Merge master into haskell-updates

2024-08-06 00:14:21 +00:00 · 2024-08-06 00:14:21 +00:00 · cda4664421
commit cda4664421
parent a76bd42a24 0306728f34
260 changed files with 7891 additions and 5523 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -12662,6 +12662,12 @@
    githubId = 1711539;
    name = "matklad";
  };
+  matko = {
+    email = "maren.van.otterdijk@gmail.com";
+    github = "matko";
+    githubId = 155603;
+    name = "Maren van Otterdijk";
+  };
  matrss = {
    name = "Matthias Riße";
    email = "matthias.risze@t-online.de";
@ -13327,6 +13333,12 @@
    name = "midchildan";
    keys = [ { fingerprint = "FEF0 AE2D 5449 3482 5F06  40AA 186A 1EDA C5C6 3F83"; } ];
  };
+  midirhee12 = {
+    email = "midirhee@proton.me";
+    github = "midirhee12";
+    githubId = 38054771;
+    name = "midirhee12";
+  };
  mig4ng = {
    email = "mig4ng@gmail.com";
    github = "mig4ng";
@ -15164,6 +15176,12 @@
    githubId = 848535;
    name = "Oleg Lebedev";
  };
+  oleina = {
+    email = "antholeinik@gmail.com";
+    github = "antholeole";
+    githubId = 48811365;
+    name = "Anthony Oleinik";
+  };
  olejorgenb = {
    email = "olejorgenb@yahoo.no";
    github = "olejorgenb";
@ -17184,6 +17202,13 @@
    githubId = 801525;
    name = "rembo10";
  };
+  remcoschrijver = {
+    email = "info@writerit.nl";
+    matrix = "@remcoschrijver:tchncs.de";
+    github = "remcoschrijver";
+    githubId = 45097990;
+    name = "Remco Schrijver";
+  };
  remexre = {
    email = "nathan+nixpkgs@remexre.com";
    github = "remexre";
--- a/maintainers/scripts/bootstrap-files/refresh-tarballs.bash
+++ b/maintainers/scripts/bootstrap-files/refresh-tarballs.bash
@ -95,6 +95,7 @@ CROSS_TARGETS=(
    powerpc64-unknown-linux-gnuabielfv2
    powerpc64le-unknown-linux-gnu
    riscv64-unknown-linux-gnu
+    s390x-unknown-linux-gnu
    x86_64-unknown-freebsd
 )

--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -72,6 +72,8 @@

 - [OpenGFW](https://github.com/apernet/OpenGFW), an implementation of the Great Firewall on Linux. Available as [services.opengfw](#opt-services.opengfw.enable).

+- [Rathole](https://github.com/rapiz1/rathole), a lightweight and high-performance reverse proxy for NAT traversal. Available as [services.rathole](#opt-services.rathole.enable).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}

 - `transmission` package has been aliased with a `trace` warning to `transmission_3`. Since [Transmission 4 has been released last year](https://github.com/transmission/transmission/releases/tag/4.0.0), and Transmission 3 will eventually go away, it was decided perform this warning alias to make people aware of the new version. The `services.transmission.package` defaults to `transmission_3` as well because the upgrade can cause data loss in certain specific usage patterns (examples: [#5153](https://github.com/transmission/transmission/issues/5153), [#6796](https://github.com/transmission/transmission/issues/6796)). Please make sure to back up to your data directory per your usage:
@ -179,6 +181,10 @@
  and `nodePackages.vscode-json-languageserver-bin` were dropped due to an unmaintained upstream.
  The `vscode-langservers-extracted` package is a maintained drop-in replacement.

+- `fetchNextcloudApp` has been rewritten to use `fetchurl` rather than
+  `fetchzip`. This invalidates all existing hashes but you can restore the old
+  behavior by passing it `unpack = true`.
+
 - `haskell.lib.compose.justStaticExecutables` now disallows references to GHC in the
  output by default, to alert users to closure size issues caused by
  [#164630](https://github.com/NixOS/nixpkgs/issues/164630). See ["Packaging
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1165,6 +1165,7 @@
  ./services/networking/r53-ddns.nix
  ./services/networking/radicale.nix
  ./services/networking/radvd.nix
+  ./services/networking/rathole.nix
  ./services/networking/rdnssd.nix
  ./services/networking/realm.nix
  ./services/networking/redsocks.nix
--- a/nixos/modules/services/misc/ananicy.nix
+++ b/nixos/modules/services/misc/ananicy.nix
@ -1,85 +1,119 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:

 let
  cfg = config.services.ananicy;
-  configFile = pkgs.writeText "ananicy.conf" (generators.toKeyValue { } cfg.settings);
-  extraRules = pkgs.writeText "extraRules" (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraRules);
-  extraTypes = pkgs.writeText "extraTypes" (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraTypes);
-  extraCgroups = pkgs.writeText "extraCgroups" (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraCgroups);
-  servicename = if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-cpp)) then "ananicy-cpp" else "ananicy";
+  configFile = pkgs.writeText "ananicy.conf" (lib.generators.toKeyValue { } cfg.settings);
+  extraRules = pkgs.writeText "extraRules" (
+    lib.concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraRules
+  );
+  extraTypes = pkgs.writeText "extraTypes" (
+    lib.concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraTypes
+  );
+  extraCgroups = pkgs.writeText "extraCgroups" (
+    lib.concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraCgroups
+  );
+  servicename =
+    if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-pp)) then "ananicy-cpp" else "ananicy";
+  # Ananicy-CPP with BPF is not supported on hardened kernels https://github.com/NixOS/nixpkgs/issues/327382
+  finalPackage =
+    if (servicename == "ananicy-cpp" && config.boot.kernelPackages.isHardened) then
+      (cfg.package { withBpf = false; })
+    else
+      cfg.package;
 in
 {
-  options = {
-    services.ananicy = {
-      enable = mkEnableOption "Ananicy, an auto nice daemon";
+  options.services.ananicy = {
+    enable = lib.mkEnableOption "Ananicy, an auto nice daemon";

-      package = mkPackageOption pkgs "ananicy" {
-        example = "ananicy-cpp";
-      };
+    package = lib.mkPackageOption pkgs "ananicy" { example = "ananicy-cpp"; };

-      rulesProvider = mkPackageOption pkgs "ananicy" {
-        example = "ananicy-cpp";
-      } // {
-        description = ''
-          Which package to copy default rules,types,cgroups from.
-        '';
-      };
+    rulesProvider = lib.mkPackageOption pkgs "ananicy" { example = "ananicy-cpp"; } // {
+      description = ''
+        Which package to copy default rules,types,cgroups from.
+      '';
+    };

-      settings = mkOption {
-        type = with types; attrsOf (oneOf [ int bool str ]);
-        default = { };
-        example = {
-          apply_nice = false;
-        };
-        description = ''
-          See <https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf>
-        '';
+    settings = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (oneOf [
+          int
+          bool
+          str
+        ]);
+      default = { };
+      example = {
+        apply_nice = false;
      };
+      description = ''
+        See <https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf>
+      '';
+    };

-      extraRules = mkOption {
-        type = with types; listOf attrs;
-        default = [ ];
-        description = ''
-          Rules to write in 'nixRules.rules'. See:
-          <https://github.com/Nefelim4ag/Ananicy#configuration>
-          <https://gitlab.com/ananicy-cpp/ananicy-cpp/#global-configuration>
-        '';
-        example = [
-          { name = "eog"; type = "Image-Viewer"; }
-          { name = "fdupes"; type = "BG_CPUIO"; }
-        ];
-      };
-      extraTypes = mkOption {
-        type = with types; listOf attrs;
-        default = [ ];
-        description = ''
-          Types to write in 'nixTypes.types'. See:
-          <https://gitlab.com/ananicy-cpp/ananicy-cpp/#types>
-        '';
-        example = [
-          { type = "my_type"; nice = 19; other_parameter = "value"; }
-          { type = "compiler"; nice = 19; sched = "batch"; ioclass = "idle"; }
-        ];
-      };
-      extraCgroups = mkOption {
-        type = with types; listOf attrs;
-        default = [ ];
-        description = ''
-          Cgroups to write in 'nixCgroups.cgroups'. See:
-          <https://gitlab.com/ananicy-cpp/ananicy-cpp/#cgroups>
-        '';
-        example = [
-          { cgroup = "cpu80"; CPUQuota = 80; }
-        ];
-      };
+    extraRules = lib.mkOption {
+      type = with lib.types; listOf attrs;
+      default = [ ];
+      description = ''
+        Rules to write in 'nixRules.rules'. See:
+        <https://github.com/Nefelim4ag/Ananicy#configuration>
+        <https://gitlab.com/ananicy-cpp/ananicy-cpp/#global-configuration>
+      '';
+      example = [
+        {
+          name = "eog";
+          type = "Image-Viewer";
+        }
+        {
+          name = "fdupes";
+          type = "BG_CPUIO";
+        }
+      ];
+    };
+    extraTypes = lib.mkOption {
+      type = with lib.types; listOf attrs;
+      default = [ ];
+      description = ''
+        Types to write in 'nixTypes.types'. See:
+        <https://gitlab.com/ananicy-cpp/ananicy-cpp/#types>
+      '';
+      example = [
+        {
+          type = "my_type";
+          nice = 19;
+          other_parameter = "value";
+        }
+        {
+          type = "compiler";
+          nice = 19;
+          sched = "batch";
+          ioclass = "idle";
+        }
+      ];
+    };
+    extraCgroups = lib.mkOption {
+      type = with lib.types; listOf attrs;
+      default = [ ];
+      description = ''
+        Cgroups to write in 'nixCgroups.cgroups'. See:
+        <https://gitlab.com/ananicy-cpp/ananicy-cpp/#cgroups>
+      '';
+      example = [
+        {
+          cgroup = "cpu80";
+          CPUQuota = 80;
+        }
+      ];
    };
  };

-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
    environment = {
-      systemPackages = [ cfg.package ];
+      systemPackages = [ finalPackage ];
      etc."ananicy.d".source = pkgs.runCommandLocal "ananicyfiles" { } ''
        mkdir -p $out
        # ananicy-cpp does not include rules or settings on purpose
@ -92,16 +126,16 @@ in
        # configured through .setings
        rm -f $out/ananicy.conf
        cp ${configFile} $out/ananicy.conf
-        ${optionalString (cfg.extraRules != [ ]) "cp ${extraRules} $out/nixRules.rules"}
-        ${optionalString (cfg.extraTypes != [ ]) "cp ${extraTypes} $out/nixTypes.types"}
-        ${optionalString (cfg.extraCgroups != [ ]) "cp ${extraCgroups} $out/nixCgroups.cgroups"}
+        ${lib.optionalString (cfg.extraRules != [ ]) "cp ${extraRules} $out/nixRules.rules"}
+        ${lib.optionalString (cfg.extraTypes != [ ]) "cp ${extraTypes} $out/nixTypes.types"}
+        ${lib.optionalString (cfg.extraCgroups != [ ]) "cp ${extraCgroups} $out/nixCgroups.cgroups"}
      '';
    };

    # ananicy and ananicy-cpp have different default settings
    services.ananicy.settings =
      let
-        mkOD = mkOptionDefault;
+        mkOD = lib.mkOptionDefault;
      in
      {
        cgroup_load = mkOD true;
@ -113,26 +147,30 @@ in
        apply_sched = mkOD true;
        apply_oom_score_adj = mkOD true;
        apply_cgroup = mkOD true;
-      } // (if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-cpp)) then {
-        # https://gitlab.com/ananicy-cpp/ananicy-cpp/-/blob/master/src/config.cpp#L12
-        loglevel = mkOD "warn"; # default is info but its spammy
-        cgroup_realtime_workaround = true;
-        log_applied_rule = mkOD false;
-      } else {
-        # https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf
-        check_disks_schedulers = mkOD true;
-        check_freq = mkOD 5;
-      });
+      }
+      // (
+        if servicename == "ananicy-cpp" then
+          {
+            # https://gitlab.com/ananicy-cpp/ananicy-cpp/-/blob/master/src/config.cpp#L12
+            loglevel = mkOD "warn"; # default is info but its spammy
+            cgroup_realtime_workaround = true;
+            log_applied_rule = mkOD false;
+          }
+        else
+          {
+            # https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf
+            check_disks_schedulers = mkOD true;
+            check_freq = mkOD 5;
+          }
+      );

    systemd = {
-      packages = [ cfg.package ];
+      packages = [ finalPackage ];
      services."${servicename}" = {
        wantedBy = [ "default.target" ];
      };
    };
  };

-  meta = {
-    maintainers = with maintainers; [ artturin ];
-  };
+  meta.maintainers = with lib.maintainers; [ artturin ];
 }
--- a/nixos/modules/services/networking/rathole.nix
+++ b/nixos/modules/services/networking/rathole.nix
@ -0,0 +1,165 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+let
+  cfg = config.services.rathole;
+  settingsFormat = pkgs.formats.toml { };
+  py-toml-merge =
+    pkgs.writers.writePython3Bin "py-toml-merge"
+      {
+        libraries = with pkgs.python3Packages; [
+          tomli-w
+          mergedeep
+        ];
+      }
+      ''
+        import argparse
+        from pathlib import Path
+        from typing import Any
+
+        import tomli_w
+        import tomllib
+        from mergedeep import merge
+
+        parser = argparse.ArgumentParser(description="Merge multiple TOML files")
+        parser.add_argument(
+            "files",
+            type=Path,
+            nargs="+",
+            help="List of TOML files to merge",
+        )
+
+        args = parser.parse_args()
+        merged: dict[str, Any] = {}
+
+        for file in args.files:
+            with open(file, "rb") as fh:
+                loaded_toml = tomllib.load(fh)
+                merged = merge(merged, loaded_toml)
+
+        print(tomli_w.dumps(merged))
+      '';
+in
+
+{
+  options = {
+    services.rathole = {
+      enable = lib.mkEnableOption "Rathole";
+
+      package = lib.mkPackageOption pkgs "rathole" { };
+
+      role = lib.mkOption {
+        type = lib.types.enum [
+          "server"
+          "client"
+        ];
+        description = ''
+          Select whether rathole needs to be run as a `client` or a `server`.
+          Server is a machine with a public IP and client is a device behind NAT,
+          but running some services that need to be exposed to the Internet.
+        '';
+      };
+
+      credentialsFile = lib.mkOption {
+        type = lib.types.path;
+        default = "/dev/null";
+        description = ''
+          Path to a TOML file to be merged with the settings.
+          Useful to set secret config parameters like tokens, which
+          should not appear in the Nix Store.
+        '';
+        example = "/var/lib/secrets/rathole/config.toml";
+      };
+
+      settings = lib.mkOption {
+        type = settingsFormat.type;
+        default = { };
+        description = ''
+          Rathole configuration, for options reference
+          see the [example](https://github.com/rapiz1/rathole?tab=readme-ov-file#configuration) on GitHub.
+          Both server and client configurations can be specified at the same time, regardless of the selected role.
+        '';
+        example = {
+          server = {
+            bind_addr = "0.0.0.0:2333";
+            services.my_nas_ssh = {
+              token = "use_a_secret_that_only_you_know";
+              bind_addr = "0.0.0.0:5202";
+            };
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.rathole = {
+      requires = [ "network.target" ];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      description = "Rathole ${cfg.role} Service";
+
+      serviceConfig =
+        let
+          name = "rathole";
+          configFile = settingsFormat.generate "${name}.toml" cfg.settings;
+          runtimeDir = "/run/${name}";
+          ratholePrestart =
+            "+"
+            + (pkgs.writeShellScript "rathole-prestart" ''
+              DYNUSER_UID=$(stat -c %u ${runtimeDir})
+              DYNUSER_GID=$(stat -c %g ${runtimeDir})
+              ${lib.getExe py-toml-merge} ${configFile} '${cfg.credentialsFile}' |
+                install -m 600 -o $DYNUSER_UID -g $DYNUSER_GID /dev/stdin ${runtimeDir}/${mergedConfigName}
+            '');
+          mergedConfigName = "merged.toml";
+        in
+        {
+          Type = "simple";
+          Restart = "on-failure";
+          RestartSec = 5;
+          ExecStartPre = ratholePrestart;
+          ExecStart = "${lib.getExe cfg.package} --${cfg.role} ${runtimeDir}/${mergedConfigName}";
+          DynamicUser = true;
+          LimitNOFILE = "1048576";
+          RuntimeDirectory = name;
+          RuntimeDirectoryMode = "0700";
+          # Hardening
+          AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+          CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          PrivateDevices = true;
+          PrivateMounts = true;
+          PrivateTmp = true;
+          # PrivateUsers=true breaks AmbientCapabilities=CAP_NET_BIND_SERVICE
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          UMask = "0066";
+        };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ xokdvium ];
+}
--- a/nixos/modules/services/web-apps/pretix.nix
+++ b/nixos/modules/services/web-apps/pretix.nix
@ -538,6 +538,7 @@ in
          TimeoutStartSec = "15min";
          ExecStart = "${getExe' pythonEnv "gunicorn"} --bind unix:/run/pretix/pretix.sock ${cfg.gunicorn.extraArgs} pretix.wsgi";
          RuntimeDirectory = "pretix";
+          Restart = "on-failure";
        };
      };

