
+++ b/pkgs/by-name/bi/binary/package.nix
@ -1,37 +1,41 @@
 {
  lib,
-  fetchFromGitHub,
-  python3Packages,
  appstream,
  blueprint-compiler,
  desktop-file-utils,
+  fetchFromGitHub,
  glib,
  gobject-introspection,
+  gtk4,
  libadwaita,
  meson,
  ninja,
  pkg-config,
+  python3Packages,
  wrapGAppsHook4,
 }:

 python3Packages.buildPythonApplication rec {
  pname = "binary";
-  version = "5.0";
-  format = "other";
+  version = "5.1";
+  pyproject = false;

  src = fetchFromGitHub {
    owner = "fizzyizzy05";
    repo = "binary";
    rev = "refs/tags/${version}";
-    hash = "sha256-T/gFXYcUJBN1NWMQaFco1bqqZTz3JHQpM8C2Y5yz7SI=";
+    hash = "sha256-HBmWaT0cjYz3UAO1r5chFW7KARpL1EnY8wEeR9etPE0=";
  };

+  strictDeps = true;
+
  nativeBuildInputs = [
    appstream
    blueprint-compiler
-    desktop-file-utils
-    glib # need glib-compile-schemas
+    desktop-file-utils # for `desktop-file-validate`
+    glib # for `glib-compile-schemas`
    gobject-introspection
+    gtk4 # for `gtk-update-icon-cache`
    meson
    ninja
    pkg-config
@ -45,6 +49,13 @@ python3Packages.buildPythonApplication rec {
  dontWrapGApps = true;
  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];

+  # NOTE: `postCheck` is intentionally not used here, as the entire checkPhase
+  # is skipped by `buildPythonApplication`
+  # https://github.com/NixOS/nixpkgs/blob/9d4343b7b27a3e6f08fc22ead568233ff24bbbde/pkgs/development/interpreters/python/mk-python-derivation.nix#L296
+  postInstallCheck = ''
+    mesonCheckPhase
+  '';
+
  meta = {
    description = "Small and simple app to convert numbers to a different base";
    homepage = "https://github.com/fizzyizzy05/binary";
--- a/pkgs/by-name/cl/clojure-lsp/package.nix
+++ b/pkgs/by-name/cl/clojure-lsp/package.nix
@ -10,23 +10,23 @@

 buildGraalvmNativeImage rec {
  pname = "clojure-lsp";
-  version = "2024.04.22-11.50.26";
+  version = "2024.08.05-18.16.00";

  src = fetchFromGitHub {
    owner = "clojure-lsp";
    repo = "clojure-lsp";
    rev = version;
-    hash = "sha256-GyPIFYR+/BZ+vq6+yuer5HoVILXLWNw1sW8XpJ7q4SA=";
+    hash = "sha256-U66Zo0o50Pw1IAph/KmrR6pYGuOFVM9K6SzaSaYdx2M=";
  };

  jar = fetchurl {
    url = "https://github.com/clojure-lsp/clojure-lsp/releases/download/${version}/clojure-lsp-standalone.jar";
-    hash = "sha256-dB16225A7L3nWplvqlal+5gho+LmqqVGPN9dfasKaPk=";
+    hash = "sha256-rQlYrcmZwmBBWwa+28TcBFzzqmzTAM9Do3aH55Y6LFI=";
  };

  extraNativeImageBuildArgs = [
    # These build args mirror the build.clj upstream
-    # ref: https://github.com/clojure-lsp/clojure-lsp/blob/2024.04.22-11.50.26/cli/build.clj#L141-L144
+    # ref: https://github.com/clojure-lsp/clojure-lsp/blob/2024.08.05-18.16.00/cli/build.clj#L141-L144
    "--no-fallback"
    "--native-image-info"
    "--features=clj_easy.graal_build_time.InitClojureClasses"
--- a/pkgs/by-name/cl/clonehero/package.nix
+++ b/pkgs/by-name/cl/clonehero/package.nix
@ -119,5 +119,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = licenses.unfree;
    maintainers = with maintainers; [ kira-bruneau syboxez ];
    platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 })
--- a/pkgs/by-name/co/commit/package.nix
+++ b/pkgs/by-name/co/commit/package.nix
@ -1,29 +1,32 @@
 {
  lib,
  stdenv,
-  fetchFromGitHub,
-  appstream-glib,
+  appstream,
  blueprint-compiler,
  desktop-file-utils,
+  fetchFromGitHub,
  gjs,
+  glib,
+  gtk4,
  gtksourceview5,
  libadwaita,
  libspelling,
  meson,
  ninja,
+  nix-update-script,
  pkg-config,
  wrapGAppsHook4,
-  nix-update-script,
 }:
-stdenv.mkDerivation rec {
+
+stdenv.mkDerivation (finalAttrs: {
  pname = "commit";
-  version = "4.1";
+  version = "4.2";

  src = fetchFromGitHub {
    owner = "sonnyp";
    repo = "Commit";
-    rev = "v${version}";
-    hash = "sha256-HhyoQ4wrc8dHvVU+MylJgaKu9HwSw+/f6UDTIM2YRNk=";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-L8CI8SAGWhhJyTc8aMPV0s+UevEJGE7n1l7fFnTjdPw=";
    fetchSubmodules = true;
  };

@ -43,10 +46,15 @@ stdenv.mkDerivation rec {
    patchShebangs {,.}*
  '';

+  strictDeps = true;
+
  nativeBuildInputs = [
-    appstream-glib
+    appstream
    blueprint-compiler
-    desktop-file-utils
+    desktop-file-utils # for `desktop-file-validate` & `update-desktop-database`
+    gjs
+    glib # for `glib-compile-schemas`
+    gtk4 # for `gtk-update-icon-cache`
    meson
    ninja
    pkg-config
@ -54,12 +62,14 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
+    gjs
+    gtksourceview5
    libadwaita
    libspelling
-    gtksourceview5
-    gjs
  ];

+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
  passthru = {
    updateScript = nix-update-script { };
  };
@ -72,4 +82,4 @@ stdenv.mkDerivation rec {
    mainProgram = "re.sonny.Commit";
    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/co/computecpp-unwrapped/package.nix
+++ b/pkgs/by-name/co/computecpp-unwrapped/package.nix
@ -45,5 +45,6 @@ stdenv.mkDerivation rec {
    license = licenses.unfree;
    maintainers = with maintainers; [ davidtwco ];
    platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/by-name/cs/csharprepl/package.nix
+++ b/pkgs/by-name/cs/csharprepl/package.nix
@ -1,22 +1,27 @@
-{ buildDotnetGlobalTool, dotnetCorePackages, lib }:
+{
+  buildDotnetGlobalTool,
+  dotnetCorePackages,
+  lib,
+}:

 buildDotnetGlobalTool {
  pname = "csharprepl";
  nugetName = "CSharpRepl";
-  version = "0.6.6";
+  version = "0.6.7";

  dotnet-sdk = dotnetCorePackages.sdk_8_0;
-  dotnet-runtime = dotnetCorePackages.runtime_8_0;
+  # We're using an SDK here because it's a REPL, and it requires an SDK instaed of a runtime
+  dotnet-runtime = dotnetCorePackages.sdk_8_0;

-  nugetHash = "sha256-VkZGnfD8p6oAJ7i9tlfwJfmKfZBHJU7Wdq+K4YjPoRs=";
+  nugetHash = "sha256-a0CiU3D6RZp1FF459NIUUry5TFRDgm4FRhqJZNAGYWs=";

-  meta = with lib; {
+  meta = {
    description = "C# REPL with syntax highlighting";
    homepage = "https://fuqua.io/CSharpRepl";
    changelog = "https://github.com/waf/CSharpRepl/blob/main/CHANGELOG.md";
-    license = licenses.mpl20;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ donteatoreo ];
+    license = lib.licenses.mpl20;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ donteatoreo ];
    mainProgram = "csharprepl";
  };
 }
--- a/pkgs/by-name/de/dell-command-configure/package.nix
+++ b/pkgs/by-name/de/dell-command-configure/package.nix
@ -107,5 +107,6 @@ in stdenv.mkDerivation rec {
    license = licenses.unfree;
    maintainers = with maintainers; [ ryangibb ];
    platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/by-name/er/erlang-language-platform/package.nix
+++ b/pkgs/by-name/er/erlang-language-platform/package.nix
@ -51,5 +51,6 @@ stdenv.mkDerivation rec {
      "x86_64-darwin"
    ];
    maintainers = with lib.maintainers; [ offsetcyan ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/by-name/ev/everspace/package.nix
+++ b/pkgs/by-name/ev/everspace/package.nix
@ -114,5 +114,6 @@ stdenv.mkDerivation rec {
    license = licenses.unfree;
    maintainers = with maintainers; [ jtrees ];
    platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/by-name/fo/follow/package.nix
+++ b/pkgs/by-name/fo/follow/package.nix
@ -12,13 +12,13 @@
 stdenv.mkDerivation rec {
  pname = "follow";

-  version = "0.0.1-alpha.17";
+  version = "0.2.0-beta.2";

  src = fetchFromGitHub {
    owner = "RSSNext";
    repo = "Follow";
    rev = "v${version}";
-    hash = "sha256-amW+jpJ2E7muKwiWbblONRFzH849js2SaT+poUWQWZI=";
+    hash = "sha256-7KSPZj9QG6zksji/eY8jczBDHr/9tStlw26LKVqXTAw=";
  };

  nativeBuildInputs = [
@ -30,7 +30,7 @@ stdenv.mkDerivation rec {

  pnpmDeps = pnpm.fetchDeps {
    inherit pname version src;
-    hash = "sha256-e9Ui3oIS0wbDLgntF7PQZCll12yvWeKLISXVoK6BjuE=";
+    hash = "sha256-FzMjN0rIjYxexf6tix4qi3mnuPkadjKihhN0Pj5y2nU=";
  };

  env = {
@ -38,14 +38,23 @@ stdenv.mkDerivation rec {

    # This environment variables inject the production Vite config at build time.
    # Copy from:
-    # 1. https://github.com/RSSNext/Follow/blob/0745ac07dd2a4a34e4251c034678ace15c302697/.github/workflows/build.yml#L18
+    # 1. https://github.com/RSSNext/Follow/blob/v0.2.0-beta.2/.github/workflows/build.yml#L18
    # 2. And logs in the corresponding GitHub Actions: https://github.com/RSSNext/Follow/actions/workflows/build.yml
    VITE_WEB_URL = "https://app.follow.is";
    VITE_API_URL = "https://api.follow.is";
    VITE_IMGPROXY_URL = "https://thumbor.follow.is";
    VITE_SENTRY_DSN = "https://e5bccf7428aa4e881ed5cb713fdff181@o4507542488023040.ingest.us.sentry.io/4507570439979008";
-    VITE_BUILD_TYPE = "production";
-    VITE_POSTHOG_KEY = "phc_EZGEvBt830JgBHTiwpHqJAEbWnbv63m5UpreojwEWNL";
+    VITE_OPENPANEL_CLIENT_ID = "0e477ab4-d92d-4d6e-b889-b09d86ab908e";
+    VITE_OPENPANEL_API_URL = "https://openpanel.follow.is/api";
+    VITE_FIREBASE_CONFIG = builtins.toJSON {
+      apiKey = "AIzaSyDuM93019tp8VI7wsszJv8ChOs7b1EE5Hk";
+      authDomain = "follow-428106.firebaseapp.com";
+      projectId = "follow-428106";
+      storageBucket = "follow-428106.appspot.com";
+      messagingSenderId = "194977404578";
+      appId = "1:194977404578:web:1920bb0c9ea5e2373669fb";
+      measurementId = "G-SJE57D4F14";
+    };
  };

  desktopItem = makeDesktopItem {
--- a/pkgs/by-name/ga/garnet/deps.nix
+++ b/pkgs/by-name/ga/garnet/deps.nix
@ -2,10 +2,11 @@
 # Please dont edit it manually, your changes might get overwritten!

