Merge master into haskell-updates

2024-02-03 00:12:45 +00:00 · 2024-02-03 00:12:45 +00:00 · f7af6d355f
commit f7af6d355f
parent 34dab68635 e718d5841a
209 changed files with 2023 additions and 1048 deletions
--- a/doc/build-helpers/trivial-build-helpers.chapter.md
+++ b/doc/build-helpers/trivial-build-helpers.chapter.md
@ -502,9 +502,14 @@ concatScript "my-file" [ file1 file2 ]

 ## `writeShellApplication` {#trivial-builder-writeShellApplication}

-This can be used to easily produce a shell script that has some dependencies (`runtimeInputs`). It automatically sets the `PATH` of the script to contain all of the listed inputs, sets some sanity shellopts (`errexit`, `nounset`, `pipefail`), and checks the resulting script with [`shellcheck`](https://github.com/koalaman/shellcheck).
+`writeShellApplication` is similar to `writeShellScriptBin` and `writeScriptBin` but supports runtime dependencies with `runtimeInputs`.
+Writes an executable shell script to `/nix/store/<store path>/bin/<name>` and checks its syntax with [`shellcheck`](https://github.com/koalaman/shellcheck) and the `bash`'s `-n` option.
+Some basic Bash options are set by default (`errexit`, `nounset`, and `pipefail`), but can be overridden with `bashOptions`.

-For example, look at the following code:
+Extra arguments may be passed to `stdenv.mkDerivation` by setting `derivationArgs`; note that variables set in this manner will be set when the shell script is _built,_ not when it's run.
+Runtime environment variables can be set with the `runtimeEnv` argument.
+
+For example, the following shell application can refer to `curl` directly, rather than needing to write `${curl}/bin/curl`:

 ```nix
 writeShellApplication {
@ -518,10 +523,6 @@ writeShellApplication {
 }
 ```

-Unlike with normal `writeShellScriptBin`, there is no need to manually write out `${curl}/bin/curl`, setting the PATH
-was handled by `writeShellApplication`. Moreover, the script is being checked with `shellcheck` for more strict
-validation.
-
 ## `symlinkJoin` {#trivial-builder-symlinkJoin}

 This can be used to put many derivations into the same directory structure. It works by creating a new derivation and adding symlinks to each of the paths listed. It expects two arguments, `name`, and `paths`. `name` is the name used in the Nix store path for the created derivation. `paths` is a list of paths that will be symlinked. These paths can be to Nix store derivations or any other subdirectory contained within.
--- a/doc/default.nix
+++ b/doc/default.nix
@ -25,6 +25,7 @@ let
      { name = "gvariant"; description = "GVariant formatted string serialization functions"; }
      { name = "customisation"; description = "Functions to customise (derivation-related) functions, derivatons, or attribute sets"; }
      { name = "meta"; description = "functions for derivation metadata"; }
+      { name = "derivations"; description = "miscellaneous derivation-specific functions"; }
    ];
  };

--- a/lib/default.nix
+++ b/lib/default.nix
@ -116,7 +116,7 @@ let
    inherit (self.customisation) overrideDerivation makeOverridable
      callPackageWith callPackagesWith extendDerivation hydraJob
      makeScope makeScopeWithSplicing makeScopeWithSplicing';
-    inherit (self.derivations) lazyDerivation;
+    inherit (self.derivations) lazyDerivation optionalDrvAttr;
    inherit (self.meta) addMetaAttrs dontDistribute setName updateName
      appendToName mapDerivationAttrset setPrio lowPrio lowPrioSet hiPrio
      hiPrioSet getLicenseFromSpdxId getExe getExe';
--- a/lib/derivations.nix
+++ b/lib/derivations.nix
@ -98,4 +98,30 @@ in
      # `lazyDerivation` caller knew a shortcut, be taken from there.
      meta = args.meta or checked.meta;
    } // passthru;
+
+  /* Conditionally set a derivation attribute.
+
+     Because `mkDerivation` sets `__ignoreNulls = true`, a derivation
+     attribute set to `null` will not impact the derivation output hash.
+     Thus, this function passes through its `value` argument if the `cond`
+     is `true`, but returns `null` if not.
+
+     Type: optionalDrvAttr :: Bool -> a -> a | Null
+
+     Example:
+       (stdenv.mkDerivation {
+         name = "foo";
+         x = optionalDrvAttr true 1;
+         y = optionalDrvAttr false 1;
+       }).drvPath == (stdenv.mkDerivation {
+         name = "foo";
+         x = 1;
+       }).drvPath
+       => true
+  */
+  optionalDrvAttr =
+    # Condition
+    cond:
+    # Attribute value
+    value: if cond then value else null;
 }
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@ -5,6 +5,7 @@ let
    isAttrs
    isPath
    isString
+    nixVersion
    pathExists
    readDir
    split
@ -17,6 +18,7 @@ let
    attrNames
    attrValues
    mapAttrs
+    optionalAttrs
    zipAttrsWith
    ;

@ -56,6 +58,7 @@ let
    substring
    stringLength
    hasSuffix
+    versionAtLeast
    ;

  inherit (lib.trivial)
@ -840,6 +843,10 @@ rec {
  # https://github.com/NixOS/nix/commit/55cefd41d63368d4286568e2956afd535cb44018
  _fetchGitSubmodulesMinver = "2.4";

+  # Support for `builtins.fetchGit` with `shallow = true` was introduced in 2.4
+  # https://github.com/NixOS/nix/commit/d1165d8791f559352ff6aa7348e1293b2873db1c
+  _fetchGitShallowMinver = "2.4";
+
  # Mirrors the contents of a Nix store path relative to a local path as a file set.
  # Some notes:
  # - The store path is read at evaluation time.
@ -894,7 +901,17 @@ rec {
          # However a simpler alternative still would be [a builtins.gitLsFiles](https://github.com/NixOS/nix/issues/2944).
          fetchResult = fetchGit ({
            url = path;
-          } // extraFetchGitAttrs);
+          }
+          # In older Nix versions, repositories were always assumed to be deep clones, which made `fetchGit` fail for shallow clones
+          # For newer versions this was fixed, but the `shallow` flag is required.
+          # The only behavioral difference is that for shallow clones, `fetchGit` doesn't return a `revCount`,
+          # which we don't need here, so it's fine to always pass it.
+
+          # Unfortunately this means older Nix versions get a poor error message for shallow repositories, and there's no good way to improve that.
+          # Checking for `.git/shallow` doesn't seem worth it, especially since that's more of an implementation detail,
+          # and would also require more code to handle worktrees where `.git` is a file.
+          // optionalAttrs (versionAtLeast nixVersion _fetchGitShallowMinver) { shallow = true; }
+          // extraFetchGitAttrs);
        in
        # We can identify local working directories by checking for .git,
        # see https://git-scm.com/docs/gitrepository-layout#_description.
--- a/lib/fileset/tests.sh
+++ b/lib/fileset/tests.sh
@ -1439,6 +1439,19 @@ if [[ -n "$fetchGitSupportsSubmodules" ]]; then
 fi
 rm -rf -- *

+# shallow = true is not supported on all Nix versions
+# and older versions don't support shallow clones at all
+if [[ "$(nix-instantiate --eval --expr "$prefixExpression (versionAtLeast builtins.nixVersion _fetchGitShallowMinver)")" == true ]]; then
+    createGitRepo full
+    # Extra commit such that there's a commit that won't be in the shallow clone
+    git -C full commit --allow-empty -q -m extra
+    git clone -q --depth 1 "file://${PWD}/full" shallow
+    cd shallow
+    checkGitTracked
+    cd ..
+    rm -rf -- *
+fi
+
 # Go through all stages of Git files
 # See https://www.git-scm.com/book/en/v2/Git-Basics-Recording-Changes-to-the-Repository

--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -1902,7 +1902,7 @@ runTests {
    expected = true;
  };

-  # lazyDerivation
+  # DERIVATIONS

  testLazyDerivationIsLazyInDerivationForAttrNames = {
    expr = attrNames (lazyDerivation {
@ -1955,6 +1955,24 @@ runTests {
    expected = derivation;
  };

+  testOptionalDrvAttr = let
+    mkDerivation = args: derivation (args // {
+      builder = "builder";
+      system = "system";
+      __ignoreNulls = true;
+    });
+  in {
+    expr = (mkDerivation {
+      name = "foo";
+      x = optionalDrvAttr true 1;
+      y = optionalDrvAttr false 1;
+    }).drvPath;
+    expected = (mkDerivation {
+      name = "foo";
+      x = 1;
+    }).drvPath;
+  };
+
  testTypeDescriptionInt = {
    expr = (with types; int).description;
    expected = "signed integer";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -66,6 +66,12 @@
    github = "0b11stan";
    githubId = 27831931;
  };
+  _0nyr = {
+    email = "onyr.maintainer@gmail.com";
+    github = "0nyr";
+    githubId = 47721040;
+    name = "Florian Rascoussier";
+  };
  _0qq = {
    email = "0qqw0qqw@gmail.com";
    github = "0qq";
@ -4392,6 +4398,15 @@
    githubId = 3179832;
    name = "D. Bohdan";
  };
+  dbrgn = {
+    email = "nix@dbrgn.ch";
+    github = "dbrgn";
+    githubId = 105168;
+    name = "Danilo B.";
+    keys = [{
+      fingerprint = "20EE 002D 778A E197 EF7D  0D2C B993 FF98 A90C 9AB1";
+    }];
+  };
  dbrock = {
    email = "daniel@brockman.se";
    github = "dbrock";
@ -15176,6 +15191,16 @@
    githubId = 11898437;
    name = "Florian Ströger";
  };
+  presto8 = {
+    name = "Preston Hunt";
+    email = "me@prestonhunt.com";
+    matrix = "@presto8:matrix.org";
+    github = "presto8";
+    githubId = 246631;
+    keys = [{
+      fingerprint = "3E46 7EF1 54AA A1D0 C7DF  A694 E45C B17F 1940 CA52";
+    }];
+  };
  priegger = {
    email = "philipp@riegger.name";
    github = "priegger";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -71,6 +71,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - [TuxClocker](https://github.com/Lurkki14/tuxclocker), a hardware control and monitoring program. Available as [programs.tuxclocker](#opt-programs.tuxclocker.enable).

+- [ALVR](https://github.com/alvr-org/alvr), a VR desktop streamer. Available as [programs.alvr](#opt-programs.alvr.enable)
+
 - [RustDesk](https://rustdesk.com), a full-featured open source remote control alternative for self-hosting and security with minimal configuration. Alternative to TeamViewer.

 - [systemd-lock-handler](https://git.sr.ht/~whynothugo/systemd-lock-handler/), a bridge between logind D-Bus events and systemd targets. Available as [services.systemd-lock-handler.enable](#opt-services.systemd-lock-handler.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -139,6 +139,7 @@
  ./programs/_1password-gui.nix
  ./programs/_1password.nix
  ./programs/adb.nix
+  ./programs/alvr.nix
  ./programs/appgate-sdp.nix
  ./programs/atop.nix
  ./programs/ausweisapp.nix
--- a/nixos/modules/programs/alvr.nix
+++ b/nixos/modules/programs/alvr.nix
@ -0,0 +1,35 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.alvr;
+in
+{
+  options = {
+    programs.alvr = {
+      enable = mkEnableOption (lib.mdDoc "ALVR, the VR desktop streamer");
+
+      package = mkPackageOption pkgs "alvr" { };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Whether to open the default ports in the firewall for the ALVR server.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ 9943 9944 ];
+      allowedUDPPorts = [ 9943 9944 ];
+    };
+  };
+
+  meta.maintainers = with maintainers; [ passivelemon ];
+}
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -2989,15 +2989,9 @@ let

      systemd.services.systemd-networkd = {
        wantedBy = [ "initrd.target" ];
-        # These before and conflicts lines can be removed when this PR makes it into a release:
-        # https://github.com/systemd/systemd/pull/27791
-        before = ["initrd-switch-root.target"];
-        conflicts = ["initrd-switch-root.target"];
      };
      systemd.sockets.systemd-networkd = {
        wantedBy = [ "initrd.target" ];
-        before = ["initrd-switch-root.target"];
-        conflicts = ["initrd-switch-root.target"];
      };

      systemd.services.systemd-network-generator.wantedBy = [ "sysinit.target" ];
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@ -160,7 +160,10 @@ in
        "network-online.target"
      ];

