Merge master into staging-next

2024-11-02 00:14:01 +00:00 · 2024-11-02 00:14:01 +00:00 · e46fdbc115
commit e46fdbc115
parent 48927d94c0 9e273e5e11
102 changed files with 3662 additions and 1560 deletions
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@ -210,6 +210,7 @@
    - changed-files:
      - any-glob-to-any-file:
        - nixos/**/*
+        - pkgs/by-name/sw/switch-to-configuration-ng/**/*
        - pkgs/os-specific/linux/nixos-rebuild/**/*

 "6.topic: nim":
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@ -191,6 +191,10 @@ and `version` from Hackage.
 `sha256`
 : Hash to use for the default case of `src`.

+`sourceRoot`, `setSourceRoot`
+: Passed to `stdenv.mkDerivation`; see [“Variables controlling the unpack
+phase”](#variables-controlling-the-unpack-phase).
+
 `revision`
 : Revision number of the updated cabal file to fetch from Hackage.
 If `null` (which is the default value), the one included in `src` is used.
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -1290,6 +1290,15 @@ lib.mapAttrs mkLicense ({
  watcom = {
    spdxId = "Watcom-1.0";
    fullName = "Sybase Open Watcom Public License 1.0";
+    # Despite being OSI‐approved, this licence is not considered FOSS
+    # by Debian, Fedora, or the FSF, due to an onerous restriction that
+    # requires publication of even privately‐deployed modifications.
+    # This violates the FSF’s freedom 3 and Debian’s “desert island
+    # test” and “dissident test”.
+    #
+    # See: <https://en.wikipedia.org/wiki/Sybase_Open_Watcom_Public_License>
+    free = false;
+    redistributable = true;
  };

  w3c = {
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -16150,6 +16150,12 @@
    githubId = 1538622;
    name = "Michael Reilly";
  };
+  ondt = {
+    name = "Ondrej Telka";
+    email = "nix@ondt.dev";
+    github = "ondt";
+    githubId = 20520951;
+  };
  onedragon = {
    name = "YiLong Liu";
    email = "18922251299@163.com";
--- a/nixos/modules/programs/openvpn3.nix
+++ b/nixos/modules/programs/openvpn3.nix
@ -1,29 +1,87 @@
 { config, lib, pkgs, ... }:

 let
+  json = pkgs.formats.json { };
  cfg = config.programs.openvpn3;
-in
-{
+
+  inherit (lib) mkEnableOption mkPackageOption mkOption literalExpression max options lists;
+  inherit (lib.types) bool submodule ints;
+in {
  options.programs.openvpn3 = {
-    enable = lib.mkEnableOption "the openvpn3 client";
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.openvpn3.override {
-        enableSystemdResolved = config.services.resolved.enable;
+    enable = mkEnableOption "the openvpn3 client";
+    package = mkPackageOption pkgs "openvpn3" { };
+    netcfg = mkOption {
+      description = "Network configuration";
+      default = { };
+      type = submodule {
+        options = {
+          settings = mkOption {
+            description = "Options stored in {file}`/etc/openvpn3/netcfg.json` configuration file";
+            default = { };
+            type = submodule {
+              freeformType = json.type;
+              options = {
+                systemd_resolved = mkOption {
+                  type = bool;
+                  description = "Whether to use systemd-resolved integration";
+                  default = config.services.resolved.enable;
+                  defaultText = literalExpression "config.services.resolved.enable";
+                  example = false;
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+    log-service = mkOption {
+      description = "Log service configuration";
+      default = { };
+      type = submodule {
+        options = {
+          settings = mkOption {
+            description = "Options stored in {file}`/etc/openvpn3/log-service.json` configuration file";
+            default = { };
+            type = submodule {
+              freeformType = json.type;
+              options = {
+                journald = mkOption {
+                  description = "Use systemd-journald";
+                  type = bool;
+                  default = true;
+                  example = false;
+                };
+                log_dbus_details = mkOption {
+                  description = "Add D-Bus details in log file/syslog";
+                  type = bool;
+                  default = true;
+                  example = false;
+                };
+                log_level = mkOption {
+                  description = "How verbose should the logging be";
+                  type = (ints.between 0 7) // {
+                    merge = _loc: defs:
+                      lists.foldl max 0 (options.getValues defs);
+                  };
+                  default = 3;
+                  example = 6;
+                };
+                timestamp = mkOption {
+                  description = "Add timestamp log file";
+                  type = bool;
+                  default = false;
+                  example = true;
+                };
+              };
+            };
+          };
+        };
      };
-      defaultText = lib.literalExpression ''pkgs.openvpn3.override {
-        enableSystemdResolved = config.services.resolved.enable;
-      }'';
-      description = ''
-        Which package to use for `openvpn3`.
-      '';
    };
  };

  config = lib.mkIf cfg.enable {
-    services.dbus.packages = [
-      cfg.package
-    ];
+    services.dbus.packages = [ cfg.package ];

    users.users.openvpn = {
      isSystemUser = true;
@ -31,13 +89,20 @@ in
      group = "openvpn";
    };

-    users.groups.openvpn = {
-      gid = config.ids.gids.openvpn;
+    users.groups.openvpn = { gid = config.ids.gids.openvpn; };
+
+    environment = {
+      systemPackages = [ cfg.package ];
+      etc = {
+        "openvpn3/netcfg.json".source =
+          json.generate "netcfg.json" cfg.netcfg.settings;
+        "openvpn3/log-service.json".source =
+          json.generate "log-service.json" cfg.log-service.settings;
+      };
    };

-    environment.systemPackages = [
-      cfg.package
-    ];
+    systemd.packages = [ cfg.package ];
  };

+  meta.maintainers = with lib.maintainers; [ shamilton progrm_jarvis ];
 }
--- a/nixos/modules/services/databases/surrealdb.nix
+++ b/nixos/modules/services/databases/surrealdb.nix
@ -14,9 +14,9 @@ in {
        type = lib.types.str;
        description = ''
          The path that surrealdb will write data to. Use null for in-memory.
-          Can be one of "memory", "file://:path", "tikv://:addr".
+          Can be one of "memory", "rocksdb://:path", "surrealkv://:path", "tikv://:addr", "fdb://:addr".
        '';
-        default = "file:///var/lib/surrealdb/";
+        default = "rocksdb:///var/lib/surrealdb/";
        example = "memory";
      };

@ -41,10 +41,9 @@ in {
      extraFlags = lib.mkOption {
        type = lib.types.listOf lib.types.str;
        default = [];
-        example = [ "--allow-all" "--auth" "--user root" "--pass root" ];
+        example = [ "--allow-all" "--user" "root" "--pass" "root" ];
        description = ''
-          Specify a list of additional command line flags,
-          which get escaped and are then passed to surrealdb.
+          Specify a list of additional command line flags.
        '';
      };
    };
@ -61,7 +60,7 @@ in {
      after = [ "network.target" ];

      serviceConfig = {
-        ExecStart = "${cfg.package}/bin/surreal start --bind ${cfg.host}:${toString cfg.port} ${lib.escapeShellArgs cfg.extraFlags} -- ${cfg.dbPath}";
+        ExecStart = "${cfg.package}/bin/surreal start --bind ${cfg.host}:${toString cfg.port} ${lib.strings.concatStringsSep " " cfg.extraFlags} -- ${cfg.dbPath}";
        DynamicUser = true;
        Restart = "on-failure";
        StateDirectory = "surrealdb";
--- a/nixos/modules/services/hardware/triggerhappy.nix
+++ b/nixos/modules/services/hardware/triggerhappy.nix
@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let

  cfg = config.services.triggerhappy;
@ -6,35 +11,53 @@ let
  socket = "/run/thd.socket";

  configFile = pkgs.writeText "triggerhappy.conf" ''
-    ${lib.concatMapStringsSep "\n"
-      ({ keys, event, cmd, ... }:
-        ''${lib.concatMapStringsSep "+" (x: "KEY_" + x) keys} ${toString { press = 1; hold = 2; release = 0; }.${event}} ${cmd}''
-      )
-      cfg.bindings}
+    ${lib.concatMapStringsSep "\n" (
+      {
+        keys,
+        event,
+        cmd,
+        ...
+      }:
+      ''${lib.concatMapStringsSep "+" (x: "KEY_" + x) keys} ${
+        toString
+          {
+            press = 1;
+            hold = 2;
+            release = 0;
+          }
+          .${event}
+      } ${cmd}''
+    ) cfg.bindings}
    ${cfg.extraConfig}
  '';

-  bindingCfg = { ... }: {
-    options = {
+  bindingCfg =
+    { ... }:
+    {
+      options = {
+
+        keys = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          description = "List of keys to match.  Key names as defined in linux/input-event-codes.h";
+        };
+
+        event = lib.mkOption {
+          type = lib.types.enum [
+            "press"
+            "hold"
+            "release"
+          ];
+          default = "press";
+          description = "Event to match.";
+        };
+
+        cmd = lib.mkOption {
+          type = lib.types.str;
+          description = "What to run.";
+        };

-      keys = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        description = "List of keys to match.  Key names as defined in linux/input-event-codes.h";
      };
-
-      event = lib.mkOption {
-        type = lib.types.enum ["press" "hold" "release"];
-        default = "press";
-        description = "Event to match.";
-      };
-
-      cmd = lib.mkOption {
-        type = lib.types.str;
-        description = "What to run.";
-      };
-
    };
-  };

 in

@ -65,9 +88,9 @@ in

      bindings = lib.mkOption {
        type = lib.types.listOf (lib.types.submodule bindingCfg);
-        default = [];
+        default = [ ];
        example = lib.literalExpression ''
-          [ { keys = ["PLAYPAUSE"];  cmd = "''${pkgs.mpc-cli}/bin/mpc -q toggle"; } ]
+          [ { keys = ["PLAYPAUSE"];  cmd = "''${lib.getExe pkgs.mpc} -q toggle"; } ]
        '';
        description = ''
          Key bindings for {command}`triggerhappy`.
@ -86,7 +109,6 @@ in

  };

-
  ###### implementation

  config = lib.mkIf cfg.enable {
@ -101,18 +123,22 @@ in
      wantedBy = [ "multi-user.target" ];
      description = "Global hotkey daemon";
      serviceConfig = {
-        ExecStart = "${pkgs.triggerhappy}/bin/thd ${lib.optionalString (cfg.user != "root") "--user ${cfg.user}"} --socket ${socket} --triggers ${configFile} --deviceglob /dev/input/event*";
+        ExecStart = "${pkgs.triggerhappy}/bin/thd ${
+          lib.optionalString (cfg.user != "root") "--user ${cfg.user}"
+        } --socket ${socket} --triggers ${configFile} --deviceglob /dev/input/event*";
      };
    };

-    services.udev.packages = lib.singleton (pkgs.writeTextFile {
-      name = "triggerhappy-udev-rules";
-      destination = "/etc/udev/rules.d/61-triggerhappy.rules";
-      text = ''
-        ACTION=="add", SUBSYSTEM=="input", KERNEL=="event[0-9]*", ATTRS{name}!="triggerhappy", \
-          RUN+="${pkgs.triggerhappy}/bin/th-cmd --socket ${socket} --passfd --udev"
-      '';
-    });
+    services.udev.packages = lib.singleton (
+      pkgs.writeTextFile {
+        name = "triggerhappy-udev-rules";
+        destination = "/etc/udev/rules.d/61-triggerhappy.rules";
+        text = ''
+          ACTION=="add", SUBSYSTEM=="input", KERNEL=="event[0-9]*", ATTRS{name}!="triggerhappy", \
+            RUN+="${pkgs.triggerhappy}/bin/th-cmd --socket ${socket} --passfd --udev"
+        '';
+      }
+    );

  };

--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -915,7 +915,9 @@ let
          "UseAddress"
          "UseDNS"
          "UseNTP"
+          "SendHostname"
          "UseHostname"
+          "Hostname"
          "UseDomains"
          "RouteMetric"
          "RapidCommit"
@ -936,6 +938,7 @@ let
        (assertValueOneOf "UseAddress" boolValues)
        (assertValueOneOf "UseDNS" boolValues)
        (assertValueOneOf "UseNTP" boolValues)
+        (assertValueOneOf "SendHostname" boolValues)
        (assertValueOneOf "UseHostname" boolValues)
        (assertValueOneOf "UseDomains" (boolValues ++ ["route"]))
        (assertInt "RouteMetric")
--- a/nixos/tests/mpd.nix
+++ b/nixos/tests/mpd.nix
@ -1,12 +1,13 @@
-import ./make-test-python.nix ({ pkgs, lib, ... }:
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
  let
    track = pkgs.fetchurl {
      # Sourced from http://freemusicarchive.org/music/Blue_Wave_Theory/Surf_Music_Month_Challenge/Skyhawk_Beach_fade_in
-      # License: http://creativecommons.org/licenses/by-sa/4.0/

      name = "Blue_Wave_Theory-Skyhawk_Beach.mp3";
      url = "https://freemusicarchive.org/file/music/ccCommunity/Blue_Wave_Theory/Surf_Music_Month_Challenge/Blue_Wave_Theory_-_04_-_Skyhawk_Beach.mp3";
-      sha256 = "0xw417bxkx4gqqy139bb21yldi37xx8xjfxrwaqa0gyw19dl6mgp";
+      hash = "sha256-91VDWwrcP6Cw4rk72VHvZ8RGfRBrpRE8xo/02dcJhHc=";
+      meta.license = lib.licenses.cc-by-sa-40;
    };

    defaultCfg = rec {
@ -16,42 +17,56 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
      musicDirectory = "${dataDir}/music";
    };

-    defaultMpdCfg = with defaultCfg; {
-      inherit dataDir musicDirectory user group;
+    defaultMpdCfg = {
+      inherit (defaultCfg)
+        dataDir
+        musicDirectory
+        user
+        group
+        ;
      enable = true;
    };

-    musicService = { user, group, musicDirectory }: {
-      description = "Sets up the music file(s) for MPD to use.";
-      requires = [ "mpd.service" ];
-      after = [ "mpd.service" ];
-      wantedBy = [ "default.target" ];
-      script = ''
-        cp ${track} ${musicDirectory}
-      '';
-      serviceConfig = {
-        User = user;
-        Group = group;
+    musicService =
+      {
+        user,
+        group,
+        musicDirectory,
+      }:
+      {
+        description = "Sets up the music file(s) for MPD to use.";
+        requires = [ "mpd.service" ];
+        after = [ "mpd.service" ];
+        wantedBy = [ "default.target" ];
+        script = ''
+          cp ${track} ${musicDirectory}
+        '';
+        serviceConfig = {
+          User = user;
+          Group = group;
+        };
      };
-    };

-    mkServer = { mpd, musicService, }:
-      { boot.kernelModules = [ "snd-dummy" ];
+    mkServer =
+      { mpd, musicService }:
+      {
+        boot.kernelModules = [ "snd-dummy" ];
        services.mpd = mpd;
        systemd.services.musicService = musicService;
      };
-  in {
+  in
+  {
    name = "mpd";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ emmanuelrosa ];
+    meta = {
+      maintainers = with lib.maintainers; [ emmanuelrosa ];
    };

-  nodes =
-    { client =
-      { ... }: { };
+    nodes = {
+      client = { ... }: { };

      serverALSA =
-        { ... }: lib.mkMerge [
+        { ... }:
+        lib.mkMerge [
          (mkServer {
            mpd = defaultMpdCfg // {
              network.listenAddress = "any";
@ -63,13 +78,14 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
                }
              '';
            };
-            musicService = with defaultMpdCfg; musicService { inherit user group musicDirectory; };
+            musicService = musicService { inherit (defaultMpdCfg) user group musicDirectory; };
          })
          { networking.firewall.allowedTCPPorts = [ 6600 ]; }
        ];

      serverPulseAudio =
-        { ... }: lib.mkMerge [
+        { ... }:
+        lib.mkMerge [
          (mkServer {
            mpd = defaultMpdCfg // {
              extraConfig = ''
@ -80,7 +96,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
              '';
            };