 { fetchNuGet }: [
-  (fetchNuGet { pname = "Azure.Core"; version = "1.25.0"; hash = "sha256-v9m4Jxa9hLH1gYK3kKITgSC0VLRdE/Qd0yBnPMnZ2XM="; })
-  (fetchNuGet { pname = "Azure.Storage.Blobs"; version = "12.14.1"; hash = "sha256-5HtijBNuV5RIg6MmU+xaeBuyfu7lu93dwv+fe2zU8sw="; })
-  (fetchNuGet { pname = "Azure.Storage.Common"; version = "12.13.0"; hash = "sha256-bi+rIM+7lgbrU8mOxYy0R+0tvYIe3MMUX9UuhbNfzxo="; })
+  (fetchNuGet { pname = "Azure.Core"; version = "1.41.0"; hash = "sha256-/ixQr8KFGlZa43gGd2A7aBzwu9h+wLO6OqIMy3YbW+Y="; })
+  (fetchNuGet { pname = "Azure.Storage.Blobs"; version = "12.21.2"; hash = "sha256-DvdMGuophEbvvVtbRU3vsNwla0zTn5dn7HbW0Mr4P/o="; })
+  (fetchNuGet { pname = "Azure.Storage.Common"; version = "12.20.1"; hash = "sha256-XBDyzAEt5iwdyB3jgoG5TLyx5NZ/MoiEerBR/7U7F4w="; })
  (fetchNuGet { pname = "CommandLineParser"; version = "2.9.1"; hash = "sha256-ApU9y1yX60daSjPk3KYDBeJ7XZByKW8hse9NRZGcjeo="; })
+  (fetchNuGet { pname = "KeraLua"; version = "1.4.1"; hash = "sha256-ouRL7+0bW/VYUNNYQoXenXzYO0HNF3D1IsScqtah3DE="; })
  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "1.1.1"; hash = "sha256-fAcX4sxE0veWM1CZBtXR/Unky+6sE33yrV7ohrWGKig="; })
  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; hash = "sha256-49+H/iFwp+AfCICvWcqo9us4CzxApPKC37Q5Eqrw+JU="; })
  (fetchNuGet { pname = "Microsoft.Build.Tasks.Git"; version = "8.0.0"; hash = "sha256-vX6/kPij8vNAu8f7rrvHHhPrNph20IcufmrBgZNxpQA="; })
@ -21,18 +22,19 @@
  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "8.0.0"; hash = "sha256-n2m4JSegQKUTlOsKLZUUHHKMq926eJ0w9N9G+I3FoFw="; })
  (fetchNuGet { pname = "Microsoft.Extensions.Options.ConfigurationExtensions"; version = "8.0.0"; hash = "sha256-A5Bbzw1kiNkgirk5x8kyxwg9lLTcSngojeD+ocpG1RI="; })
  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "8.0.0"; hash = "sha256-FU8qj3DR8bDdc1c+WeGZx/PCZeqqndweZM9epcpXjSo="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.5.1"; hash = "sha256-q4Q9HtdGbjfih1QegppYaJh1ZrzCzQ56NXM7lQ9ZvU0="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.5.1"; hash = "sha256-/Xuu3mzeicfMP4elmXkJvBLsoAye7c57sX+fRmE9yds="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.5.1"; hash = "sha256-Tro3KKW/WjAnVoaMcOwvLybp+/Mm8GCObS7DPbrNCv4="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Protocols"; version = "7.5.1"; hash = "sha256-WykYJpzRtoBaJxQth+euthUi9l2zwT1k7MIXwWdTeAs="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Protocols.OpenIdConnect"; version = "7.5.1"; hash = "sha256-1TO55DCgFxB8kzBdqwS58WK7mTyw+iOYQc8ZsCoDOKM="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.5.1"; hash = "sha256-gf0QQMx+/n8AMoH5Yrq17ndbAeFkN95qGVRxmI7J0pE="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Validators"; version = "7.5.1"; hash = "sha256-o1hxAT1gKqTGTlTHEMMcHmjn7RjtbACA0X99VBaH8cI="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "8.0.1"; hash = "sha256-zPWUKTCfGm4MWcYPU037NzezsFE1g8tEijjQkw5iooI="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "8.0.1"; hash = "sha256-Xv9MUnjb66U3xeR9drOcSX5n2DjOCIJZPMNSKjWHo9Y="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "8.0.1"; hash = "sha256-FfwrH/2eLT521Kqw+RBIoVfzlTNyYMqlWP3z+T6Wy2Y="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Protocols"; version = "8.0.1"; hash = "sha256-v3DIpG6yfIToZBpHOjtQHRo2BhXGDoE70EVs6kBtrRg="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Protocols.OpenIdConnect"; version = "8.0.1"; hash = "sha256-ZHKaZxqESk+OU1SFTFGxvZ71zbdgWqv1L6ET9+fdXX0="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "8.0.1"; hash = "sha256-beVbbVQy874HlXkTKarPTT5/r7XR1NGHA/50ywWp7YA="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Validators"; version = "8.0.1"; hash = "sha256-5LTLbFNWz33nco+hyKAEHcQeAWaBugJ0oMKR6AuEI34="; })
  (fetchNuGet { pname = "Microsoft.SourceLink.Common"; version = "8.0.0"; hash = "sha256-AfUqleVEqWuHE7z2hNiwOLnquBJ3tuYtbkdGMppHOXc="; })
  (fetchNuGet { pname = "Microsoft.SourceLink.GitHub"; version = "8.0.0"; hash = "sha256-hNTkpKdCLY5kIuOmznD1mY+pRdJ0PKu2HypyXog9vb0="; })
-  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.3"; hash = "sha256-hy/BieY4qxBWVVsDqqOPaLy1QobiIapkbrESm6v2PHc="; })
-  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.6.0"; hash = "sha256-CXjadDqpxzYqiZzF6t3Wl6Fum+8U1/cjmEBCkzxw7h4="; })
-  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "7.5.1"; hash = "sha256-1pBDkT0aL2xiPg55728rA0FHIqyCNnrv1TYLjuLnMV8="; })
+  (fetchNuGet { pname = "NLua"; version = "1.7.3"; hash = "sha256-2+eOxal0BDwAc6nJTNsFvf5E0KdfksIie7C7hEKeQos="; })
+  (fetchNuGet { pname = "System.ClientModel"; version = "1.0.0"; hash = "sha256-yHb72M/Z8LeSZea9TKw2eD0SdYEoCNwVw6Z3695SC2Y="; })
+  (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "6.0.1"; hash = "sha256-Xi8wrUjVlioz//TPQjFHqcV/QGhTqnTfUcltsNlcCJ4="; })
+  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "8.0.1"; hash = "sha256-hW4f9zWs0afxPbcMqCA/FAGvBZbBFSkugIOurswomHg="; })
  (fetchNuGet { pname = "System.Interactive.Async"; version = "6.0.1"; hash = "sha256-4yzkdop+BMlpQ+qz/H7D7LkH1Ekh9n51t9yteHpv/58="; })
  (fetchNuGet { pname = "System.IO.Hashing"; version = "6.0.0"; hash = "sha256-gSxLJ/ujWthLknylguRv40mwMl/qNcqnFI9SNjQY6lE="; })
  (fetchNuGet { pname = "System.Linq.Async"; version = "6.0.1"; hash = "sha256-uH5fZhcyQVtnsFc6GTUaRRrAQm05v5euJyWCXSFSOYI="; })
@ -40,8 +42,7 @@
  (fetchNuGet { pname = "System.Numerics.Vectors"; version = "4.5.0"; hash = "sha256-qdSTIFgf2htPS+YhLGjAGiLN8igCYJnCCo6r78+Q+c8="; })
  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; hash = "sha256-bEG1PnDp7uKYz/OgLOWs3RWwQSVYm+AnPwVmAmcgp2I="; })
  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "4.7.2"; hash = "sha256-CUZOulSeRy1CGBm7mrNrTumA9od9peKiIDR/Nb1B4io="; })
-  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "8.0.0"; hash = "sha256-IUQkQkV9po1LC0QsqrilqwNzPvnc+4eVvq+hCvq8fvE="; })
  (fetchNuGet { pname = "System.Text.Json"; version = "4.7.2"; hash = "sha256-xA8PZwxX9iOJvPbfdi7LWjM2RMVJ7hmtEqS9JvgNsoM="; })
-  (fetchNuGet { pname = "System.Text.Json"; version = "8.0.0"; hash = "sha256-XFcCHMW1u2/WujlWNHaIWkbW1wn8W4kI0QdrwPtWmow="; })
+  (fetchNuGet { pname = "System.Text.Json"; version = "8.0.5"; hash = "sha256-yKxo54w5odWT6nPruUVsaX53oPRe+gKzGvLnnxtwP68="; })
  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.4"; hash = "sha256-owSpY8wHlsUXn5xrfYAiu847L6fAKethlvYx97Ri1ng="; })
 ]
--- a/pkgs/by-name/ga/garnet/package.nix
+++ b/pkgs/by-name/ga/garnet/package.nix
@ -1,25 +1,31 @@
 {
  lib,
  buildDotnetModule,
-  fetchFromGitHub,
  dotnetCorePackages,
+  fetchFromGitHub,
  nix-update-script,
 }:
+
 buildDotnetModule rec {
  pname = "garnet";
-  version = "1.0.18";
+  version = "1.0.36";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "garnet";
-    rev = "v${version}";
-    hash = "sha256-vKjFUa/f/nsBaBkxwIhtMox2qtbBzy+ipuqFHtLhbr4=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-iWfRj1PN54TXiNMSYYNq0rjA50ag0lyEJdDFw0cMv4g=";
  };

  projectFile = "main/GarnetServer/GarnetServer.csproj";
  nugetDeps = ./deps.nix;

-  dotnet-sdk = with dotnetCorePackages; combinePackages [ sdk_6_0 sdk_8_0 ];
+  dotnet-sdk =
+    with dotnetCorePackages;
+    combinePackages [
+      sdk_6_0
+      sdk_8_0
+    ];
  dotnet-runtime = dotnetCorePackages.runtime_8_0;

  dotnetBuildFlags = [
--- a/pkgs/by-name/gc/gcs/package.nix
+++ b/pkgs/by-name/gc/gcs/package.nix
@ -22,7 +22,7 @@

 buildGoModule rec {
  pname = "gcs";
-  version = "5.27.0";
+  version = "5.28.1";

  src = fetchFromGitHub {
    owner = "richardwilkes";
@ -43,7 +43,7 @@ buildGoModule rec {
      . refresh-pdf.js.sh
    '';

-    hash = "sha256-QVkyemBQ7RrV3dpP3n7Pg0XljdxWtCphZIj2T77nKtU=";
+    hash = "sha256-ArJ+GveG2Y1PYeCuIFJoQ3eVyqvAi4HEeAEd4X03yu4=";
  };

  modPostBuild = ''
@ -51,14 +51,14 @@ buildGoModule rec {
    sed -i 's|-lmupdf[^ ]* |-lmupdf |g' vendor/github.com/richardwilkes/pdf/pdf.go
  '';

-  vendorHash = "sha256-+vCc1g5noAl/iwEYhNZJYPiScKqKGKlsuruoUO/4tiU=";
+  vendorHash = "sha256-EmAGkQ+GHzVbSq/nPu0awL79jRmZuMHheBWwanfEgGI=";

  frontend = buildNpmPackage {
    name = "${pname}-${version}-frontend";

    inherit src;
    sourceRoot = "${src.name}/server/frontend";
-    npmDepsHash = "sha256-VWTJg/pluRYVVBDiJ+t2uhyodRuIFfHpzCZMte1krDM=";
+    npmDepsHash = "sha256-LqOH3jhp4Mx7JGYSjF29kVUny3xNn7oX0qCYi79SH4w=";

    installPhase = ''
      runHook preInstall
--- a/pkgs/by-name/gt/gtklock-playerctl-module/package.nix
+++ b/pkgs/by-name/gt/gtklock-playerctl-module/package.nix
@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  gtk3,
+  playerctl,
+  libsoup_3,
+  gtklock,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gtklock-playerctl-module";
+  version = "4.0.0";
+
+  src = fetchFromGitHub {
+    owner = "jovanlanik";
+    repo = "gtklock-playerctl-module";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-YlnZxp06Bb8eIgZhCvbiX6jgnNuGoSv4wx0N4AD1V7o=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    gtk3
+    playerctl
+    libsoup_3
+  ];
+
+  passthru.tests.testModule = gtklock.testModule finalAttrs.finalPackage;
+
+  meta = {
+    description = "Gtklock module adding media player controls to the lockscreen";
+    homepage = "https://github.com/jovanlanik/gtklock-playerctl-module";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/gt/gtklock-powerbar-module/package.nix
+++ b/pkgs/by-name/gt/gtklock-powerbar-module/package.nix
@ -0,0 +1,40 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  gtk3,
+  gtklock,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gtklock-powerbar-module";
+  version = "4.0.0";
+
+  src = fetchFromGitHub {
+    owner = "jovanlanik";
+    repo = "gtklock-powerbar-module";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Zakdta1i0o7S2AbHydlonnh5OMGVgGjB2H/AiHgQT9A=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [ gtk3 ];
+
+  passthru.tests.testModule = gtklock.testModule finalAttrs.finalPackage;
+
+  meta = {
+    description = "Gtklock module adding power controls to the lockscreen";
+    homepage = "https://github.com/jovanlanik/gtklock-powerbar-module";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/gt/gtklock-userinfo-module/package.nix
+++ b/pkgs/by-name/gt/gtklock-userinfo-module/package.nix
@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  gtk3,
+  glib,
+  accountsservice,
+  gtklock,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gtklock-userinfo-module";
+  version = "4.0.0";
+
+  src = fetchFromGitHub {
+    owner = "jovanlanik";
+    repo = "gtklock-userinfo-module";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-d9S0Tj7aII2JQ5/PZmt8HaUIb5caoD4GND0PGvuRMn8=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    gtk3
+    glib
+    accountsservice
+  ];
+
+  passthru.tests.testModule = gtklock.testModule finalAttrs.finalPackage;
+
+  meta = {
+    description = "Gtklock module adding user info to the lockscreen";
+    homepage = "https://github.com/jovanlanik/gtklock-userinfo-module";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/gt/gtklock/package.nix
+++ b/pkgs/by-name/gt/gtklock/package.nix
@ -0,0 +1,74 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  scdoc,
+  pkg-config,
+  wrapGAppsHook3,
+  gtk3,
+  pam,
+  gtk-session-lock,
+  runCommand,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gtklock";
+  # Must run nixpkgs-review between version changes
+  version = "4.0.0";
+
+  src = fetchFromGitHub {
+    owner = "jovanlanik";
+    repo = "gtklock";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-e/JRJtQAyIvQhL5hSbY7I/f12Z9g2N0MAHQvX+aXz8Q=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    scdoc
+    pkg-config
+    wrapGAppsHook3
+  ];
+
+  buildInputs = [
+    gtk3
+    pam
+    gtk-session-lock
+  ];
+
+  strictDeps = true;
+
+  passthru.testModule =
+    module:
+    runCommand "${module.name}-test.sh" { } ''
+      MODULE_PATH=$(find ${module}/lib/gtklock -maxdepth 1 -name '*.so')
+      echo -e "[main]\nmodules=''${MODULE_PATH}" >./config.ini
+      ${finalAttrs.finalPackage}/bin/gtklock --config ./config.ini >./log 2>&1 || true
+      if grep incompatible ./log; then
+        echo "${module.name} is incompatible with current ${finalAttrs.finalPackage.name}!"
+        exit 1
+      else
+        echo "Successfully tested ${module.name} against ${finalAttrs.finalPackage.name}."
+      fi
+      touch $out
+    '';
+
+  meta = {
+    description = "GTK-based lockscreen for Wayland";
+    longDescription = ''
+      Important note: for gtklock to work you need to set "security.pam.services.gtklock = {};" manually.
+      Otherwise you'll lock youself out of desktop and unable to authenticate.
+    ''; # Following  nixpkgs/pkgs/applications/window-managers/sway/lock.nix
+    homepage = "https://github.com/jovanlanik/gtklock";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      dit7ya
+      aleksana
+    ];
+    platforms = lib.platforms.linux;
+    mainProgram = "gtklock";
+  };
+})
--- a/pkgs/by-name/hi/hifile/package.nix
+++ b/pkgs/by-name/hi/hifile/package.nix
@ -1,19 +1,24 @@
-{ lib, appimageTools, fetchurl }:
+{
+  lib,
+  appimageTools,
+  fetchurl,
+}:

 let
-  version = "0.9.9.13";
+  version = "0.9.9.15";
  pname = "hifile";

  src = fetchurl {
    url = "https://www.hifile.app/files/HiFile-${version}.AppImage";
-    hash = "sha256-nZlPdl7D0UWtm8mFz4IDqmvGeBVc7mbeUpzyHrdDQtk=";
+    hash = "sha256-Q0clcmBLWt8qDzHYjRRbwyZBSWW//yBTbRcnRjrSlzM=";
  };

  appimageContents = appimageTools.extractType2 {
    inherit pname version src;
  };

-in appimageTools.wrapType2 rec {
+in
+appimageTools.wrapType2 rec {
  inherit pname version src;

  extraInstallCommands = ''
@ -23,6 +28,8 @@ in appimageTools.wrapType2 rec {
      --replace-fail 'Exec=HiFile' 'Exec=${pname}'
  '';

+  passthru.updateScript = ./update.sh;
+
  meta = with lib; {
    description = "Dual-pane graphical file manager for Windows, macOS and Linux";
    longDescription = ''
--- a/pkgs/by-name/hi/hifile/update.sh
+++ b/pkgs/by-name/hi/hifile/update.sh
@ -0,0 +1,22 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=./. -i bash -p curl common-updater-scripts
+
+latestVersion=$(curl -s "https://www.hifile.app/otherdownloads" | grep -A 10 '<h1>All downloads</h1>' | grep -m 1 '<li>.*AppImage.*' | sed -n 's/.*HiFile-\([0-9.]*\)\.AppImage.*/\1/p')
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; hifile.version" | tr -d '"')
+
+echo "latest  version: $latestVersion"
+echo "current version: $currentVersion"
+
+if [[ "$latestVersion" == "$currentVersion" ]]; then
+    echo "package is up-to-date"
+    exit 0
+fi
+
+
+prefetch=$(nix-prefetch-url "https://www.hifile.app/files/HiFile-$latestVersion.AppImage")
+hash=$(nix-hash --type sha256 --to-sri "$prefetch")
+
+update-source-version hifile 0 "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" --system="x86_64-linux"
+update-source-version hifile "$latestVersion" "$hash" --system="x86_64-linux"
+
+
--- a/pkgs/by-name/id/identity/Cargo.lock
+++ b/pkgs/by-name/id/identity/Cargo.lock
--- a/pkgs/by-name/id/identity/package.nix
+++ b/pkgs/by-name/id/identity/package.nix
@ -1,54 +1,61 @@
 {
  lib,
  stdenv,
-  fetchFromGitLab,
-  rustPlatform,
-  cargo,
-  rustc,
  appstream,
  blueprint-compiler,
+  cargo,
  dav1d,
  desktop-file-utils,
+  fetchFromGitLab,
+  glib,
  gst_all_1,
  gtk4,
+  lcms,
  libadwaita,
+  libseccomp,
  libwebp,
  meson,
  ninja,
-  pkg-config,
  nix-update-script,
+  pkg-config,
+  rustPlatform,
+  rustc,
+  versionCheckHook,
  wrapGAppsHook4,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "identity";
-  version = "0.6.0";
+  version = "0.7.0";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "YaLTeR";
    repo = "identity";
-    rev = "v${version}";
-    hash = "sha256-AiOaTjYOc7Eo+9kl1H91TKAkCKNUJNWobmBENZlHBhQ=";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-h8/mWGuosBiQRpoW8rINJht/7UBVEnUnTKY5HBCAyw4=";
  };

-  cargoDeps = rustPlatform.importCargoLock {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "gst-plugin-gtk4-0.12.0-alpha.1" = "sha256-JSw9yZ4oy7m6c9pqOT+fnYEbTlneLTtWQf3/Jbek/ps=";
-    };
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-oO7l4zVKR93fFLqkY67DfzrAA9kUN06ov9ogwDuaVlE=";
  };

+  strictDeps = true;
+
  nativeBuildInputs = [
    appstream
    blueprint-compiler
    cargo
-    desktop-file-utils
+    desktop-file-utils # for `desktop-file-validate`
+    glib # for `glib-compile-schemas`
+    gtk4 # for `gtk-update-icon-cache`
    meson
    ninja
    pkg-config
-    rustc
+    rustPlatform.cargoCheckHook
    rustPlatform.cargoSetupHook
+    rustc
    wrapGAppsHook4
  ];

@ -60,18 +67,38 @@ stdenv.mkDerivation rec {
    gst_all_1.gst-plugins-good
    gst_all_1.gstreamer
    gtk4
+    lcms
    libadwaita
+    libseccomp
    libwebp
  ];

+  mesonBuildType = "release";
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+  cargoCheckType = if (finalAttrs.mesonBuildType != "debug") then "release" else "debug";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+
+    cargoCheckHook
+    mesonCheckPhase
+
+    runHook postCheck
+  '';
+
  passthru.updateScript = nix-update-script { };

  meta = {
    description = "Program for comparing multiple versions of an image or video";
    homepage = "https://gitlab.gnome.org/YaLTeR/identity";
+    changelog = "https://gitlab.gnome.org/YaLTeR/identity/-/releases/v${finalAttrs.version}";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ getchoo ];
    mainProgram = "identity";
    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/in/intel-ocl/package.nix
+++ b/pkgs/by-name/in/intel-ocl/package.nix
@ -74,5 +74,6 @@ stdenv.mkDerivation rec {
    license = lib.licenses.unfree;
    platforms = [ "x86_64-linux" ];
    maintainers = [ ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/by-name/in/intune-portal/package.nix
+++ b/pkgs/by-name/in/intune-portal/package.nix
@ -109,5 +109,6 @@ stdenv.mkDerivation rec {
    license = licenses.unfree;
    platforms = [ "x86_64-linux" ];
    maintainers = with lib.maintainers; [ rhysmdnz ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/by-name/ki/killerbee/package.nix
+++ b/pkgs/by-name/ki/killerbee/package.nix
@ -28,14 +28,18 @@ python3.pkgs.buildPythonApplication rec {
    scapy
  ];

+  preBuild = ''
+    export HOME=$(mktemp -d)
+  '';
+
  pythonImportsCheck = [ "killerbee" ];

-  meta = with lib; {
+  meta = {
    description = "IEEE 802.15.4/ZigBee Security Research Toolkit";
    homepage = "https://github.com/riverloopsec/killerbee";
    changelog = "https://github.com/riverloopsec/killerbee/releases/tag/${version}";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ fab ];
-    platforms = platforms.linux;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/by-name/li/libation/deps.nix
+++ b/pkgs/by-name/li/libation/deps.nix
@ -4,7 +4,7 @@
 { fetchNuGet }: [
  (fetchNuGet { pname = "AAXClean"; version = "1.1.2"; hash = "sha256-Abgf22iixOsF1VnVfbutYPtPuUonq0G+aSynhOMLtkM="; })
  (fetchNuGet { pname = "AAXClean.Codecs"; version = "1.1.3"; hash = "sha256-SPbynIf6vtDfnfTWcfpn7WiwKHD15CogCIEyTTVMEkM="; })
-  (fetchNuGet { pname = "AudibleApi"; version = "9.1.2.1"; hash = "sha256-rVVa0Y4xtq7QHHNFCpB0g3FuGf7YasQUH7I3SuSd1/U="; })
+  (fetchNuGet { pname = "AudibleApi"; version = "9.2.0.1"; hash = "sha256-2NcRx+2sBLQDmXA+lLFnpGj9/IzyxYnvE5doQP9oCQ8="; })
  (fetchNuGet { pname = "Avalonia"; version = "11.0.5"; hash = "sha256-BqpHqQIObTb7DHTyZAgCD9A5I0pZkHhSoPTN2g6/G9E="; })
  (fetchNuGet { pname = "Avalonia.Angle.Windows.Natives"; version = "2.1.0.2023020321"; hash = "sha256-TWop9cvak6cMv2vrA/GlpuYBxS8Fuj5UmupGIV7Q5Ks="; })
  (fetchNuGet { pname = "Avalonia.BuildServices"; version = "0.0.29"; hash = "sha256-WPHRMNowRnYSCh88DWNBCltWsLPyOfzXGzBqLYE7tRY="; })
@ -24,7 +24,7 @@
  (fetchNuGet { pname = "Avalonia.X11"; version = "11.0.5"; hash = "sha256-rvs3hwRh3F5E1j3JqcodWJTHV3BTWMKkvzq170tuPa4="; })
  (fetchNuGet { pname = "BouncyCastle.Cryptography"; version = "2.3.0"; hash = "sha256-TIBOegJAEfFRyvtwuPakvKsQbqoPHj1RSTmK7SKYsf0="; })
  (fetchNuGet { pname = "CommandLineParser"; version = "2.9.1"; hash = "sha256-ApU9y1yX60daSjPk3KYDBeJ7XZByKW8hse9NRZGcjeo="; })
-  (fetchNuGet { pname = "CsvHelper"; version = "32.0.3"; hash = "sha256-XbRxWNgxYe3sUZQZr5d9DxLAOl10cBCZ7JGm4xujuMQ="; })
+  (fetchNuGet { pname = "CsvHelper"; version = "33.0.1"; hash = "sha256-4MwA/WerpI0VYWiaEudNCNnE1v6/k2tPmLbRjmgijV4="; })
  (fetchNuGet { pname = "Dinah.Core"; version = "8.0.0.1"; hash = "sha256-jYAaIqv67DOl+l+i92QmV7TM3YXL250D8XUZ7dZh1s0="; })
  (fetchNuGet { pname = "Dinah.EntityFrameworkCore"; version = "8.0.0.1"; hash = "sha256-xTKKCBE2KfXqUaRMZqgohQmUi51GrWvaIWTW66nRRYQ="; })
  (fetchNuGet { pname = "DynamicData"; version = "7.9.5"; hash = "sha256-3XjOMuFathku9oWyss360+Ze5UMP7tSmUbMoax7qONU="; })
@ -95,8 +95,8 @@
  (fetchNuGet { pname = "NPOI"; version = "2.7.0"; hash = "sha256-zqns3HwLv8OQMyvw+LUtwqPbkAEIrVJU589AMNhnM4s="; })
  (fetchNuGet { pname = "Octokit"; version = "11.0.1"; hash = "sha256-24Ym/CXgU3LCFQcMHdFfWp8vUjLfwRcRIyW9fvr4i1s="; })
  (fetchNuGet { pname = "Pluralize.NET"; version = "1.0.2"; hash = "sha256-u/WHYDpSvGs6SkgPREm1RID4po6h8/fj2QgJal1TBwU="; })
-  (fetchNuGet { pname = "Polly"; version = "8.4.0"; hash = "sha256-9KfX2swvws/z2HL31gdRL9WMm3fDZthW1EPeD1Ix+P4="; })
-  (fetchNuGet { pname = "Polly.Core"; version = "8.4.0"; hash = "sha256-6M2ql3bQj/T6w3G1i0mZC4HtViLWJG5J5nzjP0A25r4="; })
+  (fetchNuGet { pname = "Polly"; version = "8.4.1"; hash = "sha256-CPFw0j6f2P5LfcoFAHo1RRDnCx6SXnp8gzHnwYDnYhY="; })
+  (fetchNuGet { pname = "Polly.Core"; version = "8.4.1"; hash = "sha256-EksA3U5cmsri2joM+SMtbdwOUMUVxIXT8DnH4DSAIpA="; })
  (fetchNuGet { pname = "ReactiveUI"; version = "18.3.1"; hash = "sha256-1rf4icGRKTR3XIWJpkQJCG7ObRM+72ITB5K+ND1is9M="; })
  (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; hash = "sha256-4PGZqyWhZ6/HCTF2KddDsbmTTjxs2oW79YfkberDZS8="; })
  (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.3.0"; hash = "sha256-PaiITTFI2FfPylTEk7DwzfKeiA/g/aooSU1pDcdwWLU="; })
@ -140,7 +140,7 @@
  (fetchNuGet { pname = "SharpZipLib"; version = "1.3.3"; hash = "sha256-HWEQTKh9Ktwg/zIl079dAiH+ob2ShWFAqLgG6XgIMr4="; })
  (fetchNuGet { pname = "SixLabors.Fonts"; version = "1.0.1"; hash = "sha256-fox6f9Z5xunVXiy71KTSkb0DirMN00tuUlChyp96kiI="; })
  (fetchNuGet { pname = "SixLabors.ImageSharp"; version = "2.1.7"; hash = "sha256-CPC3x2vPfjv8ZLyxnQ8uuNhlsUMrIE/+hdYP0dZGLR8="; })
-  (fetchNuGet { pname = "SixLabors.ImageSharp"; version = "3.1.4"; hash = "sha256-zOqHVIInvJiqmx4JF+8USYvdKAGRZVUqQpdncrrjRjM="; })
+  (fetchNuGet { pname = "SixLabors.ImageSharp"; version = "3.1.5"; hash = "sha256-3UehX9T+I81nfgv2dTHlpoPgYzXFk7kHr1mmlQOCBfw="; })
  (fetchNuGet { pname = "SkiaSharp"; version = "2.88.6"; hash = "sha256-y0wzgwdQXtgl5boCz/EgLWbK3SwC0cFVRUbBxOUPQXc="; })
  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Linux"; version = "2.88.6"; hash = "sha256-VjgGoi73tVvqO/UXmQb1w9ioAbFu2dxH8oHz1l5H4zE="; })
  (fetchNuGet { pname = "SkiaSharp.NativeAssets.macOS"; version = "2.88.6"; hash = "sha256-7hOMjlYTOiNPLNwfLFUjTcdgiGEtmYUI1EubiRiC6bo="; })
--- a/pkgs/by-name/li/libation/package.nix
+++ b/pkgs/by-name/li/libation/package.nix
@ -12,13 +12,13 @@