-      path = lib.mkIf config.boot.zfs.enabled [ config.boot.zfs.package ];
+      path = lib.mkIf config.boot.zfs.enabled [
+        config.boot.zfs.package
+        "${config.boot.zfs.package}/lib/udev"
+      ];

      environment = {
        # Override Path to the LXC template configuration directory
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -452,7 +452,7 @@ in {
  kerberos = handleTest ./kerberos/default.nix {};
  kernel-generic = handleTest ./kernel-generic.nix {};
  kernel-latest-ath-user-regd = handleTest ./kernel-latest-ath-user-regd.nix {};
-  kernel-rust = runTestOn ["x86_64-linux"] ./kernel-rust.nix;
+  kernel-rust = handleTestOn ["x86_64-linux"] ./kernel-rust.nix {};
  keter = handleTest ./keter.nix {};
  kexec = handleTest ./kexec.nix {};
  keycloak = discoverTests (import ./keycloak.nix);
--- a/nixos/tests/incus/container.nix
+++ b/nixos/tests/incus/container.nix
@ -31,7 +31,7 @@ in

  testScript = ''
    def instance_is_up(_) -> bool:
-        status, _ = machine.execute("incus exec container --disable-stdin --force-interactive /run/current-system/sw/bin/true")
+        status, _ = machine.execute("incus exec container --disable-stdin --force-interactive /run/current-system/sw/bin/systemctl -- is-system-running")
        return status == 0

    def set_container(config):
@ -81,11 +81,7 @@ in
        assert meminfo_bytes == "125000 kB", f"Wrong amount of memory reported from /proc/meminfo, want: '125000 kB', got: '{meminfo_bytes}'"

    with subtest("lxc-container generator configures plain container"):
-        machine.execute("incus delete --force container")
-        machine.succeed("incus launch nixos container")
-        with machine.nested("Waiting for instance to start and be usable"):
-          retry(instance_is_up)
-
+        # reuse the existing container to save some time
        machine.succeed("incus exec container test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")

    with subtest("lxc-container generator configures nested container"):
@ -103,8 +99,6 @@ in
        machine.succeed("incus launch nixos container --config security.privileged=true")
        with machine.nested("Waiting for instance to start and be usable"):
          retry(instance_is_up)
-        # give generator an extra second to run
-        machine.sleep(1)

        machine.succeed("incus exec container test -- -e /run/systemd/system/service.d/zzz-lxc-service.conf")
  '';
--- a/nixos/tests/incus/lxd-to-incus.nix
+++ b/nixos/tests/incus/lxd-to-incus.nix
@ -77,11 +77,11 @@ import ../make-test-python.nix (
        return ("inactive" in output)

      def lxd_instance_is_up(_) -> bool:
-          status, _ = machine.execute("lxc exec container --disable-stdin --force-interactive /run/current-system/sw/bin/true")
+          status, _ = machine.execute("lxc exec container --disable-stdin --force-interactive /run/current-system/sw/bin/systemctl -- is-system-running")
          return status == 0

      def incus_instance_is_up(_) -> bool:
-          status, _ = machine.execute("incus exec container --disable-stdin --force-interactive /run/current-system/sw/bin/true")
+          status, _ = machine.execute("incus exec container --disable-stdin --force-interactive /run/current-system/sw/bin/systemctl -- is-system-running")
          return status == 0

      with machine.nested("initialize lxd and resources"):
--- a/nixos/tests/incus/virtual-machine.nix
+++ b/nixos/tests/incus/virtual-machine.nix
@ -36,7 +36,7 @@ in

  testScript = ''
    def instance_is_up(_) -> bool:
-      status, _ = machine.execute("incus exec ${instance-name} --disable-stdin --force-interactive /run/current-system/sw/bin/true")
+      status, _ = machine.execute("incus exec ${instance-name} --disable-stdin --force-interactive /run/current-system/sw/bin/systemctl -- is-system-running")
      return status == 0

    machine.wait_for_unit("incus.service")
--- a/nixos/tests/kernel-rust.nix
+++ b/nixos/tests/kernel-rust.nix
@ -1,30 +1,43 @@
-{ pkgs, ... }: {
-  name = "kernel-rust";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ blitz ];
-  };
+{ system ? builtins.currentSystem
+, config ? { }
+, pkgs ? import ../.. { inherit system config; }
+}:

-  nodes.machine = { config, pkgs, ... }:
-    {
-      boot.kernelPackages = pkgs.linuxPackages_testing;
+let
+  inherit (pkgs.lib) const filterAttrs mapAttrs;

-      boot.extraModulePackages = [
-        config.boot.kernelPackages.rust-out-of-tree-module
-      ];
-
-      boot.kernelPatches = [
-        {
-          name = "Rust Support";
-          patch = null;
-          features = {
-            rust = true;
-          };
-        }
-      ];
+  kernelRustTest = kernelPackages: import ./make-test-python.nix ({ lib, ... }: {
+    name = "kernel-rust";
+    meta.maintainers = with lib.maintainers; [ blitz ma27 ];
+    nodes.machine = { config, ... }: {
+      boot = {
+        inherit kernelPackages;
+        extraModulePackages = [ config.boot.kernelPackages.rust-out-of-tree-module ];
+        kernelPatches = [
+          {
+            name = "Rust Support";
+            patch = null;
+            features = {
+              rust = true;
+            };
+          }
+        ];
+      };
    };
+    testScript = ''
+      machine.wait_for_unit("default.target")
+      machine.succeed("modprobe rust_out_of_tree")
+    '';
+  });

-  testScript = ''
-    machine.wait_for_unit("default.target")
-    machine.succeed("modprobe rust_out_of_tree")
-  '';
-}
+  kernels = {
+    inherit (pkgs.linuxKernel.packages) linux_testing;
+  }
+  // filterAttrs
+    (const (x: let
+      inherit (builtins.tryEval (
+        x.rust-out-of-tree-module or null != null
+      )) success value;
+    in success && value))
+    pkgs.linuxKernel.vanillaPackages;
+in mapAttrs (const kernelRustTest) kernels
--- a/pkgs/applications/audio/grandorgue/default.nix
+++ b/pkgs/applications/audio/grandorgue/default.nix
@ -1,18 +1,34 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, fftwFloat, alsa-lib
-, zlib, wavpack, wxGTK32, udev, jackaudioSupport ? false, libjack2
-, imagemagick, libicns, makeWrapper, Cocoa
-, includeDemo ? true }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, fftwFloat
+, alsa-lib
+, zlib
+, wavpack
+, wxGTK32
+, udev
+, jackaudioSupport ? false
+, libjack2
+, imagemagick
+, libicns
+, yaml-cpp
+, makeWrapper
+, Cocoa
+, includeDemo ? true
+}:

 stdenv.mkDerivation rec {
  pname = "grandorgue";
-  version = "3.11.0";
+  version = "3.14.0";

  src = fetchFromGitHub {
    owner = "GrandOrgue";
    repo = pname;
    rev = version;
    fetchSubmodules = true;
-    sha256 = "sha256-l1KqER/vkNwgKLXIFUzHnYLw2ivGNP7hRiKhIOzn7pw=";
+    hash = "sha256-kPz11V2yNmBe80egNLYxh/m2B1nDca3C5sGbEnrkqnw=";
  };

  postPatch = ''
@ -24,7 +40,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake pkg-config imagemagick libicns makeWrapper ];

-  buildInputs = [ fftwFloat zlib wavpack wxGTK32 ]
+  buildInputs = [ fftwFloat zlib wavpack wxGTK32 yaml-cpp ]
    ++ lib.optionals stdenv.isLinux [ alsa-lib udev ]
    ++ lib.optionals stdenv.isDarwin [ Cocoa ]
    ++ lib.optional jackaudioSupport libjack2;
@ -53,5 +69,6 @@ stdenv.mkDerivation rec {
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.unix;
    maintainers = [ lib.maintainers.puzzlewolf ];
+    mainProgram = "GrandOrgue";
  };
 }
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@ -10,6 +10,7 @@
 , fftw
 , gnutls
 , libcdio
+, libebur128
 , libmtp
 , libpthreadstubs
 , libtasn1
@ -34,21 +35,23 @@
 , gst_all_1
 , withVlc ? true
 , libvlc
+, nix-update-script
 }:

 let
-  inherit (lib) optionals;
+  inherit (lib) optionals optionalString;

 in
 stdenv.mkDerivation rec {
  pname = "strawberry";
-  version = "1.0.21";
+  version = "1.0.23";

  src = fetchFromGitHub {
    owner = "jonaski";
    repo = pname;
    rev = version;
-    hash = "sha256-McwnYHaw0LYDeHLDQzfqRIYMV2FoiMdHyOL/EE8/esU=";
+    hash = "sha256-hzZx530HD7R3JOG6cCsoaW9puYkmu7m5lr+EfobKX7o=";
+    fetchSubmodules = true;
  };

  # the big strawberry shown in the context menu is *very* much in your face, so use the grey version instead
@ -64,6 +67,7 @@ stdenv.mkDerivation rec {
    fftw
    gnutls
    libcdio
+    libebur128
    libidn2
    libmtp
    libpthreadstubs
@ -89,7 +93,7 @@ stdenv.mkDerivation rec {
    gst-plugins-good
    gst-plugins-bad
    gst-plugins-ugly
-  ]) ++ lib.optional withVlc libvlc;
+  ]) ++ optionals withVlc [ libvlc ];

  nativeBuildInputs = [
    cmake
@ -101,13 +105,15 @@ stdenv.mkDerivation rec {
    util-linux
  ];

-  postInstall = lib.optionalString withGstreamer ''
+  postInstall = optionalString withGstreamer ''
    qtWrapperArgs+=(
      --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
      --prefix GIO_EXTRA_MODULES : "${glib-networking.out}/lib/gio/modules"
    )
  '';

+  passthru.updateScript = nix-update-script { };
+
  meta = with lib; {
    description = "Music player and music collection organizer";
    homepage = "https://www.strawberrymusicplayer.org/";
--- a/pkgs/applications/blockchains/optimism/default.nix
+++ b/pkgs/applications/blockchains/optimism/default.nix
@ -6,19 +6,19 @@

 buildGoModule rec {
  pname = "optimism";
-  version = "1.1.6";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "ethereum-optimism";
    repo = "optimism";
    rev = "op-node/v${version}";
-    hash = "sha256-kzJ2zV4Iz3LqrVrs6mluiXluFqFaftycHhOAE8m0vns=";
+    hash = "sha256-fg63J1qgsQOTCLHgEWSI6ZxNf9XIPq+aYCumJ/FEx/s=";
    fetchSubmodules = true;
  };

  subPackages = [ "op-node/cmd" "op-proposer/cmd" "op-batcher/cmd" ];

-  vendorHash = "sha256-6ChcT8rgyxiory//EHNA0Q0AZRhUIDpe1pmVeQ66gA4=";
+  vendorHash = "sha256-9mLS44wzPslPfa+QwBg05+QSL6F0c8fcev1VOI9VPE4=";

  buildInputs = [
    libpcap
--- a/pkgs/applications/blockchains/optimism/geth.nix
+++ b/pkgs/applications/blockchains/optimism/geth.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "op-geth";
-  version = "1.101305.1";
+  version = "1.101305.3";

  src = fetchFromGitHub {
    owner = "ethereum-optimism";
    repo = "op-geth";
    rev = "v${version}";
-    hash = "sha256-4dsHYyoCkGGu68PiLw37y5yN5kNHroMruIIbnxl4uJE=";
+    hash = "sha256-AKVwwvt77FZlm7089EeayYVRYLo7c3v6LFVpsQN68Zk=";
    fetchSubmodules = true;
  };

@ -33,7 +33,7 @@ buildGoModule rec {
    "cmd/utils"
  ];

-  vendorHash = "sha256-lTkbdzRuWqgFl/8N0v9jH8+pVM2k87a/cQF22DqiAIE=";
+  vendorHash = "sha256-pcIydpKWZt3vwShwzGlPKGq+disdxYFOB8gxHou3mVU=";

  # Fix for usb-related segmentation faults on darwin
  propagatedBuildInputs =
--- a/pkgs/applications/emulators/citra/default.nix
+++ b/pkgs/applications/emulators/citra/default.nix
@ -15,13 +15,13 @@ let
 in {
  nightly = qt6Packages.callPackage ./generic.nix rec {
    pname = "citra-nightly";
-    version = "2070";
+    version = "2088";

    src = fetchFromGitHub {
      owner = "citra-emu";
      repo = "citra-nightly";
      rev = "nightly-${version}";
-      sha256 = "1rmc7dk7wzmxgkq7xsmx9wscszhcfr3mkvnykwgamrcb9bm8p5rb";
+      sha256 = "0l9w4i0zbafcv2s6pd1zqb11vh0i7gzwbqnzlz9al6ihwbsgbj3k";
      fetchSubmodules = true;
    };

@ -30,13 +30,13 @@ in {

  canary = qt6Packages.callPackage ./generic.nix rec {
    pname = "citra-canary";
-    version = "2740";
+    version = "2766";

    src = fetchFromGitHub {
      owner = "citra-emu";
      repo = "citra-canary";
      rev = "canary-${version}";
-      sha256 = "0m11xy0ad9sy7zsnwnb7vad3g0g78v747a1abp612ybg0aczwf9l";
+      sha256 = "1gm3ajphpzwhm3qnchsx77jyl51za8yw3r0j0h8idf9y1ilcjvi4";
      fetchSubmodules = true;
    };

--- a/pkgs/applications/graphics/lazpaint/default.nix
+++ b/pkgs/applications/graphics/lazpaint/default.nix
@ -1,30 +1,30 @@
 { lib, stdenv, fetchFromGitHub, lazarus, fpc, pango, cairo, glib
-, atk, gtk2, libX11, gdk-pixbuf, busybox, python3, makeWrapper }:
-
-with stdenv;
+, atk, gtk2, libX11, gdk-pixbuf, busybox, python3
+, makeWrapper
+}:

 let
  bgrabitmap = fetchFromGitHub {
    owner = "bgrabitmap";
    repo = "bgrabitmap";
-    rev = "v11.5.3";
-    sha256 = "sha256-qjBD9TVZQy1tKWHFWkuu6vdLjASzQb3+HRy0FLdd9a8=";
+    rev = "2814b069d55f726b9f3b4774d85d00dd72be9c05";
+    hash = "sha256-YibwdhlgjgI30gqYsKchgDPlOSpBiDBDJNlUDFMygGs=";
  };
  bgracontrols = fetchFromGitHub {
    owner = "bgrabitmap";
    repo = "bgracontrols";
-    rev = "v7.6";
-    sha256 = "sha256-btg9DMdYg+C8h0H7MU+uoo2Kb4OeLHoxFYHAv7LbLBA=";
+    rev = "v8.0";
+    hash = "sha256-5L05eGVN+xncd0/0XLFN6EL2ux4aAOsiU0BMoy0dKgg=";
  };
 in stdenv.mkDerivation rec {
  pname = "lazpaint";
-  version = "7.2.2";
+  version = "7.2.2-unstable-2024-01-20";

  src = fetchFromGitHub {
    owner = "bgrabitmap";
    repo = "lazpaint";
-    rev = "v${version}";
-    sha256 = "sha256-J6s0GnGJ7twEYW5+B72bB3EX4AYvLnhSPLbdhZWzlkw=";
+    rev = "fe54c2e2561c51218a5a2755842ce3fc2e0ebb35";
+    hash = "sha256-LaOTJiS+COJUlyJiN9H2kEKwv5lbJqOHsUXOnb+IQFA=";
  };

  nativeBuildInputs = [ lazarus fpc makeWrapper ];
@ -49,23 +49,16 @@ in stdenv.mkDerivation rec {
      lazpaint/lazpaint.lpi
  '';