-            musicService = with defaultCfg; musicService { inherit user group musicDirectory; };
+            musicService = musicService { inherit (defaultMpdCfg) user group musicDirectory; };
          })
          {
            hardware.pulseaudio = {
@ -94,40 +110,41 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
        ];
    };

-  testScript = ''
-    mpc = "${pkgs.mpc-cli}/bin/mpc --wait"
+    testScript = ''
+      mpc = "${lib.getExe pkgs.mpc} --wait"

-    # Connects to the given server and attempts to play a tune.
-    def play_some_music(server):
-        server.wait_for_unit("mpd.service")
-        server.succeed(f"{mpc} update")
-        _, tracks = server.execute(f"{mpc} ls")
+      # Connects to the given server and attempts to play a tune.
+      def play_some_music(server):
+          server.wait_for_unit("mpd.service")
+          server.succeed(f"{mpc} update")
+          _, tracks = server.execute(f"{mpc} ls")

-        for track in tracks.splitlines():
-            server.succeed(f"{mpc} add {track}")
+          for track in tracks.splitlines():
+              server.succeed(f"{mpc} add {track}")

-        _, added_tracks = server.execute(f"{mpc} playlist")
+          _, added_tracks = server.execute(f"{mpc} playlist")

-        # Check we succeeded adding audio tracks to the playlist
-        assert len(added_tracks.splitlines()) > 0
+          # Check we succeeded adding audio tracks to the playlist
+          assert len(added_tracks.splitlines()) > 0

-        server.succeed(f"{mpc} play")
+          server.succeed(f"{mpc} play")

-        _, output = server.execute(f"{mpc} status")
-        # Assure audio track is playing
-        assert "playing" in output
+          _, output = server.execute(f"{mpc} status")
+          # Assure audio track is playing
+          assert "playing" in output

-        server.succeed(f"{mpc} stop")
+          server.succeed(f"{mpc} stop")


-    play_some_music(serverALSA)
-    play_some_music(serverPulseAudio)
+      play_some_music(serverALSA)
+      play_some_music(serverPulseAudio)

-    client.wait_for_unit("multi-user.target")
-    client.succeed(f"{mpc} -h serverALSA status")
+      client.wait_for_unit("multi-user.target")
+      client.succeed(f"{mpc} -h serverALSA status")

-    # The PulseAudio-based server is configured not to accept external client connections
-    # to perform the following test:
-    client.fail(f"{mpc} -h serverPulseAudio status")
-  '';
-})
+      # The PulseAudio-based server is configured not to accept external client connections
+      # to perform the following test:
+      client.fail(f"{mpc} -h serverPulseAudio status")
+    '';
+  }
+)
--- a/pkgs/applications/audio/clerk/default.nix
+++ b/pkgs/applications/audio/clerk/default.nix
@ -1,82 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, makeWrapper
-, rofi
-, tmux
-, fzf
-, mpc-cli
-, perl
-, util-linux
-, libnotify
-, perlPackages
-}:
-
-stdenv.mkDerivation {
-  pname = "clerk";
-  version = "unstable-2023-10-07";
-
-  src = fetchFromGitHub {
-    owner = "carnager";
-    repo = "clerk";
-    rev = "907138d8fc2b1709fb49d062d0b663a48eb210bd";
-    hash = "sha256-V2nDLq2ViC5Twve0EILBEYOdEavqgYB/TQq/T+ftfmk=";
-  };
-
-  postPatch = ''
-    substituteInPlace clerk_rating_client.service \
-      --replace "/usr" "$out"
-  '';
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  buildInputs = with perlPackages; [
-    perl
-    DataMessagePack
-    DataSectionSimple
-    ConfigSimple
-    TryTiny
-    IPCRun
-    HTTPDate
-    FileSlurper
-    ArrayUtils
-    NetMPD
-  ];
-
-  dontBuild = true;
-
-  strictDeps = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    install -D clerk.pl $out/bin/clerk
-    install -D clerk_rating_client $out/bin/clerk_rating_client
-    install -D clerk_rating_client.service $out/lib/systemd/user/clerk_rating_client.service
-    runHook postInstall
-  '';
-
-  postFixup = let
-    binPath = lib.makeBinPath [
-      libnotify
-      mpc-cli
-      rofi
-      tmux
-      fzf
-      util-linux
-    ];
-  in
-  ''
-    wrapProgram $out/bin/clerk --set PERL5LIB $PERL5LIB --prefix PATH : "${binPath}"
-    wrapProgram $out/bin/clerk_rating_client --set PERL5LIB $PERL5LIB --prefix PATH : "${binPath}"
-  '';
-
-  meta = with lib; {
-    description = "MPD client based on rofi/fzf";
-    homepage = "https://github.com/carnager/clerk";
-    license = licenses.mit;
-    maintainers = with maintainers; [ anderspapitto rewine ];
-    mainProgram = "clerk";
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/audio/mpc/default.nix
+++ b/pkgs/applications/audio/mpc/default.nix
@ -1,63 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchpatch
-, installShellFiles
-, libiconv
-, libmpdclient
-, meson
-, ninja
-, pkg-config
-, sphinx
-}:
-
-stdenv.mkDerivation rec {
-  pname = "mpc";
-  version = "0.34";
-
-  src = fetchFromGitHub {
-    owner = "MusicPlayerDaemon";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-2FjYBfak0IjibuU+CNQ0y9Ei8hTZhynS/BK2DNerhVw=";
-  };
-
-  patches = [
-    # fix the build with meson 0.60 (https://github.com/MusicPlayerDaemon/mpc/pull/76)
-    (fetchpatch {
-      url = "https://github.com/MusicPlayerDaemon/mpc/commit/b656ca4b6c2a0d5b6cebd7f7daa679352f664e0e.patch";
-      sha256 = "sha256-fjjSlCKxgkz7Em08CaK7+JAzl8YTzLcpGGMz2HJlsVw=";
-    })
-  ];
-
-  buildInputs = [
-    libmpdclient
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
-
-  nativeBuildInputs = [
-    installShellFiles
-    meson
-    ninja
-    pkg-config
-    sphinx
-  ];
-
-  postInstall = ''
-    installShellCompletion --cmd mpc --bash $out/share/doc/mpc/contrib/mpc-completion.bash
-  '';
-
-  postFixup = ''
-    rm $out/share/doc/mpc/contrib/mpc-completion.bash
-  '';
-
-  meta = with lib; {
-    homepage = "https://www.musicpd.org/clients/mpc/";
-    description = "Minimalist command line interface to MPD";
-    changelog = "https://raw.githubusercontent.com/MusicPlayerDaemon/mpc/v${version}/NEWS";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = with platforms; unix;
-    mainProgram = "mpc";
-  };
-}
--- a/pkgs/applications/audio/zrythm/default.nix
+++ b/pkgs/applications/audio/zrythm/default.nix
@ -79,11 +79,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "zrythm";
-  version = "1.0.0-rc.1";
+  version = "1.0.0-rc.2";

  src = fetchzip {
    url = "https://www.zrythm.org/releases/zrythm-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-Ljbw7bjGI6js4OP9KEXCkhC9AMbInSz0nn+pROm4vXw=";
+    sha256 = "sha256-Da//nY0yXSbDPEg6t9jgL32NoT8dFYSQ4Kzc/KbHGSk=";
  };

  passthru.updateScript = writeScript "update-zrythm" ''
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -9233,6 +9233,18 @@ final: prev:
    meta.homepage = "https://github.com/dstein64/nvim-scrollview/";
  };

+  nvim-scissors = buildVimPlugin {
+    pname = "nvim-scissors";
+    version = "2024-10-30";
+    src = fetchFromGitHub {
+      owner = "chrisgrieser";
+      repo = "nvim-scissors";
+      rev = "27213bd106239eeb8adbfdd4f346f76ccd50ce53";
+      sha256 = "sha256-8rOkXEhLNLLaYoBs5Ir3kIDYWPXyhmXL7PAsY2FiX2U=";
+    };
+    meta.homepage = "https://github.com/chrisgrieser/nvim-scissors/";
+  };
+
  nvim-search-and-replace = buildVimPlugin {
    pname = "nvim-search-and-replace";
    version = "2022-09-06";
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -1671,6 +1671,10 @@ in
    }
  );

+  nvim-scissors = super.nvim-scissors.overrideAttrs {
+    nvimRequireCheck = "scissors";
+  };
+
  nvim-teal-maker = super.nvim-teal-maker.overrideAttrs {
    postPatch = ''
      substituteInPlace lua/tealmaker/init.lua \
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -776,6 +776,7 @@ https://github.com/olrtg/nvim-rename-state/,HEAD,
 https://github.com/chrisgrieser/nvim-rip-substitute/,,
 https://github.com/petertriho/nvim-scrollbar/,HEAD,
 https://github.com/dstein64/nvim-scrollview/,,
+https://github.com/chrisgrieser/nvim-scissors,HEAD,
 https://github.com/s1n7ax/nvim-search-and-replace/,HEAD,
 https://github.com/garymjr/nvim-snippets/,,
 https://github.com/dcampos/nvim-snippy/,HEAD,
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -2039,8 +2039,8 @@ let
        mktplcRef = {
          publisher = "github";
          name = "copilot";
-          version = "1.236.0"; # compatible with vscode ^1.94
-          hash = "sha256-ozJwByuSjROWSxfrapcyxDkI7xgcjqf/IKtUfEC+MGk=";
+          version = "1.243.1191"; # compatible with vscode ^1.95
+          hash = "sha256-tMUFMi+lBZZQA/8UTyoqQ5s+xnWKh39V8GYErO9ZuSo=";
        };

        meta = {
@ -2056,8 +2056,9 @@ let
        mktplcRef = {
          publisher = "github";
          name = "copilot-chat";
-          version = "0.22.2024100702"; # latest compatible with vscode ^1.94
-          hash = "sha256-n/ecEnxz3LiTx9MuHO8AMIWBJPNNxQb6vghlG/hPMUY=";
+          # Verify which version is available with nix run nixpkgs#vsce -- show github.copilot-chat --json
+          version = "0.23.2024102903"; # compatible with vscode ^1.95
+          hash = "sha256-FGvB+b24i23bdhpJpCQDvIHqqFvCJrWAKnX6fJgkr2E=";
        };
        meta = {
          description = "GitHub Copilot Chat is a companion extension to GitHub Copilot that houses experimental chat features";
--- a/pkgs/applications/radio/qlog/default.nix
+++ b/pkgs/applications/radio/qlog/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "qlog";
-  version = "0.38.0";
+  version = "0.39.0";

  src = fetchFromGitHub {
    owner = "foldynl";
    repo = "QLog";
    rev = "v${version}";
-    hash = "sha256-C9kXntcCUaEl/S1ypZrU0ZPfaJbzg6/aXJSC+TREmhc=";
+    hash = "sha256-W+Ftc97/lI49rUItVhCb9W9mxcCElED/oZxefgIDqyM=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/science/biology/jbrowse/default.nix
+++ b/pkgs/applications/science/biology/jbrowse/default.nix
@ -2,11 +2,11 @@

 let
  pname = "jbrowse";
-  version = "2.15.4";
+  version = "2.16.0";

  src = fetchurl {
    url = "https://github.com/GMOD/jbrowse-components/releases/download/v${version}/jbrowse-desktop-v${version}-linux.AppImage";
-    sha256 = "sha256-ojIvC93dx9BSnUw7zBpDMBD0xPCMG4GUH1e5ZRGd9pk=";
+    sha256 = "sha256-Nf+Dp1XVXgY1+iih7/cvzxnfCKdgHz5kpefdMucrlIA=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@ -33,20 +33,20 @@
 with python3Packages;
 buildPythonApplication rec {
  pname = "kitty";
-  version = "0.36.4";
+  version = "0.37.0";
  format = "other";

  src = fetchFromGitHub {
    owner = "kovidgoyal";
    repo = "kitty";
    rev = "refs/tags/v${version}";
-    hash = "sha256-nN0y2VKK5UNaozpHQNPN7AYkto9z6rJNpYRJhvLPtVQ=";
+    hash = "sha256-xxM5nqEr7avtJUlcsrA/KXOTxSajIg7kDQM6Q4V+6WM=";
  };

  goModules = (buildGo123Module {
    pname = "kitty-go-modules";
    inherit src version;
-    vendorHash = "sha256-8hsQH7OdsxeVG6pomuxdmTXNmQYBROoUUxoC10LeLFo=";
+    vendorHash = "sha256-d5jRhOm53HDGnsU5Lg5tVGU/9z8RGqORzS53hOyIKBk=";
  }).goModules;

  buildInputs = [
@ -55,6 +55,7 @@ buildPythonApplication rec {
    simde
    lcms2
    librsync
+    matplotlib
    openssl.dev
    xxHash
  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -69,7 +69,7 @@ let

    x86_64-darwin = fetchzip {
      url = "https://release.axocdn.com/darwin/GitKraken-v${version}.zip";
-      hash = "sha256-21VwDFw2dyySoc4NC/RR3k/VtksqaZ5vkdx0z5MKqLc=";
+      hash = "sha256-fPvEItavxFwUbk3WsTBvzRMu7fjnm5HxybEueHn//Q4=";
    };

    aarch64-darwin = fetchzip {
--- a/pkgs/applications/virtualization/cntr/default.nix
+++ b/pkgs/applications/virtualization/cntr/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cntr";
-  version = "1.5.3";
+  version = "1.5.4";

  src = fetchFromGitHub {
    owner = "Mic92";
    repo = "cntr";
    rev = version;
-    sha256 = "sha256-spa4qPEhpNSZIk16jeH9YEr4g9JcVmpetHz72A/ZAPY=";
+    sha256 = "sha256-ErGratd1RCynE+iS+qn9feJi5o9f94lUNJZfy4XAjkc=";
  };

-  cargoHash = "sha256-YN8EtUXKtT8Xc0RnW7QqL+awyWy5xFKWhYMxgYG28I4=";
+  cargoHash = "sha256-4EDAQ0MG0BTN0L3W4Jm0IdVY8vj5U3faO+ruUjLMBMY=";

  passthru.tests = nixosTests.cntr;

--- a/pkgs/applications/virtualization/colima/default.nix
+++ b/pkgs/applications/virtualization/colima/default.nix
@ -17,13 +17,13 @@

 buildGoModule rec {
  pname = "colima";
-  version = "0.7.5";
+  version = "0.7.6";

  src = fetchFromGitHub {
    owner = "abiosoft";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-WInmoTUaEm2kQ7esZgPj3YIHmHbBrlBTWcLPC9/2MdY=";
+    hash = "sha256-S8KmwUN5ZU21P/i6X9uSmQ25nMHZxYKd6XtawrwP6yU=";
    # We need the git revision
    leaveDotGit = true;
    postFetch = ''
@ -35,7 +35,7 @@ buildGoModule rec {
  nativeBuildInputs = [ installShellFiles makeWrapper ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.DarwinTools ];

-  vendorHash = "sha256-niuBo2YUUYKH0eSApOByNLrcHqr9m5VKGoiGp1fKklg=";
+  vendorHash = "sha256-caqQA+vDtC5s9qehMIMAcl8JD3Ls2wCSfOpUFPFQ9zY=";