@ -559,7 +560,10 @@ in
          "postgresql.service"
        ];
        wantedBy = [ "multi-user.target" ];
-        serviceConfig.ExecStart = "${getExe' pythonEnv "celery"} -A pretix.celery_app worker ${cfg.celery.extraArgs}";
+        serviceConfig = {
+          ExecStart = "${getExe' pythonEnv "celery"} -A pretix.celery_app worker ${cfg.celery.extraArgs}";
+          Restart = "on-failure";
+        };
      };

      nginx.serviceConfig.SupplementaryGroups = mkIf cfg.nginx.enable [ "pretix" ];
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@ -29,6 +29,7 @@ DISTRO_NAME = "@distroName@"
 NIX = "@nix@"
 SYSTEMD = "@systemd@"
 CONFIGURATION_LIMIT = int("@configurationLimit@")
+REBOOT_FOR_BITLOCKER = bool("@rebootForBitlocker@")
 CAN_TOUCH_EFI_VARIABLES = "@canTouchEfiVariables@"
 GRACEFUL = "@graceful@"
 COPY_EXTRA_FILES = "@copyExtraFiles@"
@ -189,6 +190,8 @@ def write_loader_conf(profile: str | None) -> None:
            f.write("default nixos-generation-*\n")
        if not EDITOR:
            f.write("editor 0\n")
+        if REBOOT_FOR_BITLOCKER:
+            f.write("reboot-for-bitlocker yes\n");
        f.write(f"console-mode {CONSOLE_MODE}\n")
        f.flush()
        os.fsync(f.fileno())
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
@ -40,7 +40,7 @@ let

    configurationLimit = if cfg.configurationLimit == null then 0 else cfg.configurationLimit;

-    inherit (cfg) consoleMode graceful editor;
+    inherit (cfg) consoleMode graceful editor rebootForBitlocker;

    inherit (efi) efiSysMountPoint canTouchEfiVariables;

@ -333,6 +333,22 @@ in {
      };
    };

+    rebootForBitlocker = mkOption {
+      default = false;
+
+      type = types.bool;
+
+      description = ''
+        Enable *EXPERIMENTAL* BitLocker support.
+
+        Try to detect BitLocker encrypted drives along with an active
+        TPM. If both are found and Windows Boot Manager is selected in
+        the boot menu, set the "BootNext" EFI variable and restart the
+        system. The firmware will then start Windows Boot Manager
+        directly, leaving the TPM PCRs in expected states so that
+        Windows can unseal the encryption key.
+      '';
+    };
  };

  config = mkIf cfg.enable {
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@ -103,7 +103,7 @@ let
  initrdBinEnv = pkgs.buildEnv {
    name = "initrd-bin-env";
    paths = map getBin cfg.initrdBin;
-    pathsToLink = ["/bin" "/sbin"];
+    pathsToLink = ["/bin"];
    postBuild = concatStringsSep "\n" (mapAttrsToList (n: v: "ln -sf '${v}' $out/bin/'${n}'") cfg.extraBin);
  };

@ -408,7 +408,7 @@ in {
        fsck = "${cfg.package.util-linux}/bin/fsck";
      };

-      managerEnvironment.PATH = "/bin:/sbin";
+      managerEnvironment.PATH = "/bin";

      contents = {
        "/tmp/.keep".text = "systemd requires the /tmp mount point in the initrd cpio archive";
@ -417,7 +417,7 @@ in {

        "/etc/systemd/system.conf".text = ''
          [Manager]
-          DefaultEnvironment=PATH=/bin:/sbin
+          DefaultEnvironment=PATH=/bin
          ${cfg.extraConfig}
          ManagerEnvironment=${lib.concatStringsSep " " (lib.mapAttrsToList (n: v: "${n}=${lib.escapeShellArg v}") cfg.managerEnvironment)}
        '';
@ -432,9 +432,9 @@ in {
        "/etc/shadow".text = "root:${if isBool cfg.emergencyAccess then optionalString (!cfg.emergencyAccess) "*" else cfg.emergencyAccess}:::::::";

        "/bin".source = "${initrdBinEnv}/bin";
-        "/sbin".source = "${initrdBinEnv}/sbin";
+        "/sbin".source = "${initrdBinEnv}/bin";

-        "/etc/sysctl.d/nixos.conf".text = "kernel.modprobe = /sbin/modprobe";
+        "/etc/sysctl.d/nixos.conf".text = "kernel.modprobe = /bin/modprobe";
        "/etc/modprobe.d/systemd.conf".source = "${cfg.package}/lib/modprobe.d/systemd.conf";
        "/etc/modprobe.d/ubuntu.conf".source = pkgs.runCommand "initrd-kmod-blacklist-ubuntu" { } ''
          ${pkgs.buildPackages.perl}/bin/perl -0pe 's/## file: iwlwifi.conf(.+?)##/##/s;' $src > $out
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@ -32,7 +32,7 @@ let
 in rec {

  nixos = {
-    inherit (nixos') channel manual options iso_minimal amazonImage dummy;
+    inherit (nixos') channel manual options iso_minimal dummy;
    tests = {
      inherit (nixos'.tests)
        acme
@ -116,7 +116,6 @@ in rec {
      (map onSupported [
        "nixos.dummy"
        "nixos.iso_minimal"
-        "nixos.amazonImage"
        "nixos.manual"
        "nixos.tests.acme"
        "nixos.tests.boot.uefiCdrom"
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -830,6 +830,7 @@ in {
  radicle = runTest ./radicle.nix;
  ragnarwm = handleTest ./ragnarwm.nix {};
  rasdaemon = handleTest ./rasdaemon.nix {};
+  rathole = handleTest ./rathole.nix {};
  readarr = handleTest ./readarr.nix {};
  realm = handleTest ./realm.nix {};
  redis = handleTest ./redis.nix {};
--- a/nixos/tests/rathole.nix
+++ b/nixos/tests/rathole.nix
@ -0,0 +1,89 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+
+  let
+    successMessage = "Success 3333115147933743662";
+  in
+  {
+    name = "rathole";
+    meta.maintainers = with lib.maintainers; [ xokdvium ];
+    nodes = {
+      server = {
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+          firewall.enable = false;
+        };
+
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "10.0.0.1/24";
+        };
+
+        services.rathole = {
+          enable = true;
+          role = "server";
+          settings = {
+            server = {
+              bind_addr = "0.0.0.0:2333";
+              services = {
+                success-message = {
+                  bind_addr = "0.0.0.0:80";
+                  token = "hunter2";
+                };
+              };
+            };
+          };
+        };
+      };
+
+      client = {
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+        };
+
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "10.0.0.2/24";
+        };
+
+        services.nginx = {
+          enable = true;
+          virtualHosts."127.0.0.1" = {
+            root = pkgs.writeTextDir "success-message.txt" successMessage;
+          };
+        };
+
+        services.rathole = {
+          enable = true;
+          role = "client";
+          credentialsFile = pkgs.writeText "rathole-credentials.toml" ''
+            [client.services.success-message]
+            token = "hunter2"
+          '';
+          settings = {
+            client = {
+              remote_addr = "10.0.0.1:2333";
+              services.success-message = {
+                local_addr = "127.0.0.1:80";
+              };
+            };
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+      server.wait_for_unit("rathole.service")
+      server.wait_for_open_port(2333)
+      client.wait_for_unit("rathole.service")
+      server.wait_for_open_port(80)
+      response = server.succeed("curl http://127.0.0.1/success-message.txt")
+      assert "${successMessage}" in response, "Got invalid response"
+      response = client.succeed("curl http://10.0.0.1/success-message.txt")
+      assert "${successMessage}" in response, "Got invalid response"
+    '';
+  }
+)
--- a/nixos/tests/web-apps/pretix.nix
+++ b/nixos/tests/web-apps/pretix.nix
@ -20,6 +20,7 @@
        plugins = with pkgs.pretix.plugins; [
          passbook
          pages
+          zugferd
        ];
        settings = {
          pretix = {
--- a/pkgs/applications/blockchains/taproot-assets/default.nix
+++ b/pkgs/applications/blockchains/taproot-assets/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "taproot-assets";
-  version = "0.4.0";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "lightninglabs";
    repo = "taproot-assets";
    rev = "v${version}";
-    hash = "sha256-sTLimar8cDWFl9lwQHYlKFL3CuNcy3p8CVbRjhrH+Dw=";
+    hash = "sha256-aQYVPSDudLK4ZBcBN/wNjVoF/9inOaJRbcyTP6VMdA0=";
  };

  vendorHash = "sha256-IFzYW5vAtBoUC2ebFYnxS/TojQR4kXxQACNbyn2ZkCs=";
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/consult-gh/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/consult-gh/package.nix
@ -12,13 +12,13 @@

 melpaBuild {
  pname = "consult-gh";
-  version = "0.12-unstable-2024-04-23";
+  version = "1.0-unstable-2024-08-02";

  src = fetchFromGitHub {
    owner = "armindarvish";
    repo = "consult-gh";
-    rev = "3a07139a1f7e38b959ce177a122c8f47c401d7fa";
-    hash = "sha256-BZloG5RuQzC2RwCfvqPPhGcbsCabQWBnRHdU62rwNdo=";
+    rev = "e12b24e68116ac6c171d628c547c017458d6aa2b";
+    hash = "sha256-skZkpYUWncGUf9k0IfEq3LAqDXHIfCJJ3p3b3ey+Rks=";
  };

  packageRequires = [
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/font-lock-plus/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/font-lock-plus/package.nix
@ -8,13 +8,13 @@
 melpaBuild {
  pname = "font-lock-plus";
  ename = "font-lock+";
-  version = "208-unstable-2018-01-01";
+  version = "208-unstable-2022-04-02";

  src = fetchFromGitHub {
    owner = "emacsmirror";
    repo = "font-lock-plus";
-    rev = "f2c1ddcd4c9d581bd32be88fad026b49f98b6541";
-    hash = "sha256-lFmdVMXIIXZ9ZohAJw5rhxpTv017qIyzmpuKOWDdeJ4=";
+    rev = "aa1c82d05c9222b09099a0ccd7468e955497940c";
+    hash = "sha256-er+knxqAejgKAtOnhqHfsGN286biHFdeMIUlbW7JyYw=";
  };

  passthru.updateScript = unstableGitUpdater { };
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/voicemacs/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/voicemacs/package.nix
@ -19,13 +19,13 @@

 melpaBuild {
  pname = "voicemacs";
-  version = "0-unstable-2022-02-16";
+  version = "0-unstable-2024-01-03";

  src = fetchFromGitHub {
    owner = "jcaw";
    repo = "voicemacs";
-    rev = "d91de2a31c68ab083172ade2451419d6bd7bb389";
-    hash = "sha256-/MBB2R9/V0aYZp15e0vx+67ijCPp2iPlgxe262ldmtc=";
+    rev = "d93f15d855d61f78827d78c9ca3508766266366c";
+    hash = "sha256-D/5+3SgECEb7A8qQqsAV1TQr+lA8EyOjf6NesnV2gos=";
  };

  patches = [
--- a/pkgs/applications/editors/jetbrains/bin/ides.json
+++ b/pkgs/applications/editors/jetbrains/bin/ides.json
@ -1,4 +1,15 @@
 {
+  "aqua": {
+    "product": "Aqua",
+    "wmClass": "jetbrains-aqua",
+    "meta": {
+      "isOpenSource": false,
+      "description": "Test automation IDE from JetBrains",
+      "maintainers": [ "remcoschrijver" ],
+      "longDescription": "Aqua is a test automation IDE from jetbrains that can deal with many languages and frameworks to improve your test workflows. Has support for popular testing frameworks like Selenium, Cypress, and Playwright.",
+      "homepage": "https://www.jetbrains.com/aqua/"
+    }
+  },
  "clion": {
    "product": "CLion",
    "wmClass": "jetbrains-clion",
--- a/pkgs/applications/editors/jetbrains/bin/versions.json
+++ b/pkgs/applications/editors/jetbrains/bin/versions.json
@ -1,5 +1,13 @@
 {
  "x86_64-linux": {
+    "aqua": {
+      "update-channel": "Aqua EAP licensing:EAP",
+      "url-template": "https://download.jetbrains.com/aqua/aqua-{version}.tar.gz",
+      "version": "2024.1 Public Preview",
+      "sha256": "027cac4bfab747ef97f055b63eff8a69cefc32751fcca9510c3eccaf7c36b2be",
+      "url": "https://download.jetbrains.com/aqua/aqua-241.15989.28.tar.gz",
+      "build_number": "241.15989.28"
+    },
    "clion": {
      "update-channel": "CLion RELEASE",
      "url-template": "https://download.jetbrains.com/cpp/CLion-{version}.tar.gz",
@ -131,6 +139,14 @@
    }
  },
  "aarch64-linux": {
+    "aqua": {
+      "update-channel": "Aqua EAP licensing:EAP",
+      "url-template": "https://download.jetbrains.com/aqua/aqua-{version}-aarch64.tar.gz",
+      "version": "2024.1 Public Preview",
+      "sha256": "ec59ff6e259ce0f03441e30a9d8bce8334d11c3ae858705d2f17375565adb80c",
+      "url": "https://download.jetbrains.com/aqua/aqua-241.15989.28-aarch64.tar.gz",
+      "build_number": "241.15989.28"
+    },
    "clion": {
      "update-channel": "CLion RELEASE",
      "url-template": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.tar.gz",
@ -262,6 +278,14 @@
    }
  },
  "x86_64-darwin": {
+    "aqua": {
+      "update-channel": "Aqua EAP licensing:EAP",
+      "url-template": "https://download.jetbrains.com/aqua/aqua-{version}.dmg",
+      "version": "2024.1 Public Preview",
+      "sha256": "e90b3cc44efcabd3f31025bae506ec87da138f0a06f5cd4eaf7f96bb57db123a",
+      "url": "https://download.jetbrains.com/aqua/aqua-241.15989.28.dmg",
+      "build_number": "241.15989.28"
+    },
    "clion": {
      "update-channel": "CLion RELEASE",
      "url-template": "https://download.jetbrains.com/cpp/CLion-{version}.dmg",
@ -393,6 +417,14 @@
    }
  },
  "aarch64-darwin": {
+    "aqua": {
+      "update-channel": "Aqua EAP licensing:EAP",
+      "url-template": "https://download.jetbrains.com/aqua/aqua-{version}-aarch64.dmg",
+      "version": "2024.1 Public Preview",
+      "sha256": "29b975e6845b62ed466d26920fec4c9e5e74588b5ff5cf384d672b98bb602549",
+      "url": "https://download.jetbrains.com/aqua/aqua-241.15989.28-aarch64.dmg",
+      "build_number": "241.15989.28"
+    },
    "clion": {
      "update-channel": "CLion RELEASE",
      "url-template": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.dmg",
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -100,6 +100,8 @@ in
 rec {
  # Sorted alphabetically