-  installPhase = ''
-    # Reuse existing install script
-    substituteInPlace Makefile --replace "/bin/bash" $BASH
-    cd lazpaint/release/debian
-    substituteInPlace makedeb.sh --replace "rm -rf" "ls"
-    patchShebangs ./makedeb.sh
-    PATH=$PATH:${busybox}/bin ./makedeb.sh
-    cp -r staging/usr $out
-
+  postBuild = ''
    # Python is needed for scripts
-    makeWrapper $out/share/lazpaint/lazpaint $out/bin/lazpaint \
+    wrapProgram $out/bin/lazpaint \
      --prefix PATH : ${lib.makeBinPath [ python3 ]}
  '';

  meta = with lib; {
    description = "Image editor like PaintBrush or Paint.Net";
-    homepage = "https://sourceforge.net/projects/lazpaint/";
+    homepage = "https://lazpaint.github.io";
+    downloadPage = "https://github.com/bgrabitmap/lazpaint/";
    license = licenses.gpl3;
    platforms = platforms.linux;
    maintainers = with maintainers; [ ];
--- a/pkgs/applications/misc/gsctl/default.nix
+++ b/pkgs/applications/misc/gsctl/default.nix
@ -13,6 +13,15 @@ buildGoModule rec {

  vendorHash = "sha256-6b4H8YAY8d/qIGnnGPYZoXne1LXHLsc0OEq0lCeqivo=";

+  patches = [
+    ./go120-compatibility.patch
+  ];
+
+  postPatch = ''
+    # fails on sandbox
+    rm commands/root_test.go
+  '';
+
  ldflags = [
    "-s" "-w"
    "-X github.com/giantswarm/gsctl/buildinfo.Version=${version}"
--- a/pkgs/applications/misc/gsctl/go120-compatibility.patch
+++ b/pkgs/applications/misc/gsctl/go120-compatibility.patch
@ -0,0 +1,21 @@
+--- a/client/clienterror/matcher.go
+++ b/client/clienterror/matcher.go
+@@ -2,6 +2,7 @@ package clienterror
+ 
+ import (
+ 	"crypto/x509"
+	"errors"
+ 	"net/http"
+ 
+ 	"github.com/giantswarm/microerror"
+@@ -101,9 +102,7 @@ func IsServiceUnavailableError(err error) bool {
+ // a x509.UnknownAuthorityError
+ func IsCertificateSignedByUnknownAuthorityError(err error) bool {
+ 	if clientErr, ok := err.(*APIError); ok {
+-		if _, certErrorOK := clientErr.OriginalError.(x509.UnknownAuthorityError); certErrorOK {
+-			return true
+-		}
+		return errors.As(clientErr.OriginalError, &x509.UnknownAuthorityError{})
+ 	}
+ 
+ 	return false
--- a/pkgs/applications/misc/mob/default.nix
+++ b/pkgs/applications/misc/mob/default.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "mob";
-  version = "4.4.6";
+  version = "4.5.0";

  src = fetchFromGitHub {
    owner = "remotemobprogramming";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-UunFfP0Rn4t8lSJiubbqZ0bImK9OhIdC0gSGbkg6Ohw=";
+    sha256 = "sha256-uFtE7AprM/ye2sBQeszYy07RV7RmmqD9TGcTTuZwOfY=";
  };

  vendorHash = null;
--- a/pkgs/applications/misc/monitorcontrol/default.nix
+++ b/pkgs/applications/misc/monitorcontrol/default.nix
@ -1,19 +1,28 @@
-{ lib, fetchurl, stdenv, undmg }:
+{ lib, fetchurl, stdenv, _7zz }:

 # This cannot be built from source due to the problematic nature of XCode - so
 # this is what it's like when doves cry?

 stdenv.mkDerivation rec {
  pname = "MonitorControl";
-  version = "4.1.0";
+  version = "4.2.0";

  src = fetchurl {
    url =
      "https://github.com/MonitorControl/${pname}/releases/download/v${version}/MonitorControl.${version}.dmg";
-    sha256 = "iaxM9j78Sq1EH5TCY240N+D5bG6quk2dZj8T7nt9ATo=";
+    sha256 = "Q96uK6wVe1D2uLvWL+pFR6LcmrU7cgmr2Y5tPvvTDgI=";
  };

-  nativeBuildInputs = [ undmg ];
+  # MonitorControl.${version}.dmg is APFS formatted, unpack with 7zz
+  unpackCmd = ''
+    runHook preUnpack
+
+    7zz x $src
+
+    runHook postUnpack
+  '';
+
+  nativeBuildInputs = [ _7zz ];

  sourceRoot = "MonitorControl.app";

@ -27,7 +36,7 @@ stdenv.mkDerivation rec {
    longDescription = "Controls your external display brightness and volume and shows native OSD. Use menulet sliders or the keyboard, including native Apple keys!";
    homepage = "https://github.com/MonitorControl/MonitorControl#readme";
    license = licenses.mit;
-    maintainers = with maintainers; [ cbleslie ];
+    maintainers = with maintainers; [ cbleslie cottand ];
    platforms = platforms.darwin;
  };
 }
--- a/pkgs/applications/misc/remarkable/restream/default.nix
+++ b/pkgs/applications/misc/remarkable/restream/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "restream";
-  version = "1.2.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "rien";
    repo = pname;
-    rev = version;
-    sha256 = "0vyj0kng8c9inv2rbw1qdr43ic15s5x8fvk9mbw0vpc6g723x99g";
+    rev = "v${version}";
+    hash = "sha256-AXHKOfdIM3LsHF6u3M/lMhhcuPZADoEal7de3zlx7L4=";
  };

  dontConfigure = true;
--- a/pkgs/applications/misc/ttyper/default.nix
+++ b/pkgs/applications/misc/ttyper/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ttyper";
-  version = "1.4.0";
+  version = "1.4.1";

  src = fetchFromGitHub {
    owner = "max-niederman";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-kMJcZ9U2pUXFza66fpK07IHbRc5ZQ49+bytgty94o/s=";
+    hash = "sha256-IvAx65b2rGsMdDUhRxTx8cyqnG7oxC+MseCFIJil1e0=";
  };

-  cargoHash = "sha256-pmPT8GREXKun5uyGx+b6IATp/cKziZTL7YcYwKEo/NU=";
+  cargoHash = "sha256-o3J2bEAV5NnWKFadJdSGTqUS8K2qpBKPQz6xAbfLtg4=";

  meta = with lib; {
    description = "Terminal-based typing test";
--- a/pkgs/applications/misc/tui-journal/default.nix
+++ b/pkgs/applications/misc/tui-journal/default.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "tui-journal";
-  version = "0.8.1";
+  version = "0.8.2";

  src = fetchFromGitHub {
    owner = "AmmarAbouZor";
    repo = "tui-journal";
    rev = "v${version}";
-    hash = "sha256-1cCtWhWOzCezi29oQsa0L1LTIb87ITaJk0teDP2xV78=";
+    hash = "sha256-qHNB+jRLQoiHPuTblpCHg2+6e5j8W6YPsuygRlTidtE=";
  };

-  cargoHash = "sha256-uWxzJONzRDeZVuilpEj4KprF3PtjRhJk8C9zjs5yCvg=";
+  cargoHash = "sha256-T+fXSca1u9+c305yuKOF+soxnSZ1YbBs57wco5TLpQw=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -15,6 +15,7 @@
 , gnome
 , gsettings-desktop-schemas
 , gtk3
+, gtk4
 , libX11
 , libXScrnSaver
 , libXcomposite
@ -71,7 +72,7 @@ let

  deps = [
    alsa-lib at-spi2-atk at-spi2-core atk cairo cups dbus expat
-    fontconfig freetype gdk-pixbuf glib gtk3 libdrm libX11 libGL
+    fontconfig freetype gdk-pixbuf glib gtk3 gtk4 libdrm libX11 libGL
    libxkbcommon libXScrnSaver libXcomposite libXcursor libXdamage
    libXext libXfixes libXi libXrandr libXrender libxshmfence
    libXtst libuuid mesa nspr nss pango pipewire udev wayland
@ -111,7 +112,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    # needed for GSETTINGS_SCHEMAS_PATH
-    glib gsettings-desktop-schemas gtk3
+    glib gsettings-desktop-schemas gtk3 gtk4

    # needed for XDG_ICON_DIRS
    gnome.adwaita-icon-theme
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -238,16 +238,9 @@ let
      })
    ] ++ lib.optionals (chromiumVersionAtLeast "121") [
      # M121 is the first version to require the new rust toolchain.
-      # But we don't have that ready yet.
-      # So we have to revert the singular commit that requires rust toolchain.
-      # This works, because the code in question, the QR code generator, is present in
-      # two variants: c++ and rust. This workaround will not last.
-      # The c++ variant in question is deemed to be removed in a month (give or take).
-      (githubPatch {
-        revert = true;
-        commit = "bcf739b95713071687ff25010683248de0092f6a";
-        hash = "sha256-1ZPe45cc2bjnErcF3prbLMlYpU7kpuwDVcjewINQr+Q=";
-      })
+      # Partial revert of https://github.com/chromium/chromium/commit/3687976b0c6d36cf4157419a24a39f6770098d61
+      # allowing us to use our rustc and our clang.
+      ./patches/chromium-121-rust.patch
    ];

    postPatch = ''
@ -412,11 +405,15 @@ let
      # (ld.lld: error: unable to find library -l:libffi_pic.a):
      use_system_libffi = true;
      # Use nixpkgs Rust compiler instead of the one shipped by Chromium.
-      # We do intentionally not set rustc_version as nixpkgs will never do incremental
-      # rebuilds, thus leaving this empty is fine.
      rust_sysroot_absolute = "${buildPackages.rustc}";
-      # Building with rust is disabled for now - this matches the flags in other major distributions.
+      # Rust is enabled for M121+, see next section:
      enable_rust = false;
+    } // lib.optionalAttrs (chromiumVersionAtLeast "121") {
+      # M121 the first version to actually require a functioning rust toolchain
+      enable_rust = true;
+      # While we technically don't need the cache-invalidation rustc_version provides, rustc_version
+      # is still used in some scripts (e.g. build/rust/std/find_std_rlibs.py).
+      rustc_version = buildPackages.rustc.version;
    } // lib.optionalAttrs (!(stdenv.buildPlatform.canExecute stdenv.hostPlatform)) {
      # https://www.mail-archive.com/v8-users@googlegroups.com/msg14528.html
      arm_control_flow_integrity = "none";
@ -431,6 +428,13 @@ let
    } // lib.optionalAttrs ungoogled (lib.importTOML ./ungoogled-flags.toml)
    // (extraAttrs.gnFlags or {}));

+    # We cannot use chromiumVersionAtLeast in mkDerivation's env attrset due
+    # to infinite recursion when chromium.override is used (e.g. electron).
+    # To work aroud this, we use export in the preConfigure phase.
+    preConfigure = lib.optionalString (chromiumVersionAtLeast "121") ''
+      export RUSTC_BOOTSTRAP=1
+    '';
+
    configurePhase = ''
      runHook preConfigure

--- a/pkgs/applications/networking/browsers/chromium/patches/chromium-121-rust.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/chromium-121-rust.patch
@ -0,0 +1,19 @@
+--- a/build/config/compiler/BUILD.gn
+++ b/build/config/compiler/BUILD.gn
+@@ -1629,16 +1629,6 @@
+     configs += [ "//build/config/c++:runtime_library" ]
+   }
+
+-  # Rust and C++ both provide intrinsics for LLVM to call for math operations. We
+-  # want to use the C++ intrinsics, not the ones in the Rust compiler_builtins
+-  # library. The Rust symbols are marked as weak, so that they can be replaced by
+-  # the C++ symbols. This config ensures the C++ symbols exist and are strong in
+-  # order to cause that replacement to occur by explicitly linking in clang's
+-  # compiler-rt library.
+-  if (is_clang && toolchain_has_rust) {
+-    configs += [ "//build/config/clang:compiler_builtins" ]
+-  }
+-
+   # TODO(crbug.com/830987): Come up with a better name for is POSIX + Fuchsia
+   # configuration.
+   if (is_posix || is_fuchsia) {
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -15,9 +15,9 @@
        version = "2023-11-28";
      };
    };
-    hash = "sha256-2TMTLCqoCxdy9PDlZIUa/5oXjmim1T2/LJu+3/Kf4fQ=";
-    hash_deb_amd64 = "sha256-9vPQAiZPw60oILm0He4Iz9lOc+WvtHCBE9CHA1ejc7s=";
-    version = "121.0.6167.85";
+    hash = "sha256-pZHa4YSJ4rK24f7dNUFeoyf6nDSQeY4MTR81YzPKCtQ=";
+    hash_deb_amd64 = "sha256-cMoYBCuOYzXS7OzFvvBfSL80hBY/PcEv9kWGSx3mCKw=";
+    version = "121.0.6167.139";
  };
  ungoogled-chromium = {
    deps = {
@ -28,12 +28,12 @@
        version = "2023-11-28";
      };
      ungoogled-patches = {
-        hash = "sha256-Fopr+SiezOs3w52juXvMyfxOAzrVXrRO8j0744oeO5k=";
-        rev = "223fe76bb263a216341739ce2ee333752642cf47";
+        hash = "sha256-W13YPijmdakEJiUd9iKH3V9LcKvL796QlyTrAb+yLMQ=";
+        rev = "121.0.6167.139-1";
      };
    };
-    hash = "sha256-2TMTLCqoCxdy9PDlZIUa/5oXjmim1T2/LJu+3/Kf4fQ=";
-    hash_deb_amd64 = "sha256-9vPQAiZPw60oILm0He4Iz9lOc+WvtHCBE9CHA1ejc7s=";
-    version = "121.0.6167.85";
+    hash = "sha256-pZHa4YSJ4rK24f7dNUFeoyf6nDSQeY4MTR81YzPKCtQ=";
+    hash_deb_amd64 = "sha256-cMoYBCuOYzXS7OzFvvBfSL80hBY/PcEv9kWGSx3mCKw=";
+    version = "121.0.6167.139";
  };
 }
--- a/pkgs/applications/networking/browsers/floorp/default.nix
+++ b/pkgs/applications/networking/browsers/floorp/default.nix
@ -7,19 +7,19 @@