  # disable flaky Test_extractZones
  # https://hydra.nixos.org/build/212378003/log
--- a/pkgs/applications/virtualization/virtualbox/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/default.nix
@ -49,6 +49,9 @@
  yasm,
  glslang,
  nixosTests,
+  # If open-watcom-bin is not passed, VirtualBox will fall back to use
+  # the shipped alternative sources (assembly).
+  open-watcom-bin,
  makeself,
  perl,
  vulkan-loader,
@ -230,11 +233,18 @@ stdenv.mkDerivation (finalAttrs: {
    })
    # While the KVM patch should not break any other behavior if --with-kvm is not specified,
    # we don't take any chances and only apply it if people actually want to use KVM support.
-    ++ optional enableKvm (fetchpatch {
-      name = "virtualbox-${finalAttrs.virtualboxVersion}-kvm-dev-${finalAttrs.kvmPatchVersion}.patch";
-      url = "https://github.com/cyberus-technology/virtualbox-kvm/releases/download/dev-${finalAttrs.kvmPatchVersion}/kvm-backend-${finalAttrs.virtualboxVersion}-dev-${finalAttrs.kvmPatchVersion}.patch";
-      hash = finalAttrs.kvmPatchHash;
-    })
+    ++ optional enableKvm (
+      let
+        patchVboxVersion =
+          # There is no updated patch for 7.0.22 yet, but the older one still applies.
+          if finalAttrs.virtualboxVersion == "7.0.22" then "7.0.20" else finalAttrs.virtualboxVersion;
+      in
+      fetchpatch {
+        name = "virtualbox-${finalAttrs.virtualboxVersion}-kvm-dev-${finalAttrs.kvmPatchVersion}.patch";
+        url = "https://github.com/cyberus-technology/virtualbox-kvm/releases/download/dev-${finalAttrs.kvmPatchVersion}/kvm-backend-${patchVboxVersion}-dev-${finalAttrs.kvmPatchVersion}.patch";
+        hash = finalAttrs.kvmPatchHash;
+      }
+    )
    ++ [
      ./qt-dependency-paths.patch
      # https://github.com/NixOS/nixpkgs/issues/123851
@ -292,6 +302,7 @@ stdenv.mkDerivation (finalAttrs: {
      ${optionalString (!enableHardening) "--disable-hardening"} \
      ${optionalString (!enable32bitGuests) "--disable-vmmraw"} \
      ${optionalString enableWebService "--enable-webservice"} \
+      ${optionalString (open-watcom-bin != null) "--with-ow-dir=${open-watcom-bin}"} \
      ${optionalString (enableKvm) "--with-kvm"} \
      ${extraConfigureFlags} \
      --disable-kmods
--- a/pkgs/applications/window-managers/i3/bumblebee-status/plugins.nix
+++ b/pkgs/applications/window-managers/i3/bumblebee-status/plugins.nix
@ -89,7 +89,7 @@ in
  memory.propagatedBuildInputs = [ pkgs.gnome-system-monitor ];
  messagereceiver = { };
  mocp.propagatedBuildInputs = [ pkgs.moc ];
-  mpd.propagatedBuildInputs = [ pkgs.mpc-cli ];
+  mpd.propagatedBuildInputs = [ pkgs.mpc ];
  network.propagatedBuildInputs = [ py.netifaces pkgs.iw ];
  network_traffic.propagatedBuildInputs = [ py.netifaces ];
  nic.propagatedBuildInputs = [ py.netifaces pkgs.iw ];
--- a/pkgs/by-name/af/affine/package.nix
+++ b/pkgs/by-name/af/affine/package.nix
@ -1,67 +1,75 @@
-{ lib
-, fetchurl
-, stdenvNoCC
-, copyDesktopItems
-, makeDesktopItem
-, makeWrapper
-, unzip
-, electron
-, commandLineArgs ? ""
+{
+  lib,
+  fetchurl,
+  stdenvNoCC,
+  copyDesktopItems,
+  makeDesktopItem,
+  makeWrapper,
+  unzip,
+  electron,
+  commandLineArgs ? "",
 }:

-stdenvNoCC.mkDerivation (finalAttrs: let
-  icon = fetchurl {
-    url = "https://raw.githubusercontent.com/toeverything/AFFiNE/v${finalAttrs.version}/packages/frontend/core/public/favicon-192.png";
-    hash = "sha256-smZ5W7fy3TK3bvjwV4i71j2lVmKSZcyhMhcWfPxNnN4=";
-  };
-in {
-  pname = "affine";
-  version = "0.17.0";
-  src = fetchurl {
-    url = "https://github.com/toeverything/AFFiNE/releases/download/v${finalAttrs.version}/affine-${finalAttrs.version}-stable-linux-x64.zip";
-    hash = "sha256-7Gaiv3XBxpHcI4curNlkN8kXcJZrD4WQS8ciqcabRMs=";
-  };
-  nativeBuildInputs = [
-    copyDesktopItems
-    makeWrapper
-    unzip
-  ];
-  postInstall = ''
-    mkdir -p $out/lib
-    cp -r ./resources/* -t $out/lib/
-    mkdir -p $out/share/doc/affine/
-    cp LICENSE* $out/share/doc/affine/
-    install -Dm644 ${icon} $out/share/pixmaps/affine.png
-    makeWrapper "${electron}/bin/electron" $out/bin/affine \
-      --inherit-argv0 \
-      --add-flags $out/lib/app.asar \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
-      --add-flags ${lib.escapeShellArg commandLineArgs}
-  '';
-  desktopItems = [
-    (makeDesktopItem {
-      name = "affine";
-      desktopName = "AFFiNE";
-      exec = "affine %U";
-      terminal = false;
-      icon = "affine";
-      startupWMClass = "affine";
-      categories = ["Utility"];
-    })
-  ];
-  meta = with lib; {
-    description = "Workspace with fully merged docs, whiteboards and databases";
-    longDescription = ''
-      AFFiNE is an open-source, all-in-one workspace and an operating
-      system for all the building blocks that assemble your knowledge
-      base and much more -- wiki, knowledge management, presentation
-      and digital assets
+stdenvNoCC.mkDerivation (
+  finalAttrs:
+  let
+    icon = fetchurl {
+      url = "https://raw.githubusercontent.com/toeverything/AFFiNE/v${finalAttrs.version}/packages/frontend/core/public/favicon-192.png";
+      hash = "sha256-smZ5W7fy3TK3bvjwV4i71j2lVmKSZcyhMhcWfPxNnN4=";
+    };
+  in
+  {
+    pname = "affine";
+    version = "0.17.5";
+    src = fetchurl {
+      url = "https://github.com/toeverything/AFFiNE/releases/download/v${finalAttrs.version}/affine-${finalAttrs.version}-stable-linux-x64.zip";
+      hash = "sha256-lK5DDI9CKRneY4AwMI4r1qlGyYtQG4Xi8Ys4I3jawTk=";
+    };
+    nativeBuildInputs = [
+      copyDesktopItems
+      makeWrapper
+      unzip
+    ];
+    postInstall = ''
+      mkdir -p $out/lib
+      cp -r ./resources/* -t $out/lib/
+      mkdir -p $out/share/doc/affine/
+      cp LICENSE* $out/share/doc/affine/
+      install -Dm644 ${icon} $out/share/pixmaps/affine.png
+      makeWrapper "${electron}/bin/electron" $out/bin/affine \
+        --inherit-argv0 \
+        --add-flags $out/lib/app.asar \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+        --add-flags ${lib.escapeShellArg commandLineArgs}
    '';
-    homepage = "https://affine.pro/";
-    downloadPage = "https://affine.pro/download";
-    license = licenses.mit;
-    maintainers = with maintainers; [richar redyf];
-    mainProgram = "affine";
-    platforms = ["x86_64-linux"];
-  };
-})
+    desktopItems = [
+      (makeDesktopItem {
+        name = "affine";
+        desktopName = "AFFiNE";
+        exec = "affine %U";
+        terminal = false;
+        icon = "affine";
+        startupWMClass = "affine";
+        categories = [ "Utility" ];
+      })
+    ];
+    meta = {
+      description = "Workspace with fully merged docs, whiteboards and databases";
+      longDescription = ''
+        AFFiNE is an open-source, all-in-one workspace and an operating
+        system for all the building blocks that assemble your knowledge
+        base and much more -- wiki, knowledge management, presentation
+        and digital assets
+      '';
+      homepage = "https://affine.pro/";
+      downloadPage = "https://affine.pro/download";
+      license = lib.licenses.mit;
+      maintainers = with lib.maintainers; [
+        richar
+        redyf
+      ];
+      mainProgram = "affine";
+      platforms = [ "x86_64-linux" ];
+    };
+  }
+)
--- a/pkgs/by-name/cl/clerk/package.nix
+++ b/pkgs/by-name/cl/clerk/package.nix
@ -0,0 +1,103 @@
+{
+  lib,
+  fetchFromGitHub,
+  fzf,
+  installShellFiles,
+  libnotify,
+  makeWrapper,
+  mpc,
+  perlPackages,
+  rofi,
+  stdenv,
+  tmux,
+  unstableGitUpdater,
+  util-linux,
+}:
+
+stdenv.mkDerivation {
+  pname = "clerk";
+  version = "4.0.5-unstable-2023-10-07";
+
+  src = fetchFromGitHub {
+    owner = "carnager";
+    repo = "clerk";
+    rev = "907138d8fc2b1709fb49d062d0b663a48eb210bd";
+    hash = "sha256-V2nDLq2ViC5Twve0EILBEYOdEavqgYB/TQq/T+ftfmk=";
+  };
+
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+  ];
+
+  buildInputs = with perlPackages; [
+    perl
+    DataMessagePack
+    DataSectionSimple
+    ConfigSimple
+    TryTiny
+    IPCRun
+    HTTPDate
+    FileSlurper
+    ArrayUtils
+    NetMPD
+  ];
+
+  dontBuild = true;
+
+  strictDeps = true;
+
+  postPatch = ''
+    substituteInPlace clerk_rating_client.service \
+      --replace "/usr" "$out"
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mv clerk.pl clerk
+    installBin clerk clerk_rating_client
+    install -D clerk_rating_client.service $out/lib/systemd/user/clerk_rating_client.service
+
+    runHook postInstall
+  '';
+
+  postFixup =
+    let
+      binPath = lib.makeBinPath [
+        fzf
+        libnotify
+        mpc
+        rofi
+        tmux
+        util-linux
+      ];
+    in
+    ''
+      pushd $out/bin
+      for f in clerk clerk_rating_client; do
+        wrapProgram $f \
+          --prefix PATH : "${binPath}" \
+          --set PERL5LIB $PERL5LIB
+      done
+      popd
+    '';
+
+  passthru.updateScript = unstableGitUpdater {
+    url = "https://github.com/carnager/clerk.git";
+    hardcodeZeroVersion = true;
+  };
+
+  meta = {
+    homepage = "https://github.com/carnager/clerk";
+    description = "MPD client based on rofi/fzf";
+    license = lib.licenses.mit;
+    mainProgram = "clerk";
+    maintainers = with lib.maintainers; [
+      anderspapitto
+      rewine
+      AndersonTorres
+    ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/cs/csvtk/package.nix
+++ b/pkgs/by-name/cs/csvtk/package.nix
@ -1,10 +1,13 @@
 {
  lib,
+  stdenv,
  buildGoModule,
  fetchFromGitHub,
+  installShellFiles,
+  buildPackages,
 }:
 let
-  version = "0.30.0";
+  version = "0.31.0";
 in
 buildGoModule {
  pname = "csvtk";
@ -14,10 +17,27 @@ buildGoModule {
    owner = "shenwei356";
    repo = "csvtk";
    rev = "refs/tags/v${version}";
-    hash = "sha256-xq56dErO0vjG9bZ5aISIFWX4IOHaQksE9W1is2HiFuQ=";
+    hash = "sha256-RfW7SiRcsN0F/+2bixLMNsqJCOSD1BQwlm4Zm2kogXM=";
  };

-  vendorHash = "sha256-wJedDF7QIg8oWc/QX+rZDyq/nkAW+PMb8EYb0RGJxQM=";
+  vendorHash = "sha256-5RqAtnGioasbQxLltglCWitzb7mQgNYIE9IFkE0AOME=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall =
+    let
+      csvtkBin =
+        if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
+          "$out"
+        else
+          lib.getBin buildPackages.csvtk;
+    in
+    ''
+      for shell in bash zsh fish; do
+        ${csvtkBin}/bin/csvtk genautocomplete --shell $shell --file csvtk.$shell
+        installShellCompletion csvtk.$shell
+      done
+    '';

  meta = {
    description = "Cross-platform, efficient and practical CSV/TSV toolkit in Golang";
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@ -12,6 +12,7 @@
  glib,
  webkitgtk_4_0,
  glib-networking,
+  override_xmx ? "1024m",
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
@ -54,6 +55,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  dontConfigure = true;
  dontBuild = true;

+  prePatch = ''
+    substituteInPlace dbeaver.ini \
+      --replace-fail '-Xmx1024m' '-Xmx${override_xmx}'
+  '';
+
  installPhase =
    if !stdenvNoCC.hostPlatform.isDarwin then
      ''
--- a/pkgs/tools/networking/dq/default.nix
+++ b/pkgs/tools/networking/dq/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "dq";
-  version = "20240101";
+  version = "20241027";

  src = fetchFromGitHub {
    owner = "janmojzis";
    repo = "dq";
    rev = "refs/tags/${version}";
-    hash = "sha256-dN2QpQU2jRkSVzaYh2MKbJvx0J1XACHHjsM/ePvZAp8=";
+    hash = "sha256-aXNj2JsSCxp3+zTF2/7SAffrzwQH+3NCppxpnPCLT4o=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/by-name/en/ente-auth/package.nix
+++ b/pkgs/by-name/en/ente-auth/package.nix
@ -78,7 +78,7 @@ flutter324.buildFlutterApplication rec {
  ];

  postInstall = ''
-    FAV=$out/app/data/flutter_assets/assets/icons/auth-icon.png
+    FAV=$out/app/ente-auth/data/flutter_assets/assets/icons/auth-icon.png
    ICO=$out/share/icons

    install -D $FAV $ICO/ente-auth.png
--- a/pkgs/by-name/fa/factorio/package.nix
+++ b/pkgs/by-name/fa/factorio/package.nix
@ -70,6 +70,15 @@ let
      nix-prefetch-url file://\''$HOME/Downloads/factorio_\''${releaseType}_x64_\''${version}.tar.xz --name factorio_\''${releaseType}_x64-\''${version}.tar.xz

    Note the ultimate "_" is replaced with "-" in the --name arg!
+
+    If you go this route you might want to tell Nix to explicitly hold on to the
+    source tarball. Otherwise it could get GC'd from the Nix store and you'd
+    have to redownload it next time the package wants to rebuild to use a newer
+    dependency. E.g. if you're using NixOS:
+
+      system.extraDependencies = [
+        factorio.src
+      ];
  '';

  desktopItem = makeDesktopItem {
--- a/pkgs/by-name/fi/fittrackee/package.nix
+++ b/pkgs/by-name/fi/fittrackee/package.nix
@ -28,14 +28,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "fittrackee";
-  version = "0.8.9";
+  version = "0.8.10";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "SamR1";
    repo = "FitTrackee";
    rev = "refs/tags/v${version}";
-    hash = "sha256-raN6Ef/Z/JbdJDMKBIaBL8nmvFwvuZFX4rfC0ZgWgKI=";
+    hash = "sha256-K110H5Y8vQrRx2/O+2ezhpGp4G5sJUlzE+1cSYu7+4I=";
  };

  build-system = [
--- a/pkgs/by-name/gd/gdbuspp/package.nix
+++ b/pkgs/by-name/gd/gdbuspp/package.nix
@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  glib,
+  pkg-config,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gdbuspp";
+  version = "2";
+  src = fetchFromGitHub {
+    owner = "OpenVPN";
+    repo = "gdbuspp";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-A0sl4zZa17zMec/jJASE8lDVNohzJzEGZbWjjsorB2Y=";
+  };
+
+  postPatch = ''
+    patchShebangs --build ./scripts/get-git-ref
+  '';
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [ glib ];
+
+  meta = {
+    description = "GDBus++ - a glib2 D-Bus wrapper for C++";
+    longDescription = ''
+      This library provides a simpler C++ based interface to implement D-Bus
+      into applications in a more C++ approach, based on the C++17 standard.
+    '';
+    homepage = "https://codeberg.org/OpenVPN/gdbuspp";
+    changelog = "https://codeberg.org/OpenVPN/gdbuspp/releases/tag/v${version}";
+    license = lib.licenses.agpl3Only;
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+    maintainers = [ lib.maintainers.progrm_jarvis ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/mo/mongosh/package-lock.json
+++ b/pkgs/by-name/mo/mongosh/package-lock.json
--- a/pkgs/by-name/mo/mongosh/package.nix
+++ b/pkgs/by-name/mo/mongosh/package.nix
@ -34,11 +34,11 @@ buildNpmPackage {
    updateScript = ./update.sh;
  };