+  aqua = mkJetBrainsProduct { pname = "aqua"; extraBuildInputs = [ stdenv.cc.cc lldb ]; };
+
  clion = (mkJetBrainsProduct {
    pname = "clion";
    extraBuildInputs = lib.optionals (stdenv.isLinux) [
--- a/pkgs/applications/editors/kakoune/plugins/overrides.nix
+++ b/pkgs/applications/editors/kakoune/plugins/overrides.nix
@ -2,6 +2,7 @@
 , buildKakounePluginFrom2Nix
 , kakoune-lsp, parinfer-rust, rep
 , fzf, git, guile, kakoune-unwrapped, lua5_3, plan9port
+, rustPlatform
 }:

 self: super: {
@ -131,6 +132,41 @@ declare-option -hidden str ansi_filter %{'"$out"'/bin/kak-ansi-filter}
    '';
  });

+  hop-kak = rustPlatform.buildRustPackage rec {
+    pname = "hop-kak";
+    version = "0.2.0";
+
+    src = fetchgit {
+      url = "https://git.sr.ht/~hadronized/hop.kak";
+      rev = "7314ec64809a69e0044ba7ec57a18b43e3b5f005";
+      sha256 = "stmGZQU0tp+5xxrexKMzwSwHj5F/F4HzDO9BorNWC3w=";
+
+      # this package uses git to put the commit hash in the
+      # help dialog, so leave the .git folder so the command
+      # succeeds.
+      leaveDotGit = true;
+    };
+
+    nativeBuildInputs = [
+      git
+    ];
+
+    cargoHash = "sha256-EjSj/+BysGwJBxK6Ccg2+pXHdB2Lg3dxIURRsSVTHVY=";
+
+    postInstall = ''
+      mkdir -p $out/share/kak/bin
+      mv $out/bin/hop-kak $out/share/kak/bin/
+    '';
+
+    meta = with lib; {
+      description = "hinting brought to Kakoune selections";
+      homepage = "https://git.sr.ht/~hadronized/hop.kak/";
+      license = licenses.bsd3;
+      maintainers = with maintainers; [ oleina ];
+      platforms = platforms.all;
+    };
+  };
+
  quickscope-kak = buildKakounePluginFrom2Nix rec {
    pname = "quickscope-kak";
    version = "1.0.0";
--- a/pkgs/applications/editors/kakoune/wrapper.nix
+++ b/pkgs/applications/editors/kakoune/wrapper.nix
@ -14,10 +14,17 @@ in
    paths = [ kakoune ] ++ requestedPlugins;

    postBuild = ''
+      # create a directory for bins that kakoune needs
+      # access to, without polluting the users path by adding
+      # that binary nested with this symlinkJoin.
+      mkdir -p $out/share/kak/bin
+
      # location of kak binary is used to find ../share/kak/autoload,
      # unless explicitly overriden with KAKOUNE_RUNTIME
      rm "$out/bin/kak"
-      makeWrapper "${kakoune}/bin/kak" "$out/bin/kak" --set KAKOUNE_RUNTIME "$out/share/kak"
+      makeWrapper "${kakoune}/bin/kak" "$out/bin/kak" \
+        --set KAKOUNE_RUNTIME "$out/share/kak" \
+        --set PATH "$PATH:$out/share/kak/bin"

      # currently kakoune ignores doc files if they are symlinks, so workaround by
      # copying doc files over, so they become regular files...
--- a/pkgs/applications/editors/leo-editor/default.nix
+++ b/pkgs/applications/editors/leo-editor/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "leo-editor";
-  version = "6.7.8";
+  version = "6.8.1";

  src = fetchFromGitHub {
    owner = "leo-editor";
    repo = "leo-editor";
    rev = version;
-    sha256 = "sha256-cawcfEz9QpsjfgJzG5oA5TY2EpT8hLDw5QIjwdKPW6Y=";
+    sha256 = "sha256-YhZSmk2n/Tg0zx1xuy0LtABNiBB3LmXYlhXoK7/b2tQ=";
  };

  dontBuild = true;
--- a/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix
@ -38,24 +38,27 @@

 let
  gdbDefaultsTo = if gdbUseFixed then "${gdb}/bin/gdb" else "gdb";
+  isx86Linux = stdenv.hostPlatform.system == "x86_64-linux";
  supported = {
    x86_64-linux = {
-      hash = "sha256-arTBt3UWA5zoo0dL044Sx/NT1LUS76XfGIS96NOMvJk=";
+      hash = "sha256-jibImnpRtshbHu21JeS4VxL1jETm3Ein8S/M73UXc2w=";
      arch = "linux-x64";
    };
    aarch64-linux = {
-      hash = "sha256-oVuDxx117bVd/jDqn9KivTwR5T2X5UZMHk/nZ/e/IOg=";
+      hash = "sha256-7UagRO7qHyT1JIvvTSx9+USYrnDRXJ2wnXPLaBHRc3k=";
      arch = "linux-arm64";
    };
  };

-  base = supported.${stdenv.system} or (throw "unsupported platform ${stdenv.system}");
+  base =
+    supported.${stdenv.hostPlatform.system}
+      or (throw "unsupported platform ${stdenv.hostPlatform.system}");
 in
 vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = base // {
    name = "cpptools";
    publisher = "ms-vscode";
-    version = "1.20.5";
+    version = "1.21.4";
  };

  nativeBuildInputs = [
@ -71,35 +74,40 @@ vscode-utils.buildVscodeMarketplaceExtension {
    stdenv.cc.cc.lib
  ];

-  dontAutoPatchelf = true;
+  dontAutoPatchelf = isx86Linux;

-  postPatch = ''
-    mv ./package.json ./package_orig.json
-
-    # 1. Add activation events so that the extension is functional. This listing is empty when unpacking the extension but is filled at runtime.
-    # 2. Patch `package.json` so that nix's *gdb* is used as default value for `miDebuggerPath`.
-    cat ./package_orig.json | \
-      jq --slurpfile actEvts ${./package-activation-events.json} '(.activationEvents) = $actEvts[0]' | \
-      jq '(.contributes.debuggers[].configurationAttributes | .attach , .launch | .properties.miDebuggerPath | select(. != null) | select(.default == "/usr/bin/gdb") | .default) = "${gdbDefaultsTo}"' > \
-      ./package.json
-
-    # Prevent download/install of extensions
-    touch "./install.lock"
-
-    # Clang-format from nix package.
-    rm -rf ./LLVM
-    mkdir "./LLVM/"
-    find "${clang-tools}" -mindepth 1 -maxdepth 1 | xargs ln -s -t "./LLVM"
-
-    # Patching binaries
-    chmod +x bin/cpptools bin/cpptools-srv bin/cpptools-wordexp bin/libc.so debugAdapters/bin/OpenDebugAD7
-    patchelf --replace-needed liblttng-ust.so.0 liblttng-ust.so.1 ./debugAdapters/bin/libcoreclrtraceptprovider.so
-  '';
-
-  postFixup =
+  postPatch =
    ''
-      autoPatchelf $out/share/vscode/extensions/ms-vscode.cpptools/debugAdapters
+      mv ./package.json ./package_orig.json

+      # 1. Add activation events so that the extension is functional. This listing is empty when unpacking the extension but is filled at runtime.
+      # 2. Patch `package.json` so that nix's *gdb* is used as default value for `miDebuggerPath`.
+      cat ./package_orig.json | \
+        jq --slurpfile actEvts ${./package-activation-events.json} '(.activationEvents) = $actEvts[0]' | \
+        jq '(.contributes.debuggers[].configurationAttributes | .attach , .launch | .properties.miDebuggerPath | select(. != null) | select(.default == "/usr/bin/gdb") | .default) = "${gdbDefaultsTo}"' > \
+        ./package.json
+
+      # Prevent download/install of extensions
+      touch "./install.lock"
+
+      # Clang-format from nix package.
+      rm -rf ./LLVM
+      mkdir "./LLVM/"
+      find "${clang-tools}" -mindepth 1 -maxdepth 1 | xargs ln -s -t "./LLVM"
+
+      # Patching binaries
+      chmod +x bin/cpptools bin/cpptools-srv bin/cpptools-wordexp debugAdapters/bin/OpenDebugAD7
+      patchelf --replace-needed liblttng-ust.so.0 liblttng-ust.so.1 ./debugAdapters/bin/libcoreclrtraceptprovider.so
+    ''
+    + lib.optionalString isx86Linux ''
+      chmod +x bin/libc.so
+    '';
+
+  # On aarch64 the binaries are statically linked
+  # but on x86 they are not.
+  postFixup =
+    lib.optionalString isx86Linux ''
+      autoPatchelf $out/share/vscode/extensions/ms-vscode.cpptools/debugAdapters
      # cpptools* are distributed by the extension and need to be run through the distributed musl interpretter
      patchelf --set-interpreter $out/share/vscode/extensions/ms-vscode.cpptools/bin/libc.so $out/share/vscode/extensions/ms-vscode.cpptools/bin/cpptools
      patchelf --set-interpreter $out/share/vscode/extensions/ms-vscode.cpptools/bin/libc.so $out/share/vscode/extensions/ms-vscode.cpptools/bin/cpptools-srv
--- a/pkgs/applications/graphics/lightburn/default.nix
+++ b/pkgs/applications/graphics/lightburn/default.nix
@ -6,7 +6,7 @@

 stdenv.mkDerivation rec {
  pname = "lightburn";
-  version = "1.6.03";
+  version = "1.6.04";

  nativeBuildInputs = [
    p7zip
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/LightBurnSoftware/deployment/releases/download/${version}/LightBurn-Linux64-v${version}.7z";
-    sha256 = "sha256-yMxCe9Bu5llAUrTLG8R+1HX65rs9fhhoVG79vxDzeWY=";
+    sha256 = "sha256-3dvLUfOczysRC8Ou6aQHzzmJs2rwtKAvfrwpQ4VMB/M=";
  };

  buildInputs = [
--- a/pkgs/applications/misc/dialect/default.nix
+++ b/pkgs/applications/misc/dialect/default.nix
@ -20,7 +20,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "dialect";
-  version = "2.4.1";
+  version = "2.4.2";
  pyproject = false; # built with meson

  src = fetchFromGitHub {
@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication rec {
    repo = "dialect";
    rev = version;
    fetchSubmodules = true;
-    hash = "sha256-WEeTdUdhDSfStu+rBYcuk6miuh5e0AsodbyF93Mg4mo=";
+    hash = "sha256-DAhzvia5ut806rTc2iMuMrVKyYBSaAiMyC4rEOyU4x0=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@ -9,13 +9,13 @@

 buildPythonApplication rec {
  pname = "gallery-dl";
-  version = "1.27.1";
+  version = "1.27.2";
  format = "setuptools";

  src = fetchPypi {
    inherit version;
    pname = "gallery_dl";
-    hash = "sha256-S1RF0FNJ/oKTwq9SXXIOnqBIViGIYBVuxPjV/6fbeV8=";
+    hash = "sha256-CTc6CBAFIxOX5Bd/hy3e65MbWyI2wFn+a6hj4ktuBjo=";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/misc/golden-cheetah/default.nix
+++ b/pkgs/applications/misc/golden-cheetah/default.nix
@ -16,13 +16,13 @@ let
  };
 in mkDerivation rec {
  pname = "golden-cheetah";
-  version = "3.7-DEV2404";
+  version = "3.7-DEV2408";

  src = fetchFromGitHub {
    owner = "GoldenCheetah";
    repo = "GoldenCheetah";
    rev = "refs/tags/v${version}";
-    hash = "sha256-u2igcnOulgJGZT46/Z3vSsce9mr3VsxkD3mTeQPvUOg=";
+    hash = "sha256-6JAdnYaKULJsc/zdcTMbCkbOCbiVtnJivEazDKL721c=";
  };

  buildInputs = [
--- a/pkgs/applications/misc/obsidian/default.nix
+++ b/pkgs/applications/misc/obsidian/default.nix
@ -11,7 +11,6 @@
 , commandLineArgs ? ""
 }:
 let
-  inherit (stdenv.hostPlatform) system;
  pname = "obsidian";
  version = "1.6.7";
  appname = "Obsidian";
@ -19,6 +18,7 @@ let
    description = "Powerful knowledge base that works on top of a local folder of plain text Markdown files";
    homepage = "https://obsidian.md";
    downloadPage = "https://github.com/obsidianmd/obsidian-releases/releases";
+    mainProgram = "obsidian";
    license = licenses.obsidian;
    maintainers = with maintainers; [ atila conradmearns zaninime qbit kashw2 w-lfchen ];
  };
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/developer-edition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/developer-edition_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/update.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/update.nix
@ -27,7 +27,7 @@ in writeScript "update-${pname}" ''
  HOME=`mktemp -d`
  export GNUPGHOME=`mktemp -d`