 buildDotnetModule rec {
  pname = "libation";
-  version = "11.3.14.2";
+  version = "11.4.1";

  src = fetchFromGitHub {
    owner = "rmcrackan";
    repo = "Libation";
    rev = "v${version}";
-    hash = "sha256-MsCUTXN9lwJ7YvYvrgyqapa1iZ/roMCTz3mqMhhPh14=";
+    hash = "sha256-0+SuJANPcF7TA5jVRb7MYG5u1mSw2Yk9bq4IWsGA6KU=";
  };

  sourceRoot = "${src.name}/Source";
--- a/pkgs/by-name/li/libbytesize/package.nix
+++ b/pkgs/by-name/li/libbytesize/package.nix
@ -42,6 +42,9 @@ stdenv.mkDerivation (finalAttrs: {
    libxslt
    pkg-config
    python3Packages.python
+  ];
+
+  nativeInstallCheckInputs = [
    python3Packages.pythonImportsCheckHook
  ];

@ -51,6 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
    pcre2
  ];

+  doInstallCheck = true;
  strictDeps = true;

  postInstall = ''
--- a/pkgs/by-name/lo/log4cplus/package.nix
+++ b/pkgs/by-name/lo/log4cplus/package.nix
@ -1,14 +1,20 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, pkg-config }:

 stdenv.mkDerivation rec {
  pname = "log4cplus";
-  version = "2.1.1";
+  version = "2.1.2";

  src = fetchurl {
    url = "mirror://sourceforge/log4cplus/log4cplus-${version}.tar.bz2";
-    sha256 = "sha256-ZZfeeCd15OD7qP3K2TjDcJ/YOagITEtu3648xQRuJog=";
+    hash = "sha256-JFDfu0qzXdLJ5k2MdQxRS/cpO4HY8yr3qxJEF/cK360=";
  };

+  nativeBuildInputs = [ pkg-config ];
+
+  enableParallelBuilding = true;
+
+  strictDeps = true;
+
  meta = {
    homepage = "http://log4cplus.sourceforge.net/";
    description = "Port the log4j library from Java to C++";
--- a/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix
+++ b/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix
@ -66,11 +66,11 @@ let

  derivation = stdenv.mkDerivation rec {
    pname = "onlyoffice-desktopeditors";
-    version = "8.1.1";
+    version = "8.2.0";
    minor = null;
    src = fetchurl {
      url = "https://github.com/ONLYOFFICE/DesktopEditors/releases/download/v${version}/onlyoffice-desktopeditors_amd64.deb";
-      hash = "sha256-RwWIYcbYljDqWRJcXCDODjVeYnp9xreNGO2l2aqWJ9w=";
+      hash = "sha256-sKjPxrPdnEX/EuZMQJP+PN/Mi1MRV3psK8Jje7V/ecI=";
    };

    nativeBuildInputs = [
@ -141,7 +141,7 @@ let
      done;

      substituteInPlace $out/bin/onlyoffice-desktopeditors \
-        --replace "/opt/onlyoffice/" "$out/share/"
+        --replace-fail "/opt/onlyoffice/" "$out/share/"

      ln -s $out/share/desktopeditors/DesktopEditors $out/bin/DesktopEditors

@ -180,7 +180,7 @@ buildFHSEnv {
    ln -s ${derivation}/share/icons $out/share
    cp -r ${derivation}/share/applications $out/share
    substituteInPlace $out/share/applications/onlyoffice-desktopeditors.desktop \
-        --replace "/usr/bin/onlyoffice-desktopeditors" "$out/bin/onlyoffice-desktopeditors"
+        --replace-fail "/usr/bin/onlyoffice-desktopeditors" "$out/bin/onlyoffice-desktopeditors"
  '';

  passthru.updateScript = ./update.sh;
--- a/pkgs/by-name/op/opensc/package.nix
+++ b/pkgs/by-name/op/opensc/package.nix
@ -0,0 +1,92 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  zlib,
+  readline,
+  openssl,
+  libiconv,
+  pcsclite,
+  libassuan,
+  libXt,
+  docbook_xsl,
+  libxslt,
+  docbook_xml_dtd_412,
+  darwin,
+  buildPackages,
+  nix-update-script,
+  withApplePCSC ? stdenv.hostPlatform.isDarwin,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "opensc";
+  version = "0.26.0";
+
+  src = fetchFromGitHub {
+    owner = "OpenSC";
+    repo = "OpenSC";
+    rev = version;
+    sha256 = "sha256-EIQ9YpIGwckg/JjpK0S2ZYdFf/0YC4KaWcLXRNRMuzA=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    autoreconfHook
+  ];
+  buildInputs =
+    [
+      zlib
+      readline
+      openssl
+      libassuan
+      libXt
+      libxslt
+      libiconv
+      docbook_xml_dtd_412
+    ]
+    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Carbon
+    ++ (if withApplePCSC then [ darwin.apple_sdk.frameworks.PCSC ] else [ pcsclite ]);
+
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
+
+  configureFlags = [
+    "--enable-zlib"
+    "--enable-readline"
+    "--enable-openssl"
+    "--enable-pcsc"
+    "--enable-sm"
+    "--enable-man"
+    "--enable-doc"
+    "--localstatedir=/var"
+    "--sysconfdir=/etc"
+    "--with-xsl-stylesheetsdir=${docbook_xsl}/xml/xsl/docbook"
+    "--with-pcsc-provider=${
+      if withApplePCSC then
+        "${darwin.apple_sdk.frameworks.PCSC}/Library/Frameworks/PCSC.framework/PCSC"
+      else
+        "${lib.getLib pcsclite}/lib/libpcsclite${stdenv.hostPlatform.extensions.sharedLibrary}"
+    }"
+    (lib.optionalString (
+      stdenv.hostPlatform != stdenv.buildPlatform
+    ) "XSLTPROC=${buildPackages.libxslt}/bin/xsltproc")
+  ];
+
+  PCSC_CFLAGS = lib.optionalString withApplePCSC "-I${darwin.apple_sdk.frameworks.PCSC}/Library/Frameworks/PCSC.framework/Headers";
+
+  installFlags = [
+    "sysconfdir=$(out)/etc"
+    "completiondir=$(out)/etc"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "Set of libraries and utilities to access smart cards";
+    homepage = "https://github.com/OpenSC/OpenSC/wiki";
+    license = licenses.lgpl21Plus;
+    platforms = platforms.all;
+    maintainers = [ maintainers.michaeladler ];
+  };
+}
--- a/pkgs/by-name/pl/planetary_annihilation/package.nix
+++ b/pkgs/by-name/pl/planetary_annihilation/package.nix
@ -38,5 +38,6 @@ stdenv.mkDerivation rec {
    license = lib.licenses.unfree;
    platforms = platforms.linux;
    maintainers = [ maintainers.domenkozar ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/by-name/ru/ruffle/Cargo.lock
+++ b/pkgs/by-name/ru/ruffle/Cargo.lock
--- a/pkgs/by-name/ru/ruffle/package.nix
+++ b/pkgs/by-name/ru/ruffle/package.nix
@ -23,7 +23,7 @@
 }:

 let
-  version = "nightly-2024-09-12";
+  version = "nightly-2024-11-07";
 in
 rustPlatform.buildRustPackage {
  pname = "ruffle";
@ -33,7 +33,7 @@ rustPlatform.buildRustPackage {
    owner = "ruffle-rs";
    repo = "ruffle";
    rev = version;
-    hash = "sha256-wvgx6581vvUPb9evvJl328oTP/F8+LhpeHX3vCsHXCc=";
+    hash = "sha256-eufp3myszqguoHGYGqIpv5gMkVx1d4L/GflRgvnxPTQ=";
  };

  nativeBuildInputs =
@ -97,13 +97,11 @@ rustPlatform.buildRustPackage {
  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "ecolor-0.28.1" = "sha256-X1prQIc3jzmWyEmpfQMgowW2qM1r+2T12Nd7HCsPtpc=";
-      "flash-lso-0.6.0" = "sha256-X9XYj88GmkPRy+RxvGM6vFdBxif2XYesKtqwwW2DTw4=";
+      "flash-lso-0.6.0" = "sha256-dhOAnVfxZw9JaOrY17xAeN7/y/aWZP+KUoDQuCf6D3Q=";
      "h263-rs-0.1.0" = "sha256-dyQHnCe7LwwZYlF57sbRzir9vUavN3K8wLhwPIWlmik=";
-      "jpegxr-0.3.1" = "sha256-03gbXA5T02ofgfRaanaixqfrFpxw/UOOftgKZ7hPHY4=";
+      "jpegxr-0.3.1" = "sha256-aV4Qh9ea0CirWU3lScjSKi4mii0cDTnx+miTcqWzxGg=";
      "nellymoser-rs-0.1.2" = "sha256-66yt+CKaw/QFIPeNkZA2mb9ke64rKcAw/6k/pjNYY04=";
      "nihav_codec_support-0.1.0" = "sha256-HAJS4I6yyzQzCf+vmaFp1MWXpcUgFAHPxLhfMVXmN1c=";
-      "rfd-0.14.1" = "sha256-eq4OONgYrtWCogIpjws/1uRxmv3oyIdrimDVaLJ9IMo=";
    };
  };

--- a/pkgs/servers/networking/rustus/default.nix
+++ b/pkgs/servers/networking/rustus/default.nix
@ -1,16 +1,17 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, rustPlatform
-, nix-update-script
-, pkg-config
-, openssl
-, Security
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  nix-update-script,
+  pkg-config,
+  openssl,
+  darwin,
 }:

 let
  pname = "rustus";
-  version = "0.7.6";
+  version = "0.7.6-unstable-2024-05-10";
 in
 rustPlatform.buildRustPackage {
  inherit pname version;
@ -18,11 +19,11 @@ rustPlatform.buildRustPackage {
  src = fetchFromGitHub {
    owner = "s3rius";
    repo = pname;
-    rev = version;
-    hash = "sha256-osxdqwNUONCScFarpQV48C7CR1DVR/mCttaglqiAKPo=";
+    rev = "a7ebbc3f4c367b0c71b49972b1f6ebbeb08634b8";
+    hash = "sha256-S3hq6G78HRQVLJuuwfC6U7NQXMSdllrC/ZolVPZRTsA=";
  };

-  cargoHash = "sha256-M0mJ+9VznzHDmdKAsT3YamyG/P0JF8oPeVHaX44NWM4=";
+  cargoHash = "sha256-uN0nXI15LxtSQpUCOJ8QIdgw2OyQO3i5alTik/fI8GI=";

  env.OPENSSL_NO_VENDOR = 1;