-  meta = with lib; {
+  meta = {
    homepage = "https://www.mongodb.com/try/download/shell";
    description = "MongoDB Shell";
-    maintainers = with maintainers; [ aaronjheng ];
-    license = licenses.asl20;
+    maintainers = with lib.maintainers; [ aaronjheng ];
+    license = lib.licenses.asl20;
    mainProgram = "mongosh";
  };
 }
--- a/pkgs/by-name/mo/mongosh/source.json
+++ b/pkgs/by-name/mo/mongosh/source.json
@ -1,6 +1,6 @@
 {
-  "version": "2.3.2",
-  "integrity": "sha512-KobngQr6A3kS7DJhXBc+sAnk3GujTI/WxVz+NfOVl0i/DDd6v+dI95xwhxggcu6wUtvj40AyTH20gvvvdkeGHg==",
-  "filename": "mongosh-2.3.2.tgz",
-  "deps": "sha256-t6HsvxXLutSjGfYTVX/15b+WCbT5+2NO2epW0aNttAI="
+  "version": "2.3.3",
+  "integrity": "sha512-nNVPMhaT/5HmTWGPuHfa3WWbu0lDQRyqoHP51YWZcBX4pgOWwGPXpQqEHLsKhEvzL8jdp8aemT/3/iyfvWUAhA==",
+  "filename": "mongosh-2.3.3.tgz",
+  "deps": "sha256-jL7Lf35AHZEUrsSVe4qMT60XzFr03NEBjWFWFkY3n/U="
 }
--- a/pkgs/by-name/mp/mpc/package.nix
+++ b/pkgs/by-name/mp/mpc/package.nix
@ -0,0 +1,54 @@
+{
+  lib,
+  fetchFromGitHub,
+  installShellFiles,
+  libiconv,
+  libmpdclient,
+  meson,
+  ninja,
+  pkg-config,
+  python3Packages,
+  stdenv,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mpc";
+  version = "0.35";
+
+  src = fetchFromGitHub {
+    owner = "MusicPlayerDaemon";
+    repo = "mpc";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-oVdnj3nsYvOHcIOgoamLamriuWu9lucWUQtxVmXZabs=";
+  };
+
+  buildInputs = [
+    libmpdclient
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
+
+  nativeBuildInputs = [
+    installShellFiles
+    meson
+    ninja
+    pkg-config
+    python3Packages.sphinx
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd mpc --bash $out/share/doc/mpc/contrib/mpc-completion.bash
+  '';
+
+  postFixup = ''
+    rm $out/share/doc/mpc/contrib/mpc-completion.bash
+  '';
+
+  meta = {
+    homepage = "https://www.musicpd.org/clients/mpc/";
+    description = "Minimalist command line interface to MPD";
+    changelog = "https://raw.githubusercontent.com/MusicPlayerDaemon/mpc/refs/heads/master/NEWS";
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "mpc";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/nc/ncspot/package.nix
+++ b/pkgs/by-name/nc/ncspot/package.nix
@ -35,16 +35,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ncspot";
-  version = "1.2.0";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "hrkfdn";
    repo = "ncspot";
    rev = "refs/tags/v${version}";
-    hash = "sha256-FI/MZRxTyYWh+CWq3roO6d48xlPsyL58+euGmCZ8p4Y=";
+    hash = "sha256-h3Mp67AKuzzeO6l7jN6yrQAHpYSsaOp1Y+qJoamK82U=";
  };

-  cargoHash = "sha256-Jg/P6aaMlgpunYd30eoBt1leL0vgEBn2wNRGZsP4abc=";
+  cargoHash = "sha256-uWnW4Ov5MoDh3xkmTsNSin9WI0SJAoDGa+n8IMNvo4Y=";

  nativeBuildInputs = [ pkg-config ] ++ lib.optional withClipboard python3;

@ -80,8 +80,8 @@ rustPlatform.buildRustPackage rec {
    ++ lib.optional withTermion "termion_backend";

  postInstall = ''
-    install -D --mode=444 $src/misc/ncspot.desktop $out/share/applications/nscpot.desktop
-    install -D --mode=444 $src/images/logo.svg $out/share/icons/hicolor/scalable/apps/nscpot.png
+    install -D --mode=444 $src/misc/ncspot.desktop $out/share/applications/ncspot.desktop
+    install -D --mode=444 $src/images/logo.svg $out/share/icons/hicolor/scalable/apps/ncspot.svg
  '';

  passthru = {
--- a/pkgs/by-name/op/openvpn3/0001-build-reduce-hardcode-in-asio_path.patch
+++ b/pkgs/by-name/op/openvpn3/0001-build-reduce-hardcode-in-asio_path.patch
@ -0,0 +1,46 @@
+From 30b2528054e6627a7124ac04cb018356ef23d864 Mon Sep 17 00:00:00 2001
+From: Petr Portnov <mrjarviscraft@gmail.com>
+Date: Mon, 2 Sep 2024 22:25:33 +0300
+Subject: [PATCH 1/1] build: reduce hardcode in `asio_path`
+
+Currently, `asio_path` variable value is concatenated with `/asio/include`
+to specify the path to custom `asio` installation.
+The problem is that this is too strict as some distros (namely NixOS)
+may have the `include` directory with a differently named parent.
+Thus this change minimizes the hardcoded part of the path to make it more flexible.
+
+Signed-off-by: Petr Portnov <mrjarviscraft@gmail.com>
+---
+ meson.build       | 2 +-
+ meson_options.txt | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index c9e0a2d..c01eb8e 100644
+--- a/meson.build
+++ b/meson.build
+@@ -74,7 +74,7 @@ endif
+ #
+ #  Setup additional include header dirs
+ #
+-asio_inc = get_option('asio_path') / 'asio' / 'include'
+asio_inc = get_option('asio_path') / 'include'
+ message ('ASIO library: ' + asio_inc)
+ 
+ openvpn3_core_inc = get_option('openvpn3_core_path')
+diff --git a/meson_options.txt b/meson_options.txt
+index d9cf02e..43e301e 100644
+--- a/meson_options.txt
+++ b/meson_options.txt
+@@ -26,7 +26,7 @@ option('debug_options', type: 'boolean', value: false,
+ #
+ #  Build environment and related build time options
+ #
+-option('asio_path', type: 'string', value: './vendor/asio',
+option('asio_path', type: 'string', value: './vendor/asio/asio',
+        description: 'Path to the ASIO header files')
+ 
+ option('openvpn3_core_path', type: 'string', value: './openvpn3-core',
+-- 
+2.43.0
+
--- a/pkgs/by-name/op/openvpn3/0002-build-allow-installation-directories-customization.patch
+++ b/pkgs/by-name/op/openvpn3/0002-build-allow-installation-directories-customization.patch
@ -0,0 +1,115 @@
+From 848cc46d05c203de393d75434a3f571d78687f50 Mon Sep 17 00:00:00 2001
+From: Petr Portnov <mrjarviscraft@gmail.com>
+Date: Sun, 22 Sep 2024 13:16:02 +0300
+Subject: [PATCH] build: allow installation directories' customization
+
+This allows to configure the installation directories
+for systemd and D-Bus files.
+
+Signed-off-by: Petr Portnov <mrjarviscraft@gmail.com>
+---
+ distro/systemd/meson.build |  9 +++++++--
+ meson.build                | 12 ++++++++++--
+ meson_options.txt          | 12 ++++++++++++
+ src/configmgr/meson.build  | 10 ++++++----
+ 4 files changed, 35 insertions(+), 8 deletions(-)
+
+diff --git a/distro/systemd/meson.build b/distro/systemd/meson.build
+index 36d556c..9c636b6 100644
+--- a/distro/systemd/meson.build
+++ b/distro/systemd/meson.build
+@@ -15,12 +15,17 @@ systemd_cfg = configuration_data({
+ 
+ systemd_service_cfg = dependency('systemd')
+ 
+systemd_system_unit_dir = get_option('systemd_system_unit_dir')
+if systemd_system_unit_dir == ''
+  systemd_system_unit_dir = systemd_service_cfg.get_variable('systemdsystemunitdir')
+endif
+
+ configure_file(
+     input: 'openvpn3-autoload.service.in',
+     output: 'openvpn3-autoload.service',
+     configuration: systemd_cfg,
+     install: true,
+-    install_dir: systemd_service_cfg.get_variable('systemdsystemunitdir'),
+    install_dir: systemd_system_unit_dir,
+ )
+ 
+ configure_file(
+@@ -28,7 +33,7 @@ configure_file(
+     output: 'openvpn3-session@.service',
+     configuration: systemd_cfg,
+     install: true,
+-    install_dir: systemd_service_cfg.get_variable('systemdsystemunitdir'),
+    install_dir: systemd_system_unit_dir,
+ )
+ 
+ custom_target('openvpn3-systemd',
+diff --git a/meson.build b/meson.build
+index 586c72a..ba41440 100644
+--- a/meson.build
+++ b/meson.build
+@@ -203,8 +203,16 @@ message('OpenVPN 3 Linux service binary directory: ' + get_option('prefix') / li
+ 
+ #
+ #  D-Bus configuration
+-dbus_policy_dir = dep_dbus.get_variable('datadir') / 'dbus-1' / 'system.d'
+-dbus_service_dir = dep_dbus.get_variable('system_bus_services_dir')
+dbus_policy_dir = get_option('dbus_policy_dir')
+if dbus_policy_dir == ''
+    dbus_policy_dir = dep_dbus.get_variable('datadir') / 'dbus-1' / 'system.d'
+endif
+
+dbus_service_dir = get_option('dbus_system_service_dir')
+if dbus_service_dir == ''
+    dbus_service_dir = dep_dbus.get_variable('system_bus_services_dir')
+endif
+
+ dbus_config = {
+     'OPENVPN_USERNAME': get_option('openvpn_username'),
+     'LIBEXEC_PATH': get_option('prefix') / libexec_dir,
+diff --git a/meson_options.txt b/meson_options.txt
+index 43e301e..04809df 100644
+--- a/meson_options.txt
+++ b/meson_options.txt
+@@ -93,6 +93,18 @@ option('use-legacy-polkit-pkla', type: 'feature', value: 'disabled',
+ option('polkit_pkla_rulesdir', type: 'string', value: '',
+        description: 'Override PolicyKit PKLA rules directory')
+ 
+#
+# Installation
+#
+option('dbus_policy_dir', type: 'string',
+       description: 'D-Bus policy directory')
+option('dbus_system_service_dir', type: 'string',
+       description: 'D-Bus system service directory')
+option('systemd_system_unit_dir', type: 'string',
+       description: 'Path to systemd system unit directory')
+option('create_statedir', type: 'feature', value: 'enabled',
+       description: 'Create directory for OpenVPN 3 state during install phase')
+
+ #
+ #  Testing tools
+ #
+diff --git a/src/configmgr/meson.build b/src/configmgr/meson.build
+index 5d0a649..6f788b7 100644
+--- a/src/configmgr/meson.build
+++ b/src/configmgr/meson.build
+@@ -52,7 +52,9 @@ configure_file(
+     install_dir: dbus_service_dir,
+ )
+ 
+-# Create the configs directory for persistent configuration profiles
+-# NOTE: Can be replaced with install_emptydir() when Meson 0.60 or newer
+-#       is available on all supported distros
+-meson.add_install_script('sh','-c', 'mkdir -p $DESTDIR@0@'.format(openvpn3_statedir / 'configs'))
+if get_option('create_statedir').enabled()
+    # Create the configs directory for persistent configuration profiles
+    # NOTE: Can be replaced with install_emptydir() when Meson 0.60 or newer
+    #       is available on all supported distros
+    meson.add_install_script('sh','-c', 'mkdir -p $DESTDIR@0@'.format(openvpn3_statedir / 'configs'))
+endif
+-- 
+2.45.2
+
--- a/pkgs/by-name/op/openvpn3/package.nix
+++ b/pkgs/by-name/op/openvpn3/package.nix
@ -0,0 +1,135 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  asio,
+  glib,
+  jsoncpp,
+  libcap_ng,
+  libnl,
+  libuuid,
+  lz4,
+  openssl,
+  pkg-config,
+  protobuf,
+  python3,
+  systemd,
+  tinyxml-2,
+  wrapGAppsHook3,
+  gobject-introspection,
+  meson,
+  ninja,
+  gdbuspp,
+  cmake,
+  git,
+  enableSystemdResolved ? true,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "openvpn3";
+  # also update openvpn3-core
+  version = "23";
+
+  src = fetchFromGitHub {
+    owner = "OpenVPN";
+    repo = "openvpn3-linux";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-5gkutqyUPZDwRPzSFdUXg2G5mtQKbdhZu8xnNAdXoF0=";
+    # `openvpn3-core` is a submodule.
+    # TODO: make it into a separate package
+    fetchSubmodules = true;
+  };
+
+  patches = [
+    # Merged in upstream, will land in v24
+    # https://github.com/OpenVPN/openvpn3-linux/commit/75abb7dc9366ba85fb1a144d88f02a1e8a62f538
+    ./0001-build-reduce-hardcode-in-asio_path.patch
+    ./0002-build-allow-installation-directories-customization.patch
+  ];
+
+  postPatch = ''
+    echo '#define OPENVPN_VERSION "3.git:unknown:unknown"
+    #define PACKAGE_GUIVERSION "v${builtins.replaceStrings [ "_" ] [ ":" ] version}"
+    #define PACKAGE_NAME "openvpn3-linux"
+    ' > ./src/build-version.h
+
+    patchShebangs \
+      ./scripts \
+      ./src/python/{openvpn2,openvpn3-as,openvpn3-autoload} \
+      ./distro/systemd/openvpn3-systemd \
+      ./src/tests/dbus/netcfg-subscription-test \
+      ./src/shell/bash-completion/gen-openvpn2-completion.py
+  '';
+
+  pythonPath = python3.withPackages (ps: [
+    ps.dbus-python
+    ps.pygobject3
+    ps.systemd
+  ]);
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    cmake
+    git
+
+    python3.pkgs.wrapPython
+    python3.pkgs.docutils
+    python3.pkgs.jinja2
+    python3.pkgs.dbus-python
+    wrapGAppsHook3
+    gobject-introspection
+  ];
+
+  buildInputs = [
+    asio
+    glib
+    jsoncpp
+    libcap_ng
+    libnl
+    libuuid
+    lz4
+    openssl
+    protobuf
+    tinyxml-2
+    gdbuspp
+  ] ++ lib.optionals enableSystemdResolved [ systemd.dev ];
+
+  mesonFlags = [
+    (lib.mesonOption "selinux" "disabled")
+    (lib.mesonOption "selinux_policy" "disabled")
+    (lib.mesonOption "bash-completion" "enabled")
+    (lib.mesonOption "test_programs" "disabled")
+    (lib.mesonOption "unit_tests" "disabled")
+    (lib.mesonOption "asio_path" "${asio}")
+    (lib.mesonOption "dbus_policy_dir" "${placeholder "out"}/share/dbus-1/system.d")
+    (lib.mesonOption "dbus_system_service_dir" "${placeholder "out"}/share/dbus-1/system-services")
+    (lib.mesonOption "systemd_system_unit_dir" "${placeholder "out"}/lib/systemd/system")
+    (lib.mesonOption "create_statedir" "disabled")
+    (lib.mesonOption "sharedstatedir" "/etc")
+  ];
+
+  dontWrapGApps = true;
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+  postFixup = ''
+    wrapPythonPrograms
+    wrapPythonProgramsIn "$out/libexec/openvpn3-linux" "$out ${pythonPath}"
+  '';
+
+  NIX_LDFLAGS = "-lpthread";
+
+  meta = {
+    description = "OpenVPN 3 Linux client";
+    license = lib.licenses.agpl3Plus;
+    homepage = "https://github.com/OpenVPN/openvpn3-linux/";
+    changelog = "https://github.com/OpenVPN/openvpn3-linux/releases/tag/v${version}";
+    maintainers = with lib.maintainers; [
+      shamilton
+      progrm_jarvis
+    ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/pi/picom-pijulius/package.nix
+++ b/pkgs/by-name/pi/picom-pijulius/package.nix
@ -9,13 +9,13 @@
 }:
 picom.overrideAttrs (previousAttrs: {
  pname = "picom-pijulius";
-  version = "8.2-unstable-2024-10-05";
+  version = "8.2-unstable-2024-10-30";