 ((buildMozillaMach rec {
  pname = "floorp";
-  packageVersion = "11.7.1";
+  packageVersion = "11.8.2";
  applicationName = "Floorp";
  binaryName = "floorp";

  # Must match the contents of `browser/config/version.txt` in the source tree
-  version = "115.6.0";
+  version = "115.7.0";

  src = fetchFromGitHub {
    owner = "Floorp-Projects";
    repo = "Floorp";
    fetchSubmodules = true;
    rev = "v${packageVersion}";
-    hash = "sha256-1GxWqibUR10gz0TjQuCtFntlxoNkq4CY5Yt/4FcIDDQ=";
+    hash = "sha256-bEHl+0MzvQNMCxOjBuFx92gwNr0spVA+on0znBUIhz0=";
  };

  extraConfigureFlags = [
--- a/pkgs/applications/networking/cluster/civo/default.nix
+++ b/pkgs/applications/networking/cluster/civo/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "civo";
-  version = "1.0.72";
+  version = "1.0.73";

  src = fetchFromGitHub {
    owner  = "civo";
    repo   = "cli";
    rev    = "v${version}";
-    sha256 = "sha256-UK/vxfasiRzU0WTLKPkGJSkOX0vpDy1OUwGyTmEwsB0=";
+    sha256 = "sha256-rLT4HvA0GjbZyiaiXFnG2iBK7O3S94wJL4jrkcFADFc=";
  };

-  vendorHash = "sha256-uKssj80EkuFS9UB0EZxEf7ZYk4hlnrKD5QKJnRMwV4o=";
+  vendorHash = "sha256-oqitgYSL7nf2Lyne0c2vHOSOEG5uHPH9+3lgiROK2Yc=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/cluster/kubedb-cli/default.nix
+++ b/pkgs/applications/networking/cluster/kubedb-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubedb-cli";
-  version = "0.40.1";
+  version = "0.41.0";

  src = fetchFromGitHub {
    owner = "kubedb";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-GGZjqXw0Fi5QdQjVrw//sDVA8oRKADCwHeRY22z7bko=";
+    sha256 = "sha256-P4B5N2hIDTYtrHk86n3MCvy6IXlDyAUc1wFhXmEkQFA=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/cluster/kubergrunt/default.nix
+++ b/pkgs/applications/networking/cluster/kubergrunt/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubergrunt";
-  version = "0.14.1";
+  version = "0.14.2";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = "kubergrunt";
    rev = "v${version}";
-    sha256 = "sha256-bPZZzvbHynW0FtfmE78agBDADmCyBS2a4E/K+tJHkQY=";
+    sha256 = "sha256-r2lx+R/TQxD/miCJK3V//N3gKiCrg/mneT9BS+ZqRiU=";
  };

  vendorHash = "sha256-K24y41qpuyBHqljUAtNQu3H8BNqznxYOsvEVo+57OtY=";
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
@ -2,7 +2,7 @@
 callPackage ./generic.nix {} rec {
  pname = "signal-desktop-beta";
  dir = "Signal Beta";
-  version = "6.44.0-beta.1";
+  version = "6.47.0-beta.1";
  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
-  hash = "sha256-SW/br1k7lO0hQngST0qV9Qol1hA9f1NZe86A5uyYhcI=";
+  hash = "sha256-9vbdWdV8dVFyxDMGLvE/uQKeSl+ze5agI5QYZMr84/w=";
 }
--- a/pkgs/applications/networking/ipfs-cluster/default.nix
+++ b/pkgs/applications/networking/ipfs-cluster/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "ipfs-cluster";
-  version = "1.0.7";
+  version = "1.0.8";

-  vendorHash = "sha256-/Kjm/hM+lKsZ6fzStDyOitp7Vtt7Vb8ak7E/W0lbW20=";
+  vendorHash = "sha256-uwDXUy9mh/DvLuwj8Htm55wla5/JjvZH5ztJbqnox+U=";

  src = fetchFromGitHub {
    owner = "ipfs-cluster";
    repo = "ipfs-cluster";
    rev = "v${version}";
-    hash = "sha256-eBbbD77nnjcumhrsixAlI09B1ZAxK5IOHoBeJGgj+TY=";
+    hash = "sha256-qZUoYJjw3Qac7Kmg5PfNWTDM8Ra3rqrbjScLbK6FRx4=";
  };

  meta = with lib; {
--- a/pkgs/applications/networking/weather/meteo/default.nix
+++ b/pkgs/applications/networking/weather/meteo/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "meteo";
-  version = "0.9.9.2";
+  version = "0.9.9.3";

  src = fetchFromGitLab {
    owner = "bitseater";
    repo = pname;
    rev = version;
-    sha256 = "sha256-9+FNpLjiX0zdsUnbBnNSLt/Ma/cqtclP25tl+faPlpU=";
+    sha256 = "sha256-hubKusrs0Hh8RryoEI29pnhTSNsIbtGMltlH4qoM6gE=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "PortfolioPerformance";
-  version = "0.67.2";
+  version = "0.67.3";

  src = fetchurl {
    url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-YmbnV5/wwaDiuDUTx00sIdbVgtqD8vtvpTNFxXutP3U=";
+    hash = "sha256-WqWrerEBaaXA9vhpVHEyMZdAxajeOPANFyUeK42cXUU=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@ -7,6 +7,7 @@
 , perl
 , blas
 , lapack
+, llvmPackages
 , mpi
 , cudaPackages
 , plumed
@ -77,7 +78,7 @@ in stdenv.mkDerivation rec {
    cudaPackages.cuda_cudart
    cudaPackages.libcufft
    cudaPackages.cuda_profiler_api
-  ];
+  ] ++ lib.optional stdenv.isDarwin llvmPackages.openmp;

  propagatedBuildInputs = lib.optional enableMpi mpi;
  propagatedUserEnvPkgs = lib.optional enableMpi mpi;
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -61,12 +61,17 @@ let
            rustPlatform.bindgenHook
          ];

+          disallowedReferences = [
+            rustc.unwrapped
+          ];
+
          preInstall = ''
            export CARGO_HOME="$PWD/../.cargo/"
          '';

          postInstall = ''
            mv -v $GEM_HOME/gems/${attrs.gemName}-${attrs.version}/lib/{glfm_markdown/glfm_markdown.so,}
+            find $out -type f -name .rustc_info.json -delete
          '';
        };
      };
--- a/pkgs/applications/video/stremio/default.nix
+++ b/pkgs/applications/video/stremio/default.nix
@ -4,19 +4,19 @@

 stdenv.mkDerivation rec {
  pname = "stremio-shell";
-  version = "4.4.142";
+  version = "4.4.165";

  src = fetchFromGitHub {
    owner = "Stremio";
    repo = pname;
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-OyuTFmEIC8PH4PDzTMn8ibLUAzJoPA/fTILee0xpgQI=";
+    sha256 = "sha256-Gky0/HaGm11PeV4twoQV71T99NG2o0mYzQxu/c9x5oE=";
  };

  server = fetchurl {
    url = "https://s3-eu-west-1.amazonaws.com/stremio-artifacts/four/v${version}/server.js";
-    sha256 = "sha256-YYeD3SEbLgNQHGP5AI9WiHUU6xLkTeFAqYIuWsIsYSs=";
+    sha256 = "sha256-52Pg0PrV15arGqhD3rXYCl1J6kcoL+/BHRvgiQBO/OA=";
  };

  buildInputs = [ qtwebengine mpv ];
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -62,13 +62,13 @@ let
 in
 buildGoModule rec {
  pname = "podman";
-  version = "4.9.0";
+  version = "4.9.1";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman";
    rev = "v${version}";
-    hash = "sha256-ygYBSZdxpE3HrFz585p7NFgHHSAfxAce/fFCQ7fcvgk=";
+    hash = "sha256-G5LTxBzBn+JFQzhzpsphqTcqq5bi+WjmjsOtJvSxO3k=";
  };

  patches = [
--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@ -14,13 +14,13 @@

 buildGoModule rec {
  pname = "runc";
-  version = "1.1.11";
+  version = "1.1.12";

  src = fetchFromGitHub {
    owner = "opencontainers";
    repo = "runc";
    rev = "v${version}";
-    hash = "sha256-3LZWidINg15Aqoswml/BY7ZmLvz0XsbtYV5Cx8h5lpM=";
+    hash = "sha256-N77CU5XiGYIdwQNPFyluXjseTeaYuNJ//OsEUS0g/v0=";
  };

  vendorHash = null;
--- a/pkgs/applications/virtualization/youki/default.nix
+++ b/pkgs/applications/virtualization/youki/default.nix
@ -10,15 +10,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "youki";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchFromGitHub {
    owner = "containers";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-BZhg4VhJbAo6XO4w01zguodyr3KEbav+PON0aOmi2bI=";
+    hash = "sha256-/cc+gHnakxC446MxErvgCDvc1gMWNi45h6fZ1Cd1Pj0=";
  };

+  cargoPatches = [
+    ./fix-cargo-lock.patch
+  ];
+
  nativeBuildInputs = [ pkg-config installShellFiles ];

  buildInputs = [ dbus libseccomp systemd ];
@ -33,7 +37,7 @@ rustPlatform.buildRustPackage rec {
  cargoBuildFlags = [ "-p" "youki" ];
  cargoTestFlags = [ "-p" "youki" ];

-  cargoHash = "sha256-IkL0gS3hht1XBnOy0YHO02vfw4sljtwfNImfojiLIE4=";
+  cargoHash = "sha256-PKn448fOCnyMC42NtQnLt8kvZIBautsq4Fw/bRvwmpw=";

  meta = with lib; {
    description = "A container runtime written in Rust";
--- a/pkgs/applications/virtualization/youki/fix-cargo-lock.patch
+++ b/pkgs/applications/virtualization/youki/fix-cargo-lock.patch
@ -0,0 +1,40 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index cfef78c0..7cad3faa 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -1879,7 +1879,7 @@ checksum = "13e3bf6590cbc649f4d1a3eefc9d5d6eb746f5200ffb04e5e142700b8faa56e7"
+ 
+ [[package]]
+ name = "libcgroups"
+-version = "0.3.1"
+version = "0.3.2"
+ dependencies = [
+  "anyhow",
+  "clap",
+@@ -1904,7 +1904,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "libcontainer"
+-version = "0.3.1"
+version = "0.3.2"
+ dependencies = [
+  "anyhow",
+  "bitflags 2.4.2",
+@@ -1947,7 +1947,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "liboci-cli"
+-version = "0.3.1"
+version = "0.3.2"
+ dependencies = [
+  "clap",
+ ]
+@@ -5712,7 +5712,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "youki"
+-version = "0.3.1"
+version = "0.3.2"
+ dependencies = [
+  "anyhow",
+  "caps",
--- a/pkgs/applications/window-managers/fbpanel/default.nix
+++ b/pkgs/applications/window-managers/fbpanel/default.nix
@ -1,30 +1,51 @@
-{ lib, stdenv, fetchurl, pkg-config
-, libX11, libXmu, libXpm, gtk2, libpng, libjpeg, libtiff, librsvg, gdk-pixbuf, gdk-pixbuf-xlib
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, libX11
+, libXmu
+, libXpm
+, gtk2
+, libpng
+, libjpeg
+, libtiff
+, librsvg
+, gdk-pixbuf
+, gdk-pixbuf-xlib
+, pypy2
 }:

 stdenv.mkDerivation rec {
  pname = "fbpanel";
-  version = "6.1";
-  src = fetchurl {
-    url = "mirror://sourceforge/fbpanel/${pname}-${version}.tbz2";
-    sha256 = "e14542cc81ea06e64dd4708546f5fd3f5e01884c3e4617885c7ef22af8cf3965";
+  version = "7.0";
+  src = fetchFromGitHub {
+    owner = "aanatoly";
+    repo = "fbpanel";
+    rev = "478754b687e2b48b111507ea22e8e2a001be5199";
+    hash = "sha256-+KcVcrh1aV6kjLGyiDnRHXSzJfelXWrhJS0DitG4yPA=";
  };
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [ libX11 libXmu libXpm gtk2 libpng libjpeg libtiff librsvg gdk-pixbuf gdk-pixbuf-xlib.dev ];
+  nativeBuildInputs = [ pkg-config pypy2 ];
+  buildInputs = [
+    libX11
+    libXmu
+    libXpm
+    gtk2
+    libpng
+    libjpeg
+    libtiff
+    librsvg
+    gdk-pixbuf
+    gdk-pixbuf-xlib.dev
+  ];

-  preConfigure = "patchShebangs .";
-
-  postConfigure = ''
-    substituteInPlace config.mk \
-      --replace "CFLAGSX =" "CFLAGSX = -I${gdk-pixbuf-xlib.dev}/include/gdk-pixbuf-2.0"
+  preConfigure = ''
+    sed -re '1i#!${pypy2}/bin/pypy' -i configure .config/*.py
+    sed -re 's/\<out\>/outputredirect/g' -i .config/rules.mk
+    sed -i 's/struct\ \_plugin_instance \*stam\;//' panel/plugin.h
  '';