-  gpg --receive-keys ADD7079479700DCADFDD5337E36D3B13F3D93274
+  curl https://keys.openpgp.org/vks/v1/by-fingerprint/14F26682D0916CDD81E37B6D61B7B526D98F0353 | gpg --import -

  tmpfile=`mktemp`
  url=${baseUrl}
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -35,11 +35,11 @@

  firefox-beta = buildMozillaMach rec {
    pname = "firefox-beta";
-    version = "128.0b3";
+    version = "129.0b9";
    applicationName = "Mozilla Firefox Beta";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "d2519052244dd6d5cad39afcf78e86b17e5f1520f3f182db123997f8d126b048cd6862e92558c8f112224c951f706ccf1ccb2cb19b5221d4a47bc7154f562ab2";
+      sha512 = "f4f9efb640c7db12301b1b7d23b417e6786a9072f617d2e8a1bdbcaaa4d50d6a4d49d06566d3fff7b066b32ad39aeb0dcd003721c110c2add77dbd3d68df6a0c";
    };

    meta = {
@ -64,13 +64,13 @@

  firefox-devedition = buildMozillaMach rec {
    pname = "firefox-devedition";
-    version = "128.0b3";
+    version = "129.0b9";
    applicationName = "Mozilla Firefox Developer Edition";
    requireSigning = false;
    branding = "browser/branding/aurora";
    src = fetchurl {
      url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "b1313d35218adac5b81059f605b788188454f064c3192a6bb91a7c7b361fb2e087ac49177c48f23de517551b563489adfc7486bc4e6b95e5ae4aeac49aa5ac97";
+      sha512 = "225c7abd58b7dd1e6c54e4a5172b7dc4ea19f9f90930d6823d15f2f80524f4f910eb4cb7cf3f863722490447ac8f146654ab129ee89766306b4a6992e2706b20";
    };

    meta = {
--- a/pkgs/applications/networking/cluster/kube-router/default.nix
+++ b/pkgs/applications/networking/cluster/kube-router/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kube-router";
-  version = "2.1.3";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "cloudnativelabs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-H+jPHf7sMrMlqLWa3L34U8nbBgqeX+MqChiuSsVdx6A=";
+    hash = "sha256-tEeqenOJVpwFGBS3iYlVdedNo02NV9/jtGsgrquV+0I=";
  };

-  vendorHash = "sha256-BrpjG9DhDQSsbeJ+1MRAwXyKVULK3KHjvLydduTb024=";
+  vendorHash = "sha256-sIWRODIV3iJ5FdVjVwesqfbYivOlqZAvPSYa38vhCMA=";

  CGO_ENABLED = 0;

--- a/pkgs/applications/networking/cluster/rke2/latest/versions.nix
+++ b/pkgs/applications/networking/cluster/rke2/latest/versions.nix
@ -1,14 +1,14 @@
 {
-  rke2Version = "1.30.1+rke2r1";
-  rke2RepoSha256 = "0jrvvpj9fnlbykyr06w1f92ay708xzaizg8dhg1z4bsq1cdgs33k";
-  rke2Commit = "e7f87c6dd56fdd76a7dab58900aeea8946b2c008";
-  rke2VendorHash = "sha256-QqV8mSbqa8A5zABHQoVB2jht/eYCoqTZ/WoAqIl9oZY=";
-  k8sVersion = "v1.30.1";
-  k8sImageTag = "v1.30.1-rke2r1-build20240515";
-  etcdVersion = "v3.5.9-k3s1";
+  rke2Version = "1.30.3+rke2r1";
+  rke2RepoSha256 = "1ix7mm11j9ir9xz0yypznja5mcbizibclh314sgcsfxhg39w4a70";
+  rke2Commit = "e742dc53b463d205773cfb25633309671ce6777c";
+  rke2VendorHash = "sha256-6ma0t0ElZ13VTS/aK5AknJ00F45kZXn36b5sePK2wh0=";
+  k8sVersion = "v1.30.3";
+  k8sImageTag = "v1.30.3-rke2r1-build20240717";
+  etcdVersion = "v3.5.13-k3s1";
  pauseVersion = "3.6";
-  ccmVersion = "v1.29.3-build20240412";
-  dockerizedVersion = "v1.30.1-rke2r1";
-  golangVersion = "go1.22.2";
+  ccmVersion = "v1.29.3-build20240515";
+  dockerizedVersion = "v1.30.3-dev.";
+  golangVersion = "go1.22.5";
  eol = "2025-06-28";
 }
--- a/pkgs/applications/networking/cluster/rke2/stable/versions.nix
+++ b/pkgs/applications/networking/cluster/rke2/stable/versions.nix
@ -1,14 +1,14 @@
 {
-  rke2Version = "1.28.10+rke2r1";
-  rke2RepoSha256 = "1pbanikvrl6rqrplrpvjc9ym8qq1yrs621gwy99shp0prfw5zvsx";
-  rke2Commit = "b0d0d687d98f4fa015e7b30aaf2807b50edcc5d7";
-  rke2VendorHash = "sha256-iidkTSrrHyW5ZEouzHAWUwCC9nplGz1v/E9bM2lMPeM=";
-  k8sVersion = "v1.28.10";
-  k8sImageTag = "v1.28.10-rke2r1-build20240514";
-  etcdVersion = "v3.5.9-k3s1";
+  rke2Version = "1.28.11+rke2r1";
+  rke2RepoSha256 = "1mkl7mnlsq2j9n610jnr9545hq6ilr5sdg8jxjxjbk9lnmmbvrm1";
+  rke2Commit = "6b12d7a783238b72da8450fa1b6ec587cebb79ed";
+  rke2VendorHash = "sha256-VenNSaa86nbhrFYzXPbj0fxbDlrIu6pxqMo+HPDuUxs=";
+  k8sVersion = "v1.28.11";
+  k8sImageTag = "v1.28.11-rke2r1-build20240619";
+  etcdVersion = "v3.5.13-k3s1";
  pauseVersion = "3.6";
-  ccmVersion = "v1.29.3-build20240412";
-  dockerizedVersion = "v1.28.10-rke2r1";
-  golangVersion = "go1.21.9";
+  ccmVersion = "v1.29.3-build20240515";
+  dockerizedVersion = "v1.28.11-rke2r1";
+  golangVersion = "go1.21.11";
  eol = "2024-10-28";
 }
--- a/pkgs/applications/networking/cluster/rke2/testing/versions.nix
+++ b/pkgs/applications/networking/cluster/rke2/testing/versions.nix
@ -1,14 +1,14 @@
 {
-  rke2Version = "1.30.1-rc3+rke2r1";
-  rke2RepoSha256 = "0jrvvpj9fnlbykyr06w1f92ay708xzaizg8dhg1z4bsq1cdgs33k";
-  rke2Commit = "e7f87c6dd56fdd76a7dab58900aeea8946b2c008";
-  rke2VendorHash = "sha256-QqV8mSbqa8A5zABHQoVB2jht/eYCoqTZ/WoAqIl9oZY=";
-  k8sVersion = "v1.30.1";
-  k8sImageTag = "v1.30.1-rke2r1-build20240515";
-  etcdVersion = "v3.5.9-k3s1";
+  rke2Version = "1.30.3-rc5+rke2r1";
+  rke2RepoSha256 = "1ix7mm11j9ir9xz0yypznja5mcbizibclh314sgcsfxhg39w4a70";
+  rke2Commit = "e742dc53b463d205773cfb25633309671ce6777c";
+  rke2VendorHash = "sha256-6ma0t0ElZ13VTS/aK5AknJ00F45kZXn36b5sePK2wh0=";
+  k8sVersion = "v1.30.3";
+  k8sImageTag = "v1.30.3-rke2r1-build20240717";
+  etcdVersion = "v3.5.13-k3s1";
  pauseVersion = "3.6";
-  ccmVersion = "v1.29.3-build20240412";
-  dockerizedVersion = "v1.30.1-rc3-rke2r1";
-  golangVersion = "go1.22.2";
+  ccmVersion = "v1.29.3-build20240515";
+  dockerizedVersion = "v1.30.3-dev.";
+  golangVersion = "go1.22.5";
  eol = "2025-06-28";
 }
--- a/pkgs/applications/networking/instant-messengers/discord/darwin.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/darwin.nix
@ -1,8 +1,21 @@
-{ pname, version, src, meta, stdenv, binaryName, desktopName, lib, undmg, makeWrapper, writeScript
+{ pname, version, src, meta, stdenv, binaryName, desktopName, lib, undmg, makeWrapper, writeScript, python3, runCommand
 , branch
 , withOpenASAR ? false, openasar
 , withVencord ? false, vencord }:

+let
+  disableBreakingUpdates = runCommand "disable-breaking-updates.py"
+    {
+      pythonInterpreter = "${python3.interpreter}";
+      configDirName = lib.toLower binaryName;
+      meta.mainProgram = "disable-breaking-updates.py";
+    } ''
+    mkdir -p $out/bin
+    cp ${./disable-breaking-updates.py} $out/bin/disable-breaking-updates.py
+    substituteAllInPlace $out/bin/disable-breaking-updates.py
+    chmod +x $out/bin/disable-breaking-updates.py
+  '';
+in
 stdenv.mkDerivation {
  inherit pname version src meta;

@ -18,7 +31,8 @@ stdenv.mkDerivation {

    # wrap executable to $out/bin
    mkdir -p $out/bin
-    makeWrapper "$out/Applications/${desktopName}.app/Contents/MacOS/${binaryName}" "$out/bin/${binaryName}"
+    makeWrapper "$out/Applications/${desktopName}.app/Contents/MacOS/${binaryName}" "$out/bin/${binaryName}" \
+      --run ${lib.getExe disableBreakingUpdates}

    runHook postInstall
  '';
@ -33,6 +47,8 @@ stdenv.mkDerivation {
  '';

  passthru = {
+    # make it possible to run disableBreakingUpdates standalone
+    inherit disableBreakingUpdates;
    updateScript = writeScript "discord-update-script" ''
      #!/usr/bin/env nix-shell
      #!nix-shell -i bash -p curl gnugrep common-updater-scripts
--- a/pkgs/applications/networking/instant-messengers/discord/disable-breaking-updates.py
+++ b/pkgs/applications/networking/instant-messengers/discord/disable-breaking-updates.py
@ -17,12 +17,19 @@ import os
 import sys
 from pathlib import Path

-XDG_CONFIG_HOME = os.environ.get("XDG_CONFIG_HOME") or os.path.join(
-    os.path.expanduser("~"), ".config"
-)
+config_home = {
+    "darwin": os.path.join(os.path.expanduser("~"), "Library", "Application Support"),
+    "linux": os.environ.get("XDG_CONFIG_HOME") or os.path.join(os.path.expanduser("~"), ".config")
+}.get(sys.platform, None)

-settings_path = Path(f"{XDG_CONFIG_HOME}/@configDirName@/settings.json")
-settings_path_temp = Path(f"{XDG_CONFIG_HOME}/@configDirName@/settings.json.tmp")
+if config_home is None:
+    print("[Nix] Unsupported operating system.")
+    sys.exit(1)
+
+config_dir_name = "@configDirName@".replace(" ", "") if sys.platform == "darwin" else "@configDirName@"
+
+settings_path = Path(f"{config_home}/{config_dir_name}/settings.json")
+settings_path_temp = Path(f"{config_home}/{config_dir_name}/settings.json.tmp")

 if os.path.exists(settings_path):
    with settings_path.open(encoding="utf-8") as settings_file:
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20240724";
+  version = "20240805-1";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    hash = "sha256-fWvmQb8qxuwwShSCQrQnBQuDM2/3lvzsWxXmLq0vXdY=";
+    hash = "sha256-n1mFIyrZ8d9h2m6rUzIVSt9Xdw1VlBLlXY15JLoIaVA=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix
@ -30,7 +30,7 @@ let
  in {
    inherit x86_64-darwin;
    aarch64-darwin = x86_64-darwin;
-    x86_64-linux = "3.35.3348";
+    x86_64-linux = "3.36.3462";
  }.${system} or throwSystem;

  hash = let
@ -38,7 +38,7 @@ let
  in {
    inherit x86_64-darwin;
    aarch64-darwin = x86_64-darwin;
-    x86_64-linux = "sha256-KtDUuAzD53mFJ0+yywp0Q2/hx9MGsOhFjRLWsZAd+h0=";
+    x86_64-linux = "sha256-tlX15AT4PcrmD2Vna99TGqo0b/8xv2YOAt03aCqSeXg=";
  }.${system} or throwSystem;

  meta = with lib; {
--- a/pkgs/applications/networking/sniffnet/default.nix
+++ b/pkgs/applications/networking/sniffnet/default.nix
@ -15,16 +15,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "sniffnet";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "gyulyvgc";
    repo = "sniffnet";
    rev = "refs/tags/v${version}";
-    hash = "sha256-3OvzMzlaSwT7fOJATi+2QsSWln+SLkXNr2kYlQGClwA=";
+    hash = "sha256-wepy56LOhliU6t0ZRPviEbZtsWNqrtUnpUXsEdkRDqI=";
  };

-  cargoHash = "sha256-PdlST5n8YaKkByPOvFAg5CqRxVkqRgLeVHW6CJOKioY=";
+  cargoHash = "sha256-cV3WhidnH2CBlmHa3IVHTQfTuPdSHwwY0XhgNPyLDN4=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/networking/trayscale/default.nix
+++ b/pkgs/applications/networking/trayscale/default.nix
@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "trayscale";
-  version = "0.12.6";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "DeedleFake";
    repo = "trayscale";
    rev = "v${version}";
-    hash = "sha256-4zjT5GrGOYaKD61EWG7gxAMwf2ZQivWlzaKH0h4jLGU=";
+    hash = "sha256-uaHForU+0dAkLPczHr6ZBpNZ6iirvsje+6i8rHrNXdQ=";
  };

-  vendorHash = "sha256-h5FdXlDvvorP9iOsKXxc6q3HwyB44faZGvw/Ew3LkkQ=";
+  vendorHash = "sha256-RvGKPIXdkeTdpFraxie76xrtfqRsIpzpBricEQZNFYc=";

  subPackages = [ "cmd/trayscale" ];

--- a/pkgs/applications/networking/xpipe/default.nix
+++ b/pkgs/applications/networking/xpipe/default.nix
@ -33,14 +33,14 @@ let
  }.${system} or throwSystem;

  hash = {
-    x86_64-linux = "sha256-u5vVM8qLm9m6VMmCV2Q3VrsqorIyOPrFCPXNh1s5mgY=";
+    x86_64-linux = "sha256-KLOI0lG0rZbLS2uiONNlgyCkohzQhytRovAfrjnGuDI=";
  }.${system} or throwSystem;

  displayname = "XPipe";

 in stdenvNoCC.mkDerivation rec {
  pname = "xpipe";
-  version = "10.0.4";
+  version = "10.2.2";

  src = fetchzip {
    url = "https://github.com/xpipe-io/xpipe/releases/download/${version}/xpipe-portable-linux-${arch}.tar.gz";
--- a/pkgs/applications/office/mendeley/default.nix
+++ b/pkgs/applications/office/mendeley/default.nix
@ -7,13 +7,13 @@

 let
  pname = "mendeley";
-  version = "2.118.0";
+  version = "2.120.0";

  executableName = "${pname}-reference-manager";

  src = fetchurl {
    url = "https://static.mendeley.com/bin/desktop/mendeley-reference-manager-${version}-x86_64.AppImage";
-    hash = "sha256-JzA6JmjxqZC2K51NozlYeTmZkzT5OTRF3WVGY4Wrfgo=";
+    hash = "sha256-yKHrTcIiNhsLMfwNQNSLE2mAQLsDFxhTYdper3a8oM8=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -8,7 +8,6 @@
 , qtsvg
 , qtwayland
 , qtwebsockets
-, qt5compat
 , makeWrapper
 , wrapQtAppsHook
 , botan2
@ -21,14 +20,14 @@
 let
  pname = "qownnotes";
  appname = "QOwnNotes";
-  version = "24.8.2";
+  version = "24.8.3";
 in
 stdenv.mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-aNsfDpO11VaT0SpGxc8V+8cgsPKrBKDKociIgZd3SdA=";
+    hash = "sha256-lbNJT6IbIgTYLpsMWK6Nk0XXhw1De+wZgrH4DE1vDKg=";
  };

  nativeBuildInputs = [
@ -45,7 +44,6 @@ stdenv.mkDerivation {
    qtdeclarative
    qtsvg
    qtwebsockets
-    qt5compat
    botan2
  ] ++ lib.optionals stdenv.isLinux [ qtwayland ];