  src = fetchFromGitHub {
    owner = "pijulius";
    repo = "picom";
-    rev = "9977760e5ace3b17453e3cd89d14bc0f8de5b5f9";
-    hash = "sha256-lqmZqEmD/+qZg+8UOOGJB6L0FdUuZFN5qBdL593RC/A=";
+    rev = "bdbcae085c1ba6c2ec6f21712ed140daaa630d89";
+    hash = "sha256-3S8p4vXfryL3IfWPpjhp1GxqJelHRw5aFI3a+ysRKTU=";
  };

  buildInputs = (previousAttrs.buildInputs or [ ]) ++ [ pcre ];
--- a/pkgs/by-name/pr/proton-ge-bin/package.nix
+++ b/pkgs/by-name/pr/proton-ge-bin/package.nix
@ -6,11 +6,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "proton-ge-bin";
-  version = "GE-Proton9-16";
+  version = "GE-Proton9-18";

  src = fetchzip {
    url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-n/pU5bAr78Hawo8BMk7VW8uK0FjVsBJGMf78zRMGFPQ=";
+    hash = "sha256-NoRNM61Y9q8ksOXPeDV/NaIqHblWjXtK3tXcX5UEwkI=";
  };

  outputs = [
--- a/pkgs/by-name/pr/proxmox-auto-install-assistant/Cargo.lock
+++ b/pkgs/by-name/pr/proxmox-auto-install-assistant/Cargo.lock
--- a/pkgs/by-name/pr/proxmox-auto-install-assistant/package.nix
+++ b/pkgs/by-name/pr/proxmox-auto-install-assistant/package.nix
@ -0,0 +1,47 @@
+{
+  lib,
+  fetchgit,
+  rustPlatform,
+  testers,
+  proxmox-auto-install-assistant,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "proxmox-auto-install-assistant";
+  version = "8.2.6";
+
+  src = fetchgit {
+    url = "git://git.proxmox.com/git/pve-installer.git";
+    rev = "c339618cbdcbce378bf192e01393a60903fe2b04";
+    hash = "sha256-nF2FpzXeoPIB+dW92HAI+EJZuMJxlnD012Yu3hL9OvU=";
+  };
+
+  postPatch = ''
+    rm -v .cargo/config.toml
+    cp -v ${./Cargo.lock} Cargo.lock
+    # fix up hard-coded version number to match that of the debian package
+    substituteInPlace proxmox-auto-install-assistant/Cargo.toml \
+      --replace-fail 'version = "0.1.0"' 'version = "${version}"'
+  '';
+
+  buildAndTestSubdir = "proxmox-auto-install-assistant";
+
+  cargoLock.lockFile = ./Cargo.lock;
+
+  passthru.tests.version = testers.testVersion { package = proxmox-auto-install-assistant; };
+
+  meta = {
+    description = "Tool to prepare a Proxmox installation ISO for automated installations";
+    longDescription = ''
+      This tool can be used to prepare a Proxmox installation ISO for automated installations.
+      Additional uses are to validate the format of an answer file or to test match filters and
+      print information on the properties to match against for the current hardware
+    '';
+    homepage = "https://pve.proxmox.com/wiki/Automated_Installation";
+    changelog = "https://git.proxmox.com/?p=pve-installer.git;a=blob;f=debian/changelog";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ christoph-heiss ];
+    platforms = lib.platforms.linux;
+    mainProgram = "proxmox-auto-install-assistant";
+  };
+}
--- a/pkgs/os-specific/darwin/raycast/default.nix
+++ b/pkgs/os-specific/darwin/raycast/default.nix
@ -11,12 +11,12 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "raycast";
-  version = "1.84.2";
+  version = "1.84.8";

  src = fetchurl {
    name = "Raycast.dmg";
    url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-9bONKZyOEPj6eGQKx6IyZSf7ZZhwL985AzN/imNsoys=";
+    hash = "sha256-MSxscz2c5eNfdlWxn8sEVtqg2iXlPnIfJHnaiMvwtgY=";
  };

  dontPatch = true;
--- a/pkgs/by-name/sk/skhd/package.nix
+++ b/pkgs/by-name/sk/skhd/package.nix
@ -1,18 +1,13 @@
 {
  lib,
-  overrideSDK,
  stdenv,
-  darwin,
  fetchFromGitHub,
-  testers,
+  apple-sdk_11,
+  darwinMinVersionHook,
  nix-update-script,
+  versionCheckHook,
 }:
-let
-  inherit (darwin.apple_sdk_11_0.frameworks) Carbon Cocoa;
-
-  stdenv' = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-in
-stdenv'.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "skhd";
  version = "0.3.9";

@ -24,8 +19,8 @@ stdenv'.mkDerivation (finalAttrs: {
  };

  buildInputs = [
-    Carbon
-    Cocoa
+    apple-sdk_11
+    (darwinMinVersionHook "10.13")
  ];

  makeFlags = [ "BUILD_PATH=$(out)/bin" ];
@ -38,14 +33,11 @@ stdenv'.mkDerivation (finalAttrs: {
    substituteInPlace $out/Library/LaunchDaemons/org.nixos.skhd.plist --subst-var out
  '';

-  passthru = {
-    tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-      version = "skhd-v${finalAttrs.version}";
-    };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;

-    updateScript = nix-update-script { };
-  };
+  passthru.updateScript = nix-update-script { };

  meta = {
    description = "Simple hotkey daemon for macOS";
--- a/pkgs/by-name/te/telegram-bot-api/package.nix
+++ b/pkgs/by-name/te/telegram-bot-api/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation {
  pname = "telegram-bot-api";
-  version = "7.10";
+  version = "7.11";

  src = fetchFromGitHub {
    repo = "telegram-bot-api";
    owner = "tdlib";
-    rev = "a186a9ae823d91678ace87ef5b920688c555f5b5";
-    hash = "sha256-1oGDR9WLWC/0QyAmTkMWkbkD+49/gU/nWBZq0mMOl8g=";
+    rev = "6d1b62b51bdc543c10f854aae751e160e5b7b9c5";
+    hash = "sha256-FLHAv9CQ90Jd2DnzQSRl5wHW6hnWUCz0Ap65Vjkgj0s=";
    fetchSubmodules = true;
  };

@ -36,6 +36,7 @@ stdenv.mkDerivation {
    maintainers = with lib.maintainers; [
      Anillc
      Forden
+      nartsiss
    ];
    platforms = lib.platforms.all;
    mainProgram = "telegram-bot-api";
--- a/pkgs/by-name/to/tomlplusplus/package.nix
+++ b/pkgs/by-name/to/tomlplusplus/package.nix
@ -44,12 +44,15 @@ stdenv.mkDerivation (finalAttrs: {
    glibcLocales
  ];

-  doCheck = true;
  mesonFlags = [
    "-Dbuild_tests=${lib.boolToString finalAttrs.doCheck}"
    "-Dbuild_examples=true"
  ];

+  # almost all tests fail on Darwin with the following exception:
+  # libc++abi: terminating due to uncaught exception of type std::runtime_error: collate_byname<char>::collate_byname failed to construct for
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
  passthru = {
    updateScript = nix-update-script { };
    tests.pkg-config = testers.hasPkgConfigModules {
--- a/pkgs/by-name/vk/vkd3d/package.nix
+++ b/pkgs/by-name/vk/vkd3d/package.nix
@ -14,14 +14,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "vkd3d";
-  version = "1.12";
+  version = "1.13";

  src = fetchFromGitLab {
    domain = "gitlab.winehq.org";
    owner = "wine";
    repo = "vkd3d";
    rev = "vkd3d-${finalAttrs.version}";
-    hash = "sha256-9FNuWtfJJqkSZ3O11G22aNp8PfseLHH4oyL6MulNwMY=";
+    hash = "sha256-5G+cdK3rJWlEbJN7uPspPyTtjVk4v/sTg134tZo1CTI=";
  };

  outputs = [ "out" "dev" "lib" ];
--- a/pkgs/by-name/wa/watchdog/package.nix
+++ b/pkgs/by-name/wa/watchdog/package.nix
@ -0,0 +1,25 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  version = "5.16";
+  pname = "watchdog";
+  src = fetchzip {
+    url = "mirror://sourceforge/watchdog/watchdog-${finalAttrs.version}.tar.gz";
+    hash = "sha256-ecXsnPvAhlRB8jiTgK+i1j6m/0idNqmzjSqi6UGCydE=";
+  };
+  makeFlags = [
+    "CONFIG_FILENAME:=${placeholder "out"}/etc/watchdog.conf"
+  ];
+
+  meta = {
+    description = "Software watchdog for Linux";
+    homepage = "https://sourceforge.net/projects/watchdog/";
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ n8henrie ];
+    mainProgram = "watchdog";
+  };
+})
--- a/pkgs/by-name/ya/yaffshiv/package.nix
+++ b/pkgs/by-name/ya/yaffshiv/package.nix
@ -0,0 +1,32 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  python3,
+}:
+
+stdenv.mkDerivation {
+  pname = "yaffshiv";
+  version = "0-unstable-2024-08-30";
+
+  src = fetchFromGitHub {
+    owner = "devttys0";
+    repo = "yaffshiv";
+    rev = "f6f0ef77bf79ca46aaa77bc34eda06e7b55da8e8";
+    sha256 = "sha256-C43UzkaPKheexvVcKi/Krcik+arPXggWAYMSi9RY5eo=";
+  };
+
+  buildInputs = [ python3 ];
+
+  installPhase = ''
+    install -D -m755 src/yaffshiv $out/bin/yaffshiv
+  '';
+
+  meta = {
+    description = "Simple YAFFS file system parser and extractor";
+    homepage = "https://github.com/devttys0/yaffshiv";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sgo ];
+    mainProgram = "yaffshiv";
+  };
+}
--- a/pkgs/by-name/za/zapret/package.nix
+++ b/pkgs/by-name/za/zapret/package.nix
@ -13,40 +13,40 @@
  gawk
 }:

-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "zapret";
-  version = "0-unstable-2024-08-01";
+  version = "67";

  src = fetchFromGitHub {
    owner = "bol-van";
    repo = "zapret";
-    rev = "9cf72b7c68f6a7c80dfddc6c1cf6d6db32718376";
-    hash = "sha256-8cqKCNYLLkZXlwrybKUPG6fLd7gmf8zV9tjWoTxAwIY=";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-4TgM0NkvVvdSEJ01SULu+GqpfqokTTErHAt3QkxkLIs=";
  };

  buildInputs = [ libcap zlib libnetfilter_queue libnfnetlink ];
  nativeBuildInputs = [ iptables nftables gawk ];

-  buildPhase = ''
-    mkdir -p $out/bin
-
-    make TGT=$out/bin
-  '';
+  makeFlags = [ "TGT=${placeholder "out"}/bin" ];

  installPhase = ''
+    runHook preInstall
+
    mkdir -p $out/usr/share/zapret/init.d/sysv
    mkdir -p $out/usr/share/docs

    cp $src/blockcheck.sh $out/bin/blockcheck

    substituteInPlace $out/bin/blockcheck \
-      --replace "ZAPRET_BASE=\"\$EXEDIR\"" "ZAPRET_BASE=$out/usr/share/zapret"
+      --replace-fail '$(cd "$EXEDIR"; pwd)' "$out/usr/share/zapret"
+
+    ln -s ../../../bin/blockcheck $out/usr/share/zapret/blockcheck

    cp $src/init.d/sysv/functions $out/usr/share/zapret/init.d/sysv/functions
    cp $src/init.d/sysv/zapret $out/usr/share/zapret/init.d/sysv/init.d

    substituteInPlace $out/usr/share/zapret/init.d/sysv/functions \
-      --replace "ZAPRET_BASE=\$(readlink -f \"\$EXEDIR/../..\")" "ZAPRET_BASE=$out/usr/share/zapret"
+      --replace-fail "/opt/zapret" "\"$out/usr/share/zapret\""

    touch $out/usr/share/zapret/config

@ -57,6 +57,8 @@ stdenv.mkDerivation {
    cp $src/common/* $out/usr/share/zapret/common
    cp $src/ipset/* $out/usr/share/zapret/ipset

+    rm -f $out/usr/share/zapret/ipset/zapret-hosts-user-exclude.txt.default
+
    mkdir -p $out/usr/share/zapret/nfq
    ln -s ../../../../bin/nfqws $out/usr/share/zapret/nfq/nfqws

@ -67,16 +69,18 @@ stdenv.mkDerivation {
    done

    ln -s ../usr/share/zapret/init.d/sysv/init.d $out/bin/zapret
+
+    runHook postInstall
  '';

-  meta = with lib; {
+  meta = {
    description = "DPI bypass multi platform";
    homepage = "https://github.com/bol-van/zapret";
-    license = licenses.mit;
-    maintainers = with maintainers; [ nishimara ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ nishimara ];
    mainProgram = "zapret";

    # probably gonna work on darwin, but untested
    broken = stdenv.hostPlatform.isDarwin;
  };
-}
+})
--- a/pkgs/by-name/ze/zed-editor/Cargo.lock
+++ b/pkgs/by-name/ze/zed-editor/Cargo.lock
@ -854,7 +854,7 @@ dependencies = [
 "chrono",
 "futures-util",
 "http-types",
- "hyper 0.14.30",
+ "hyper 0.14.31",
 "hyper-rustls 0.24.2",
 "serde",
 "serde_json",
@ -1350,7 +1350,7 @@ dependencies = [
 "http-body 0.4.6",
 "http-body 1.0.1",
 "httparse",
- "hyper 0.14.30",
+ "hyper 0.14.31",
 "hyper-rustls 0.24.2",
 "once_cell",
 "pin-project-lite",
@ -1441,7 +1441,7 @@ dependencies = [
 "headers",
 "http 0.2.12",
 "http-body 0.4.6",
- "hyper 0.14.30",
+ "hyper 0.14.31",
 "itoa",
 "matchit",
 "memchr",
@ -1587,7 +1587,7 @@ dependencies = [
 "bitflags 2.6.0",
 "cexpr",
 "clang-sys",
- "itertools 0.10.5",
+ "itertools 0.12.1",
 "lazy_static",
 "lazycell",
 "proc-macro2",
@ -2366,7 +2366,7 @@ dependencies = [
 "clickhouse-derive",
 "clickhouse-rs-cityhash-sys",
 "futures 0.3.30",
- "hyper 0.14.30",
+ "hyper 0.14.31",
 "hyper-tls",
 "lz4",
 "sealed",
@ -2569,7 +2569,7 @@ dependencies = [
 "gpui",
 "hex",
 "http_client",
- "hyper 0.14.30",
+ "hyper 0.14.31",
 "indoc",
 "jsonwebtoken",
 "language",
@ -5568,9 +5568,9 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"