-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: plugin.o:(.bss+0x0): multiple definition of `stam'; panel.o:(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-  NIX_LDFLAGS="-lX11";
+  makeFlags = ["V=1"];
+  NIX_CFLAGS_COMPILE = ["-Wno-error" "-I${gdk-pixbuf-xlib.dev}/include/gdk-pixbuf-2.0"];

  meta = with lib; {
    description = "A stand-alone panel";
@ -34,9 +55,4 @@ stdenv.mkDerivation rec {
    mainProgram = "fbpanel";
  };

-  passthru = {
-    updateInfo = {
-      downloadPage = "fbpanel.sourceforge.net";
-    };
-  };
 }
--- a/pkgs/applications/window-managers/miriway/default.nix
+++ b/pkgs/applications/window-managers/miriway/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "miriway";
-  version = "unstable-2024-01-26";
+  version = "unstable-2024-01-30";

  src = fetchFromGitHub {
    owner = "Miriway";
    repo = "Miriway";
-    rev = "d2c773d28adbbbc07bdbb3bb4ab74172fa231846";
-    hash = "sha256-eypHMFnnDOh87/VbZBunuLhfjilnJMNi+ZRvtWBmsyU=";
+    rev = "429ace6c7d9ea6799a01875ff61f1e554d5eabd9";
+    hash = "sha256-8qsDyHbJJMxevMIi6Kde+zr2yJAtFaq19TTcAGXMnrE=";
  };

  strictDeps = true;
--- a/pkgs/build-support/fetchgithub/default.nix
+++ b/pkgs/build-support/fetchgithub/default.nix
@ -28,7 +28,11 @@ let
  useFetchGit = fetchSubmodules || (leaveDotGit == true) || deepClone || forceFetchGit || (sparseCheckout != []);
  # We prefer fetchzip in cases we don't need submodules as the hash
  # is more stable in that case.
-  fetcher = if useFetchGit then fetchgit else fetchzip.override { withUnzip = false; };
+  fetcher =
+    if useFetchGit then fetchgit
+    # fetchzip may not be overridable when using external tools, for example nix-prefetch
+    else if fetchzip ? override then fetchzip.override { withUnzip = false; }
+    else fetchzip;
  privateAttrs = lib.optionalAttrs private {
    netrcPhase = ''
      if [ -z "''$${varBase}USERNAME" -o -z "''$${varBase}PASSWORD" ]; then
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@ -152,19 +152,21 @@ rec {
    , meta ? { }
    , allowSubstitutes ? false
    , preferLocalBuild ? true
+    , derivationArgs ? { } # Extra arguments to pass to `stdenv.mkDerivation`
    }:
    let
      matches = builtins.match "/bin/([^/]+)" destination;
    in
    runCommand name
-      {
+      ({
        inherit text executable checkPhase allowSubstitutes preferLocalBuild;
-        passAsFile = [ "text" ];
+        passAsFile = [ "text" ]
+          ++ derivationArgs.passAsFile or [ ];
        meta = lib.optionalAttrs (executable && matches != null)
          {
            mainProgram = lib.head matches;
-          } // meta;
-      }
+          } // meta // derivationArgs.meta or {};
+      } // removeAttrs derivationArgs [ "passAsFile" "meta" ])
      ''
        target=$out${lib.escapeShellArg destination}
        mkdir -p "$(dirname "$target")"
@ -238,53 +240,94 @@ rec {
      meta.mainProgram = name;
    };

-  /*
-    Similar to writeShellScriptBin and writeScriptBin.
-    Writes an executable Shell script to /nix/store/<store path>/bin/<name> and
-    checks its syntax with shellcheck and the shell's -n option.
-    Individual checks can be foregone by putting them in the excludeShellChecks
-    list, e.g. [ "SC2016" ].
-    Automatically includes sane set of shellopts (errexit, nounset, pipefail)
-    and handles creation of PATH based on runtimeInputs
-
-    Note that the checkPhase uses stdenv.shell for the test run of the script,
-    while the generated shebang uses runtimeShell. If, for whatever reason,
-    those were to mismatch you might lose fidelity in the default checks.
-
-    Example:
-
-    Writes my-file to /nix/store/<store path>/bin/my-file and makes executable.
-
-
-    writeShellApplication {
-      name = "my-file";
-      runtimeInputs = [ curl w3m ];
-      text = ''
-        curl -s 'https://nixos.org' | w3m -dump -T text/html
-       '';
-    }
-
-  */
+  # See doc/build-helpers/trivial-build-helpers.chapter.md
+  # or https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-text-writing
  writeShellApplication =
-    { name
-    , text
-    , runtimeInputs ? [ ]
-    , meta ? { }
-    , checkPhase ? null
-    , excludeShellChecks ? [ ]
+    {
+      /*
+         The name of the script to write.
+
+         Type: String
+       */
+      name,
+      /*
+         The shell script's text, not including a shebang.
+
+         Type: String
+       */
+      text,
+      /*
+         Inputs to add to the shell script's `$PATH` at runtime.
+
+         Type: [String|Derivation]
+       */
+      runtimeInputs ? [ ],
+      /*
+         Extra environment variables to set at runtime.
+
+         Type: AttrSet
+       */
+      runtimeEnv ? null,
+      /*
+         `stdenv.mkDerivation`'s `meta` argument.
+
+         Type: AttrSet
+       */
+      meta ? { },
+      /*
+         The `checkPhase` to run. Defaults to `shellcheck` on supported
+         platforms and `bash -n`.
+
+         The script path will be given as `$target` in the `checkPhase`.
+
+         Type: String
+       */
+      checkPhase ? null,
+      /*
+         Checks to exclude when running `shellcheck`, e.g. `[ "SC2016" ]`.
+
+         See <https://www.shellcheck.net/wiki/> for a list of checks.
+
+         Type: [String]
+       */
+      excludeShellChecks ? [ ],
+      /*
+         Bash options to activate with `set -o` at the start of the script.
+
+         Defaults to `[ "errexit" "nounset" "pipefail" ]`.
+
+         Type: [String]
+       */
+      bashOptions ? [ "errexit" "nounset" "pipefail" ],
+      /* Extra arguments to pass to `stdenv.mkDerivation`.
+
+         :::{.caution}
+         Certain derivation attributes are used internally,
+         overriding those could cause problems.
+         :::
+
+         Type: AttrSet
+       */
+      derivationArgs ? { },
    }:
    writeTextFile {
-      inherit name meta;
+      inherit name meta derivationArgs;
      executable = true;
      destination = "/bin/${name}";
      allowSubstitutes = true;
      preferLocalBuild = false;
      text = ''
        #!${runtimeShell}
-        set -o errexit
-        set -o nounset
-        set -o pipefail
-      '' + lib.optionalString (runtimeInputs != [ ]) ''
+        ${lib.concatMapStringsSep "\n" (option: "set -o ${option}") bashOptions}
+      '' + lib.optionalString (runtimeEnv != null)
+        (lib.concatStrings
+          (lib.mapAttrsToList
+            (name: value: ''
+              ${lib.toShellVar name value}
+              export ${name}
+            '')
+            runtimeEnv))
+      + lib.optionalString (runtimeInputs != [ ]) ''

        export PATH="${lib.makeBinPath runtimeInputs}:$PATH"
      '' + ''
--- a/pkgs/build-support/trivial-builders/test/writeShellApplication.nix
+++ b/pkgs/build-support/trivial-builders/test/writeShellApplication.nix
@ -1,29 +1,141 @@
-/*
-  Run with:
-
-      cd nixpkgs
-      nix-build -A tests.trivial-builders.writeShellApplication
-*/
-
-{ lib, writeShellApplication, runCommand }:
+# Run with:
+# nix-build -A tests.trivial-builders.writeShellApplication
+{ writeShellApplication
+, writeTextFile
+, runCommand
+, lib
+, linkFarm
+, diffutils
+, hello
+}:
 let
-  pkg = writeShellApplication {
-    name = "test-script";
+  checkShellApplication = args@{name, expected, ...}:
+    let
+      writeShellApplicationArgs = builtins.removeAttrs args ["expected"];
+      script = writeShellApplication writeShellApplicationArgs;
+      executable = lib.getExe script;
+      expected' = writeTextFile {
+        name = "${name}-expected";
+        text = expected;
+      };
+      actual = "${name}-actual";
+    in
+    runCommand name { } ''
+      echo "Running test executable ${name}"
+      ${executable} > ${actual}
+      echo "Got output from test executable:"
+      cat ${actual}
+      echo "Checking test output against expected output:"
+      ${diffutils}/bin/diff --color --unified ${expected'} ${actual}
+      touch $out
+    '';
+in
+linkFarm "writeShellApplication-tests" {
+  test-meta =
+    let
+      script = writeShellApplication {
+        name = "test-meta";
+        text = "";
+        meta.description = "A test for the `writeShellApplication` `meta` argument.";
+      };
+    in
+    assert script.meta.mainProgram == "test-meta";
+    assert script.meta.description == "A test for the `writeShellApplication` `meta` argument.";
+    script;
+
+  test-runtime-inputs =
+    checkShellApplication {
+      name = "test-runtime-inputs";
+      text = ''
+        hello
+      '';
+      runtimeInputs = [ hello ];
+      expected = "Hello, world!\n";
+    };
+
+  test-runtime-env =
+    checkShellApplication {
+      name = "test-runtime-env";
+      runtimeEnv = {
+        MY_COOL_ENV_VAR = "my-cool-env-value";
+        MY_OTHER_COOL_ENV_VAR = "my-other-cool-env-value";
+        # Check that we can serialize a bunch of different types:
+        BOOL = true;
+        INT = 1;
+        LIST = [1 2 3];
+        MAP = {
+          a = "a";
+          b = "b";
+        };
+      };
+      text = ''
+        echo "$MY_COOL_ENV_VAR"
+        echo "$MY_OTHER_COOL_ENV_VAR"
+      '';
+      expected = ''
+        my-cool-env-value
+        my-other-cool-env-value
+      '';
+    };
+
+  test-check-phase =
+    checkShellApplication {
+      name = "test-check-phase";
+      text = "";
+      checkPhase = ''
+        echo "echo -n hello" > $target
+      '';
+      expected = "hello";
+    };
+
+  test-argument-forwarding =
+    checkShellApplication {
+      name = "test-argument-forwarding";
+      text = "";
+      derivationArgs.MY_BUILD_TIME_VARIABLE = "puppy";
+      derivationArgs.postCheck = ''
+        if [[ "$MY_BUILD_TIME_VARIABLE" != puppy ]]; then
+          echo "\$MY_BUILD_TIME_VARIABLE is not set to 'puppy'!"
+          exit 1
+        fi
+      '';
+      meta.description = "A test checking that `writeShellApplication` forwards extra arguments to `stdenv.mkDerivation`.";
+      expected = "";
+    };
+
+  test-exclude-shell-checks = writeShellApplication {
+    name = "test-exclude-shell-checks";
    excludeShellChecks = [ "SC2016" ];
    text = ''
-      echo -e '#!/usr/bin/env bash\n' \
-       'echo "$SHELL"' > /tmp/something.sh  # this line would normally
-                                            # ...cause shellcheck error
+      # Triggers SC2016: Expressions don't expand in single quotes, use double
+      # quotes for that.
+      echo '$SHELL'
    '';
  };
-in
-  assert pkg.meta.mainProgram == "test-script";
-  runCommand "test-writeShellApplication" { } ''

-    echo Testing if writeShellApplication builds without shellcheck error...
+  test-bash-options-pipefail = checkShellApplication {
+    name = "test-bash-options-pipefail";
+    text = ''
+      touch my-test-file
+      echo puppy | grep doggy | sed 's/doggy/puppy/g'
+      #            ^^^^^^^^^^ This will fail.
+      true
+    '';
+    # Don't use `pipefail`:
+    bashOptions = ["errexit" "nounset"];
+    expected = "";
+  };

-    target=${lib.getExe pkg}
-
-    touch $out
-  ''
+  test-bash-options-nounset = checkShellApplication {
+    name = "test-bash-options-nounset";
+    text = ''
+      echo -n "$someUndefinedVariable"
+    '';
+    # Don't use `nounset`:
+    bashOptions = [];
+    # Don't warn about the undefined variable at build time:
+    excludeShellChecks = [ "SC2154" ];
+    expected = "";
+  };

+}
--- a/pkgs/by-name/al/alsa-tools/package.nix
+++ b/pkgs/by-name/al/alsa-tools/package.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "alsa-tools";
-  version = "1.2.5";
+  version = "1.2.11";

  src = fetchurl {
    url = "mirror://alsa/tools/alsa-tools-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-NacQJ6AfTX3kci4iNSDpQN5os8VwtsZxaRVnrij5iT4=";
+    hash = "sha256-CRXJY0pQL9NlXKnFdNJZvJ55mD2R1Frqz/bzwA+K4+k=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/al/alvr/package.nix
+++ b/pkgs/by-name/al/alvr/package.nix
@ -0,0 +1,36 @@
+{ lib,
+  appimageTools,
+  fetchurl,
+}:
+let
+  pname = "alvr";
+  version = "20.6.1";
+  src = fetchurl {
+    url = "https://github.com/alvr-org/ALVR/releases/download/v${version}/ALVR-x86_64.AppImage";
+    hash = "sha256-IYw3D18xUGWiFu74c4d8d4tohZztAD6mmZCYsDNxR+A=";
+  };
+
+  appimageContents = appimageTools.extractType2 { inherit pname version src; };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraInstallCommands = ''
+    mv $out/bin/alvr-${version} $out/bin/alvr
+
+    install -Dm444 ${appimageContents}/alvr.desktop -t $out/share/applications
+    substituteInPlace $out/share/applications/alvr.desktop \
+      --replace 'Exec=alvr_dashboard' 'Exec=alvr'
+    cp -r ${appimageContents}/usr/share/icons $out/share
+  '';
+
+  meta = with lib; {
+    description = "Stream VR games from your PC to your headset via Wi-Fi";
+    homepage = "https://github.com/alvr-org/ALVR/";
+    changelog = "https://github.com/alvr-org/ALVR/releases/tag/v${version}";
+    license = licenses.mit;
+    mainProgram = "alvr";
+    maintainers = with maintainers; [ passivelemon ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ast-grep";
-  version = "0.17.0";
+  version = "0.18.1";

  src = fetchFromGitHub {
    owner = "ast-grep";
    repo = "ast-grep";
    rev = version;
-    hash = "sha256-/lWvFYSE4gFbVPlJMROGcb86mVviGdh1tFAY74qTTX4=";
+    hash = "sha256-hr6VAqBsv3szVClR93y5ickkrNKjvl6BfzqKA3zc6vM=";
  };