--- a/pkgs/applications/science/biology/last/default.nix
+++ b/pkgs/applications/science/biology/last/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "last";
-  version = "1548";
+  version = "1550";

  src = fetchFromGitLab {
    owner = "mcfrith";
    repo = "last";
    rev = "refs/tags/${version}";
-    hash = "sha256-6mLPnyEAuRvCeV8pv3avsm6CKDrBPgX8xSxGO2kvTrM=";
+    hash = "sha256-kvI3m2FIPscU/a3GEH+O3yx5TgdNHdYP6OW3/mI2roM=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/robotics/qgroundcontrol/default.nix
+++ b/pkgs/applications/science/robotics/qgroundcontrol/default.nix
@ -4,7 +4,7 @@

 stdenv.mkDerivation rec {
  pname = "qgroundcontrol";
-  version = "4.4.0";
+  version = "4.4.1";

  propagatedBuildInputs = [
    qtbase qtcharts qtlocation qtserialport qtsvg qtquickcontrols2
@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
    owner = "mavlink";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-LKERjHoIgJ4cF1MjB5nVW3FB/DrmKP4Xj58avsDobhc=";
+    hash = "sha256-FdF9QQYCF7HbmjvUQgV6HytJo2Aje2OEDPO2GSl1dqE=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/version-management/git-codereview/default.nix
+++ b/pkgs/applications/version-management/git-codereview/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "git-codereview";
-  version = "1.11.0";
+  version = "1.12.0";

  src = fetchFromGitHub {
    owner = "golang";
    repo = "review";
    rev = "v${version}";
-    hash = "sha256-fIvNaMfgwnMBUNo6kr37zhKiBgKNzT2E0dLLtqaVBvI=";
+    hash = "sha256-s3Re+LD3B8TAjamOSu66AfhaiIdcBoTjxEWxHEWSLPA=";
  };

  vendorHash = null;
--- a/pkgs/applications/video/mpv/scripts/modernx-zydezu.nix
+++ b/pkgs/applications/video/mpv/scripts/modernx-zydezu.nix
@ -7,14 +7,14 @@
 }:
 buildLua (finalAttrs: {
  pname = "modernx-zydezu";
-  version = "0.3.6";
+  version = "0.3.6.6";

  scriptPath = "modernx.lua";
  src = fetchFromGitHub {
    owner = "zydezu";
    repo = "ModernX";
    rev = finalAttrs.version;
-    hash = "sha256-QGi7saDQzYZWf+pVlfwYhqC2CVMtQy/Elkjm+ToOm2o=";
+    hash = "sha256-Jt3Y/4no3dUOopjvbS/dBGU0vw9Lq4o5inb4efuyYBM=";
  };

  postInstall = ''
@ -31,11 +31,12 @@ buildLua (finalAttrs: {

  passthru.updateScript = nix-update-script { };

-  meta = with lib; {
+  meta = {
    description = "Modern OSC UI replacement for MPV that retains the functionality of the default OSC";
+    changelog = "https://github.com/zydezu/ModernX/releases/tag/${finalAttrs.version}";
    homepage = "https://github.com/zydezu/ModernX";
-    license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [
+    license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [
      luftmensch-luftmensch
      Guanran928
    ];
--- a/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix
+++ b/pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix
@ -8,13 +8,13 @@

 buildLua rec {
  pname = "mpv-playlistmanager";
-  version = "0-unstable-2024-02-26";
+  version = "0-unstable-2024-07-28";

  src = fetchFromGitHub {
    owner = "jonniek";
    repo = "mpv-playlistmanager";
-    rev = "1911dc053951169c98cfcfd9f44ef87d9122ca80";
-    hash = "sha256-pcdOMhkivLF5B86aNuHrqj77DuYLAFGlwFwY7jxkDkE=";
+    rev = "54ed4421f9db5df22524d37e565fe4bb2d12117e";
+    hash = "sha256-RAIyPgqDjKkKcBAzIehpqxCNkWt0Gyxvfo8ycXkjAe0=";
  };
  passthru.updateScript = unstableGitUpdater { };

--- a/pkgs/applications/virtualization/docker/buildx.nix
+++ b/pkgs/applications/virtualization/docker/buildx.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "docker-buildx";
-  version = "0.16.1";
+  version = "0.16.2";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "buildx";
    rev = "v${version}";
-    hash = "sha256-pD4drDX9jS6X6S2q/GaxODL1zVG++xGerDQiioONHII=";
+    hash = "sha256-s4VLuOLPNZGThnvr20EBddxKkreWf3B4D0RRx9OwJiw=";
  };

  doCheck = false;
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@ -120,6 +120,7 @@ let
    else if targetPlatform.libc == "nblibc"           then "${sharedLibraryLoader}/libexec/ld.elf_so"
    else if targetPlatform.system == "i686-linux"     then "${sharedLibraryLoader}/lib/ld-linux.so.2"
    else if targetPlatform.system == "x86_64-linux"   then "${sharedLibraryLoader}/lib/ld-linux-x86-64.so.2"
+    else if targetPlatform.system == "s390x-linux"    then "${sharedLibraryLoader}/lib/ld64.so.1"
    # ELFv1 (.1) or ELFv2 (.2) ABI
    else if targetPlatform.isPower64                  then "${sharedLibraryLoader}/lib/ld64.so.*"
    # ARM with a wildcard, which can be "" or "-armhf".
--- a/pkgs/build-support/compress-drv/default.nix
+++ b/pkgs/build-support/compress-drv/default.nix
@ -4,39 +4,54 @@
  runCommand,
 }:
 /**
-  #  compressDrv compresses files in a given derivation.
+  Compresses files of a given derivation, and returns a new derivation with
+  compressed files

-  ## Inputs:
+  # Inputs

  `formats` ([String])

  : List of file extensions to compress. Example: `["txt" "svg" "xml"]`.

-  `compressors` (String -> String)
+  `compressors` ( { ${fileExtension} :: String })

  : Map a desired extension (e.g. `gz`) to a compress program.

-  The compressor program that will be executed to get the `COMPRESSOR` extension.
-  The program should have a single " {}", which will be the replaced with the
-  target filename.
+    The compressor program that will be executed to get the `COMPRESSOR` extension.
+    The program should have a single " {}", which will be the replaced with the
+    target filename.

-  Compressor must:
-  - read symlinks (thus --force is needed to gzip, zstd, xz).
-  - keep the original file in place (--keep).
+    Compressor must:

-  Example:
+    - read symlinks (thus --force is needed to gzip, zstd, xz).
+    - keep the original file in place (--keep).
+
+  # Type

  ```
-  {
-    xz = "${xz}/bin/xz --force --keep {}";
+  compressDrv :: Derivation -> { formats :: [ String ]; compressors :: { ${fileExtension} :: String; } } -> Derivation
+  ```
+
+  # Examples
+  :::{.example}
+  ## `pkgs.compressDrv` usage example
+  ```
+  compressDrv pkgs.spdx-license-list-data.json {
+    formats = ["json"];
+    compressors = {
+      "json" = "${zopfli}/bin/zopfli --keep {}";
+    };
  }
+  =>
+  «derivation /nix/store/...-spdx-license-list-data-3.24.0-compressed.drv»
  ```

-  See compressDrvWeb, which is a wrapper on top of compressDrv, for broader use
+  See also pkgs.compressDrvWeb, which is a wrapper on top of compressDrv, for broader usage
  examples.
+  :::
 */
 drv:
-{ formats, compressors, ... }:
+{ formats, compressors }:
 let
  validProg =
    ext: prog:
--- a/pkgs/build-support/compress-drv/web.nix
+++ b/pkgs/build-support/compress-drv/web.nix
@ -4,76 +4,105 @@
  compressDrv,
 }:
 /**
-  # compressDrvWeb compresses a derivation for common web server use.
+  compressDrvWeb compresses a derivation for common web server use.

  Useful when one wants to pre-compress certain static assets and pass them to
-  the web server. For example, `pkgs.gamja` creates this derivation:
+  the web server.

-      /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/
-      ├── index.2fd01148.js
-      ├── index.2fd01148.js.map
-      ├── index.37aa9a8a.css
-      ├── index.37aa9a8a.css.map
-      ├── index.html
-      └── manifest.webmanifest
+  # Inputs

-  `pkgs.compressDrvWeb pkgs.gamja`:
+  `formats` ([String])

-      /nix/store/f5ryid7zrw2hid7h9kil5g5j29q5r2f7-gamja-1.0.0-beta.9-compressed
-      ├── index.2fd01148.js -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.2fd01148.js
-      ├── index.2fd01148.js.br
-      ├── index.2fd01148.js.gz
-      ├── index.2fd01148.js.map -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.2fd01148.js.map
-      ├── index.2fd01148.js.map.br
-      ├── index.2fd01148.js.map.gz
-      ├── index.37aa9a8a.css -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.37aa9a8a.css
-      ├── index.37aa9a8a.css.br
-      ├── index.37aa9a8a.css.gz
-      ├── index.37aa9a8a.css.map -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.37aa9a8a.css.map
-      ├── index.37aa9a8a.css.map.br
-      ├── index.37aa9a8a.css.map.gz
-      ├── index.html -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.html
-      ├── index.html.br
-      ├── index.html.gz
-      ├── manifest.webmanifest -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/manifest.webmanifest
-      ├── manifest.webmanifest.br
-      └── manifest.webmanifest.gz
+  : List of file extensions to compress.

-  When this `-compressed` directory is passed to a properly configured web
-  server, it will serve those pre-compressed files:
+    Defaults to common formats that compress well.