@ -30,11 +31,13 @@ rustPlatform.buildRustPackage {
    pkg-config
  ];

-  buildInputs = [
-    openssl
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-  ];
+  buildInputs =
+    [
+      openssl
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      darwin.apple_sdk.frameworks.Security
+    ];

  passthru.updateScript = nix-update-script { };

@ -60,13 +63,12 @@ rustPlatform.buildRustPackage {
  #   "--skip=util::tests::test_process_multi_addr"
  # ];

-
-  meta = with lib; {
+  meta = {
    description = "TUS protocol implementation in Rust";
    mainProgram = "rustus";
    homepage = "https://s3rius.github.io/rustus/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ happysalada ];
-    platforms = platforms.all;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ happysalada ];
+    platforms = lib.platforms.all;
  };
 }
--- a/pkgs/by-name/sc/scc/package.nix
+++ b/pkgs/by-name/sc/scc/package.nix
@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
  pname = "scc";
-  version = "3.3.5";
+  version = "3.4.0";

  src = fetchFromGitHub {
    owner = "boyter";
    repo = "scc";
    rev = "v${version}";
-    hash = "sha256-7qenc/1FEwiyR7qz6u8L35Wb8zAUVQ5sG5bvYpZKdzs=";
+    hash = "sha256-B6QYG4ZREZEaSfOLo5nwi6yFXkFBWvSsXwnZog1uBj8=";
  };

  vendorHash = null;
@ -27,8 +27,6 @@ buildGoModule rec {
      Br1ght0ne
    ];
    license = with licenses; [
-      unlicense
-      # or
      mit
    ];
  };
--- a/pkgs/by-name/sh/showmethekey/package.nix
+++ b/pkgs/by-name/sh/showmethekey/package.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "showmethekey";
-  version = "1.15.0";
+  version = "1.15.1";

  src = fetchFromGitHub {
    owner = "AlynxZhou";
    repo = "showmethekey";
    rev = "refs/tags/v${version}";
-    hash = "sha256-zlLpQZbjEJjgCxlHGaiDFGRZ/6tz5fpKVLVqtjO4pHM=";
+    hash = "sha256-odlIgWFmhDqju7U5Y9q6apUEAqZUvMUA7/eU7LMltQs=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/sn/snet/package.nix
+++ b/pkgs/by-name/sn/snet/package.nix
@ -1,6 +1,10 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:

-buildGoModule rec {
+buildGoModule {
  pname = "snet";
  version = "unstable-2021-11-26";

@ -13,11 +17,14 @@ buildGoModule rec {

  vendorHash = "sha256-dubmCLeD8Fwe1msfLN+5WzdbFkfTRnZDU3F49gjWTS4=";

-  meta = with lib; {
+  # flaky test, random failures
+  checkFlags = [ "-skip=TestBloomfilter" ];
+
+  meta = {
    description = "Transparent proxy works on linux desktop, MacOS, router";
    homepage = "https://github.com/monsterxx03/snet";
-    license = licenses.mit;
-    maintainers = with maintainers; [ azuwis ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ azuwis ];
    mainProgram = "snet";
  };
 }
--- a/pkgs/by-name/st/starpls-bin/package.nix
+++ b/pkgs/by-name/st/starpls-bin/package.nix
@ -38,5 +38,6 @@ stdenv.mkDerivation (finalAttrs: {
    platforms = [ "aarch64-darwin" "x86_64-linux" ];
    maintainers = with maintainers; [ aaronjheng ];
    mainProgram = "starpls";
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 })
--- a/pkgs/by-name/st/stereotool/package.nix
+++ b/pkgs/by-name/st/stereotool/package.nix
@ -16,7 +16,7 @@

 stdenv.mkDerivation rec {
  pname = "stereotool";
-  version = "10.30";
+  version = "10.41";

  srcs =
    let
@ -35,19 +35,19 @@ stdenv.mkDerivation rec {
          (fetchurl {
            name = "alsa";
            url = "https://download.thimeo.com/stereo_tool_gui_64_${versionNoPoint}";
-            hash = "sha256-sy1ps4knMlSKVapSQTJ6+8Q7x70/CpRUj7UkWWUkraI=";
+            hash = "sha256-v+e24IHcGBEu/jHw52tzxxb9F7V39N7XYQt0Ln5YAP8=";
          })
          # Jack version for 64bits.
          (fetchurl {
            name = "jack";
            url = "https://download.thimeo.com/stereo_tool_gui_jack_64_${versionNoPoint}";
-            hash = "sha256-sy1ps4knMlSKVapSQTJ6+8Q7x70/CpRUj7UkWWUkraI=";
+            hash = "sha256-v+e24IHcGBEu/jHw52tzxxb9F7V39N7XYQt0Ln5YAP8=";
          })
          # Cmd version for 64bits
          (fetchurl {
            name = "cmd";
            url = "https://download.thimeo.com/stereo_tool_cmd_64_${versionNoPoint}";
-            hash = "sha256-ncrMkuqNkdhfa1l5Ya+EMoeySDTkFshbpXVIvoJdEAc=";
+            hash = "sha256-jYxmwh7L4XCDnhj+hTAGTlm7rjanUk76CtXmhFS8vPU=";
          })
        ];
        # Sources if the system is aarch64-linux
@ -55,17 +55,17 @@ stdenv.mkDerivation rec {
          (fetchurl {
            name = "alsa";
            url = "https://download.thimeo.com/stereo_tool_gui_pi2_64_${versionNoPoint}";
-            hash = "sha256-o4KW7oPPUYrFLKGo/Q+ISrga9EoA7FUZUzuGtYVVT+Y=";
+            hash = "sha256-zKRum8jU5tqgpDjs6ZY0aUnoRXi+tfyOi9ZZDUIGhi4=";
          })
          (fetchurl {
            name = "jack";
            url = "https://download.thimeo.com/stereo_tool_gui_jack_pi2_64_${versionNoPoint}";
-            hash = "sha256-o4KW7oPPUYrFLKGo/Q+ISrga9EoA7FUZUzuGtYVVT+Y=";
+            hash = "sha256-zKRum8jU5tqgpDjs6ZY0aUnoRXi+tfyOi9ZZDUIGhi4=";
          })
          (fetchurl {
            name = "cmd";
            url = "https://download.thimeo.com/stereo_tool_pi2_64_${versionNoPoint}";
-            hash = "sha256-kzzPh/l+ShvdFnFqTn6CGsj8MlMxikuhi7tThD3qFEk=";
+            hash = "sha256-Z/xfNKN8GxHJ+9OoHw76JWmTWClz0ZJxtwlmg+8wZ3A=";
          })
        ];
        # Sources if the system is aarch32-linux
@ -73,17 +73,17 @@ stdenv.mkDerivation rec {
          (fetchurl {
            name = "alsa";
            url = "https://download.thimeo.com/stereo_tool_gui_pi2_${versionNoPoint}";
-            hash = "sha256-D5e72QabHJPaXhLa06pkS+Q/X6PiRzTn8jF2EpSf41k=";
+            hash = "sha256-DHsWEr7k+QVwkoKndkuDEGDKcH0jGikESfg/5qREjdE=";
          })
          (fetchurl {
            name = "jack";
            url = "https://download.thimeo.com/stereo_tool_gui_jack_pi2_${versionNoPoint}";
-            hash = "sha256-D5e72QabHJPaXhLa06pkS+Q/X6PiRzTn8jF2EpSf41k=";
+            hash = "sha256-DHsWEr7k+QVwkoKndkuDEGDKcH0jGikESfg/5qREjdE=";
          })
          (fetchurl {
            name = "cmd";
            url = "https://download.thimeo.com/stereo_tool_pi2_${versionNoPoint}";
-            hash = "sha256-RELyXszIVjsAl0qPufLbcqDTKFOTt4Hqp8CsAl56Ybo=";
+            hash = "sha256-fL8nlmp8ZFvcZL9KlH2zcOrDapXMGTdP6wIQ0TxRZZE=";
          })
        ];
        # Sources if the system is 32bits i686
@ -92,17 +92,17 @@ stdenv.mkDerivation rec {
            # The name is the name of this source in the build directory
            name = "alsa";
            url = "https://download.thimeo.com/stereo_tool_gui_${versionNoPoint}";
-            hash = "sha256-JSy88rTlbqIclLIg1HT+OYltve5lw8Q2fH6MIQNouUk=";
+            hash = "sha256-IaLNl1a3IVjlCh566xeT9UlgzHA6NEwBacTuFLrEFxs=";
          })
          (fetchurl {
            name = "jack";
            url = "https://download.thimeo.com/stereo_tool_gui_jack_${versionNoPoint}";
-            hash = "sha256-JSy88rTlbqIclLIg1HT+OYltve5lw8Q2fH6MIQNouUk=";
+            hash = "sha256-IaLNl1a3IVjlCh566xeT9UlgzHA6NEwBacTuFLrEFxs=";
          })
          (fetchurl {
            name = "cmd";
            url = "https://download.thimeo.com/stereo_tool_cmd_${versionNoPoint}";
-            hash = "sha256-b6v0TJaCaJKZP6uwJmmHek4y51YsK8NoslysljYHcF0=";
+            hash = "sha256-oCGhxQkpT0jNwbWoBnC5nmvVrDjYmr75s3Qq+NftZy0=";
          })
        ];
      }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}"));
--- a/pkgs/by-name/te/terra-station/package.nix
+++ b/pkgs/by-name/te/terra-station/package.nix
@ -72,5 +72,6 @@ stdenv.mkDerivation rec {
    maintainers = [ maintainers.peterwilli ];
    platforms = [ "x86_64-linux" ];
    mainProgram = "terra-station";
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/by-name/ty/typst-live/package.nix
+++ b/pkgs/by-name/ty/typst-live/package.nix
@ -1,22 +1,23 @@
-{ lib
-, rustPlatform
-, fetchCrate
-, stdenv
-, darwin
-, makeWrapper
-, typst
+{
+  lib,
+  rustPlatform,
+  fetchCrate,
+  stdenv,
+  darwin,
+  makeWrapper,
+  typst,
 }:

 rustPlatform.buildRustPackage rec {
  pname = "typst-live";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-9GhrWhT0mYU2OOeoHGd5XY7BKO/S7cKTnURXi9dF+IU=";
+    hash = "sha256-bR4Rhhs6rAC6C1nfPFj/3rCtfEziuTGn5m33CR0qZkU=";
  };

-  cargoHash = "sha256-KGwmTXkY2nv5oWwjs5ZLz6u3bJ7YWJQPqOqJJNxKDkM=";
+  cargoHash = "sha256-jUtlJ5LPEy/4BX2G5z/UbOYM5nPNH/hTC7MiMrqYWRI=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/by-name/ub/ubi_reader/package.nix
+++ b/pkgs/by-name/ub/ubi_reader/package.nix
@ -1,29 +1,32 @@
-{ lib
-, python3
-, fetchFromGitHub
+{
+  fetchFromGitHub,
+  lib,
+  python3,
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "ubi_reader";
-  version = "0.8.5";
-  format = "setuptools";
+  version = "0.8.9";
+  pyproject = true;

  src = fetchFromGitHub {
-    owner = "jrspruitt";
-    repo = pname;
-    rev = "v${version}-master";
-    hash = "sha256-tjQs1F9kcFrC9FDkfdnax0C8O8Bg7blkpL7GU56eeWU=";
+    owner = "onekey-sec";
+    repo = "ubi_reader";
+    rev = "v${version}";
+    hash = "sha256-04HwzkonPzzWfX8VE//fMoVv5ggAS+61zx2W8VEUIy4=";
  };

-  propagatedBuildInputs = with python3.pkgs; [ python-lzo ];
+  build-system = [ python3.pkgs.poetry-core ];
+
+  dependencies = [ python3.pkgs.lzallright ];

  # There are no tests in the source
  doCheck = false;

-  meta = with lib; {
-    description = "Collection of Python scripts for reading information about and extracting data from UBI and UBIFS images";
-    homepage = "https://github.com/jrspruitt/ubi_reader";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ vlaci ];
+  meta = {
+    description = "Python scripts capable of extracting and analyzing the contents of UBI and UBIFS images";
+    homepage = "https://github.com/onekey-sec/ubi_reader";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ vlaci ];
  };
 }
--- a/pkgs/by-name/ug/uglify-js/package-lock.json
+++ b/pkgs/by-name/ug/uglify-js/package-lock.json
@ -1,12 +1,12 @@
 {
  "name": "uglify-js",
-  "version": "3.18.0",
+  "version": "3.19.3",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "uglify-js",
-      "version": "3.18.0",
+      "version": "3.19.3",
      "license": "BSD-2-Clause",
      "bin": {
        "uglifyjs": "bin/uglifyjs"
--- a/pkgs/by-name/ug/uglify-js/package.nix
+++ b/pkgs/by-name/ug/uglify-js/package.nix
@ -10,16 +10,16 @@

 buildNpmPackage rec {
  pname = "uglify-js";
-  version = "3.18.0";
+  version = "3.19.3";

  src = fetchFromGitHub {
    owner = "mishoo";
    repo = "UglifyJS";
    rev = "v${version}";
-    hash = "sha256-m+OEcvWEk4RX0C4re9TFZpkcBvSwl7qfIM+56t100ws=";
+    hash = "sha256-sMLQSB1+ux/ya/J22KGojlAxWhtPQdk22KdHy43zdyg=";
  };