-  cargoHash = "sha256-r1vfh2JtBjWFgXrijlFxPyRr8LRAIogiA2TZHI5MJRM=";
+  cargoHash = "sha256-ttJMtaQfVnFj4/wUz4fn8X/EmUwW+usqhmWhy4Y0AB8=";

  # Work around https://github.com/NixOS/nixpkgs/issues/166205.
  env = lib.optionalAttrs stdenv.cc.isClang {
--- a/pkgs/by-name/ca/cargo-xwin/package.nix
+++ b/pkgs/by-name/ca/cargo-xwin/package.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-xwin";
-  version = "0.16.3";
+  version = "0.16.4";

  src = fetchFromGitHub {
    owner = "rust-cross";
    repo = "cargo-xwin";
    rev = "v${version}";
-    hash = "sha256-3i/XlCuHjVBSH4XZR5M457H+kheKZoJXlwqRwPhSnCM=";
+    hash = "sha256-nJgy9KoqrCD4NGFOJMN9f1XDyIrZ0a5WHTRX6G/+tnU=";
  };

-  cargoHash = "sha256-yKoUcrAZy66qahDvRgOnbJmXuUXDjDBTGt2p5gXjVyI=";
+  cargoHash = "sha256-JCCL/QV1DjmXTY3UChZ4BfA9VSyOTQLIfh6DSF/kIuA=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.Security
--- a/pkgs/by-name/fi/files-cli/package.nix
+++ b/pkgs/by-name/fi/files-cli/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "files-cli";
-  version = "2.12.25";
+  version = "2.12.27";

  src = fetchFromGitHub {
    repo = "files-cli";
    owner = "files-com";
    rev = "v${version}";
-    hash = "sha256-gsZawXXLesMHr3DU0cowrAcYdtuoosmTLws8SBSFKOY=";
+    hash = "sha256-MKW5jvdSd41nuz9oTP6sMzBo+TnNxE/+86KoPHRogBM=";
  };

-  vendorHash = "sha256-MomEyp81wMQbq4x+CFRoS7hn5fNw3NTAVQVzSd1dr+s=";
+  vendorHash = "sha256-rJtcocjH6GFmiDs7IizCMt/51RbHmvXdIIlWRETg6tg=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ga/galerio/package.nix
+++ b/pkgs/by-name/ga/galerio/package.nix
@ -0,0 +1,23 @@
+{ lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "galerio";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "dbrgn";
+    repo = "galerio";
+    rev = "v${version}";
+    hash = "sha256-JR/YfMUs5IHBRr3uYqHXLNcr23YHyDvgH2y/1ip+2Y8=";
+  };
+
+  cargoHash = "sha256-nYaCN09LP/2MfNRY8oZKtjzFCBFCeRF1IZ2ZBmbHg7I=";
+
+  meta = with lib; {
+    description = " A simple generator for self-contained HTML flexbox galleries";
+    homepage = "https://github.com/dbrgn/galerio";
+    maintainers = with maintainers; [ dbrgn ];
+    license = with licenses; [ asl20 mit ];
+    mainProgram = "galerio";
+  };
+}
--- a/pkgs/by-name/ge/geist-font/package.nix
+++ b/pkgs/by-name/ge/geist-font/package.nix
@ -0,0 +1,43 @@
+{ lib
+, stdenvNoCC
+, fetchzip
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "geist-font";
+  version = "1.1.0";
+
+  srcs = [
+    (fetchzip {
+      name = "geist-mono";
+      url = "https://github.com/vercel/geist-font/releases/download/${version}/Geist.Mono.zip";
+      stripRoot = false;
+      hash = "sha256-8I4O2+bJAlUiDIhbyXzAcwXP5qpmHoh4IfrFio7IZN8=";
+    })
+    (fetchzip {
+      name = "geist-sans";
+      url = "https://github.com/vercel/geist-font/releases/download/${version}/Geist.zip";
+      stripRoot = false;
+      hash = "sha256-nSN+Ql5hTd230w/u6VZyAZaPtFSaHGmMc6T1fgGTCME=";
+    })
+  ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 geist-{mono,sans}/*/*.otf -t $out/share/fonts/opentype
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Font family created by Vercel in collaboration with Basement Studio";
+    homepage = "https://vercel.com/font";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ eclairevoyant x0ba ];
+    platforms = lib.platforms.all;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+  };
+}
--- a/pkgs/by-name/in/invidtui/package.nix
+++ b/pkgs/by-name/in/invidtui/package.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "invidtui";
-  version = "0.3.7";
+  version = "0.3.8";

  src = fetchFromGitHub {
    owner = "darkhz";
    repo = "invidtui";
    rev = "refs/tags/v${version}";
-    hash = "sha256-bzstO6xaVdu7u1vBgwUjnJ9CEep0UHT73FbybBRd8y8=";
+    hash = "sha256-m2ygORf6GIJZXYYJKy6i12wDEkxQywtYdCutHeiyNYY=";
  };

-  vendorHash = "sha256-F0Iyy8H6ZRYiAlMdYGQS2p2hFN9ICmfTiRP/F9kpW7c=";
+  vendorHash = "sha256-HQ6JHXiqawDwSV48/Czbao4opnuz1LqIBdcObrkCfNs=";

  doCheck = true;

--- a/pkgs/by-name/le/legba/package.nix
+++ b/pkgs/by-name/le/legba/package.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "legba";
-  version = "0.7.1";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "evilsocket";
    repo = "legba";
    rev = "v${version}";
-    hash = "sha256-7HDW5M0lsKbcQw3p/CYmUeX2xE4BZXUSNqa9Ab/ZP0I=";
+    hash = "sha256-yevQEbDuVaSsSfA3ug9rDeWtGjMvS+uD7qHguRVt4sg=";
  };

-  cargoHash = "sha256-rkqwc8BILW/OIHa95skkG4IDlBfH3qX1ROJgcn8f2W0=";
+  cargoHash = "sha256-UBt4FP5zW+dijneHNaFJ80Ui5R+m+8aSwHTcqKDeEVg=";

  nativeBuildInputs = [ cmake pkg-config ];
  buildInputs = [ openssl.dev samba ];
--- a/pkgs/by-name/lo/louvain-community/package.nix
+++ b/pkgs/by-name/lo/louvain-community/package.nix
@ -2,21 +2,24 @@
 , fetchFromGitHub
 , cmake
 , lib
+, unstableGitUpdater
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "louvain-community";
-  version = "unstable-2021-03-18";
+  version = "unstable-2024-01-30";

  src = fetchFromGitHub {
    owner = "meelgroup";
    repo = "louvain-community";
-    rev = "8cc5382d4844af127b1c1257373740d7e6b76f1e";
-    hash = "sha256-0i3wrDdOyleOPv5iVO1YzPfTPnIdljLabCvl3SYEQOs=";
+    rev = "681a711a530ded0b25af72ee4881d453a80ac8ac";
+    hash = "sha256-mp2gneTtm/PaCqz4JNOZgdKmFoV5ZRVwNYjHc4s2KuY=";
  };

  nativeBuildInputs = [ cmake ];

+  passthru.updateScript = unstableGitUpdater {};
+
  meta = with lib; {
    description = "Louvain Community Detection Library";
    homepage = "https://github.com/meelgroup/louvain-community";
--- a/pkgs/by-name/ne/net-cpp/package.nix
+++ b/pkgs/by-name/ne/net-cpp/package.nix
@ -16,6 +16,7 @@
 , process-cpp
 , properties-cpp
 , python3
+, validatePkgConfig
 }:

 let
@ -25,13 +26,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "net-cpp";
-  version = "3.1.0";
+  version = "3.1.1";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/lib-cpp/net-cpp";
    rev = finalAttrs.version;
-    hash = "sha256-qXKuFLmtPjdqTcBIM07xbRe3DnP7AzieCy7Tbjtl0uc=";
+    hash = "sha256-MSqdP3kGI9hDdxFv2a0yd5ZkFkf1lMurB+KDIZLR9jg=";
  };

  outputs = [
@ -41,22 +42,6 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  patches = [
-    # Enable disabling of Werror
-    # Remove when version > 3.1.0
-    (fetchpatch {
-      name = "0001-net-cpp-Add-ENABLE_WERROR-option.patch";
-      url = "https://gitlab.com/ubports/development/core/lib-cpp/net-cpp/-/commit/0945180aa6dd38245688d5ebc11951b272e93dc4.patch";
-      hash = "sha256-91YuEgV+Q9INN4BJXYwWgKUNHHtUYz3CG+ROTy24GIE=";
-    })
-
-    # Enable opting out of tests
-    # https://gitlab.com/ubports/development/core/lib-cpp/net-cpp/-/merge_requests/14
-    (fetchpatch {
-      name = "0002-net-cpp-Make-tests-optional.patch";
-      url = "https://gitlab.com/OPNA2608/net-cpp/-/commit/cfbcd55446a4224a4c913ead3a370cd56d07a71b.patch";
-      hash = "sha256-kt48txzmWNXyxvx3DWAJl7I90c+o3KlgveNQjPkhfxA=";
-    })
-
    # Be more lenient with how quickly HTTP test server must be up, for slower hardware / archs
    (fetchpatch {
      url = "https://salsa.debian.org/ubports-team/net-cpp/-/raw/941d9eceaa66a06eabb1eb79554548b47d4a60ab/debian/patches/1007_wait-for-flask.patch";
@ -76,6 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
    cmake
    doxygen
    graphviz
+    validatePkgConfig
  ];

  buildInputs = [
@ -98,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {

  cmakeFlags = [
    # https://gitlab.com/ubports/development/core/lib-cpp/net-cpp/-/issues/4
-    "-DENABLE_WERROR=OFF"
+    (lib.cmakeBool "ENABLE_WERROR" false)
  ];

  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
@ -114,6 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = with lib; {
    description = "Simple yet beautiful networking API for C++11";
    homepage = "https://gitlab.com/ubports/development/core/lib-cpp/net-cpp";
+    changelog = "https://gitlab.com/ubports/development/core/lib-cpp/net-cpp/-/blob/${finalAttrs.version}/ChangeLog";
    license = licenses.lgpl3Only;
    maintainers = teams.lomiri.members;
    platforms = platforms.linux;
--- a/pkgs/by-name/or/ory/package.nix
+++ b/pkgs/by-name/or/ory/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "ory";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchFromGitHub {
    owner = "ory";
    repo = "cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-dO595NzdkVug955dqji/ttAPb+sMGLxJftXHzHA37Lo=";
+    hash = "sha256-o5ii8+tQzVcoIgTHQ9nnGJf2VKhWhL+osbAKPB7esDA=";
  };

  nativeBuildInputs = [
@ -23,7 +23,7 @@ buildGoModule rec {
    "sqlite"
  ];

-  vendorHash = "sha256-H1dM/r7gJvjnexQwlA4uhJ7rUH15yg4AMRW/f0k1Ixw=";
+  vendorHash = "sha256-iUPZbeCZ08iDf8+u2CoVH1yN2JyBqQjeS3dAKUMyX9Y=";

  postInstall = ''
    mv $out/bin/cli $out/bin/ory
--- a/pkgs/by-name/ot/oterm/package.nix
+++ b/pkgs/by-name/ot/oterm/package.nix
@ -5,13 +5,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "oterm";
-  version = "0.1.21";
+  version = "0.1.22";
  pyproject = true;
  src = fetchFromGitHub {
    owner = "ggozad";
    repo = "oterm";
    rev = "refs/tags/${version}";
-    hash = "sha256-S6v7VDIGPu6UDbDe0H3LWF6IN0Z6ENmiCDxz+GuCibI=";
+    hash = "sha256-hRbPlRuwM3NspTNd3mPhVxPJl8zA9qyFwDGNKH3Slag=";
  };

  pythonRelaxDeps = [
--- a/pkgs/by-name/pd/pdfannots2json/package.nix
+++ b/pkgs/by-name/pd/pdfannots2json/package.nix
@ -0,0 +1,25 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+let
+  pname = "pdfannots2json";
+  version = "1.0.16";
+in
+  buildGoModule {
+    inherit pname version;
+
+    src = fetchFromGitHub {
+      owner = "mgmeyers";
+      repo = "pdfannots2json";
+      rev = "refs/tags/${version}";
+      sha256 = "sha256-qk4OSws/6SevN/Q0lsyxw+fZkm2uy1WwOYYL7CB7QUk=";
+    };
+
+    vendorHash = null;
+
+    meta = with lib; {
+      homepage = "https://github.com/mgmeyers/pdfannots2json";
+      license = licenses.agpl3;
+      description = "A tool to convert PDF annotations to JSON";
+      maintainers = with maintainers; [ _0nyr ];
+    };
+  }
--- a/pkgs/by-name/pe/persistent-cache-cpp/package.nix
+++ b/pkgs/by-name/pe/persistent-cache-cpp/package.nix
@ -12,17 +12,18 @@
 , lomiri
 , pkg-config
 , python3
+, validatePkgConfig
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "persistent-cache-cpp";
-  version = "1.0.6";
+  version = "1.0.7";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/lib-cpp/persistent-cache-cpp";
    rev = finalAttrs.version;
-    hash = "sha256-RLZiYY0Y9LT+ajM4Va4MpVVDBlu2yvCpn8bNGMB8ydo=";
+    hash = "sha256-bOABrRSy5Mzeaqoc5ujcGXyBAaCJLv/488M7fkr0npE=";
  };

  outputs = [
@ -32,43 +33,22 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  patches = [
-    # Version in CMakeLists.txt didn't get bumped, emits wrong version in pkg-config
-    # Remove when https://gitlab.com/ubports/development/core/lib-cpp/persistent-cache-cpp/-/merge_requests/13 merged & in release
-    (fetchpatch {
-      name = "0001-persistent-cache-cpp-CMakeLists-txt-Update-version.patch";
-      url = "https://gitlab.com/OPNA2608/persistent-cache-cpp/-/commit/20d5d3f61563c62bcbe85e71ddc4fe16d7c995d5.patch";
-      hash = "sha256-BKovtT9OvV+xEwBO8AZTxAzL9kqyDB9ip32t2Xx4eIk=";
-    })
-
    # PersistentStringCacheImpl.exceptions test fails on LLVM's libcxx, it depends on std::system_error producing a very specific exception text
    # Expects "Unknown error 666", gets "unspecified generic_category error"
    # Remove when https://gitlab.com/ubports/development/core/lib-cpp/persistent-cache-cpp/-/merge_requests/14 merged & in release
    (fetchpatch {
-      name = "0002-persistent-cache-cpp-persistent_string_cache_impl_test-libcxx-fix.patch";
-      url = "https://gitlab.com/OPNA2608/persistent-cache-cpp/-/commit/a696dbd3093b8333f9ee1f0cad846b2256c729c5.patch";
+      name = "0001-persistent-cache-cpp-persistent_string_cache_impl_test-libcxx-fix.patch";
+      url = "https://gitlab.com/ubports/development/core/lib-cpp/persistent-cache-cpp/-/commit/a696dbd3093b8333f9ee1f0cad846b2256c729c5.patch";
      hash = "sha256-SJxdXeM7W+WKEmiLTwnQYAM7YmPayEk6vPb46y4thv4=";
    })