-      $ curl -I -H 'Accept-Encoding: br' https://irc.example.org/
-      <...>
-      content-encoding: br
-      <...>
+  `extraFormats` ([ String ])
+
+  : Extra extensions to compress in addition to `formats`.
+
+  `compressors` ( { ${fileExtension} :: String })
+
+  : Map a desired extension (e.g. `gz`) to a compress program.
+
+  # Type
+
+  ```
+  compressDrvWeb :: Derivation -> { formats :: [ String ]; extraFormats :: [ String ]; compressors :: { ${fileExtension} :: String; } } -> Derivation
+  ```
+
+  # Examples
+  :::{.example}
+  ## `pkgs.compressDrvWeb` full usage example with `pkgs.gamja` and a webserver
+  ```nix
+
+  For example, building `pkgs.gamja` produces the following output:
+
+    /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/
+    ├── index.2fd01148.js
+    ├── index.2fd01148.js.map
+    ├── index.37aa9a8a.css
+    ├── index.37aa9a8a.css.map
+    ├── index.html
+    └── manifest.webmanifest
+
+  With `pkgs.compressDrvWeb`, one can compress these files:
+
+  ```nix
+  pkgs.compressDrvWeb pkgs.gamja {}
+  =>
+  «derivation /nix/store/...-gamja-compressed.drv»
+  ```
+
+  ```bash
+  /nix/store/f5ryid7zrw2hid7h9kil5g5j29q5r2f7-gamja-1.0.0-beta.9-compressed
+  ├── index.2fd01148.js -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.2fd01148.js
+  ├── index.2fd01148.js.br
+  ├── index.2fd01148.js.gz
+  ├── index.2fd01148.js.map -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.2fd01148.js.map
+  ├── index.2fd01148.js.map.br
+  ├── index.2fd01148.js.map.gz
+  ├── index.37aa9a8a.css -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.37aa9a8a.css
+  ├── index.37aa9a8a.css.br
+  ├── index.37aa9a8a.css.gz
+  ├── index.37aa9a8a.css.map -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.37aa9a8a.css.map
+  ├── index.37aa9a8a.css.map.br
+  ├── index.37aa9a8a.css.map.gz
+  ├── index.html -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.html
+  ├── index.html.br
+  ├── index.html.gz
+  ├── manifest.webmanifest -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/manifest.webmanifest
+  ├── manifest.webmanifest.br
+  └── manifest.webmanifest.gz
+  ```
+
+  When the `-compressed` derivation is passed to a properly configured web server,
+  it enables direct serving of the pre-compressed files.
+
+  ```shell-session
+  $ curl -I -H 'Accept-Encoding: br' https://irc.example.org/
+  <...>
+  content-encoding: br
+  <...>
+  ```

  For example, a caddy configuration snippet for gamja to serve
  the static assets (JS, CSS files) pre-compressed:

-      virtualHosts."irc.example.org".extraConfig = ''
-        root * ${pkgs.compressDrvWeb pkgs.gamja {}}
-        file_server browse {
-            precompressed br gzip
-        }
-      '';
+  ```nix
+  {
+    virtualHosts."irc.example.org".extraConfig = ''
+      root * ${pkgs.compressDrvWeb pkgs.gamja {}}
+      file_server browse {
+          precompressed br gzip
+      }
+    '';
+  }
+  ```

  This feature is also available in nginx via `ngx_brotli` and
  `ngx_http_gzip_static_module`.
-
-  ## Inputs
-
-  `formats` ([String])
-
-  : List of file extensions to compress. Default is common formats that compress
-  well. The list may be expanded.
-
-  `extraFormats` ([String])
-
-  : Extra extensions to compress in addition to `formats`.
-
-  `compressors` (String -> String)
-
-  : See parameter `compressors` of compressDrv.
+  :::
 */
 drv:
 {
@ -95,7 +124,6 @@ drv:
    "gz" = "${zopfli}/bin/zopfli --keep {}";
    "br" = "${brotli}/bin/brotli --keep --no-copy-stat {}";
  },
-  ...
 }:
 compressDrv drv {
  formats = formats ++ extraFormats;
--- a/pkgs/build-support/fetchnextcloudapp/default.nix
+++ b/pkgs/build-support/fetchnextcloudapp/default.nix
@ -8,7 +8,7 @@
 , patches ? [ ]
 , description ? null
 , homepage ? null
-, unpack ? true # whether to use fetchzip rather than fetchurl
+, unpack ? false # whether to use fetchzip rather than fetchurl
 }:
 applyPatches ({
  inherit patches;
--- a/pkgs/by-name/ar/art/package.nix
+++ b/pkgs/by-name/ar/art/package.nix
@ -26,13 +26,13 @@

 stdenv.mkDerivation rec {
  pname = "art";
-  version = "1.22.1";
+  version = "1.23";

  src = fetchFromBitbucket {
    owner = "agriggio";
    repo = "art";
    rev = version;
-    hash = "sha256-f6SnTvMelJaPGNeGboI34RvWXcJatEi1G6vfAdDFy8A=";
+    hash = "sha256-OB/Rr4rHNJc40o6esNPDRbhN4EPGf2zhlzzM+mBpUUU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/aw/awscli2/package.nix
+++ b/pkgs/by-name/aw/awscli2/package.nix
@ -59,14 +59,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
  pname = "awscli2";
-  version = "2.17.13"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.17.18"; # N.B: if you change this, check if overrides are still up-to-date
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-cli";
    rev = "refs/tags/${version}";
-    hash = "sha256-hnD+2NE7gqbe99UQmRlHoPGdWZj0o2Buvk3kRR15tgI=";
+    hash = "sha256-HxFtMFeGR6XAMsP5LM0tvJ/ECWVpveIhWRTKvf8uYA0=";
  };

  postPatch = ''
--- a/pkgs/by-name/bm/bmake/package.nix
+++ b/pkgs/by-name/bm/bmake/package.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bmake";
-  version = "20240711";
+  version = "20240722";

  src = fetchurl {
    url = "https://www.crufty.net/ftp/pub/sjg/bmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-z+2sCduQhqytVeejoNIkBo90tMARxbZK1x8dhoCHjOA=";
+    hash = "sha256-FlS9DK0oQ2CElmmh6amTGB/tE3iWqsJpS4LqmjX3CeQ=";
  };

  patches = [
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@ -28,13 +28,13 @@ let
 in
 buildNpmPackage' rec {
  pname = "bruno";
-  version = "1.23.0";
+  version = "1.23.1";

  src = fetchFromGitHub {
    owner = "usebruno";
    repo = "bruno";
    rev = "v${version}";
-    hash = "sha256-zbQlmxrvA2rZLEGmhj7MkVP5SmJdhhL9F3wRrB97DJs=";
+    hash = "sha256-uQe+j7EH62SH64z9mTpsR/tiYm4vSMDbAkYRhfkjf68=";

    postFetch = ''
      ${lib.getExe npm-lockfile-fix} $out/package-lock.json
--- a/pkgs/applications/networking/instant-messengers/cinny/default.nix
+++ b/pkgs/applications/networking/instant-messengers/cinny/default.nix
@ -1,23 +1,18 @@
-{ lib
-, buildNpmPackage
-, fetchFromGitHub
-, writeText
-, jq
-, python3
-, pkg-config
-, pixman
-, cairo
-, pango
-, stdenv
-, darwin
-, conf ? { }
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  python3,
+  pkg-config,
+  pixman,
+  cairo,
+  pango,
+  stdenv,
+  darwin,
 }:

-let
-  configOverrides = writeText "cinny-config-overrides.json" (builtins.toJSON conf);
-in
 buildNpmPackage rec {
-  pname = "cinny";
+  pname = "cinny-unwrapped";
  version = "4.0.3";

  src = fetchFromGitHub {
@ -35,7 +30,6 @@ buildNpmPackage rec {
  ) "-D_LIBCPP_HAS_NO_LIBRARY_ALIGNED_ALLOCATION=1";

  nativeBuildInputs = [
-    jq
    python3
    pkg-config
  ];
@ -44,15 +38,12 @@ buildNpmPackage rec {
    pixman
    cairo
    pango
-  ] ++ lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.CoreText
-  ];
+  ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.CoreText ];

  installPhase = ''
    runHook preInstall

    cp -r dist $out
-    jq -s '.[0] * .[1]' "config.json" "${configOverrides}" > "$out/config.json"

    runHook postInstall
  '';
--- a/pkgs/by-name/ci/cinny/package.nix
+++ b/pkgs/by-name/ci/cinny/package.nix
@ -0,0 +1,32 @@
+{
+  cinny-unwrapped,
+  jq,
+  stdenvNoCC,
+  writeText,
+  conf ? { },
+}:
+let
+  configOverrides = writeText "cinny-config-overrides.json" (builtins.toJSON conf);
+in
+if (conf == { }) then
+  cinny-unwrapped
+else
+  stdenvNoCC.mkDerivation {
+    pname = "cinny";
+    inherit (cinny-unwrapped) version meta;
+
+    dontUnpack = true;
+
+    nativeBuildInputs = [ jq ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      ln -s ${cinny-unwrapped}/* $out
+      rm $out/config.json
+      jq -s '.[0] * .[1]' "${cinny-unwrapped}/config.json" "${configOverrides}" > "$out/config.json"
+
+      runHook postInstall
+    '';
+  }
--- a/pkgs/by-name/co/comet-gog/package.nix
+++ b/pkgs/by-name/co/comet-gog/package.nix
@ -10,19 +10,19 @@
 let
  inherit (darwin.apple_sdk.frameworks) CoreFoundation SystemConfiguration;
 in
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage rec {
  pname = "comet-gog";
-  version = "0-unstable-2024-05-25";
+  version = "0.1.2";

  src = fetchFromGitHub {
    owner = "imLinguin";
    repo = "comet";
-    rev = "378ec2abdc2498e7c0c12aa50b71f6d94c3e8e3c";
-    hash = "sha256-r7ZPpJLy2fZsyNijl0+uYWQN941TCbv+Guv3wzD83IQ=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-TdIqdNn5HnIED7LMn4qAzKPHlA5t/Q1Dn+W+ulx5qOU=";
    fetchSubmodules = true;
  };

-  cargoHash = "sha256-dXNAGMVayzgT96ETrph9eCbQv28EK/OOxIRV8ewpVvs=";
+  cargoHash = "sha256-gAGCpcVjOkUZa/CobOjOt07WMHpvE5/q1bw+z4yBeNE=";

  # error: linker `aarch64-linux-gnu-gcc` not found
  postPatch = ''
@ -37,6 +37,7 @@ rustPlatform.buildRustPackage {
  ];

  meta = {
+    changelog = "https://github.com/imLinguin/comet/releases/tag/v${version}";
    description = "Open Source implementation of GOG Galaxy's Communication Service";
    homepage = "https://github.com/imLinguin/comet";
    license = lib.licenses.gpl3Plus;
--- a/pkgs/by-name/co/concurrently/package.nix
+++ b/pkgs/by-name/co/concurrently/package.nix
@ -0,0 +1,77 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch2,
+  makeWrapper,
+  nodejs,
+  pnpm_8,
+}:
+
+let
+  pnpm = pnpm_8;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "concurrently";
+  version = "8.2.2";
+
+  src = fetchFromGitHub {
+    owner = "open-cli-tools";
+    repo = "concurrently";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-VoyVYBOBMguFKnG2VItk1L5BbF72nO7bYJpb7adqICs=";
+  };
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      patches
+      ;
+    hash = "sha256-F1teWIABkK0mqZcK3RdGNKmexI/C59QWSrrD1jYbHt0=";
+  };
+
+  patches = [
+    (fetchpatch2 {
+      name = "use-pnpm-8.patch";
+      url = "https://github.com/open-cli-tools/concurrently/commit/0b67a1a5a335396340f4347886fb9d0968a57555.patch";
+      hash = "sha256-mxid2Yl9S6+mpN7OLUCrJ1vS0bQ/UwNiGJ0DL6Zn//Q=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    nodejs
+    pnpm.configHook
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/bin" "$out/lib/concurrently"
+    cp -r dist node_modules "$out/lib/concurrently"
+    makeWrapper "${lib.getExe nodejs}" "$out/bin/concurrently" \
+      --add-flags "$out/lib/concurrently/dist/bin/concurrently.js"
+    ln -s "$out/bin/concurrently" "$out/bin/con"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/open-cli-tools/concurrently/releases/tag/v${finalAttrs.version}";
+    description = "Run commands concurrently";
+    homepage = "https://github.com/open-cli-tools/concurrently";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jpetrucciani ];
+    mainProgram = "concurrently";
+  };
+})
--- a/pkgs/by-name/da/davis/package.nix
+++ b/pkgs/by-name/da/davis/package.nix
@ -6,16 +6,16 @@

 php.buildComposerProject (finalAttrs: {
  pname = "davis";
-  version = "4.4.3";
+  version = "4.4.4";

  src = fetchFromGitHub {
    owner = "tchapi";
    repo = "davis";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-0Km4bLQVfbkr5BL8XY5tM147Sje8hcFOjhCRnXq+4d4=";
+    hash = "sha256-nQkyNs718Zrc2BiTNXSXPY23aiviJKoBJeuoSm5ISOI=";
  };

-  vendorHash = "sha256-NOb6rc9jVsf+/RVOW7SLBAJk9SihcRxoepUEGBGLi2w=";
+  vendorHash = "sha256-zZlDonCwb9tJyckounv96eF4cx6Z/LBoAdB/r600HM4=";

  postInstall = ''
    # Only include the files needed for runtime in the derivation
--- a/pkgs/by-name/ek/eksctl/package.nix
+++ b/pkgs/by-name/ek/eksctl/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "eksctl";
-  version = "0.187.0";
+  version = "0.188.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = pname;
    rev = version;
-    hash = "sha256-EZYKRkxU2KcjiANUA2tXOk7Kp60O0iOGXRIjmSa61SY=";
+    hash = "sha256-ZEMTPvmRhUFqaugtvgWv9EbuE6sF489ay0C3QUuAxfo=";
  };

-  vendorHash = "sha256-aOLZQKhBy5uBmOhJPfk3ZDHp/YbZw9oN4DaAu1NFcvA=";
+  vendorHash = "sha256-xz+hEgLNplXJIfqyNE10Zc5SwSdedLAL3tHuh6875+A=";

  doCheck = false;

--- a/pkgs/by-name/fa/fast-float/package.nix
+++ b/pkgs/by-name/fa/fast-float/package.nix
@ -1,28 +1,31 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "fast-float";
-  version = "6.1.2";
+  version = "6.1.3";

  src = fetchFromGitHub {
    owner = "fastfloat";
    repo = "fast_float";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-1QH9XvY981nSKCjb2nK3tDFHkJy9N1zGNX0dACRjTxE=";
+    hash = "sha256-CMPk2RNbfPT+Pe2L9nS/i1JNXM0giuX+lOuF1g9tn9s=";
  };

-  nativeBuildInputs = [
-    cmake
-  ];
+  nativeBuildInputs = [ cmake ];

  meta = {
    description = "Fast and exact implementation of the C++ from_chars functions for number types";
    homepage = "https://github.com/fastfloat/fast_float";
-    license = with lib.licenses; [ asl20 boost mit ];
+    license = with lib.licenses; [
+      asl20
+      boost
+      mit
+    ];
    maintainers = with lib.maintainers; [ wegank ];
    platforms = lib.platforms.all;
  };
--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@ -1,62 +1,65 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, chafa
-, cmake
-, darwin
-, dbus
-, dconf
-, ddcutil
-, glib
-, hwdata
-, imagemagick_light
-, libXrandr
-, libdrm
-, libglvnd
-, libpulseaudio
-, libselinux