 [[package]]
 name = "hyper"
-version = "0.14.30"
+version = "0.14.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a152ddd61dfaec7273fe8419ab357f33aee0d914c5f4efbf0d96fa749eea5ec9"
+checksum = "8c08302e8fa335b151b788c775ff56e7a03ae64ff85c548ee820fecb70356e85"
 dependencies = [
 "bytes 1.7.2",
 "futures-channel",
@ -5583,7 +5583,7 @@ dependencies = [
 "httpdate",
 "itoa",
 "pin-project-lite",
- "socket2 0.4.10",
+ "socket2 0.5.7",
 "tokio",
 "tower-service",
 "tracing",
@ -5618,7 +5618,7 @@ checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
 dependencies = [
 "futures-util",
 "http 0.2.12",
- "hyper 0.14.30",
+ "hyper 0.14.31",
 "log",
 "rustls 0.21.12",
 "rustls-native-certs 0.6.3",
@ -5651,7 +5651,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
 dependencies = [
 "bytes 1.7.2",
- "hyper 0.14.30",
+ "hyper 0.14.31",
 "native-tls",
 "tokio",
 "tokio-native-tls",
@ -6473,7 +6473,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4979f22fdb869068da03c9f7528f8297c6fd2606bc3a4affe42e6a823fdb8da4"
 dependencies = [
 "cfg-if",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.6",
 ]

 [[package]]
@ -9502,6 +9502,7 @@ dependencies = [
 "fs",
 "futures 0.3.30",
 "gpui",
+ "itertools 0.13.0",
 "log",
 "parking_lot",
 "prost",
@ -9626,7 +9627,7 @@ dependencies = [
 "h2 0.3.26",
 "http 0.2.12",
 "http-body 0.4.6",
- "hyper 0.14.30",
+ "hyper 0.14.31",
 "hyper-tls",
 "ipnet",
 "js-sys",
@ -9930,9 +9931,9 @@ dependencies = [

 [[package]]
 name = "runtimelib"
-version = "0.15.0"
+version = "0.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7d76d28b882a7b889ebb04e79bc2b160b3061821ea596ff0f4a838fc7a76db0"
+checksum = "43075bcdb843dc90af086586895247681fb79ed9dc24c62e5455995a807d3d85"
 dependencies = [
 "anyhow",
 "async-dispatcher",
@ -13416,7 +13417,7 @@ dependencies = [
 "futures-util",
 "headers",
 "http 0.2.12",
- "hyper 0.14.30",
+ "hyper 0.14.31",
 "log",
 "mime",
 "mime_guess",
@ -14129,7 +14130,7 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@ -14996,7 +14997,7 @@ dependencies = [

 [[package]]
 name = "zed"
-version = "0.159.6"
+version = "0.159.7"
 dependencies = [
 "activity_indicator",
 "anyhow",
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@ -88,13 +88,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "zed-editor";
-  version = "0.159.6";
+  version = "0.159.7";

  src = fetchFromGitHub {
    owner = "zed-industries";
    repo = "zed";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Jr4s22UXd4jtpXRyWSkCVRUhYZXgISDmq+RYr2i7qGs=";
+    hash = "sha256-gqovQkg3Zypi5YV/wIzTFfJQt5Zwb8IF+drQKvRCgEM=";
  };

  patches =
--- a/pkgs/development/coq-modules/iris/default.nix
+++ b/pkgs/development/coq-modules/iris/default.nix
@ -6,6 +6,7 @@ mkCoqDerivation rec {
  owner = "iris";
  inherit version;
  defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "8.19" "8.20"; out = "4.3.0"; }
    { case = range "8.18" "8.19"; out = "4.2.0"; }
    { case = range "8.16" "8.18"; out = "4.1.0"; }
    { case = range "8.13" "8.17"; out = "4.0.0"; }
@ -13,6 +14,7 @@ mkCoqDerivation rec {
    { case = range "8.11" "8.13"; out = "3.4.0"; }
    { case = range "8.9"  "8.10"; out = "3.3.0"; }
  ] null;
+  release."4.3.0".sha256 = "sha256-3qhjiFI+A3I3fD8rFfJL5Hek77wScfn/FNNbDyGqA1k=";
  release."4.2.0".sha256 = "sha256-HuiHIe+5letgr1NN1biZZFq0qlWUbFmoVI7Q91+UIfM=";
  release."4.1.0".sha256 = "sha256-nTZUeZOXiH7HsfGbMKDE7vGrNVCkbMaWxdMWUcTUNlo=";
  release."4.0.0".sha256 = "sha256-Jc9TmgGvkiDaz9IOoExyeryU1E+Q37GN24NIM397/Gg=";
--- a/pkgs/development/coq-modules/stdpp/default.nix
+++ b/pkgs/development/coq-modules/stdpp/default.nix
@ -6,6 +6,7 @@ mkCoqDerivation rec {
  domain = "gitlab.mpi-sws.org";
  owner = "iris";
  defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "8.19" "8.20"; out = "1.11.0"; }
    { case = range "8.18" "8.19"; out = "1.10.0"; }
    { case = range "8.16" "8.18"; out = "1.9.0"; }
    { case = range "8.13" "8.17"; out = "1.8.0"; }
@ -13,6 +14,7 @@ mkCoqDerivation rec {
    { case = range "8.11" "8.13"; out = "1.5.0"; }
    { case = range "8.8" "8.10";  out = "1.4.0"; }
  ] null;
+  release."1.11.0".sha256 = "sha256-yqnkaA5gUdZBJZ3JnvPYh11vKQRl0BAnior1yGowG7k=";
  release."1.10.0".sha256 = "sha256-bfynevIKxAltvt76lsqVxBmifFkzEhyX8lRgTKxr21I=";
  release."1.9.0".sha256 = "sha256-OXeB+XhdyzWMp5Karsz8obp0rTeMKrtG7fu/tmc9aeI=";
  release."1.8.0".sha256 = "sha256-VkIGBPHevHeHCo/Q759Q7y9WyhSF/4SMht4cOPuAXHU=";
--- a/pkgs/development/haskell-modules/generic-builder.nix
+++ b/pkgs/development/haskell-modules/generic-builder.nix
@ -34,6 +34,8 @@ in
 , version, revision ? null
 , sha256 ? null
 , src ? fetchurl { url = "mirror://hackage/${pname}-${version}.tar.gz"; inherit sha256; }
+, sourceRoot ? null
+, setSourceRoot ? null
 , buildDepends ? [], setupHaskellDepends ? [], libraryHaskellDepends ? [], executableHaskellDepends ? []
 , buildTarget ? ""
 , buildTools ? [], libraryToolDepends ? [], executableToolDepends ? [], testToolDepends ? [], benchmarkToolDepends ? []
@ -825,6 +827,8 @@ stdenv.mkDerivation ({
         ;

 }
+// optionalAttrs (args ? sourceRoot)             { inherit sourceRoot; }
+// optionalAttrs (args ? setSourceRoot)          { inherit setSourceRoot; }
 // optionalAttrs (args ? preCompileBuildDriver)  { inherit preCompileBuildDriver; }
 // optionalAttrs (args ? postCompileBuildDriver) { inherit postCompileBuildDriver; }
 // optionalAttrs (args ? preUnpack)              { inherit preUnpack; }
--- a/pkgs/development/libraries/hivex/default.nix
+++ b/pkgs/development/libraries/hivex/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  pname = "hivex";
-  version = "1.3.23";
+  version = "1.3.24";

  src = fetchurl {
    url = "https://libguestfs.org/download/hivex/${pname}-${version}.tar.gz";
-    hash = "sha256-QM9UhPFclGciWfs7makL7285DmPzelKhwGgIogFqa70=";
+    hash = "sha256-pS+kXOzJp4rbLShgXWgmHk8f1FFKd4pUcwE9LMyKGTw=";
  };

  patches = [ ./hivex-syms.patch ];
--- a/pkgs/development/libraries/xml-security-c/default.nix
+++ b/pkgs/development/libraries/xml-security-c/default.nix
@ -15,12 +15,12 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "xml-security-c";
-  version = "2.0.4";
+  version = "3.0.0";

  src = fetchgit {
    url = "https://git.shibboleth.net/git/cpp-xml-security";
    rev = finalAttrs.version;
-    hash = "sha256-60A6LqUUGmoZMmIvhuZWjrZl6utp7WLhPe738oNd/AA=";
+    hash = "sha256-D60JtD4p9ERh6sowvwBHtE9XWVm3D8saooagDvA6ZtQ=";
  };

  configureFlags = [
--- a/pkgs/development/ocaml-modules/eliom/default.nix
+++ b/pkgs/development/ocaml-modules/eliom/default.nix
@ -17,13 +17,13 @@

 buildDunePackage rec {
  pname = "eliom";
-  version = "11.0.0";
+  version = "11.0.1";

  src = fetchFromGitHub {
    owner = "ocsigen";
    repo = "eliom";
    rev = version;
-    hash = "sha256-RgIK3xkKdX+zOurhML4370rsO4blJrWoEla09Nfe9Mw=";
+    hash = "sha256-SUzfJ1R/J0jKaMC0wmXB+sNfG1VfFaFbDJql1OPdRpg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/ocaml-modules/ocf/default.nix
+++ b/pkgs/development/ocaml-modules/ocf/default.nix
@ -2,7 +2,7 @@

 buildDunePackage rec {
  pname = "ocf";
-  version = "0.8.0";
+  version = "0.9.0";
  duneVersion = "3";
  minimalOCamlVersion = "4.03";
  src = fetchFromGitLab {
@ -10,7 +10,7 @@ buildDunePackage rec {
    owner = "zoggy";
    repo = "ocf";
    rev = version;
-    sha256 = "sha256:00ap3q5yjqmpk87lxqv1j2wkc7583ynhjr1jjrfn9r0j2h9pfd60";
+    sha256 = "sha256-tTNpvncLO/WfcMbjqRfqzcdPv2Bd877fOU5AZlkkcXA=";
  };

  propagatedBuildInputs = [ yojson ];
--- a/pkgs/development/python-modules/annexremote/default.nix
+++ b/pkgs/development/python-modules/annexremote/default.nix
@ -3,7 +3,6 @@
  buildPythonPackage,
  fetchFromGitHub,
  pytestCheckHook,
-  pythonOlder,
  setuptools,
  setuptools-scm,
 }:
@ -13,8 +12,6 @@ buildPythonPackage rec {
  version = "1.6.6";
  pyproject = true;

-  disabled = pythonOlder "3.7";
-
  src = fetchFromGitHub {
    owner = "Lykos153";
    repo = "AnnexRemote";
@ -22,7 +19,7 @@ buildPythonPackage rec {
    hash = "sha256-RShDcqAjG+ujGzWu5S9za24WSsIWctqi3nWQ8EU4DTo=";
  };

-  nativeBuildInputs = [
+  build-system = [
    setuptools
    setuptools-scm
  ];
--- a/pkgs/development/python-modules/ax-platform/default.nix
+++ b/pkgs/development/python-modules/ax-platform/default.nix
@ -1,21 +1,24 @@
 {
  lib,
+  botorch,
  buildPythonPackage,
  fetchFromGitHub,
-  botorch,
+  hypothesis,
  ipywidgets,
  jinja2,
+  jupyter,
+  mercurial,
  pandas,
  plotly,
-  setuptools,
-  setuptools-scm,
-  typeguard,
-  hypothesis,
-  mercurial,
  pyfakefs,
-  pytestCheckHook,
-  yappi,
  pyre-extensions,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools-scm,
+  setuptools,
+  sqlalchemy,
+  typeguard,
+  yappi,
 }:

 buildPythonPackage rec {
@ -23,6 +26,8 @@ buildPythonPackage rec {
  version = "0.4.3";
  pyproject = true;

+  disabled = pythonOlder "3.10";
+
  src = fetchFromGitHub {
    owner = "facebook";
    repo = "ax";
@ -30,6 +35,8 @@ buildPythonPackage rec {
    hash = "sha256-jmBjrtxqg4Iu3Qr0HRqjVfwURXzbJaGm+DBFNHYk/vA=";
  };

+  env.ALLOW_BOTORCH_LATEST = "1";
+
  build-system = [
    setuptools
    setuptools-scm
@ -45,7 +52,10 @@ buildPythonPackage rec {
    pyre-extensions
  ];

-  env.ALLOW_BOTORCH_LATEST = "1";
+  optional-dependencies = {
+    mysql = [ sqlalchemy ];
+    notebook = [ jupyter ];
+  };

  nativeCheckInputs = [
    hypothesis
@ -53,21 +63,23 @@ buildPythonPackage rec {
    pyfakefs
    pytestCheckHook
    yappi
-  ];
-  pytestFlagsArray = [
-    "--ignore=ax/benchmark"
-    "--ignore=ax/runners/tests/test_torchx.py"
+  ] ++ lib.flatten (builtins.attrValues optional-dependencies);
+
+  disabledTestPaths = [
+    "ax/benchmark"
+    "ax/runners/tests/test_torchx.py"
    # requires pyre_extensions
-    "--ignore=ax/telemetry/tests"
-    "--ignore=ax/core/tests/test_utils.py"
-    "--ignore=ax/early_stopping/tests/test_strategies.py"
+    "ax/telemetry/tests"
+    "ax/core/tests/test_utils.py"
+    "ax/early_stopping/tests/test_strategies.py"
    # broken with sqlalchemy 2
-    "--ignore=ax/core/tests/test_experiment.py"
-    "--ignore=ax/service/tests/test_ax_client.py"
-    "--ignore=ax/service/tests/test_scheduler.py"
-    "--ignore=ax/service/tests/test_with_db_settings_base.py"
-    "--ignore=ax/storage"
+    "ax/core/tests/test_experiment.py"
+    "ax/service/tests/test_ax_client.py"
+    "ax/service/tests/test_scheduler.py"
+    "ax/service/tests/test_with_db_settings_base.py"
+    "ax/storage"
  ];
+
  disabledTests = [
    # exact comparison of floating points
    "test_optimize_l0_homotopy"
@ -78,12 +90,13 @@ buildPythonPackage rec {
    # uses torch.equal
    "test_convert_observations"
  ];
+
  pythonImportsCheck = [ "ax" ];

  meta = {
-    changelog = "https://github.com/facebook/Ax/releases/tag/${version}";
-    description = "Ax is an accessible, general-purpose platform for understanding, managing, deploying, and automating adaptive experiments";
+    description = "Platform for understanding, managing, deploying, and automating adaptive experiments";
    homepage = "https://ax.dev/";
+    changelog = "https://github.com/facebook/Ax/releases/tag/${version}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ veprbl ];
  };
--- a/pkgs/development/python-modules/binwalk/default.nix
+++ b/pkgs/development/python-modules/binwalk/default.nix
@ -20,6 +20,7 @@
  pyqtgraph,
  pyqt5,
  pytestCheckHook,
+  yaffshiv,
  visualizationSupport ? false,
 }:

@ -49,6 +50,7 @@ buildPythonPackage rec {
      squashfsTools
      xz
      pycrypto
+      yaffshiv
    ]
    ++ lib.optionals visualizationSupport [
      matplotlib
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@ -52,7 +52,7 @@

 buildPythonPackage rec {
  pname = "chromadb";
-  version = "0.5.11";
+  version = "0.5.17";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -61,13 +61,13 @@ buildPythonPackage rec {
    owner = "chroma-core";
    repo = "chroma";
    rev = "refs/tags/${version}";
-    hash = "sha256-qE8eX97khcQa2JS9ZuJ1j3/pduXcQGyuVyvsnvKaemo=";
+    hash = "sha256-ui4wUV9jIvgPtnY5L8mHg9k3l3ccL4u1rir426wwuMg=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-zciqOK5EkvxX3ctkGdkAppOQAW4CJ554PZsw2ctrdG0=";
+    hash = "sha256-lF+TpoQF6vZoxjPX3CN6TnWiY72qoxrVu2hilWgNx2E=";
  };

  pythonRelaxDeps = [
@ -149,6 +149,8 @@ buildPythonPackage rec {
    # Tests are laky / timing sensitive
    "test_fastapi_server_token_authn_allows_when_it_should_allow"
    "test_fastapi_server_token_authn_rejects_when_it_should_reject"
+    # Issue with event loop
+    "test_http_client_bw_compatibility"
  ];

  disabledTestPaths = [
--- a/pkgs/development/python-modules/dask-awkward/default.nix
+++ b/pkgs/development/python-modules/dask-awkward/default.nix
@ -71,6 +71,8 @@ buildPythonPackage rec {
    "test_from_text"
    # ValueError: not a ROOT file: first four bytes...
    "test_basic_root_works"
+    # Flaky. https://github.com/dask-contrib/dask-awkward/issues/506.
+    "test_distance_behavior"
  ];

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/gensim/default.nix
+++ b/pkgs/development/python-modules/gensim/default.nix
@ -19,7 +19,8 @@ buildPythonPackage rec {
  version = "4.3.3";
  pyproject = true;

-  disabled = pythonOlder "3.8";
+  # C code generated with CPython3.12 does not work cython_0.
+  disabled = !(pythonOlder "3.12");

  src = fetchPypi {
    inherit pname version;
@ -44,6 +45,10 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

+  pythonRelaxDeps = [
+    "scipy"
+  ];
+
  pythonImportsCheck = [ "gensim" ];

  # Test setup takes several minutes
--- a/pkgs/development/python-modules/google-cloud-artifact-registry/default.nix
+++ b/pkgs/development/python-modules/google-cloud-artifact-registry/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "google-cloud-artifact-registry";
-  version = "1.11.5";
+  version = "1.12.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "google_cloud_artifact_registry";
    inherit version;
-    hash = "sha256-lNWDbgu9DDNRSh7cC1TfiYvy237bH16QduskPzQt9Mg=";
+    hash = "sha256-XuPps4IBJxIfF+9qmqDYzZDw3BOrZeVUznk/3af33XQ=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/google-cloud-compute/default.nix
+++ b/pkgs/development/python-modules/google-cloud-compute/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "google-cloud-compute";
-  version = "1.19.2";
+  version = "1.20.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "google_cloud_compute";
    inherit version;
-    hash = "sha256-P86Cq+FOdvqqgSNNmnvh5jSy7Yon9V/u/PKxRkZ/f6s=";
+    hash = "sha256-q32xYqLCWV+tpJKgBnAV3DDjWCxPFOTtbMdDNyHIcp0=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@ -83,7 +83,11 @@ buildPythonPackage rec {
    rm -rf venv/
  '';

-  pythonRelaxDeps = [ "tomlkit" ];
+  pythonRelaxDeps = [
+    "tomlkit"
+    "aiofiles"
+    "markupsafe"
+  ];

  pythonRemoveDeps = [
    # our package is presented as a binary, not a python lib - and
--- a/pkgs/development/python-modules/hstspreload/default.nix
+++ b/pkgs/development/python-modules/hstspreload/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "hstspreload";
-  version = "2024.10.1";
+  version = "2024.11.1";
  pyproject = true;

  disabled = pythonOlder "3.6";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "sethmlarson";
    repo = "hstspreload";
    rev = "refs/tags/${version}";
-    hash = "sha256-so693xMgVb7pUoin3oYT26F02/C5KeVCuPQjOAJ6axQ=";
+    hash = "sha256-Gm0jZbJwVdoU19gkTuzJ9Mop1qsPDboTg53Yiocb3Rc=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/hyppo/default.nix
+++ b/pkgs/development/python-modules/hyppo/default.nix
@ -1,31 +1,32 @@
 {
  lib,
-  buildPythonPackage,
-  pythonOlder,
-  fetchFromGitHub,
-  setuptools,
-  pytestCheckHook,
  autograd,
+  buildPythonPackage,
+  fetchFromGitHub,
+  future,
+  matplotlib,
  numba,
  numpy,
+  pytestCheckHook,
+  pythonOlder,
  scikit-learn,
  scipy,
-  matplotlib,
  seaborn,
+  setuptools,
 }:

 buildPythonPackage rec {
  pname = "hyppo";
-  version = "0.5.0";
+  version = "0.5.1";
  pyproject = true;

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "neurodata";
-    repo = pname;
+    repo = "hyppo";
    rev = "refs/tags/v${version}";
-    hash = "sha256-7ZDzmSnieXz6E0x7mOL4109+hyeEQ0AW0Qhc4IwBM18=";
+    hash = "sha256-bYxqYSOOifQE3gbw8vNk/A13D5TPx7ERSgFvRHMXKGM=";
  };

  # some of the doctests (4/21) are broken, e.g. unbound variables, nondeterministic with insufficient tolerance, etc.
@ -36,8 +37,9 @@ buildPythonPackage rec {

  build-system = [ setuptools ];

-  propagatedBuildInputs = [
+  dependencies = [
    autograd
+    future
    numba
    numpy
    scikit-learn
--- a/pkgs/development/python-modules/llama-cloud/default.nix
+++ b/pkgs/development/python-modules/llama-cloud/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "llama-cloud";
-  version = "0.1.2";
+  version = "0.1.4";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_cloud";
    inherit version;
-    hash = "sha256-fIB0fpp/MtS3OcLV1K3XNR+DbZLmM9asA/pAGJbTMJc=";
+    hash = "sha256-bwFVl5vZYWCVHLgSxIg28frOA3vHnM/Y0YWxjvTJ+vg=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/llama-index-core/default.nix
+++ b/pkgs/development/python-modules/llama-index-core/default.nix
@ -35,7 +35,7 @@

 buildPythonPackage rec {
  pname = "llama-index-core";
-  version = "0.11.16";
+  version = "0.11.20";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -44,7 +44,7 @@ buildPythonPackage rec {
    owner = "run-llama";
    repo = "llama_index";
    rev = "refs/tags/v${version}";
-    hash = "sha256-t4hQMlORpdWXkbKQhVSxD/pdxFtu+sJ4FQQxIXLoH94=";
+    hash = "sha256-r4xedtxoYv6CcxtDrgwau9LY3kOBg3jXlQm1g59L7x4=";
  };

  sourceRoot = "${src.name}/${pname}";
@ -63,6 +63,8 @@ buildPythonPackage rec {
    cp -r ${nltk-data.punkt}/tokenizers/punkt/* llama_index/core/_static/nltk_cache/tokenizers/punkt/
  '';

+  pythonRelaxDeps = [ "tenacity" ];
+
  build-system = [ poetry-core ];

  dependencies = [
@ -127,6 +129,8 @@ buildPythonPackage rec {
    # Tests require network access
    "test_from_namespaced_persist_dir"
    "test_from_persist_dir"
+    # asyncio.exceptions.InvalidStateError: invalid state
+    "test_workflow_context_to_dict_mid_run"
  ];

  meta = with lib; {
--- a/pkgs/development/python-modules/llama-index-graph-stores-neo4j/default.nix
+++ b/pkgs/development/python-modules/llama-index-graph-stores-neo4j/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "llama-index-graph-stores-neo4j";
-  version = "0.3.2";
+  version = "0.3.5";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_graph_stores_neo4j";
    inherit version;
-    hash = "sha256-O/iTlpbREmN1tbojbaqZ7gLAN2JdKmKEzhKCnpth6S0=";
+    hash = "sha256-r3/bxG4EZmeJ5fa4mmE2OTlbvGN780rsze5HoKQssiY=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/llama-index-legacy/default.nix
+++ b/pkgs/development/python-modules/llama-index-legacy/default.nix
@ -20,6 +20,8 @@ buildPythonPackage rec {
    hash = "sha256-9pafEIXvsKvr1jZ+RvNRICDz9rnAhvRYpRmDDdYeggY=";
  };

+  pythonRelaxDeps = [ "tenacity" ];
+
  build-system = [ poetry-core ];

  dependencies = [ llama-index-core ];
--- a/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "llama-index-llms-ollama";
-  version = "0.3.3";
+  version = "0.3.4";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_llms_ollama";
    inherit version;
-    hash = "sha256-J54Z9tWb81DcIIDVzaXqa9JkKd576gvGdMoiTDoTOII=";
+    hash = "sha256-Vt9uGIcIGvRSL57DK+LUYy2NTyYZ9yqnHqYJZiMeVKA=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/llama-index-llms-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-openai/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "llama-index-llms-openai";
-  version = "0.2.12";
+  version = "0.2.16";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_llms_openai";
    inherit version;
-    hash = "sha256-RyG8GnZcyfiWuSgku07RTyicGfwVdlpmgJB4slY6dBE=";
+    hash = "sha256-fGZt0nBWwnigef9F1T8fv8jtNjdkqnuu7i4D30f5Byo=";
  };

  pythonRemoveDeps = [
--- a/pkgs/development/python-modules/llama-index-multi-modal-llms-openai/default.nix
+++ b/pkgs/development/python-modules/llama-index-multi-modal-llms-openai/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "llama-index-multi-modal-llms-openai";
-  version = "0.2.2";
+  version = "0.2.3";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_multi_modal_llms_openai";
    inherit version;
-    hash = "sha256-xyBc/Zoj4iAdtSfKP4+l70+yYKtsmxXnkWNjCpFu4Vk=";
+    hash = "sha256-jrm38f85Vu8JeeIbyD5qiF5AmHtxmfGV5GUl0G465AI=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/llama-index-vector-stores-chroma/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-chroma/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "llama-index-vector-stores-chroma";
-  version = "0.2.0";
+  version = "0.2.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_vector_stores_chroma";
    inherit version;
-    hash = "sha256-n6fGNgXB4pbhea1e5QT0Co/sVnd8r3L5+pVCut5U2Uw=";
+    hash = "sha256-3vFadjVLtGWLFrrbklN6cudmJz1eVmsFdUYQBdpThH8=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
+++ b/pkgs/development/python-modules/llama-index-vector-stores-qdrant/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "llama-index-vector-stores-qdrant";
-  version = "0.3.0";
+  version = "0.3.3";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -19,7 +19,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_index_vector_stores_qdrant";
    inherit version;
-    hash = "sha256-mWY86wyS3aVd+cBhY8pCvn6w86Z0AdWrjOlz987Wg6I=";
+    hash = "sha256-YpecQB3OHi7id/Mvu73dn+gcXjXzVZR5+Sr0KwkIbDs=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/llama-parse/default.nix
+++ b/pkgs/development/python-modules/llama-parse/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "llama-parse";
-  version = "0.5.7";
+  version = "0.5.12";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -17,7 +17,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "llama_parse";
    inherit version;
-    hash = "sha256-sqKdvOMrmTQvuULRwhCr7w7qV99vJmZimQOe96kx/v8=";
+    hash = "sha256-4kFgbPNXRCXfdsD10BoxqVx5LG+++AqvcvjtZEi9FxU=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/pyclipper/default.nix
+++ b/pkgs/development/python-modules/pyclipper/default.nix
@ -2,27 +2,26 @@
  lib,
  fetchFromGitHub,
  buildPythonPackage,
+  setuptools,
  setuptools-scm,
  cython,
  pytestCheckHook,
-  pythonOlder,
 }:

 buildPythonPackage rec {
  pname = "pyclipper";
-  version = "1.3.0.post5";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.7";
+  version = "1.3.0.post6";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "fonttools";
-    repo = pname;
+    repo = "pyclipper";
    rev = "refs/tags/${version}";
-    hash = "sha256-FKpP+tgJFzhij3wDQsAgwrTNnny7lgmN+tlSQ9JgG+Q=";
+    hash = "sha256-s2D0ipDatAaF7A1RYOKyI31nkfc/WL3vHWsAMbo+WcY=";
  };

-  nativeBuildInputs = [
+  build-system = [
+    setuptools
    setuptools-scm
    cython
  ];
--- a/pkgs/development/python-modules/sqlalchemy-mixins/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy-mixins/default.nix
@ -1,5 +1,6 @@
 {
  lib,
+  aiosqlite,
  buildPythonPackage,
  fetchFromGitHub,
  setuptools,
@ -18,7 +19,7 @@ buildPythonPackage rec {

  src = fetchFromGitHub {
    owner = "absent1706";
-    repo = pname;
+    repo = "sqlalchemy-mixins";
    rev = "refs/tags/v${version}";
    hash = "sha256-0uB3x7RQSNEq3DyTSiOIGajwPQQEBjXK8HOyuXCNa/E=";
  };
@ -30,7 +31,10 @@ buildPythonPackage rec {
    sqlalchemy
  ];

-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    aiosqlite
+    pytestCheckHook
+  ];

  pythonImportsCheck = [ "sqlalchemy_mixins" ];

--- a/pkgs/development/python-modules/yappi/default.nix
+++ b/pkgs/development/python-modules/yappi/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "yappi";
-  version = "1.6.0";
+  version = "1.6.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "sumerc";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-zA4apOGyrbjBOxUKBARiKmmM9rSVFVGWsDpOaItOoLU=";
+    hash = "sha256-nkkm50/94iVYZdUBm7DZkNQsBqddO6unjP29ctf7dxo=";
  };

  patches = [ ./tests.patch ];
--- a/pkgs/misc/screensavers/xtrlock-pam/default.nix
+++ b/pkgs/misc/screensavers/xtrlock-pam/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python2, pkg-config, pam, xorg }:
+{ lib, stdenv, fetchFromGitHub, python39, pkg-config, pam, xorg }:

 stdenv.mkDerivation {
  pname = "xtrlock-pam";
@ -12,7 +12,7 @@ stdenv.mkDerivation {
  };

  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ python2 pam xorg.libX11 ];
+  buildInputs = [ python39 pam xorg.libX11 ];

  configurePhase = ''
    substituteInPlace .config/options.py --replace /usr/include/security/pam_appl.h ${pam}/include/security/pam_appl.h
@ -24,7 +24,7 @@ stdenv.mkDerivation {
    homepage = "https://github.com/aanatoly/xtrlock-pam";
    description = "PAM based X11 screen locker";
    license = "unknown";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ ondt ];
    platforms = with lib.platforms; linux;
  };
 }
--- a/pkgs/os-specific/linux/cifs-utils/default.nix
+++ b/pkgs/os-specific/linux/cifs-utils/default.nix
@ -1,5 +1,18 @@
-{ stdenv, lib, fetchurl, autoreconfHook, docutils, pkg-config
-, libkrb5, keyutils, pam, talloc, python3 }:
+{
+  stdenv,
+  lib,
+  fetchurl,
+  autoreconfHook,
+  docutils,
+  pkg-config,
+  libcap,
+  libkrb5,
+  keyutils,
+  pam,
+  samba,
+  talloc,
+  python3,
+}:

 stdenv.mkDerivation rec {
  pname = "cifs-utils";
@ -10,16 +23,30 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-ohEj92pKajbJZTGJukkY6988/NP5CScwpH/zRQtbWyo=";
  };

-  nativeBuildInputs = [ autoreconfHook docutils pkg-config ];
-
-  buildInputs = [ libkrb5 keyutils pam talloc python3 ];
-
-  configureFlags = [ "ROOTSBINDIR=$(out)/sbin" ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    # AC_FUNC_MALLOC is broken on cross builds.
-    "ac_cv_func_malloc_0_nonnull=yes"
-    "ac_cv_func_realloc_0_nonnull=yes"
+  nativeBuildInputs = [
+    autoreconfHook
+    docutils
+    pkg-config
  ];