    # Enable usage of BUILD_TESTING to opting out of tests
    # Remove when https://gitlab.com/ubports/development/core/lib-cpp/persistent-cache-cpp/-/merge_requests/15 merged & in release
    (fetchpatch {
-      name = "0003-persistent-cache-cpp-Enable-opting-out-of-tests.patch";
-      url = "https://gitlab.com/OPNA2608/persistent-cache-cpp/-/commit/1fb06d28c16325e90046e93662c0f5fd16c29b4a.patch";
+      name = "0002-persistent-cache-cpp-Enable-opting-out-of-tests.patch";
+      url = "https://gitlab.com/ubports/development/core/lib-cpp/persistent-cache-cpp/-/commit/1fb06d28c16325e90046e93662c0f5fd16c29b4a.patch";
      hash = "sha256-2/6EYBh71S4dzqWEde+3dLOGp015fN6IifAj1bI1XAI=";
    })
-
-    # Enable linking based on stdenv (static or dynamic), only propagate leveldb link requirement when linked statically
-    # Remove when https://gitlab.com/ubports/development/core/lib-cpp/persistent-cache-cpp/-/merge_requests/16 merged & in release
-    (fetchpatch {
-      name = "0004-persistent-cache-cpp-Un-hardcode-static-linking.patch";
-      url = "https://gitlab.com/OPNA2608/persistent-cache-cpp/-/commit/45cd84fe76e3a0e1da41a662df695009a6f4f07e.patch";
-      hash = "sha256-1UjdhzrjnIUO1ySaZTm0vkdNgok0RNlGtNOWUoAUlzU=";
-    })
-    (fetchpatch {
-      name = "0005-persistent-cache-cpp-Propagate-leveldb-dependency-only-when-needed.patch";
-      url = "https://gitlab.com/OPNA2608/persistent-cache-cpp/-/commit/6204b65df32360a7e358558041219a867652c429.patch";
-      hash = "sha256-cIewdtF0OdQuLz94KNY2HL8XZp1IaKlZz2hNlMvKLw4=";
-    })
  ];

  postPatch = ''
@ -87,6 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
    cmake
    doxygen
    pkg-config
+    validatePkgConfig
  ];

  buildInputs = [
@ -106,6 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
  cmakeFlags = [
    # error: 'old_version' may be used uninitialized
    (lib.cmakeBool "Werror" false)
+    # Defaults to static if not set
    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
  ];

@ -123,6 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
      image files) that is fast, scalable, and crash-proof.
    '';
    homepage = "https://gitlab.com/ubports/development/core/lib-cpp/persistent-cache-cpp";
+    changelog = "https://gitlab.com/ubports/development/core/lib-cpp/persistent-cache-cpp/-/blob/${finalAttrs.version}/ChangeLog";
    license = licenses.lgpl3Only;
    maintainers = teams.lomiri.members;
    platforms = platforms.unix;
--- a/pkgs/by-name/pi/pixi/package.nix
+++ b/pkgs/by-name/pi/pixi/package.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "pixi";
-  version = "0.11.1";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "prefix-dev";
    repo = "pixi";
    rev = "v${version}";
-    hash = "sha256-NOa8OvZs+BoJQ9qIU1lpMmEOecZpmwwCNYpDk1LUSTI=";
+    hash = "sha256-4EKJwHXNDUGhwlSSZFoPHdG5WBDoHFAQncG+CpD2sik=";
  };

-  cargoHash = "sha256-rDtr9ITYH5o/QPG1Iozh05iTA8c0i+3DnabXLzyqdrg=";
+  cargoHash = "sha256-s1ODwuYv1x5/iP8yHS5FRk5MacrW81LaXI7/J+qtPNM=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/pr/presenterm/package.nix
+++ b/pkgs/by-name/pr/presenterm/package.nix
@ -24,7 +24,9 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-bufFiyqRsn4eG57bKn42p5cyX+Z7oiz/USZvg9YOvHA=";

-  buildFeatures = [ "sixel" ];
+  # Crashes at runtime on darwin with:
+  # Library not loaded: .../out/lib/libsixel.1.dylib
+  buildFeatures = lib.optionals (!stdenv.isDarwin) [ "sixel" ];

  # Skip test that currently doesn't work
  checkFlags = [ "--skip=execute::test::shell_code_execution" ];
@ -41,8 +43,5 @@ rustPlatform.buildRustPackage rec {
    license = licenses.bsd2;
    maintainers = with maintainers; [ mikaelfangel ];
    mainProgram = "presenterm";
-    # Crashes at runtime on darwin with:
-    # Library not loaded: .../out/lib/libsixel.1.dylib
-    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/by-name/pr/protoc-gen-js/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-js/package.nix
@ -0,0 +1,37 @@
+{ stdenv, lib, buildBazelPackage, bazel_6, fetchFromGitHub, darwin }:
+
+buildBazelPackage rec {
+  pname = "protoc-gen-js";
+  version = "3.21.2";
+
+  src = fetchFromGitHub {
+    owner = "protocolbuffers";
+    repo = "protobuf-javascript";
+    rev = "v${version}";
+    hash = "sha256-TmP6xftUVTD7yML7UEM/DB8bcsL5RFlKPyCpcboD86U=";
+  };
+
+  bazel = bazel_6;
+  bazelTargets = [ "generator:protoc-gen-js" ];
+  bazelBuildFlags = lib.optionals stdenv.cc.isClang [ "--cxxopt=-x" "--cxxopt=c++" "--host_cxxopt=-x" "--host_cxxopt=c++" ];
+  removeRulesCC = false;
+  removeLocalConfigCC = false;
+
+  LIBTOOL = lib.optionalString stdenv.isDarwin "${darwin.cctools}/bin/libtool";
+
+  fetchAttrs.sha256 = "sha256-H0zTMCMFct09WdR/mzcs9FcC2OU/ZhGye7GAkx4tGa8=";
+
+  buildAttrs.installPhase = ''
+    mkdir -p $out/bin
+    install -Dm755 bazel-bin/generator/protoc-gen-js $out/bin/
+  '';
+
+  meta = with lib; {
+    description = "Protobuf plugin for generating JavaScript code";
+    homepage = "https://github.com/protocolbuffers/protobuf-javascript";
+    platforms = platforms.linux ++ platforms.darwin;
+    license = with licenses; [ asl20 bsd3 ];
+    sourceProvenance = [ sourceTypes.fromSource ];
+    maintainers = with maintainers; [ Sorixelle ];
+  };
+}
--- a/pkgs/by-name/pu/pupdate/package.nix
+++ b/pkgs/by-name/pu/pupdate/package.nix
@ -12,13 +12,13 @@

 buildDotnetModule rec {
  pname = "pupdate";
-  version = "3.1.0";
+  version = "3.2.0";

  src = fetchFromGitHub {
    owner = "mattpannella";
    repo = "${pname}";
    rev = "${version}";
-    hash = "sha256-wIYqEtbQZsj9gq5KaLhd+sEnrKHBHzA9jWR+9dGDQ0s=";
+    hash = "sha256-9u1CKxWohGj7Gm3BrC2tpoQAY1r3cpP8OIePo+g7ETo=";
  };

  buildInputs = [
--- a/pkgs/by-name/py/pysqlrecon/package.nix
+++ b/pkgs/by-name/py/pysqlrecon/package.nix
@ -31,6 +31,9 @@ python3.pkgs.buildPythonApplication rec {
    typer
  ];

+  # Project has no tests
+  doCheck = false;
+
  pythonImportsCheck = [
    "pysqlrecon"
  ];
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@ -7,10 +7,10 @@
  inherit buildUnstable;
 }).overrideAttrs (finalAttrs: _: {
  pname = "renode-unstable";
-  version = "1.14.0+20240106git1b3952c2c";
+  version = "1.14.0+20240119git1a0826937";

  src = fetchurl {
    url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-portable.tar.gz";
-    hash = "sha256-tDo/01jYoq1Qg8h0BS4BQSPh3rsINpe72eMk9UBWgR0=";
+    hash = "sha256-bv5+6DVzBFt5XeKcLJFpUHB5T1RKCNi/CuXXpIn6e9k=";
  };
 })
--- a/pkgs/by-name/ux/uxn/package.nix
+++ b/pkgs/by-name/ux/uxn/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "uxn";
-  version = "unstable-2024-01-15";
+  version = "unstable-2024-01-21";

  src = fetchFromSourcehut {
    owner = "~rabbits";
    repo = "uxn";
-    rev = "8212ca5edb55a28976515a73fcb454f18eb44a09";
-    hash = "sha256-K/qTKSGt/sFHt0lfUbwa/Y2XlWst30q1aKvsm4sjrLc=";
+    rev = "3e1183285a94a0930c9b09fd4fa73ac3a5d24fda";
+    hash = "sha256-hhxcj/jVBOm7E63Z9sS3SnFjexQEXVtw3QU5n/4hkVI=";
  };

  outputs = [ "out" "projects" ];
--- a/pkgs/development/tools/yj/default.nix
+++ b/pkgs/development/tools/yj/default.nix
@ -18,6 +18,7 @@ buildGoModule rec {
  meta = with lib; {
    description = "Convert YAML <=> TOML <=> JSON <=> HCL";
    license = licenses.asl20;
+    mainProgram = "yj";
    maintainers = with maintainers; [ Profpatsch ];
    homepage = "https://github.com/sclevine/yj";
  };
--- a/pkgs/by-name/zi/zitadel/console-use-local-protobuf-plugins.patch
+++ b/pkgs/by-name/zi/zitadel/console-use-local-protobuf-plugins.patch
@ -0,0 +1,21 @@
+diff --git a/console/buf.gen.yaml b/console/buf.gen.yaml
+index 1737c2ded..d6affa8bc 100644
+--- a/console/buf.gen.yaml
+++ b/console/buf.gen.yaml
+@@ -3,12 +3,12 @@ version: v1
+ managed:
+   enabled: true
+ plugins:
+-  - plugin: buf.build/protocolbuffers/js
+  - plugin: js
+     out: src/app/proto/generated
+     opt: import_style=commonjs,binary
+-  - plugin: buf.build/grpc/web
+  - plugin: grpc-web
+     out: src/app/proto/generated
+     opt: import_style=typescript,mode=grpcweb
+-  - plugin: buf.build/grpc-ecosystem/openapiv2
+  - plugin: openapiv2
+     out: src/app/proto/generated
+     opt: allow_delete_body
+\ No newline at end of file
--- a/pkgs/by-name/zi/zitadel/console.nix
+++ b/pkgs/by-name/zi/zitadel/console.nix
@ -6,15 +6,24 @@
 { mkYarnPackage
 , fetchYarnDeps
 , lib
+
+, grpc-gateway
+, protoc-gen-grpc-web
+, protoc-gen-js
 }:

 let
  protobufGenerated = generateProtobufCode {
    pname = "zitadel-console";
+    nativeBuildInputs = [
+      grpc-gateway
+      protoc-gen-grpc-web
+      protoc-gen-js
+    ];
    workDir = "console";
    bufArgs = "../proto --include-imports --include-wkt";
    outputPath = "src/app/proto";
-    hash = "sha256-NmlKjKWxmqatyR6OitlQ7bfl6U6PS6KWqTALwX42HS4=";
+    hash = "sha256-h/5K6PvEFyjzS5p7SfuDIk91TkN1iPc+iXor8T/QSeE=";
  };
 in
 mkYarnPackage rec {
@ -26,7 +35,7 @@ mkYarnPackage rec {
  packageJSON = ./package.json;
  offlineCache = fetchYarnDeps {
    yarnLock = "${src}/yarn.lock";
-    hash = "sha256-rSKoIznYVDNgrBmut7YSxNhgPJnbIeO+/s0HnrYWPUc=";
+    hash = "sha256-cfo2WLSbfU8tYADjF7j9zTLNsboVThF6MUBrb49MrII=";
  };