-, libsepol
-, libxcb
-, makeBinaryWrapper
-, networkmanager
-, nix-update-script
-, ocl-icd
-, opencl-headers
-, overrideSDK
-, pcre
-, pcre2
-, pkg-config
-, python3
-, rpm
-, sqlite
-, testers
-, util-linux
-, vulkan-loader
-, wayland
-, xfce
-, xorg
-, yyjson
-, zlib
-, rpmSupport ? false
-, vulkanSupport ? true
-, waylandSupport ? true
-, x11Support ? true
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  chafa,
+  cmake,
+  darwin,
+  dbus,
+  dconf,
+  ddcutil,
+  glib,
+  hwdata,
+  imagemagick_light,
+  libXrandr,
+  libdrm,
+  libglvnd,
+  libpulseaudio,
+  libselinux,
+  libsepol,
+  libxcb,
+  makeBinaryWrapper,
+  nix-update-script,
+  ocl-icd,
+  opencl-headers,
+  overrideSDK,
+  pcre,
+  pcre2,
+  pkg-config,
+  python3,
+  rpm,
+  sqlite,
+  testers,
+  util-linux,
+  vulkan-loader,
+  wayland,
+  xfce,
+  xorg,
+  yyjson,
+  zlib,
+  rpmSupport ? false,
+  vulkanSupport ? true,
+  waylandSupport ? true,
+  x11Support ? true,
 }:
 let
  stdenv' = if stdenv.isDarwin then overrideSDK stdenv "11.0" else stdenv;
 in
 stdenv'.mkDerivation (finalAttrs: {
  pname = "fastfetch";
-  version = "2.20.0";
+  version = "2.21.0";

  src = fetchFromGitHub {
    owner = "fastfetch-cli";
    repo = "fastfetch";
    rev = finalAttrs.version;
-    hash = "sha256-8N2BG9eTZpAvnc1wiG6p7GJSCPfZ+NTbz8kLGPRg5HU=";
+    hash = "sha256-1bWWwMzbzECWARhl3ULMVF5QhbvrV5ShVT382BnRGg8=";
  };

-  outputs = [ "out" "man" ];
+  outputs = [
+    "out"
+    "man"
+  ];

  nativeBuildInputs = [
    cmake
@ -65,79 +68,83 @@ stdenv'.mkDerivation (finalAttrs: {
    python3
  ];

-  buildInputs = [
-    chafa
-    imagemagick_light
-    pcre
-    pcre2
-    sqlite
-    yyjson
-  ] ++ lib.optionals stdenv.isLinux [
-    dbus
-    dconf
-    ddcutil
-    glib
-    hwdata
-    libdrm
-    libpulseaudio
-    libselinux
-    libsepol
-    networkmanager
-    ocl-icd
-    opencl-headers
-    util-linux
-    zlib
-  ] ++ lib.optionals rpmSupport [
-    rpm
-  ] ++ lib.optionals vulkanSupport [
-    vulkan-loader
-  ] ++ lib.optionals waylandSupport [
-    wayland
-  ] ++ lib.optionals x11Support [
-    libXrandr
-    libglvnd
-    libxcb
-    xorg.libXau
-    xorg.libXdmcp
-    xorg.libXext
-  ] ++ lib.optionals (x11Support && (!stdenv.isDarwin)) [
-    xfce.xfconf
-  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk_11_0.frameworks; [
-    Apple80211
-    AppKit
-    AVFoundation
-    Cocoa
-    CoreDisplay
-    CoreVideo
-    CoreWLAN
-    DisplayServices
-    IOBluetooth
-    MediaRemote
-    OpenCL
-    SystemConfiguration
-    darwin.moltenvk
-  ]);
+  buildInputs =
+    [
+      chafa
+      imagemagick_light
+      pcre
+      pcre2
+      sqlite
+      yyjson
+    ]
+    ++ lib.optionals stdenv.isLinux [
+      dbus
+      dconf
+      ddcutil
+      glib
+      hwdata
+      libdrm
+      libpulseaudio
+      libselinux
+      libsepol
+      ocl-icd
+      opencl-headers
+      util-linux
+      zlib
+    ]
+    ++ lib.optionals rpmSupport [ rpm ]
+    ++ lib.optionals vulkanSupport [ vulkan-loader ]
+    ++ lib.optionals waylandSupport [ wayland ]
+    ++ lib.optionals x11Support [
+      libXrandr
+      libglvnd
+      libxcb
+      xorg.libXau
+      xorg.libXdmcp
+      xorg.libXext
+    ]
+    ++ lib.optionals (x11Support && (!stdenv.isDarwin)) [ xfce.xfconf ]
+    ++ lib.optionals stdenv.isDarwin (
+      with darwin.apple_sdk_11_0.frameworks;
+      [
+        Apple80211
+        AppKit
+        AVFoundation
+        Cocoa
+        CoreDisplay
+        CoreVideo
+        CoreWLAN
+        DisplayServices
+        IOBluetooth
+        MediaRemote
+        OpenCL
+        SystemConfiguration
+        darwin.moltenvk
+      ]
+    );

-  cmakeFlags = [
-    (lib.cmakeOptionType "filepath" "CMAKE_INSTALL_SYSCONFDIR" "${placeholder "out"}/etc")
-    (lib.cmakeBool "ENABLE_DIRECTX_HEADERS" false)
-    (lib.cmakeBool "ENABLE_DRM" false)
-    (lib.cmakeBool "ENABLE_IMAGEMAGICK6" false)
-    (lib.cmakeBool "ENABLE_OSMESA" false)
-    (lib.cmakeBool "ENABLE_SYSTEM_YYJSON" true)
-    (lib.cmakeBool "ENABLE_GLX" x11Support)
-    (lib.cmakeBool "ENABLE_RPM" rpmSupport)
-    (lib.cmakeBool "ENABLE_VULKAN" x11Support)
-    (lib.cmakeBool "ENABLE_WAYLAND" waylandSupport)
-    (lib.cmakeBool "ENABLE_X11" x11Support)
-    (lib.cmakeBool "ENABLE_XCB" x11Support)
-    (lib.cmakeBool "ENABLE_XCB_RANDR" x11Support)
-    (lib.cmakeBool "ENABLE_XFCONF" (x11Support && (!stdenv.isDarwin)))
-    (lib.cmakeBool "ENABLE_XRANDR" x11Support)
-  ] ++ lib.optionals stdenv.isLinux [
-    (lib.cmakeOptionType "filepath" "CUSTOM_PCI_IDS_PATH" "${hwdata}/share/hwdata/pci.ids")
-    (lib.cmakeOptionType "filepath" "CUSTOM_AMDGPU_IDS_PATH" "${libdrm}/share/libdrm/amdgpu.ids")
-  ];
+  cmakeFlags =
+    [
+      (lib.cmakeOptionType "filepath" "CMAKE_INSTALL_SYSCONFDIR" "${placeholder "out"}/etc")
+      (lib.cmakeBool "ENABLE_DIRECTX_HEADERS" false)
+      (lib.cmakeBool "ENABLE_DRM" false)
+      (lib.cmakeBool "ENABLE_IMAGEMAGICK6" false)
+      (lib.cmakeBool "ENABLE_OSMESA" false)
+      (lib.cmakeBool "ENABLE_SYSTEM_YYJSON" true)
+      (lib.cmakeBool "ENABLE_GLX" x11Support)
+      (lib.cmakeBool "ENABLE_RPM" rpmSupport)
+      (lib.cmakeBool "ENABLE_VULKAN" x11Support)
+      (lib.cmakeBool "ENABLE_WAYLAND" waylandSupport)
+      (lib.cmakeBool "ENABLE_X11" x11Support)
+      (lib.cmakeBool "ENABLE_XCB" x11Support)
+      (lib.cmakeBool "ENABLE_XCB_RANDR" x11Support)
+      (lib.cmakeBool "ENABLE_XFCONF" (x11Support && (!stdenv.isDarwin)))
+      (lib.cmakeBool "ENABLE_XRANDR" x11Support)
+    ]
+    ++ lib.optionals stdenv.isLinux [
+      (lib.cmakeOptionType "filepath" "CUSTOM_PCI_IDS_PATH" "${hwdata}/share/hwdata/pci.ids")
+      (lib.cmakeOptionType "filepath" "CUSTOM_AMDGPU_IDS_PATH" "${libdrm}/share/libdrm/amdgpu.ids")
+    ];

  postPatch = ''
    substituteInPlace completions/fastfetch.fish --replace-fail python3 '${python3.interpreter}'
@ -162,8 +169,12 @@ stdenv'.mkDerivation (finalAttrs: {
  meta = {
    description = "Like neofetch, but much faster because written in C";
    homepage = "https://github.com/fastfetch-cli/fastfetch";
+    changelog = "https://github.com/fastfetch-cli/fastfetch/releases/tag/${finalAttrs.version}";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ khaneliman ];
+    maintainers = with lib.maintainers; [
+      luftmensch-luftmensch
+      khaneliman
+    ];
    platforms = lib.platforms.all;
    mainProgram = "fastfetch";
  };
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@ -120,7 +120,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "fwupd";
-  version = "1.9.22";
+  version = "1.9.23";

  # libfwupd goes to lib
  # daemon, plug-ins and libfwupdplugin go to out
@ -131,7 +131,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "fwupd";
    repo = "fwupd";
    rev = finalAttrs.version;
-    hash = "sha256-skmfTejj9cPdihwPIbsyoSI8ekVNcUXUNMcpPs9uSNo=";
+    hash = "sha256-SLwRATYUSnHN6r5KyVGXbdAFjHCfykItbBTsl5/s8fA=";
  };

  patches = [
--- a/pkgs/by-name/ga/gamescope/package.nix
+++ b/pkgs/by-name/ga/gamescope/package.nix
@ -27,6 +27,7 @@
 , stb
 , wlroots
 , libdecor
+, lcms
 , lib
 , makeBinaryWrapper
 , patchelfUnstable
@ -44,14 +45,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gamescope";
-  version = "3.14.24";
+  version = "3.14.26";

  src = fetchFromGitHub {
    owner = "ValveSoftware";
    repo = "gamescope";
    rev = "refs/tags/${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-+8uojnfx8V8BiYAeUsOaXTXrlcST83z6Eld7qv1oboE=";
+    hash = "sha256-vCPKySLB1D9oKgCrYrXqt/s0hV+/ocuWOrcDUzKbdKI=";
  };

  patches = [
@ -132,6 +133,7 @@ stdenv.mkDerivation (finalAttrs: {
    pixman
    libcap
    stb
+    lcms
  ]);

  postInstall = lib.optionalString enableExecutable ''
--- a/pkgs/by-name/gf/gfortran/package.nix
+++ b/pkgs/by-name/gf/gfortran/package.nix
@ -0,0 +1,11 @@
+{ wrapCC, gcc }:
+# Use the same GCC version as the one from stdenv by default
+wrapCC (
+  gcc.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
--- a/pkgs/by-name/gf/gfortran10/package.nix
+++ b/pkgs/by-name/gf/gfortran10/package.nix
@ -0,0 +1,10 @@
+{ wrapCC, gcc10 }:
+wrapCC (
+  gcc10.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
--- a/pkgs/by-name/gf/gfortran11/package.nix
+++ b/pkgs/by-name/gf/gfortran11/package.nix
@ -0,0 +1,10 @@
+{ wrapCC, gcc11 }:
+wrapCC (
+  gcc11.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
--- a/pkgs/by-name/gf/gfortran12/package.nix
+++ b/pkgs/by-name/gf/gfortran12/package.nix
@ -0,0 +1,10 @@
+{ wrapCC, gcc12 }:
+wrapCC (
+  gcc12.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
--- a/pkgs/by-name/gf/gfortran13/package.nix
+++ b/pkgs/by-name/gf/gfortran13/package.nix
@ -0,0 +1,10 @@
+{ wrapCC, gcc13 }:
+wrapCC (
+  gcc13.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
--- a/pkgs/by-name/gf/gfortran14/package.nix
+++ b/pkgs/by-name/gf/gfortran14/package.nix
@ -0,0 +1,10 @@
+{ wrapCC, gcc14 }:
+wrapCC (
+  gcc14.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
--- a/pkgs/by-name/gf/gfortran48/package.nix
+++ b/pkgs/by-name/gf/gfortran48/package.nix
@ -0,0 +1,10 @@
+{ wrapCC, gcc48 }:
+wrapCC (
+  gcc48.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
--- a/pkgs/by-name/gf/gfortran49/package.nix
+++ b/pkgs/by-name/gf/gfortran49/package.nix
@ -0,0 +1,10 @@
+{ wrapCC, gcc49 }:
+wrapCC (
+  gcc49.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
--- a/pkgs/by-name/gf/gfortran6/package.nix
+++ b/pkgs/by-name/gf/gfortran6/package.nix
@ -0,0 +1,10 @@
+{ wrapCC, gcc6 }:
+wrapCC (
+  gcc6.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
--- a/pkgs/by-name/gf/gfortran7/package.nix
+++ b/pkgs/by-name/gf/gfortran7/package.nix
@ -0,0 +1,10 @@
+{ wrapCC, gcc7 }:
+wrapCC (
+  gcc7.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
--- a/pkgs/by-name/gf/gfortran8/package.nix
+++ b/pkgs/by-name/gf/gfortran8/package.nix
@ -0,0 +1,10 @@
+{ wrapCC, gcc8 }:
+wrapCC (
+  gcc8.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
--- a/pkgs/by-name/gf/gfortran9/package.nix
+++ b/pkgs/by-name/gf/gfortran9/package.nix
@ -0,0 +1,10 @@
+{ wrapCC, gcc9 }:
+wrapCC (
+  gcc9.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)
--- a/pkgs/by-name/gi/gickup/package.nix
+++ b/pkgs/by-name/gi/gickup/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "gickup";
-  version = "0.10.30";
+  version = "0.10.31";

  src = fetchFromGitHub {
    owner = "cooperspencer";
    repo = "gickup";
    rev = "refs/tags/v${version}";
-    hash = "sha256-knnc4FAzGk1hV/Pzoc+klm4dt1cFrn4BYZx1lY7iLp8=";
+    hash = "sha256-6du9x5QQN1VJzAABJ+8Fm3YscfoRwKVYZO9tTMz22AQ=";
  };

-  vendorHash = "sha256-XxDsEmi945CduurQRsH7rjFAEu/SMX3rSd63Dwq2r8A=";
+  vendorHash = "sha256-Nmt7T6sDWVHQZuINvON24Mq638Q04r5bpOBnz2vp4vM=";

  ldflags = [ "-X main.version=${version}" ];

--- a/pkgs/by-name/go/godns/package.nix
+++ b/pkgs/by-name/go/godns/package.nix
@ -9,19 +9,19 @@

 buildGoModule rec {
  pname = "godns";
-  version = "3.1.6";
+  version = "3.1.7";

  src = fetchFromGitHub {
    owner = "TimothyYe";
    repo = "godns";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Kr+zMmjpHR2JtCaDyLMcQwOUXlPJeisu94zHRpEYV/I=";
+    hash = "sha256-aTCYnjv9DTlCohdESGAjMz7JQG0BsLTNMiknyB6Ut50=";
  };

  vendorHash = "sha256-E15h5p4ppRb91EUoz5dyWNFl745rt419NMCSurMLxis=";
  npmDeps = fetchNpmDeps {
    src = "${src}/web";
-    hash = "sha256-2yeqLly0guU/kpX+yH/QOoDGzyJTxkTaCt8EleJhybU=";
+    hash = "sha256-gnAUI3lLDhjZ+nLap41COq765ymR6a8FgVY/aqqidTQ=";
  };

  npmRoot = "web";
--- a/pkgs/by-name/go/gowall/package.nix
+++ b/pkgs/by-name/go/gowall/package.nix
@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+}:
+
+buildGoModule rec {
+  pname = "gowall";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "Achno";
+    repo = "gowall";
+    rev = "v${version}";
+    hash = "sha256-4h7vRu1aqCGccKx2UiLSFNloqf22QUml4BHkKzzdwYA=";
+  };
+
+  vendorHash = "sha256-jNx4ehew+IBx7M6ey/rT0vb53+9OBVYSEDJv8JWfZIw=";
+
+  nativeBuildInputs = [ installShellFiles ];
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd gowall \
+      --bash <($out/bin/gowall completion bash) \
+      --fish <($out/bin/gowall completion fish) \
+      --zsh <($out/bin/gowall completion zsh)
+  '';
+
+  meta = {
+    changelog = "https://github.com/Achno/gowall/releases/tag/v${version}";
+    description = "Tool to convert a Wallpaper's color scheme / palette";
+    homepage = "https://github.com/Achno/gowall";
+    license = lib.licenses.mit;
+    mainProgram = "gowall";
+    maintainers = with lib.maintainers; [
+      crem
+      emilytrau
+    ];
+  };
+}
--- a/pkgs/by-name/ig/ignite-cli/package.nix
+++ b/pkgs/by-name/ig/ignite-cli/package.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "ignite-cli";
-  version = "28.5.0";
+  version = "28.5.1";

  src = fetchFromGitHub {
    repo = "cli";
    owner = "ignite";
    rev = "v${version}";
-    hash = "sha256-s8RKlqIL1AjsqO+sOrWnAfHCpP1G7BFxnr5aHVe7Np4=";
+    hash = "sha256-JgcLW+CoxLaz9WKGkSDpUEZJtEeP35LveW0B3arnNw0=";
  };

  vendorHash = "sha256-NEjva9KDPz7rykqcKcTOwSKBR3n4oFSYARX/BQzhgqY=";
--- a/pkgs/by-name/in/inter-nerdfont/package.nix