+  buildInputs = [
+    keyutils
+    libcap
+    libkrb5
+    pam
+    python3
+    samba
+    talloc
+  ];
+
+  configureFlags =
+    [ "ROOTSBINDIR=$(out)/sbin" ]
+    ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      # AC_FUNC_MALLOC is broken on cross builds.
+      "ac_cv_func_malloc_0_nonnull=yes"
+      "ac_cv_func_realloc_0_nonnull=yes"
+    ];
+
  meta = with lib; {
    homepage = "https://wiki.samba.org/index.php/LinuxCIFS_utils";
    description = "Tools for managing Linux CIFS client filesystems";
--- a/pkgs/servers/computing/torque/default.nix
+++ b/pkgs/servers/computing/torque/default.nix
@ -1,14 +1,31 @@
-{ lib, stdenv, fetchFromGitHub, openssl, flex, bison, pkg-config, groff, libxml2, util-linux
-, coreutils, file, libtool, which, boost, autoreconfHook
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  autoreconfHook,
+  pkg-config,
+  flex,
+  bison,
+
+  openssl,
+  groff,
+  libxml2,
+  util-linux,
+  libtool,
+  which,
+  coreutils,
+  boost,
+  zlib,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
  pname = "torque";
  version = "6.1.3h2";

  src = fetchFromGitHub {
    owner = "adaptivecomputing";
-    repo = pname;
+    repo = "torque";
    # branch 6.1.3h2, as they aren't pushing tags
    # https://github.com/adaptivecomputing/torque/issues/467
    rev = "458883319157cfc5c509046d09f9eb8e68e8d398";
@ -16,10 +33,24 @@ stdenv.mkDerivation rec {
  };

  strictDeps = true;
-  nativeBuildInputs = [ autoreconfHook pkg-config flex bison libxml2 ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    flex
+    bison
+    libxml2
+  ];
+
  buildInputs = [
-    openssl groff libxml2 util-linux libtool
-    which boost
+    openssl
+    groff
+    libxml2
+    util-linux
+    libtool
+    which
+    boost
+    zlib
  ];

  enableParallelBuilding = true;
@ -29,25 +60,22 @@ stdenv.mkDerivation rec {

  postPatch = ''
    substituteInPlace Makefile.am \
-      --replace "contrib/init.d contrib/systemd" ""
+      --replace-fail "contrib/init.d contrib/systemd" ""
    substituteInPlace src/cmds/Makefile.am \
-      --replace "/etc/" "$out/etc/"
+      --replace-fail "/etc/" "$out/etc/"
    substituteInPlace src/mom_rcp/pathnames.h \
-      --replace /bin/cp ${coreutils}/bin/cp
+      --replace-fail /bin/cp ${coreutils}/bin/cp
    substituteInPlace src/resmom/requests.c \
-      --replace /bin/cp ${coreutils}/bin/cp
+      --replace-fail /bin/cp ${coreutils}/bin/cp
  '';

  preConfigure = ''
-    substituteInPlace ./configure \
-      --replace '/usr/bin/file' '${file}/bin/file'
-
    # fix broken libxml2 detection
    sed -i '/xmlLib\=/c\xmlLib=xml2' ./configure

    for s in fifo cray_t3e dec_cluster msic_cluster sgi_origin umn_cluster; do
      substituteInPlace src/scheduler.cc/samples/$s/Makefile.in \
-        --replace "schedprivdir = " "schedprivdir = $out/"
+        --replace-fail "schedprivdir = " "schedprivdir = $out/"
    done

    for f in $(find ./ -name Makefile.in); do
@ -59,9 +87,7 @@ stdenv.mkDerivation rec {
  '';

  postInstall = ''
-    cp -v buildutils/pbs_mkdirs $out/bin/
-    cp -v torque.setup $out/bin/
-    chmod +x $out/bin/pbs_mkdirs $out/bin/torque.setup
+    install -Dm755 torque.setup buildutils/pbs_mkdirs -t $out/bin/
  '';

  meta = with lib; {
--- a/pkgs/servers/ftp/pure-ftpd/default.nix
+++ b/pkgs/servers/ftp/pure-ftpd/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "pure-ftpd";
-  version = "1.0.51";
+  version = "1.0.52";

  src = fetchurl {
    url = "https://download.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-${version}.tar.gz";
-    sha256 = "sha256-QWD2a3ZhXuojl+rE6j8KFGt5KCB7ebxMwvma17e9lRM=";
+    sha256 = "sha256-ESbzqVhW0IiJ/4lwPLGqnsmSTZOdFU6WkEySDwXcPHQ=";
  };

  buildInputs = [ openssl pam libxcrypt ];
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@ -18,11 +18,11 @@ let
  '';
 in stdenv.mkDerivation rec {
  pname = "keycloak";
-  version = "26.0.2";
+  version = "26.0.5";

  src = fetchzip {
    url = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    hash = "sha256-bhzzhFYMimGts5EElvlRpii4UGPzug6R0/F1lfbXKok=";
+    hash = "sha256-BpXW+PN9kgHGshFwvrx2Tj5K0VXuVbT1VZgWl1ElSjI=";
  };

  nativeBuildInputs = [ makeWrapper jre ];
--- a/pkgs/shells/fish/plugins/forgit.nix
+++ b/pkgs/shells/fish/plugins/forgit.nix
@ -2,13 +2,13 @@

 buildFishPlugin rec {
  pname = "forgit";
-  version = "24.10.0";
+  version = "24.11.0";

  src = fetchFromGitHub {
    owner = "wfxr";
    repo = "forgit";
    rev = version;
-    hash = "sha256-g1uedR9BLG0DuGdM/9xqFv6yhBHHnqjQMt1n0z9I29I=";
+    hash = "sha256-8BMFL3WktkkB8m6asbNeb9swnLWi3jHo012fBXGa8ls=";
  };

  postInstall = ''
--- a/pkgs/tools/archivers/7zz/default.nix
+++ b/pkgs/tools/archivers/7zz/default.nix
@ -2,9 +2,9 @@
 , lib
 , fetchzip

-  # Only used for Linux's x86/x86_64
+  # Only useful on Linux x86/x86_64, and brings in non‐free Open Watcom
 , uasm
-, useUasm ? (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86)
+, useUasm ? false

  # RAR code is under non-free unRAR license
  # see the meta.license section below for more details
--- a/pkgs/tools/networking/openvpn3/default.nix
+++ b/pkgs/tools/networking/openvpn3/default.nix
@ -1,123 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, asio
-, autoconf-archive
-, autoreconfHook
-, glib
-, gtest
-, jsoncpp
-, libcap_ng
-, libnl
-, libuuid
-, lz4
-, openssl
-, pkg-config
-, protobuf
-, python3
-, systemd
-, enableSystemdResolved ? false
-, tinyxml-2
-, wrapGAppsHook3
-}:
-
-let
-  openvpn3-core = fetchFromGitHub {
-    owner = "OpenVPN";
-    repo = "openvpn3";
-    rev = "7590cb109349809b948e8edaeecabdbfe24e4b17";
-    hash = "sha256-S9D/FQa7HYj0FJnyb5dCrtgTH9Nf2nvtyp/VHiebq7I=";
-  };
-in
-stdenv.mkDerivation rec {
-  pname = "openvpn3";
-  # also update openvpn3-core
-  version = "20";
-
-  src = fetchFromGitHub {
-    owner = "OpenVPN";
-    repo = "openvpn3-linux";
-    rev = "v${version}";
-    hash = "sha256-Weyb+rcx04mpDdcL7Qt4O+PvPf5MLPAP/Uy+8qoNXbQ=";
-  };
-
-  postPatch = ''
-    rm -r ./vendor/googletest
-    cp -r ${gtest.src} ./vendor/googletest
-    rm -r ./openvpn3-core
-    ln -s ${openvpn3-core} ./openvpn3-core
-
-    chmod -R +w ./vendor/googletest
-    shopt -s globstar
-
-    patchShebangs **/*.py **/*.sh ./src/python/{openvpn2,openvpn3-as,openvpn3-autoload} \
-    ./distro/systemd/openvpn3-systemd ./src/tests/dbus/netcfg-subscription-test
-
-    echo "3.git:v${version}:unknown" > openvpn3-core-version
-  '';
-
-  preAutoreconf = ''
-    substituteInPlace ./update-version-m4.sh --replace 'VERSION="$(git describe --always --tags)"' "VERSION=v${version}"
-    ./update-version-m4.sh
-  '';
-
-  nativeBuildInputs = [
-    autoconf-archive
-    autoreconfHook
-    python3.pkgs.docutils
-    python3.pkgs.jinja2
-    pkg-config
-    wrapGAppsHook3
-    python3.pkgs.wrapPython
-  ] ++ pythonPath;
-
-  buildInputs = [
-    asio
-    glib
-    jsoncpp
-    libcap_ng
-    libnl
-    libuuid
-    lz4
-    openssl
-    protobuf
-    tinyxml-2
-  ] ++ lib.optionals enableSystemdResolved [
-    systemd
-  ];
-
-  # runtime deps
-  pythonPath = with python3.pkgs; [
-    dbus-python
-    pygobject3
-  ];
-
-  dontWrapGApps = true;
-  preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
-  postFixup = ''
-    wrapPythonPrograms
-  '';
-
-  configureFlags = [
-    "--enable-bash-completion"
-    "--enable-addons-aws"
-    "--disable-selinux-build"
-    "--disable-build-test-progs"
-  ] ++ lib.optionals enableSystemdResolved [
-    # This defaults to --resolv-conf /etc/resolv.conf. See
-    # https://github.com/OpenVPN/openvpn3-linux/blob/v20/configure.ac#L434
-    "DEFAULT_DNS_RESOLVER=--systemd-resolved"
-  ];
-
-  NIX_LDFLAGS = "-lpthread";
-
-  meta = with lib; {
-    description = "OpenVPN 3 Linux client";
-    license = licenses.agpl3Plus;
-    homepage = "https://github.com/OpenVPN/openvpn3-linux/";
-    maintainers = with maintainers; [ shamilton ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/tools/networking/rshijack/default.nix
+++ b/pkgs/tools/networking/rshijack/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "rshijack";
-  version = "0.5.1";
+  version = "0.5.2";

  src = fetchFromGitHub {
    owner = "kpcyrd";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-UyrHMw+3JE4zR+N7rdcTkLP3m4h6txkYa8uG9r7S9ZE=";
+    sha256 = "sha256-vTbjb0tm6jCP9+QWG5R83v31W6RUgSEv96iR37QdnFo=";
  };

-  cargoHash = "sha256-bGGbZ3JXeo6eytiDHrgHOQN3VgfaqtWssz5hY0RZoZ0=";
+  cargoHash = "sha256-3rDPk+lPRrDrE2iqHAOi7zhyc+xYPXkM9P4Bu0JUL40=";

  meta = with lib; {
    description = "TCP connection hijacker";
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"

-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.33"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.34"
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@ -1,9 +1,9 @@
 GIT
  remote: https://github.com/rapid7/metasploit-framework
-  revision: 1939065b94ee3c2033e720b753c5a6bd70e09c07
-  ref: refs/tags/6.4.33
+  revision: e9286ec3faffa15e12ef3e267da335cd4afdfaea
+  ref: refs/tags/6.4.34
  specs:
-    metasploit-framework (6.4.33)
+    metasploit-framework (6.4.34)
      aarch64
      abbrev
      actionpack (~> 7.0.0)
@ -44,7 +44,7 @@ GIT
      metasploit-concern
      metasploit-credential
      metasploit-model
-      metasploit-payloads (= 2.0.183)
+      metasploit-payloads (= 2.0.187)
      metasploit_data_models
      metasploit_payloads-mettle (= 1.0.35)
      mqtt
@ -69,7 +69,7 @@ GIT
      pg
      puma
      railties
-      rasn1
+      rasn1 (= 0.13.0)
      rb-readline
      recog
      redcarpet
@ -274,7 +274,7 @@ GEM
      activemodel (~> 7.0)
      activesupport (~> 7.0)
      railties (~> 7.0)
-    metasploit-payloads (2.0.183)
+    metasploit-payloads (2.0.187)
    metasploit_data_models (6.0.3)
      activerecord (~> 7.0)
      activesupport (~> 7.0)
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@ -15,13 +15,13 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "metasploit-framework";
-  version = "6.4.33";
+  version = "6.4.34";

  src = fetchFromGitHub {
    owner = "rapid7";
    repo = "metasploit-framework";
    rev = "refs/tags/${version}";
-    hash = "sha256-RMQEFRIArj2RuYk6GFDsGXpWRPANxD8OUJUQMtQUBW4=";
+    hash = "sha256-2ZYyvASTh1vqBolUCyp8lNLgTPv0tFd7+qZe3KpkDhk=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@ -734,12 +734,12 @@
    platforms = [];
    source = {
      fetchSubmodules = false;
-      rev = "1939065b94ee3c2033e720b753c5a6bd70e09c07";
-      sha256 = "0vh52ka3444ma073zi0dy125cyhrxi81hfl9p68kvbh028ah9i24";
+      rev = "e9286ec3faffa15e12ef3e267da335cd4afdfaea";
+      sha256 = "068fcjmdqpm6z9xmgd7lzd6f1lllghm0nm490vm5p1wk0jy355nr";
      type = "git";
      url = "https://github.com/rapid7/metasploit-framework";
    };
-    version = "6.4.33";
+    version = "6.4.34";
  };
  metasploit-model = {
    groups = ["default"];
@ -756,10 +756,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0bdn7g01a4hvli6ymkl215xmw823jnd5fwv63wy9bgyaih14ysmd";
+      sha256 = "13cm4pblldz1cl3cmvppkwsbv12b2a4kfl3r3kzfyjwrlhz121wn";
      type = "gem";
    };
-    version = "2.0.183";
+    version = "2.0.187";
  };
  metasploit_data_models = {
    groups = ["default"];
--- a/pkgs/tools/system/btop/default.nix
+++ b/pkgs/tools/system/btop/default.nix
@ -1,16 +1,17 @@
-{ lib
-, config
-, stdenv
-, fetchFromGitHub
-, cmake
-, darwin
-, removeReferencesTo
-, btop
-, testers
-, autoAddDriverRunpath
-, cudaSupport ? config.cudaSupport
-, rocmSupport ? config.rocmSupport
-, rocmPackages
+{
+  lib,
+  config,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  removeReferencesTo,
+  autoAddDriverRunpath,
+  apple-sdk_15,
+  darwinMinVersionHook,
+  versionCheckHook,
+  rocmPackages,
+  cudaSupport ? config.cudaSupport,
+  rocmSupport ? config.rocmSupport,
 }:

 stdenv.mkDerivation rec {
@ -24,15 +25,17 @@ stdenv.mkDerivation rec {
    hash = "sha256-A5hOBxj8tKlkHd8zDHfDoU6fIu8gDpt3/usbiDk0/G0=";
  };

-  nativeBuildInputs = [
-    cmake
-  ] ++ lib.optionals cudaSupport [
-    autoAddDriverRunpath
-  ];
+  nativeBuildInputs =
+    [
+      cmake
+    ]
+    ++ lib.optionals cudaSupport [
+      autoAddDriverRunpath
+    ];

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk_11_0.frameworks.CoreFoundation
-    darwin.apple_sdk_11_0.frameworks.IOKit
+    apple-sdk_15
+    (darwinMinVersionHook "10.15")
  ];

  installFlags = [ "PREFIX=$(out)" ];
@ -46,9 +49,9 @@ stdenv.mkDerivation rec {
    patchelf --add-rpath ${lib.getLib rocmPackages.rocm-smi}/lib $out/bin/btop
  '';

-  passthru.tests.version = testers.testVersion {
-    package = btop;
-  };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;

  meta = with lib; {
    description = "Monitor of resources";
--- a/Show More
+++ b/Show More