-  npmDepsHash = "sha256-iLWmNifHpVvFSFXkfItVpGlh6za9T9wSr1Af4CQQSGM=";
+  npmDepsHash = "sha256-/Xb8DT7vSzZPEd+Z+z1BlFnrOeOwGP+nGv2K9iz6lKI=";

  postPatch = ''
    cp ${./package-lock.json} package-lock.json
@ -54,6 +54,7 @@ buildNpmPackage rec {

  meta = {
    homepage = "https://github.com/mishoo/UglifyJS";
+    changelog = "https://github.com/mishoo/UglifyJS/releases/tag/v" + version;
    description = "JavaScript parser / mangler / compressor / beautifier toolkit";
    mainProgram = "uglifyjs";
    license = lib.licenses.bsd2;
--- a/pkgs/by-name/ug/uglify-js/update.sh
+++ b/pkgs/by-name/ug/uglify-js/update.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p ripgrep common-updater-scripts nodejs prefetch-npm-deps jq
+#!nix-shell -i bash -p ripgrep sd common-updater-scripts nodejs prefetch-npm-deps jq

 set -xeu -o pipefail

--- a/pkgs/by-name/uh/uhk-agent/package.nix
+++ b/pkgs/by-name/uh/uhk-agent/package.nix
@ -74,5 +74,6 @@ stdenvNoCC.mkDerivation {
    license = licenses.unfreeRedistributable;
    maintainers = with maintainers; [ ngiger nickcao ];
    platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/by-name/un/unciv/package.nix
+++ b/pkgs/by-name/un/unciv/package.nix
@ -10,7 +10,7 @@
 , libXxf86vm
 }:
 let
-  version = "4.13.2-redo";
+  version = "4.14.5-patch1";

  desktopItem = makeDesktopItem {
    name = "unciv";
@ -39,7 +39,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-bZXBgSjmW+fBdDfG7cqKkF4VLYw7Iq2mw5j6iDh2ZhY=";
+    hash = "sha256-NJFv6gdNms+qcouqR/NILnT+l6z0+vOU4bGT6FqaIUw=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/wo/worldofgoo/package.nix
+++ b/pkgs/by-name/wo/worldofgoo/package.nix
@ -70,5 +70,6 @@ stdenv.mkDerivation rec {
    license = licenses.unfree;
    platforms = [ "i686-linux" "x86_64-linux" ];
    maintainers = with maintainers; [ jcumming ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/by-name/ya/yarg/package.nix
+++ b/pkgs/by-name/ya/yarg/package.nix
@ -122,5 +122,6 @@ stdenv.mkDerivation (finalAttrs: {
    license = licenses.lgpl3Plus;
    maintainers = with maintainers; [ kira-bruneau ];
    platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 })
--- a/pkgs/by-name/za/zap/package.nix
+++ b/pkgs/by-name/za/zap/package.nix
@ -1,4 +1,12 @@
-{ lib, stdenv, fetchurl, jre, runtimeShell }:
+{
+  lib,
+  stdenv,
+  fetchurl,
+  jre,
+  makeDesktopItem,
+  copyDesktopItems,
+  runtimeShell,
+}:

 stdenv.mkDerivation rec {
  pname = "zap";
@ -8,15 +16,34 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-ZBDhlrqrRYqSBOKar7V0X8oAOipsA4byxuXAS2diH6c=";
  };

+  desktopItems = [
+    (makeDesktopItem {
+      name = "zap";
+      exec = "zap";
+      icon = "zap";
+      desktopName = "Zed Attack Proxy";
+      categories = [
+        "Development"
+        "Security"
+        "System"
+      ];
+    })
+  ];
+
  buildInputs = [ jre ];

+  nativeBuildInputs = [ copyDesktopItems ];
+
  # From https://github.com/zaproxy/zaproxy/blob/master/zap/src/main/java/org/parosproxy/paros/Constant.java
  version_tag = "20012000";

  # Copying config and adding version tag before first use to avoid permission
  # issues if zap tries to copy config on it's own.
  installPhase = ''
-    mkdir -p "$out/bin" "$out/share"
+    runHook preInstall
+
+    mkdir -p $out/{bin,share}
+
    cp -pR . "$out/share/${pname}/"

    cat >> "$out/bin/${pname}" << EOF
@ -33,12 +60,17 @@ stdenv.mkDerivation rec {
    EOF

    chmod u+x  "$out/bin/${pname}"
+
+    runHook postInstall
  '';

  meta = with lib; {
    homepage = "https://www.zaproxy.org/";
    description = "Java application for web penetration testing";
-    maintainers = with maintainers; [ mog rafael ];
+    maintainers = with maintainers; [
+      mog
+      rafael
+    ];
    platforms = platforms.linux;
    license = licenses.asl20;
    mainProgram = "zap";
--- a/pkgs/development/coq-modules/autosubst-ocaml/default.nix
+++ b/pkgs/development/coq-modules/autosubst-ocaml/default.nix
@ -0,0 +1,47 @@
+{
+  lib,
+  mkCoqDerivation,
+  coq,
+  version ? null,
+}:
+
+mkCoqDerivation {
+  pname = "autosubst-ocaml";
+  owner = "uds-psl";
+
+  release."1.1+8.19".sha256 = "sha256-AGbhw/6lg4GpDE6hZBhau9DLW7HVXa0UzGvJfSV8oHE=";
+
+  inherit version;
+  defaultVersion =
+    with lib.versions;
+    lib.switch coq.coq-version [
+      {
+        case = isEq "8.19";
+        out = "1.1+8.19";
+      }
+    ] null;
+
+  buildInputs = with coq.ocamlPackages; [
+    angstrom
+    ocamlgraph
+    ppx_deriving
+    ppxlib
+  ];
+  useDune = true;
+
+  buildPhase = ''
+    dune build
+  '';
+
+  installPhase = ''
+    dune install --prefix $out --libdir $OCAMLFIND_DESTDIR
+  '';
+
+  meta = with lib; {
+    description = "An OCaml reimplementation of the Autosubst 2 code generator";
+    homepage = "https://github.com/uds-psl/autosubst-ocaml";
+    mainProgram = "autosubst";
+    maintainers = with maintainers; [ chen ];
+    license = licenses.mit;
+  };
+}
--- a/pkgs/development/libraries/fox/default.nix
+++ b/pkgs/development/libraries/fox/default.nix
@ -1,16 +1,18 @@
-{ lib
-, stdenv
-, fetchurl
-, libpng
-, libjpeg
-, libtiff
-, zlib
-, bzip2
-, mesa_glu
-, libXcursor
-, libXext
-, libXrandr
-, libXft
+{
+  lib,
+  stdenv,
+  fetchurl,
+  libpng,
+  libjpeg,
+  libtiff,
+  zlib,
+  bzip2,
+  mesa_glu,
+  libXcursor,
+  libXext,
+  libXrandr,
+  libXft,
+  cups,
 }:

 stdenv.mkDerivation rec {
@ -22,7 +24,22 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-bu+IEqNkv9OAf96dPYre3CP759pjalVIbYyc3QSQW2w=";
  };

-  buildInputs = [ libpng libjpeg libtiff zlib bzip2 mesa_glu libXcursor libXext libXrandr libXft ];
+  buildInputs =
+    [
+      libpng
+      libjpeg
+      libtiff
+      zlib
+      bzip2
+      mesa_glu
+      libXcursor
+      libXext
+      libXrandr
+      libXft
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      cups
+    ];

  doCheck = true;

--- a/pkgs/development/php-packages/castor/default.nix
+++ b/pkgs/development/php-packages/castor/default.nix
@ -9,16 +9,16 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "castor";
-  version = "0.18.2";
+  version = "0.20.0";

  src = fetchFromGitHub {
    owner = "jolicode";
    repo = "castor";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-f+vz3SFXnZS67dyHQyycONBtfydMVh2XjB/4r9QIak8=";
+    hash = "sha256-/ceWw2/ct0+89XKgLzNywkd7/tIYI1+k1h05c6vaqIU=";
  };

-  vendorHash = "sha256-U/L+iJ/DKCiUEbSUc/BgYeKakv0BdK6Eq5BJjtwb1Yk=";
+  vendorHash = "sha256-w8CyN3iLgC8seN01yC8ikQQs773A/rT3z5n+emEKqDE=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/development/php-packages/php-codesniffer/default.nix
+++ b/pkgs/development/php-packages/php-codesniffer/default.nix
@ -4,19 +4,19 @@
  php,
 }:

-php.buildComposerProject (finalAttrs: {
+php.buildComposerProject2 (finalAttrs: {
  pname = "php-codesniffer";
-  version = "3.9.0";
+  version = "3.11.0";

  src = fetchFromGitHub {
    owner = "PHPCSStandards";
    repo = "PHP_CodeSniffer";
    rev = "${finalAttrs.version}";
-    hash = "sha256-HyAb0vfruJWch09GVWtKI+NOTpsUkkLRusFSwZlNHjA=";
+    hash = "sha256-zCAaXKlKIBF7LK+DHkbzOqnSMj+ZaeafZnSOHOq3Z5Q=";
  };

  composerLock = ./composer.lock;
-  vendorHash = "sha256-nM0sKdD+fc3saPCvU+0KI7HM+LdSi0vJIoutwuZnx/Y=";
+  vendorHash = "sha256-r40bINMa9n4Rzlv75QSuz0TiV5qGsdh4mwMqj9BsKTY=";

  meta = {
    changelog = "https://github.com/PHPCSStandards/PHP_CodeSniffer/releases/tag/${finalAttrs.version}";
--- a/pkgs/development/php-packages/phpinsights/composer.lock
+++ b/pkgs/development/php-packages/phpinsights/composer.lock
--- a/pkgs/development/php-packages/phpinsights/default.nix
+++ b/pkgs/development/php-packages/phpinsights/default.nix
@ -4,18 +4,18 @@
  php,
 }:

-php.buildComposerProject (finalAttrs: {
+php.buildComposerProject2 (finalAttrs: {
  pname = "phpinsights";
-  version = "2.11.0";
+  version = "2.12.0";

  src = fetchFromGitHub {
    owner = "nunomaduro";
    repo = "phpinsights";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-7ATlfAlCFv78JSKg5cD/VcYoq/EAM/6/GjH3lkfVCJ8=";
+    hash = "sha256-XuvwO/MkGBMWo2hjDPDDYS3JmfWJH75mbNn6oKsMWps=";
  };

-  vendorHash = "sha256-MOq7xmX8wqDk9W3M2gkejyXXPTcVFFgU0ohmDpL0Tvg=";
+  vendorHash = "sha256-xeruE3oCrl6usg/7Wmop/w/CrIZfT+zMTQiQJXtBExw=";

  composerLock = ./composer.lock;

--- a/pkgs/development/python-modules/duckduckgo-search/default.nix
+++ b/pkgs/development/python-modules/duckduckgo-search/default.nix
@ -1,10 +1,10 @@
 {
  lib,
  buildPythonPackage,
-  click,
  fetchFromGitHub,
  pythonOlder,
  setuptools,
+  click,
  primp,

  # Optional dependencies
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "duckduckgo-search";
-  version = "6.3.2";
+  version = "6.3.4";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "deedy5";
    repo = "duckduckgo_search";
    rev = "refs/tags/v${version}";
-    hash = "sha256-5AuPAv78ePrnCr5L4CfIu/fq7Ha19zC78zg8JLu3U2A=";
+    hash = "sha256-NvFoiyoXeNOrynGN+VHVfIA3+D9zfAWFeWEVU8/TkZQ=";
  };

  build-system = [ setuptools ];
@ -30,7 +30,7 @@ buildPythonPackage rec {
  dependencies = [
    click
    primp
-  ];
+  ] ++ optional-dependencies.lxml;

  optional-dependencies = {
    lxml = [ lxml ];
@ -44,7 +44,7 @@ buildPythonPackage rec {
    description = "Python CLI and library for searching for words, documents, images, videos, news, maps and text translation using the DuckDuckGo.com search engine";
    mainProgram = "ddgs";
    homepage = "https://github.com/deedy5/duckduckgo_search";
-    changelog = "https://github.com/deedy5/duckduckgo_search/releases/tag/${version}";
+    changelog = "https://github.com/deedy5/duckduckgo_search/releases/tag/v${version}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ drawbu ];
  };
--- a/pkgs/development/python-modules/image-go-nord/default.nix
+++ b/pkgs/development/python-modules/image-go-nord/default.nix
@ -2,32 +2,51 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  ffmpeg-python,
+  numpy,
  pillow,
+  pypaInstallHook,
  pytestCheckHook,
  pythonOlder,
+  requests,
+  setuptoolsBuildHook,
 }:

 buildPythonPackage rec {
  pname = "image-go-nord";
-  version = "1.1.0";
-  format = "setuptools";
+  version = "1.2.0";
+  pyproject = false;
+
  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "Schrodinger-Hat";
    repo = "ImageGoNord-pip";
    rev = "refs/tags/v${version}";
-    hash = "sha256-2Dnl0dcdMo4PnhHTb/5cJ7C0CvW84av4CCbrTLPqopg=";
+    hash = "sha256-rPp4QrkbDhrdpfynRUYgxpNgUNxU+3h54Ea7s/+u1kI=";
  };