+++ b/pkgs/by-name/in/inter-nerdfont/package.nix
@ -0,0 +1,44 @@
+{
+  lib,
+  fontforge,
+  nerd-font-patcher,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "inter-nerdfont";
+  version = "4.0";
+
+  src = fetchzip {
+    url = "https://github.com/rsms/inter/releases/download/v${finalAttrs.version}/Inter-${finalAttrs.version}.zip";
+    stripRoot = false;
+    hash = "sha256-hFK7xFJt69n+98+juWgMvt+zeB9nDkc8nsR8vohrFIc=";
+  };
+
+  nativeBuildInputs = [
+    fontforge
+    nerd-font-patcher
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    nerd-font-patcher Inter.ttc
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm444 'Inter Nerd Font.ttc' $out/share/fonts/truetype/InterNerdFont.ttc
+    cp *.ttf $out/share/fonts/truetype
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://gitlab.com/mid_os/inter-nerdfont";
+    description = "NerdFont patch of the Inter font";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.midirhee12 ];
+  };
+})
--- a/pkgs/by-name/la/labelle/package.nix
+++ b/pkgs/by-name/la/labelle/package.nix
@ -8,14 +8,14 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "labelle";
-  version = "1.2.2";
+  version = "1.2.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "labelle-org";
    repo = "labelle";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Im1mZ9kJB+0uPAmEXpUWoOYBooejes05vTGLDqPCAN4=";
+    hash = "sha256-nGWffQAXlnKiWBUnSo/IKGdWsLdwLr9N4jAURcVGfj8=";
  };

  postPatch = ''
--- a/pkgs/by-name/ma/mapcache/package.nix
+++ b/pkgs/by-name/ma/mapcache/package.nix
@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  apacheHttpd,
+  apr,
+  aprutil,
+  curl,
+  db,
+  fcgi,
+  gdal,
+  geos,
+  libgeotiff,
+  libjpeg,
+  libpng,
+  libtiff,
+  pcre2,
+  pixman,
+  proj,
+  sqlite,
+  zlib,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mapcache";
+  version = "1.14.1";
+
+  src = fetchFromGitHub {
+    owner = "MapServer";
+    repo = "mapcache";
+    rev = "rel-${lib.replaceStrings [ "." ] [ "-" ] version}";
+    hash = "sha256-AwdZdOEq9SZ5VzuBllg4U1gdVxZ9IVdqiDrn3QuRdCk=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    apacheHttpd
+    apr
+    aprutil
+    curl
+    db
+    fcgi
+    gdal
+    geos
+    libgeotiff
+    libjpeg
+    libpng
+    libtiff
+    pcre2
+    pixman
+    proj
+    sqlite
+    zlib
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "WITH_BERKELEY_DB" true)
+    (lib.cmakeBool "WITH_MEMCACHE" true)
+    (lib.cmakeBool "WITH_TIFF" true)
+    (lib.cmakeBool "WITH_GEOTIFF" true)
+    (lib.cmakeBool "WITH_PCRE2" true)
+    (lib.cmakeFeature "APACHE_MODULE_DIR" "${placeholder "out"}/modules")
+  ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-std=c99";
+
+  meta = {
+    description = "Server that implements tile caching to speed up access to WMS layers";
+    homepage = "https://mapserver.org/mapcache/";
+    changelog = "https://www.mapserver.org/development/changelog/mapcache/";
+    license = lib.licenses.mit;
+    maintainers = lib.teams.geospatial.members;
+    platforms = lib.platforms.unix;
+  };
+}
--- a/pkgs/servers/geospatial/mapserver/default.nix
+++ b/pkgs/servers/geospatial/mapserver/default.nix
@ -1,29 +1,53 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config
-, cairo, curl, fcgi, freetype, fribidi, gdal, geos, giflib, harfbuzz
-, libjpeg, libpng, librsvg, libxml2, postgresql, proj, protobufc, zlib
-, withPython ? true, swig, python3
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  withPython ? true,
+
+  cairo,
+  cmake,
+  curl,
+  fcgi,
+  freetype,
+  fribidi,
+  gdal,
+  geos,
+  giflib,
+  harfbuzz,
+  libjpeg,
+  libpng,
+  librsvg,
+  libxml2,
+  pkg-config,
+  postgresql,
+  proj,
+  protobufc,
+  python3,
+  swig,
+  zlib,
 }:

 stdenv.mkDerivation rec {
  pname = "mapserver";
-  version = "8.0.1";
+  version = "8.2.1";

  src = fetchFromGitHub {
    owner = "MapServer";
    repo = "MapServer";
    rev = "rel-${lib.replaceStrings [ "." ] [ "-" ] version}";
-    sha256 = "sha256-fAf4kOe/6bQW0i46+EZbD/6iWI2Bjkn2no6XeR/+mg4=";
+    sha256 = "sha256-kZEDC89yoQP0ma5avp6r+Hz8JMpErGlBVQkhlHO6UFw=";
  };

-  patches = [
-    # drop this patch for version 8.0.2
-    ./fix-build-w-libxml2-12.patch
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ] ++ lib.optionals withPython [ swig python3.pkgs.setuptools ];
+  nativeBuildInputs =
+    [
+      cmake
+      pkg-config
+    ]
+    ++ lib.optionals withPython [
+      swig
+      python3.pkgs.setuptools
+    ];

  buildInputs = [
    cairo
@ -38,7 +62,7 @@ stdenv.mkDerivation rec {
    libjpeg
    libpng
    librsvg
-    libxml2
+    (libxml2.override { enableHttp = true; })
    postgresql
    proj
    protobufc
--- a/pkgs/by-name/mi/minijinja/package.nix
+++ b/pkgs/by-name/mi/minijinja/package.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "minijinja";
-  version = "2.1.0";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "mitsuhiko";
    repo = "minijinja";
    rev = version;
-    hash = "sha256-R+OY5RIKX5AkP/sRkU1SoFAeFpFPjiMOuow9nEG30W0=";
+    hash = "sha256-21PPIh4xu5EFXdtvmmvoSRPdYiSEwswkACNys32kjXY=";
  };

-  cargoHash = "sha256-PiR7uq8VnD3vrYHeUh6QJ+yx4UxIq7pr17TNXpksfiA=";
+  cargoHash = "sha256-lPHM/pEXt4VLTTRxVxQTt/IAKhOxmzYkq71x10LFZ0w=";

  # The tests relies on the presence of network connection
  doCheck = false;
--- a/pkgs/by-name/mi/miru/darwin.nix
+++ b/pkgs/by-name/mi/miru/darwin.nix
@ -19,7 +19,7 @@ stdenvNoCC.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/ThaUnknown/miru/releases/download/v${version}/mac-Miru-${version}-mac.zip";
-    hash = "sha256-N4+WDXhu62QUFqdCcPPfYEOd2OImg/Moj+UT0xK2oGE=";
+    hash = "sha256-6QK9A+xy7Z66YDC9eJ5vFjtW8frjtYy9yoax7z6sWsg=";
  };

  sourceRoot = ".";
--- a/pkgs/by-name/mi/miru/linux.nix
+++ b/pkgs/by-name/mi/miru/linux.nix
@ -19,7 +19,7 @@ appimageTools.wrapType2 rec {
  src = fetchurl {
    url = "https://github.com/ThaUnknown/miru/releases/download/v${version}/linux-Miru-${version}.AppImage";
    name = "${pname}-${version}.AppImage";
-    hash = "sha256-wnqCKnZKt0Fj8TasdRVzI558W7aIB5FLkcDEiZfz3ZQ=";
+    hash = "sha256-J632TswcRC6CnK5ppqdbY97V3Q1ADDNgX0joxC5ybmM=";
  };

  extraInstallCommands =
--- a/pkgs/by-name/mi/miru/package.nix
+++ b/pkgs/by-name/mi/miru/package.nix
@ -5,7 +5,7 @@
 }:
 let
  pname = "miru";
-  version = "5.1.6";
+  version = "5.2.7";
  meta = with lib; {
    description = "Stream anime torrents, real-time with no waiting for downloads";
    homepage = "https://miru.watch";
--- a/pkgs/by-name/mu/museum/package.nix
+++ b/pkgs/by-name/mu/museum/package.nix
@ -7,7 +7,7 @@

 buildGoModule rec {

-  version = "photos-v0.9.5";
+  version = "photos-v0.9.16";
  pname = "museum";

  src = fetchFromGitHub {
@ -15,7 +15,7 @@ buildGoModule rec {
    repo = "ente";
    sparseCheckout = [ "server" ];
    rev = version;
-    hash = "sha256-U+3k6uIJWDw7QxF1GRF+f6ZXdmCwSkOJ/F60rU1PXRM=";
+    hash = "sha256-ZtlwDV3Iksi2QNzoAsAtbN7B/n0UKubU4nlXx4N0l+E=";
  };

  sourceRoot = "${src.name}/server";
--- a/pkgs/by-name/mu/music-assistant/ffmpeg.patch
+++ b/pkgs/by-name/mu/music-assistant/ffmpeg.patch
@ -1,8 +1,8 @@
 diff --git a/music_assistant/server/helpers/audio.py b/music_assistant/server/helpers/audio.py
-index 42011923..1e5dc112 100644
+index 6b7b5c8e..ec3b92d7 100644
 --- a/music_assistant/server/helpers/audio.py
 +++ b/music_assistant/server/helpers/audio.py
-@@ -218,7 +218,7 @@ async def crossfade_pcm_parts(
+@@ -214,7 +214,7 @@ async def crossfade_pcm_parts(
         await outfile.write(fade_out_part)
     args = [
         # generic args
@ -11,7 +11,7 @@ index 42011923..1e5dc112 100644
         "-hide_banner",
         "-loglevel",
         "quiet",
-@@ -281,7 +281,7 @@ async def strip_silence(
+@@ -277,7 +277,7 @@ async def strip_silence(
 ) -> bytes:
     """Strip silence from begin or end of pcm audio using ffmpeg."""
     fmt = ContentType.from_bit_depth(bit_depth)
@ -20,16 +20,16 @@ index 42011923..1e5dc112 100644
     args += [
         "-acodec",
         fmt.name.lower(),
-@@ -823,7 +823,7 @@ async def get_ffmpeg_stream(
+@@ -824,7 +824,7 @@ async def get_ffmpeg_stream(
 async def check_audio_support() -> tuple[bool, bool, str]:
     """Check if ffmpeg is present (with/without libsoxr support)."""
     # check for FFmpeg presence
-    returncode, output = await check_output("ffmpeg -version")
-+    returncode, output = await check_output("@ffmpeg@ -version")
+-    returncode, output = await check_output("ffmpeg", "-version")
+    returncode, output = await check_output("@ffmpeg@", "-version")
     ffmpeg_present = returncode == 0 and "FFmpeg" in output.decode()
 
     # use globals as in-memory cache
-@@ -877,7 +877,7 @@ async def get_silence(
+@@ -878,7 +878,7 @@ async def get_silence(
         return
     # use ffmpeg for all other encodings
     args = [
@ -38,7 +38,7 @@ index 42011923..1e5dc112 100644
         "-hide_banner",
         "-loglevel",
         "quiet",
-@@ -971,7 +971,7 @@ def get_ffmpeg_args(
+@@ -972,7 +972,7 @@ def get_ffmpeg_args(
 
     # generic args
     generic_args = [
@ -48,10 +48,10 @@ index 42011923..1e5dc112 100644
         "-loglevel",
         loglevel,
 diff --git a/music_assistant/server/helpers/tags.py b/music_assistant/server/helpers/tags.py
-index dc38e4c0..f4f3e2fe 100644
+index d17b55f6..b7b56c04 100644
 --- a/music_assistant/server/helpers/tags.py
 +++ b/music_assistant/server/helpers/tags.py
-@@ -368,7 +368,7 @@ async def parse_tags(
+@@ -380,7 +380,7 @@ async def parse_tags(
     file_path = input_file if isinstance(input_file, str) else "-"
 
     args = (
@ -60,7 +60,7 @@ index dc38e4c0..f4f3e2fe 100644
         "-hide_banner",
         "-loglevel",
         "fatal",
-@@ -440,7 +440,7 @@ async def get_embedded_image(input_file: str | AsyncGenerator[bytes, None]) -> b
+@@ -471,7 +471,7 @@ async def get_embedded_image(input_file: str | AsyncGenerator[bytes, None]) -> b
     """
     file_path = input_file if isinstance(input_file, str) else "-"
     args = (
--- a/pkgs/by-name/mu/music-assistant/frontend.nix
+++ b/pkgs/by-name/mu/music-assistant/frontend.nix
@ -6,12 +6,12 @@

 buildPythonPackage rec {
  pname = "music-assistant-frontend";
-  version = "2.5.15";
+  version = "2.7.0";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-D8VFdXgaVXSxk7c24kvb9TflFztS1zLwW4qGqV32nLo=";
+    hash = "sha256-KrloxxdqIwQ5NsxAGm28D5StHnw9LTqDDtcchD5X5Qk=";
  };

  postPatch = ''
--- a/pkgs/by-name/mu/music-assistant/package.nix
+++ b/pkgs/by-name/mu/music-assistant/package.nix
@ -11,6 +11,19 @@ let
  python = python3.override {
    self = python;
    packageOverrides = self: super: {
+      aiojellyfin = super.aiojellyfin.overridePythonAttrs rec {
+        version = "0.9.2";
+
+        src = fetchFromGitHub {
+          owner = "jc2k";
+          repo = "aiojellyfin";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-q+b1tKr46qq3PULPkCaQk2VoC1aaNxPK/E1Kj4PABfI=";
+        };
+
+        doCheck = false;
+      };
+
      music-assistant-frontend = self.callPackage ./frontend.nix { };
    };
  };
@ -24,14 +37,14 @@ in

 python.pkgs.buildPythonApplication rec {
  pname = "music-assistant";
-  version = "2.0.7";
+  version = "2.1.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "music-assistant";
    repo = "server";
-    rev = version;
-    hash = "sha256-JtdlZ3hH4fRU5TjmMUlrdSSCnLrIGCuSwSSrnLgjYEs=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ALsl2xfAFYejDEhR5/ZpeIxoHFgvz471tb4OP5xQAUE=";
  };

  patches = [
@ -43,8 +56,6 @@ python.pkgs.buildPythonApplication rec {
  ];

  postPatch = ''
-    sed -i "/--cov/d" pyproject.toml
-
    substituteInPlace pyproject.toml \
      --replace-fail "0.0.0" "${version}"
  '';
@ -71,6 +82,7 @@ python.pkgs.buildPythonApplication rec {
      certifi
      colorlog
      cryptography
+      eyed3
      faust-cchardet
      ifaddr
      mashumaro
@ -87,10 +99,13 @@ python.pkgs.buildPythonApplication rec {
  };

  nativeCheckInputs = with python.pkgs; [
-    ffmpeg-headless
+    aiojellyfin
    pytest-aiohttp
+    pytest-cov-stub
    pytestCheckHook
-  ] ++ lib.flatten (lib.attrValues optional-dependencies);
+    syrupy
+  ]
+  ++ lib.flatten (lib.attrValues optional-dependencies);

  pythonImportsCheck = [ "music_assistant" ];

--- a/pkgs/by-name/mu/music-assistant/providers.nix
+++ b/pkgs/by-name/mu/music-assistant/providers.nix
@ -1,10 +1,12 @@
 # Do not edit manually, run ./update-providers.py

 {
-  version = "2.0.7";
+  version = "2.1.1";
  providers = {
    airplay = [
    ];
+    apple_music = [
+    ]; # missing pywidevine
    builtin = [
    ];
    chromecast = ps: with ps; [
@ -29,8 +31,9 @@
    ]; # missing hass-client
    hass_players = [
    ];
-    jellyfin = [
-    ]; # missing jellyfin_apiclient_python
+    jellyfin = ps: with ps; [
+      aiojellyfin
+    ];
    musicbrainz = [
    ];
    opensubsonic = ps: with ps; [
@ -48,6 +51,7 @@
      aioslimproto
    ];
    snapcast = ps: with ps; [
+      bidict
      snapcast
    ];
    sonos = ps: with ps; [
@ -71,8 +75,8 @@
    ugp = [
    ];
    ytmusic = ps: with ps; [
-      pytube
+      yt-dlp
      ytmusicapi
-    ];
+    ]; # missing yt-dlp-youtube-accesstoken
  };
 }
--- a/Show More
+++ b/Show More