-  propagatedBuildInputs = [ pillow ];
+  nativeBuildInputs = [
+    pypaInstallHook
+    setuptoolsBuildHook
+  ];
+
+  dependencies = [
+    ffmpeg-python
+    numpy
+    pillow
+    requests
+  ];

  nativeCheckInputs = [ pytestCheckHook ];

-  meta = with lib; {
+  pythonImportsCheck = [ "ImageGoNord" ];
+
+  meta = {
    description = "Tool that can convert rgb images to nordtheme palette";
    homepage = "https://github.com/Schrodinger-Hat/ImageGoNord-pip";
-    license = licenses.mit;
-    maintainers = with maintainers; [ kranzes ];
+    changelog = "https://github.com/Schroedinger-Hat/ImageGoNord-pip/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kranzes ];
  };
 }
--- a/pkgs/development/python-modules/primp/default.nix
+++ b/pkgs/development/python-modules/primp/default.nix
@ -25,20 +25,20 @@ let
 in
 buildPythonPackage rec {
  pname = "primp";
-  version = "0.6.4";
+  version = "0.6.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "deedy5";
    repo = "primp";
    rev = "refs/tags/v${version}";
-    hash = "sha256-wCD99eEU4RW8kUJY72cXhJh5124PVd6kJt+HZjm/hFI=";
+    hash = "sha256-dexJdeNGpRsPLk8b/gNeQc1dsQLOiXNL5zgDEN9qHfQ=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-iY6TSc7GU6OWVUpW6qpwH4g9/eGKhP/YZ5PQoO8NmVc=";
+    hash = "sha256-0mkrs50l0JEUH1WsM/Bp8AblCy6nkuohZKDsp6OVQpM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@ -378,7 +378,7 @@ let
    frailtyMMpen = [ pkgs.gsl ];
    gamstransfer = [ pkgs.zlib ];
    gdalraster = [ pkgs.pkg-config ];
-    gdtools = with pkgs; [ cairo.dev fontconfig.lib freetype.dev ];
+    gdtools = with pkgs; [ cairo.dev fontconfig.lib freetype.dev ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ expat xorg.libXdmcp ];
    GeneralizedWendland = [ pkgs.gsl ];
    ggiraph = with pkgs; [ pkgs.libpng.dev ];
    git2r = with pkgs; [ zlib.dev openssl.dev libssh2.dev libgit2 pkg-config ];
--- a/pkgs/development/tools/devbox/default.nix
+++ b/pkgs/development/tools/devbox/default.nix
@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
  pname = "devbox";
-  version = "0.13.4";
+  version = "0.13.6";

  src = fetchFromGitHub {
    owner = "jetpack-io";
    repo = pname;
    rev = version;
-    hash = "sha256-+3AKBhxf1m6cBNtEx8xmUmJ2PUk0LNPaS+cZhsXJoTs=";
+    hash = "sha256-E2wIXa/cYVY7vOq1PWKJHG1EVpgN8o6AxIi7KtwjsxI=";
  };

  ldflags = [
@ -26,7 +26,7 @@ buildGoModule rec {
  # integration tests want file system access
  doCheck = false;

-  vendorHash = "sha256-rwmNzYzmZqNcNVV4GgqCVLT6ofIkblVCMJHLGwlhcGw=";
+  vendorHash = "sha256-js0dxnLBSnfhgjigTmQAh7D9t6ZeSHf7k6Xd3RIBUjo=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/development/tools/ocaml/findlib/default.nix
+++ b/pkgs/development/tools/ocaml/findlib/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ocaml${ocaml.version}-findlib";
-  version = "1.9.6";
+  version = "1.9.7";

  src = fetchurl {
    url = "http://download.camlcity.org/download/findlib-${version}.tar.gz";
-    sha256 = "sha256-LfmWJ5rha2Bttf9Yefk9v63giY258aPoL3+EX6opMKI=";
+    hash = "sha256-zNgiAI8bh6vVahL/f0rxlaDNouO8AROSF3miBcl5Hik=";
  };

  nativeBuildInputs = [ ocaml ];
@ -14,6 +14,10 @@ stdenv.mkDerivation rec {

  patches = [ ./ldconf.patch ./install_topfind.patch ];

+  postPatch = ''
+    substituteInPlace src/bytes/Makefile --replace-warn OCAMLOPT_SHARED OCAMLOPT
+  '';
+
  dontAddPrefix=true;
  dontAddStaticConfigureFlags = true;
  configurePlatforms = [];
--- a/pkgs/development/tools/ocaml/findlib/install_topfind.patch
+++ b/pkgs/development/tools/ocaml/findlib/install_topfind.patch
@ -1,13 +1,13 @@
 --- a/src/findlib/Makefile
 +++ b/src/findlib/Makefile
-@@ -123,8 +123,8 @@
+@@ -134,8 +134,8 @@
 install: all
 	$(INSTALLDIR) "$(DESTDIR)$(prefix)$(OCAML_SITELIB)/$(NAME)"
 	$(INSTALLDIR) "$(DESTDIR)$(prefix)$(OCAMLFIND_BIN)"
 -	test $(INSTALL_TOPFIND) -eq 0 || $(INSTALLDIR) "$(DESTDIR)$(prefix)$(OCAML_CORE_STDLIB)"
-	test $(INSTALL_TOPFIND) -eq 0 || $(INSTALLFILE) topfind "$(DESTDIR)$(prefix)$(OCAML_CORE_STDLIB)/"
+-	test $(INSTALL_TOPFIND) -eq 0 || $(CP) topfind "$(DESTDIR)$(prefix)$(OCAML_CORE_STDLIB)/"
 +	test $(INSTALL_TOPFIND) -eq 0 || $(INSTALLDIR) "$(DESTDIR)$(prefix)$(OCAML_SITELIB)"
-+	test $(INSTALL_TOPFIND) -eq 0 || $(INSTALLFILE) topfind "$(DESTDIR)$(prefix)$(OCAML_SITELIB)/"
+	test $(INSTALL_TOPFIND) -eq 0 || $(CP) topfind "$(DESTDIR)$(prefix)$(OCAML_SITELIB)/"
 	files=`$(SH) $(TOP)/tools/collect_files $(TOP)/Makefile.config \
 	findlib.cmi findlib.mli findlib.cma findlib.cmxa findlib$(LIB_SUFFIX) findlib.cmxs \
 	findlib_config.cmi findlib_config.ml topfind.cmi topfind.mli \
--- a/pkgs/development/tools/replay-io/default.nix
+++ b/pkgs/development/tools/replay-io/default.nix
@ -141,6 +141,7 @@ in rec {
      license = lib.licenses.bsd3;
      maintainers = with maintainers; [ phryneas ];
      platforms = [ "x86_64-linux" ];
+      sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
    };
  };
 }
--- a/pkgs/development/tools/rust/cargo-audit/default.nix
+++ b/pkgs/development/tools/rust/cargo-audit/default.nix
@ -1,36 +1,39 @@
-{ lib
-, rustPlatform
-, fetchCrate
-, pkg-config
-, openssl
-, zlib
-, stdenv
-, Security
-, SystemConfiguration
+{
+  lib,
+  rustPlatform,
+  fetchCrate,
+  pkg-config,
+  openssl,
+  zlib,
+  stdenv,
+  Security,
+  SystemConfiguration,
 }:

 rustPlatform.buildRustPackage rec {
  pname = "cargo-audit";
-  version = "0.20.1";
+  version = "0.21.0";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-1HLs7j8opRma3WaHbqeTqG0iJOgD0688/7p/+jrNPAg=";
+    hash = "sha256-oMXpJE49If4QKE80ZKhRpMRPh3Bl517a2Ez/1VcaQJQ=";
  };

-  cargoHash = "sha256-Cd8K/Y+vWWuneeE52yaYgvg9NdBqW+QjUC5XLVVIgc0=";
+  cargoHash = "sha256-XefJGAU3NxIyby/0lIx2xnJ00Jv1bNlKWkBe+1hapoU=";

  nativeBuildInputs = [
    pkg-config
  ];

-  buildInputs = [
-    openssl
-    zlib
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-    SystemConfiguration
-  ];
+  buildInputs =
+    [
+      openssl
+      zlib
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      Security
+      SystemConfiguration
+    ];

  buildFeatures = [ "fix" ];

@ -42,7 +45,14 @@ rustPlatform.buildRustPackage rec {
    mainProgram = "cargo-audit";
    homepage = "https://rustsec.org";
    changelog = "https://github.com/rustsec/rustsec/blob/cargo-audit/v${version}/cargo-audit/CHANGELOG.md";
-    license = with licenses; [ mit /* or */ asl20 ];
-    maintainers = with maintainers; [ basvandijk figsoda jk ];
+    license = with licenses; [
+      mit # or
+      asl20
+    ];
+    maintainers = with maintainers; [
+      basvandijk
+      figsoda
+      jk
+    ];
  };
 }
--- a/pkgs/development/tools/rust/cargo-lambda/default.nix
+++ b/pkgs/development/tools/rust/cargo-lambda/default.nix
@ -16,16 +16,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-lambda";
-  version = "1.4.0";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-QTFIFD04pAcNgj+ktY8WP0ScDmSy6mNlhfiXAabMlGE=";
+    hash = "sha256-58kVtwBZEAlv9eVesqmWMZ+KxAwEiGMm8mCf9X5tPMI=";
  };

-  cargoHash = "sha256-1/+bkxEpIvaJBJatqpX186MHKOdLO8Jiw8NEnyr9ctg=";
+  cargoHash = "sha256-DoMIVpYtEHvYSW2THpZFdhoFI0zjC70hYnwnzGwkJ4Q=";

  nativeCheckInputs = [ cacert ];

@ -43,36 +43,16 @@ rustPlatform.buildRustPackage rec {
    ];

  checkFlags = [
-    # Disabled because they access the network.
-    "--skip=test_build_basic_extension"
-    "--skip=test_build_basic_function"
-    "--skip=test_build_basic_zip_extension"
-    "--skip=test_build_basic_zip_function"
-    "--skip=test_build_event_type_function"
-    "--skip=test_build_http_feature_function"
-    "--skip=test_build_http_function"
-    "--skip=test_build_internal_zip_extension"
-    "--skip=test_build_logs_extension"
-    "--skip=test_build_telemetry_extension"
-    "--skip=test_build_zip_workspace"
+    # Tests disabled because they access the network.
    "--skip=test_download_example"
-    "--skip=test_init_subcommand"
-    "--skip=test_init_subcommand_without_override"
-    "--skip=test_build_example"
-    "--skip=test_deploy_workspace"
-    "--skip=test_add_files"
-    "--skip=test_consistent_hash"
-    "--skip=test_create_binary_archive_from_target"
-    "--skip=test_create_binary_archive_with_base_path"
-    "--skip=test_zip_extension"
-    "--skip=test_zip_funcion"
-    "--skip=test_zip_funcion_with_files"
-    "--skip=test_zip_internal_extension"
  ];

-  # remove date from version output to make reproducible
+  # Remove files that don't make builds reproducible:
+  # - Remove build.rs file that adds the build date to the version.
+  # - Remove cargo_lambda.rs that contains tests that reach the network.
  postPatch = ''
    rm crates/cargo-lambda-cli/build.rs
+    rm crates/cargo-lambda-cli/tests/cargo_lambda.rs
  '';

  postInstall = ''
--- a/pkgs/games/dwarf-fortress/game.nix
+++ b/pkgs/games/dwarf-fortress/game.nix
@ -168,5 +168,6 @@ stdenv.mkDerivation {
    license = licenses.unfreeRedistributable;
    platforms = attrNames platforms;
    maintainers = with maintainers; [ a1russell robbinch roconnor abbradar numinit shazow ncfavier ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };
 }
--- a/pkgs/games/oilrush/default.nix
+++ b/pkgs/games/oilrush/default.nix
@ -72,6 +72,7 @@ stdenv.mkDerivation {
    #maintainers = with lib.maintainers; [ astsmtl ];
    platforms = lib.platforms.linux;
    hydraPlatforms = [];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
  };

 }
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@ -21,7 +21,7 @@
 }:

 let
-  version = "0.99.1";
+  version = "0.100.0";
 in

 rustPlatform.buildRustPackage {
@ -32,10 +32,10 @@ rustPlatform.buildRustPackage {
    owner = "nushell";
    repo = "nushell";
    rev = "refs/tags/${version}";
-    hash = "sha256-amPQJW8ofSMh2cQQrqPNOp/p33KwPNX7fpZ4SiJGQHU=";
+    hash = "sha256-lbVvKpaG9HSm2W+NaVUuEOxTNUIf0iRATTVDKFPjqV4=";
  };

-  cargoHash = "sha256-AblXOeSJGqrZY5aRzdst9F+ZB++/3Adu7Kri5lDsDH8=";
+  cargoHash = "sha256-omC/qcpgy65Md1MC0QGUVCRVNl9sWlFcCRxdS4aeU+g=";

  nativeBuildInputs = [ pkg-config ]
    ++ lib.optionals (withDefaultFeatures && stdenv.hostPlatform.isLinux) [ python3 ]
--- a/pkgs/shells/nushell/plugins/formats.nix
+++ b/pkgs/shells/nushell/plugins/formats.nix
@ -12,7 +12,7 @@
 rustPlatform.buildRustPackage rec {
  pname = "nushell_plugin_formats";
  inherit (nushell) version src;
-  cargoHash = "sha256-9wKJkZnbM8Zt90LlSTd9hb40Xuy2cOBThwUWyS2NuaI=";
+  cargoHash = "sha256-Ftjcic/2rN5cYlzD7C9HyWWm4a37+s/mqRMHH4+4uBA=";

  nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
--- a/pkgs/shells/nushell/plugins/gstat.nix
+++ b/pkgs/shells/nushell/plugins/gstat.nix
@ -12,7 +12,7 @@
 rustPlatform.buildRustPackage rec {
  pname = "nushell_plugin_gstat";
  inherit (nushell) version src;
-  cargoHash = "sha256-Z2A6DaARkffU7FABuLSTNeDLClRr4V21bD76ns8ueAM=";
+  cargoHash = "sha256-IGOT3tlFUjnD5DBbi8zERPcL7OiP8lwKtK4GVOR53xU=";

  nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
  buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
--- a/pkgs/shells/nushell/plugins/net.nix
+++ b/pkgs/shells/nushell/plugins/net.nix
@ -5,7 +5,7 @@
  stdenv,
  IOKit,
  CoreFoundation,
-  unstableGitUpdater,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage rec {
@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
    IOKit
  ];

-  passthru.updateScript = unstableGitUpdater { };
+  passthru.updateScript = nix-update-script { };

  meta = with lib; {
    description = "Nushell plugin to list system network interfaces";
--- a/pkgs/shells/nushell/plugins/polars.nix
+++ b/pkgs/shells/nushell/plugins/polars.nix
@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
  pname = "nushell_plugin_polars";
  inherit (nushell) version src;

-  cargoHash = "sha256-bpZphNYHx9LkEu9JlGrIkks2M99JRjc+skY8MqPHMJA=";
+  cargoHash = "sha256-CMrq0UVJxXoyHo9OvatW9tlknqzOuK70NI8H/ZgbYBY=";

  nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
  buildInputs =
--- a/pkgs/shells/nushell/plugins/query.nix
+++ b/pkgs/shells/nushell/plugins/query.nix
@ -14,7 +14,7 @@
 rustPlatform.buildRustPackage rec {
  pname = "nushell_plugin_query";
  inherit (nushell) version src;
-  cargoHash = "sha256-4oSmt92nMIaSV7hLEBv5GIDYVmtT96O4qktO8ovdcBQ=";
+  cargoHash = "sha256-xztQzfe/ZjG3YvQMDN3ADtWIcjUr3thPxbPjOKKvB9Q=";

  nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
  buildInputs =
--- a/pkgs/shells/nushell/plugins/units.nix
+++ b/pkgs/shells/nushell/plugins/units.nix
@ -11,15 +11,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "nushell_plugin_units";
-  version = "0.1.2";
+  version = "0.1.3";

  src = fetchFromGitHub {
    repo = "nu_plugin_units";
    owner = "JosephTLyons";
    rev = "v${version}";
-    hash = "sha256-PS16n4j/dg5/+RaliYA18bStNpAecv9aaY2YKXsgLWY=";
+    hash = "sha256-zPN18ECzh2/l0kxp+Vyp3d9kCq3at/7SqMYbV3WDV3I=";
  };
-  cargoHash = "sha256-pxA+6E5luFHq/N0K/8Xk2LapwDnPqDUEpTYqP/jcc3s=";
+  cargoHash = "sha256-6NWyuErdxj7//wW4L7ijW4RiWqdwbeTrelIjpisAGkg=";

  nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
--- a/pkgs/tools/networking/termscp/default.nix
+++ b/pkgs/tools/networking/termscp/default.nix
@ -1,61 +1,74 @@
-{ lib
-, stdenv
-, dbus
-, fetchFromGitHub
-, openssl
-, pkg-config
-, rustPlatform
-, AppKit
-, Cocoa
-, Foundation
-, Security
-, samba
+{
+  lib,
+  stdenv,
+  dbus,
+  fetchFromGitHub,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  AppKit,
+  Cocoa,
+  Foundation,
+  Security,
+  samba,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage rec {
  pname = "termscp";
-  version = "0.15.0";
+  version = "0.16.1";

  src = fetchFromGitHub {
    owner = "veeso";
    repo = "termscp";
    rev = "refs/tags/v${version}";
-    hash = "sha256-/WYhwt/GAULX/UY1GyqzauaMRlVuvAwwS0DNfYB7aD4=";
+    hash = "sha256-tR+jfFdCSsf+WR8VUX60/mdfsp7cX9jUDI+CKIZkgEE=";
  };

-  cargoHash = "sha256-OqrJpVb9EF22OGP5SOIfEUg66+T96qcN3GH+fs72+7A=";
+  cargoHash = "sha256-g6A8rNOUduhdwSqunDlZvO7E07GmDgb1o2FVohFAcL0=";

  nativeBuildInputs = [
    pkg-config
  ];

-  buildInputs = [
-    dbus
-    openssl
-    samba
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    AppKit
-    Cocoa
-    Foundation
-    Security
-  ];
+  buildInputs =
+    [
+      dbus
+      openssl
+      samba
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      AppKit
+      Cocoa
+      Foundation
+      Security
+    ];

  # Needed to get openssl-sys to use pkg-config.
  OPENSSL_NO_VENDOR = 1;

-  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.hostPlatform.isDarwin [
-    "-framework" "AppKit"
-  ]);
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.hostPlatform.isDarwin [
+      "-framework"
+      "AppKit"
+    ]
+  );

  # Requires network access
  doCheck = false;

-  meta = with lib; {
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    changelog = "https://github.com/veeso/termscp/blob/v${version}/CHANGELOG.md";
    description = "Feature rich terminal UI file transfer and explorer with support for SCP/SFTP/FTP/S3/SMB";
    homepage = "https://github.com/veeso/termscp";
-    changelog = "https://github.com/veeso/termscp/blob/v${version}/CHANGELOG.md";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
    mainProgram = "termscp";
+    maintainers = with lib.maintainers; [
+      fab
+    ];
  };
 }
--- a/pkgs/tools/security/opensc/default.nix
+++ b/pkgs/tools/security/opensc/default.nix
@ -1,65 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, zlib, readline, openssl
-, libiconv, pcsclite, libassuan, libXt
-, docbook_xsl, libxslt, docbook_xml_dtd_412
-, Carbon, PCSC, buildPackages
-, withApplePCSC ? stdenv.hostPlatform.isDarwin
-}:
-
-stdenv.mkDerivation rec {
-  pname = "opensc";
-  version = "0.25.1";
-
-  src = fetchFromGitHub {
-    owner = "OpenSC";
-    repo = "OpenSC";
-    rev = version;
-    sha256 = "sha256-Ktvp/9Hca87qWmDlQhFzvWsr7TvNpIAvOFS+4zTZbB8=";
-  };
-
-  nativeBuildInputs = [ pkg-config autoreconfHook ];
-  buildInputs = [
-    zlib readline openssl libassuan
-    libXt libxslt libiconv docbook_xml_dtd_412
-  ]
-  ++ lib.optional stdenv.hostPlatform.isDarwin Carbon
-  ++ (if withApplePCSC then [ PCSC ] else [ pcsclite ]);
-
-  env.NIX_CFLAGS_COMPILE = "-Wno-error";
-
-  configureFlags = [
-    "--enable-zlib"
-    "--enable-readline"
-    "--enable-openssl"
-    "--enable-pcsc"
-    "--enable-sm"
-    "--enable-man"
-    "--enable-doc"
-    "--localstatedir=/var"
-    "--sysconfdir=/etc"
-    "--with-xsl-stylesheetsdir=${docbook_xsl}/xml/xsl/docbook"
-    "--with-pcsc-provider=${
-      if withApplePCSC then
-        "${PCSC}/Library/Frameworks/PCSC.framework/PCSC"
-      else
-        "${lib.getLib pcsclite}/lib/libpcsclite${stdenv.hostPlatform.extensions.sharedLibrary}"
-      }"
-    (lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform)
-      "XSLTPROC=${buildPackages.libxslt}/bin/xsltproc")
-  ];
-
-  PCSC_CFLAGS = lib.optionalString withApplePCSC
-    "-I${PCSC}/Library/Frameworks/PCSC.framework/Headers";
-
-  installFlags = [
-    "sysconfdir=$(out)/etc"
-    "completiondir=$(out)/etc"
-  ];
-
-  meta = with lib; {
-    description = "Set of libraries and utilities to access smart cards";
-    homepage = "https://github.com/OpenSC/OpenSC/wiki";
-    license = licenses.lgpl21Plus;
-    platforms = platforms.all;
-    maintainers = [ maintainers.michaeladler ];
-  };
-}
--- a/pkgs/tools/system/osquery/info.json
+++ b/pkgs/tools/system/osquery/info.json
@ -5,9 +5,9 @@
    },
    "osquery": {
        "fetchSubmodules": true,
-        "hash": "sha256-PJrGAqDxo5l6jtQdpTqraR195G6kaLQ2ik08WtlWEmk=",
+        "hash": "sha256-ZgIYPPfLNXuCVcz+9lmFnDAnpmlLBolt6mLsfGR8rvs=",
        "owner": "osquery",
        "repo": "osquery",
-        "rev": "5.12.2"
+        "rev": "5.13.1"
    }
 }
--- a/pkgs/tools/text/mdcat/default.nix
+++ b/pkgs/tools/text/mdcat/default.nix
@ -13,20 +13,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "mdcat";
-  version = "2.5.0";
+  version = "2.6.1";

  src = fetchFromGitHub {
    owner = "swsnr";
    repo = "mdcat";
    rev = "mdcat-${version}";
-    hash = "sha256-Y0tWhqRGrjex/yKWmRu4+hSRM9/vchsYyx26x/HBuRw=";
+    hash = "sha256-iZenHdlYoHyX4CC2/qeNWBYxoeE35kx6xnYWfxcRZYg=";
  };

  nativeBuildInputs = [ pkg-config asciidoctor installShellFiles ];
  buildInputs = [ openssl ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security SystemConfiguration ];

-  cargoHash = "sha256-f2YmrmRlQTCBTzG7DWJVldP/lOhl2iCnhnOLHx1QJDc=";
+  cargoHash = "sha256-NnsChyW7lwnlv2MWSJTlFIBVVpvUsYIiilDnmfIBE+8=";

  nativeCheckInputs = [ ansi2html ];
  # Skip tests that use the network and that include files.
--- a/pkgs/tools/wayland/gtklock/default.nix
+++ b/pkgs/tools/wayland/gtklock/default.nix
@ -1,57 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, meson
-, ninja
-, scdoc
-, pkg-config
-, wrapGAppsHook3
-, gtk3
-, pam
-, gtk-session-lock
-}:
-
-stdenv.mkDerivation rec {
-  pname = "gtklock";
-  version = "3.0.0";
-
-  src = fetchFromGitHub {
-    owner = "jovanlanik";
-    repo = "gtklock";
-    rev = "v${version}";
-    hash = "sha256-B6pySjiwPBRFb4avE9NHsS1KkWMPW81DAqYro/wtrmQ=";
-  };
-
-  nativeBuildInputs = [
-    meson
-    ninja
-    scdoc
-    pkg-config
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
-    gtk3
-    pam
-    gtk-session-lock
-  ];
-
-  strictDeps = true;
-
-  installFlags = [
-    "DESTDIR=$(out)"
-    "PREFIX="
-  ];
-
-  meta = with lib; {
-    description = "GTK-based lockscreen for Wayland";
-    longDescription = ''
-      Important note: for gtklock to work you need to set "security.pam.services.gtklock = {};" manually.
-    ''; # Following  nixpkgs/pkgs/applications/window-managers/sway/lock.nix
-    homepage = "https://github.com/jovanlanik/gtklock";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ dit7ya aleksana ];
-    platforms = platforms.linux;
-    mainProgram = "gtklock";
-  };
-}
--- a/pkgs/tools/wayland/gtklock/playerctl-module.nix
+++ b/pkgs/tools/wayland/gtklock/playerctl-module.nix
@ -1,34 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, pkg-config
-, gtk3
-, playerctl
-, libsoup
-}:
-
-stdenv.mkDerivation rec {
-  pname = "gtklock-playerctl-module";
-  version = "3.0.0";
-
-  src = fetchFromGitHub {
-    owner = "jovanlanik";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-eN4E3+jv8IyRvV8pvfCjCc6pl8y7qSLRlj7tYkX0JrE=";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [ gtk3 playerctl libsoup ];
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  meta = with lib; {
-    description = "Gtklock module adding media player controls to the lockscreen";
-    homepage = "https://github.com/jovanlanik/gtklock-playerctl-module";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ aleksana ];
-    platforms = platforms.linux;
-  };
-}
--- a/Show More
+++ b/Show More