  postPatch = ''
--- a/pkgs/by-name/zi/zitadel/package.json
+++ b/pkgs/by-name/zi/zitadel/package.json
@ -25,8 +25,11 @@
    "@angular/router": "^16.2.5",
    "@angular/service-worker": "^16.2.5",
    "@ctrl/ngx-codemirror": "^6.1.0",
+    "@fortawesome/angular-fontawesome": "^0.13.0",
+    "@fortawesome/fontawesome-svg-core": "^6.4.2",
+    "@fortawesome/free-brands-svg-icons": "^6.4.2",
    "@grpc/grpc-js": "^1.9.3",
-    "@ngx-translate/core": "^14.0.0",
+    "@ngx-translate/core": "^15.0.0",
    "angular-oauth2-oidc": "^15.0.1",
    "angularx-qrcode": "^16.0.0",
    "buffer": "^6.0.3",
@ -34,18 +37,18 @@
    "cors": "^2.8.5",
    "file-saver": "^2.0.5",
    "flag-icons": "^6.7.0",
-    "google-proto-files": "^3.0.3",
+    "google-proto-files": "^4.0.0",
    "google-protobuf": "^3.21.2",
    "grpc-web": "^1.4.1",
    "i18n-iso-countries": "^7.6.0",
-    "libphonenumber-js": "^1.10.30",
+    "libphonenumber-js": "^1.10.49",
    "material-design-icons-iconfont": "^6.1.1",
    "moment": "^2.29.4",
    "ngx-color": "^9.0.0",
    "opentype.js": "^1.3.4",
    "rxjs": "~7.8.0",
    "tinycolor2": "^1.6.0",
-    "tslib": "^2.4.1",
+    "tslib": "^2.6.2",
    "uuid": "^9.0.0",
    "zone.js": "~0.13.1"
  },
@ -60,11 +63,11 @@
    "@angular/compiler-cli": "^16.2.5",
    "@angular/language-service": "^16.2.5",
    "@bufbuild/buf": "^1.23.1",
-    "@types/file-saver": "^2.0.2",
+    "@types/file-saver": "^2.0.7",
    "@types/google-protobuf": "^3.15.3",
    "@types/jasmine": "~4.3.6",
    "@types/jasminewd2": "~2.0.10",
-    "@types/jsonwebtoken": "^9.0.1",
+    "@types/jsonwebtoken": "^9.0.5",
    "@types/node": "^20.7.0",
    "@types/opentype.js": "^1.3.4",
    "@types/qrcode": "^1.5.2",
@ -83,6 +86,6 @@
    "prettier": "^3.0.3",
    "prettier-plugin-organize-imports": "^3.2.2",
    "protractor": "~7.0.0",
-    "typescript": "^4.9.5"
+    "typescript": "^5.1.6"
  }
 }
--- a/pkgs/by-name/zi/zitadel/package.nix
+++ b/pkgs/by-name/zi/zitadel/package.nix
@ -15,14 +15,14 @@
 }:

 let
-  version = "2.40.3";
+  version = "2.42.10";
  zitadelRepo = fetchFromGitHub {
    owner = "zitadel";
    repo = "zitadel";
    rev = "v${version}";
-    hash = "sha256-WqsK6DAYkLs5wBNvkVGarLMm/unBLtipFkl07pR90HI=";
+    hash = "sha256-Uv0iEIFkTdBAi0WDBQHf0ATs4L2FOU4NmiE9p1MHSa0=";
  };
-  goModulesHash = "sha256-IVf1YVnhyEYgZqM31Cv3aBFnPG7v5WW6fCEvlN+sTIE=";
+  goModulesHash = "sha256-PQch046YjYhAmVlNNdgDLWIqFvEpXRgXAYFMwSZmk4w=";

  buildZitadelProtocGen = name:
    buildGoModule {
@ -62,6 +62,7 @@ let
      name = "${pname}-buf-generated";

      src = zitadelRepo;
+      patches = [ ./console-use-local-protobuf-plugins.patch ];

      nativeBuildInputs = nativeBuildInputs ++ [ buf ];

@ -91,7 +92,7 @@ let
      protoc-gen-zitadel
    ];
    outputPath = ".artifacts";
-    hash = "sha256-xrEF1B4pMoCZs1WO9F6IoqHnSyt5BhPVTIABMWK/q2E=";
+    hash = "sha256-3qDVY2CvtY8lZDr+p5i0vV6zZ5KyTtxBLyV7Os9KuIw=";
  };
 in
 buildGoModule rec {
@ -104,10 +105,11 @@ buildGoModule rec {

  proxyVendor = true;
  vendorHash = goModulesHash;
+  ldflags = [ "-X 'github.com/zitadel/zitadel/cmd/build.version=${version}'" ];

  # Adapted from Makefile in repo, with dependency fetching and protobuf codegen
  # bits removed
-  buildPhase = ''
+  preBuild = ''
    mkdir -p pkg/grpc
    cp -r ${protobufGenerated}/grpc/github.com/zitadel/zitadel/pkg/grpc/* pkg/grpc
    mkdir -p openapi/v2/zitadel
@ -122,12 +124,13 @@ buildGoModule rec {
    go run internal/api/assets/generator/asset_generator.go -directory=internal/api/assets/generator/ -assets=docs/apis/assets/assets.md

    cp -r ${passthru.console}/* internal/api/ui/console/static
-    CGO_ENABLED=0 go build -o zitadel -v -ldflags="-s -w -X 'github.com/zitadel/zitadel/cmd/build.version=${version}'"
  '';

+  doCheck = false;
+
  installPhase = ''
    mkdir -p $out/bin
-    install -Dm755 zitadel $out/bin/
+    install -Dm755 $GOPATH/bin/zitadel $out/bin/
  '';

  passthru = {
--- a/pkgs/data/icons/papirus-icon-theme/default.nix
+++ b/pkgs/data/icons/papirus-icon-theme/default.nix
@ -13,13 +13,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "papirus-icon-theme";
-  version = "20231201";
+  version = "20240201";

  src = fetchFromGitHub {
    owner = "PapirusDevelopmentTeam";
    repo = pname;
    rev = version;
-    hash = "sha256-nLc2nt8YI193loMHjzzEwgvb+tdNrVTZskqssX2oFrU=";
+    hash = "sha256-hAmtvib6wENEAGQdK242wwDqF3Ddu4YR00KPaWR8JMo=";
  };

  nativeBuildInputs = [
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@ -3,12 +3,12 @@
 let
  generator = pkgsBuildBuild.buildGoModule rec {
    pname = "v2ray-domain-list-community";
-    version = "20240123112230";
+    version = "20240131105845";
    src = fetchFromGitHub {
      owner = "v2fly";
      repo = "domain-list-community";
      rev = version;
-      hash = "sha256-tt6/JEX1WM6ayBU4NnY/yjz9S6IDAfr6hJmyF9mPHAo=";
+      hash = "sha256-aoHcRrZOFHagFNieJf9LtWHd1JDisPb3cpu9x5rMizE=";
    };
    vendorHash = "sha256-azvMUi8eLNoNofRa2X4SKTTiMd6aOyO6H/rOiKjkpIY=";
    meta = with lib; {
--- a/pkgs/desktops/lomiri/data/lomiri-schemas/default.nix
+++ b/pkgs/desktops/lomiri/data/lomiri-schemas/default.nix
@ -8,17 +8,18 @@
 , glib
 , intltool
 , pkg-config
+, validatePkgConfig
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "lomiri-schemas";
-  version = "0.1.3";
+  version = "0.1.4";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/lomiri-schemas";
    rev = finalAttrs.version;
-    hash = "sha256-FrDUFqdD0KW2VG2pTA6LMb6/9PdNtQUlYTEo1vnW6QQ=";
+    hash = "sha256-Pnn/Qh5EYEqmP8QFsZcSCpDL36++aeUUok3t9a1/1n0=";
  };

  strictDeps = true;
@ -28,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
    glib # glib-compile-schemas
    pkg-config
    intltool
+    validatePkgConfig
  ];

  buildInputs = [
@ -36,8 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  cmakeFlags = [
-    "-DGSETTINGS_LOCALINSTALL=ON"
-    "-DGSETTINGS_COMPILE=ON"
+    (lib.cmakeBool "GSETTINGS_LOCALINSTALL" true)
+    (lib.cmakeBool "GSETTINGS_COMPILE" true)
  ];

  passthru = {
@ -48,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = with lib; {
    description = "GSettings / AccountsService schema files for Lomiri";
    homepage = "https://gitlab.com/ubports/development/core/lomiri-schemas";
+    changelog = "https://gitlab.com/ubports/development/core/lomiri-schemas/-/blob/${finalAttrs.version}/ChangeLog";
    license = licenses.lgpl21Plus;
    maintainers = teams.lomiri.members;
    platforms = platforms.linux;
--- a/pkgs/desktops/lomiri/development/geonames/default.nix
+++ b/pkgs/desktops/lomiri/development/geonames/default.nix
@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitLab
-, fetchpatch
 , gitUpdater
 , testers
 , buildPackages
@ -17,17 +16,18 @@
 , withDocumentation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform
 , gtk-doc
 , pkg-config
+, validatePkgConfig
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "geonames";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/geonames";
    rev = finalAttrs.version;
-    hash = "sha256-Mo7Khj2pgdJ9kT3npFXnh1WTSsY/B1egWTccbAXFNY8=";
+    hash = "sha256-AhRnUoku17kVY0UciHQXFDa6eCH6HQ4ZGIOobCaGTKQ=";
  };

  outputs = [
@ -39,16 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
    "devdoc"
  ];

-  patches = [
-    # Improves install locations of demo & docs
-    # Remove when https://gitlab.com/ubports/development/core/geonames/-/merge_requests/3 merged & in release
-    (fetchpatch {
-      name = "0001-geonames-Use-CMAKE_INSTALL_BINDIR-for-install.patch";
-      url = "https://gitlab.com/OPNA2608/geonames/-/commit/3bca6d4d02843aed851a0a7480d5cd5ac02b4cda.patch";
-      hash = "sha256-vwffuMKpIqymYaiGEvnNeVXLmnz5e4aBpg55fnNbjKs=";
-    })
-  ];
-
  postPatch = ''
    patchShebangs src/generate-locales.sh tests/setup-test-env.sh
  '';
@ -60,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
    gettext
    glib # glib-compile-resources
    pkg-config
+    validatePkgConfig
  ] ++ lib.optionals withDocumentation [
    docbook-xsl-nons
    docbook_xml_dtd_45
@ -84,14 +75,14 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  cmakeFlags = [
-    "-DWANT_DOC=${lib.boolToString withDocumentation}"
-    "-DWANT_DEMO=${lib.boolToString withExamples}"
-    "-DWANT_TESTS=${lib.boolToString finalAttrs.finalPackage.doCheck}"
+    (lib.cmakeBool "WANT_DOC" withDocumentation)
+    (lib.cmakeBool "WANT_DEMO" withExamples)
+    (lib.cmakeBool "WANT_TESTS" finalAttrs.finalPackage.doCheck)
    # Keeps finding & using glib-compile-resources from buildInputs otherwise
-    "-DCMAKE_PROGRAM_PATH=${lib.makeBinPath [ buildPackages.glib.dev ]}"
+    (lib.cmakeFeature "CMAKE_PROGRAM_PATH" (lib.makeBinPath [ buildPackages.glib.dev ]))
  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
    # only for cross without native execute support because the canExecute "emulator" call has a format that I can't get CMake to accept
-    "-DCMAKE_CROSSCOMPILING_EMULATOR=${stdenv.hostPlatform.emulator buildPackages}"
+    (lib.cmakeFeature "CMAKE_CROSSCOMPILING_EMULATOR" (stdenv.hostPlatform.emulator buildPackages))
  ];

  preInstall = lib.optionalString withDocumentation ''
@ -109,6 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = with lib; {
    description = "Parse and query the geonames database dump";
    homepage = "https://gitlab.com/ubports/development/core/geonames";
+    changelog = "https://gitlab.com/ubports/development/core/geonames/-/blob/${finalAttrs.version}/ChangeLog";
    license = licenses.gpl3Only;
    maintainers = teams.lomiri.members;
    platforms = platforms.all;
--- a/pkgs/desktops/lomiri/development/libusermetrics/2001-Remove-custom-check-target.patch
+++ b/pkgs/desktops/lomiri/development/libusermetrics/2001-Remove-custom-check-target.patch
@ -0,0 +1,37 @@
+From 52ac1d6548b4a92d569c5d2f53b84c604c7fce8a Mon Sep 17 00:00:00 2001
+From: OPNA2608 <opna2608@protonmail.com>
+Date: Thu, 1 Feb 2024 22:42:39 +0100
+Subject: [PATCH] Remove custom check target
+
+The automatic one provides better controls for us
+---
+ CMakeLists.txt | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index af643a7..75b3cc1 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -105,18 +105,13 @@ add_subdirectory("data")
+ 
+ 
+ if(ENABLE_TESTS)
+-enable_testing()
+include(CTest)
+ 
+ pkg_check_modules(QTDBUSTEST REQUIRED libqtdbustest-1 REQUIRED)
+ include_directories(${QTDBUSTEST_INCLUDE_DIRS})
+ 
+ add_subdirectory(tests)
+ 
+-ADD_CUSTOM_TARGET(
+-	check
+-	${CMAKE_CTEST_COMMAND} --force-new-ctest-process --output-on-failure
+-)
+-
+ find_package(CoverageReport)
+ enable_coverage_report(
+   TARGETS
+-- 
+2.42.0
+
--- a/pkgs/desktops/lomiri/development/libusermetrics/default.nix
+++ b/pkgs/desktops/lomiri/development/libusermetrics/default.nix
@ -19,18 +19,19 @@
 , qtdeclarative
 , qtxmlpatterns
 , ubports-click
+, validatePkgConfig
 , wrapQtAppsHook
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "libusermetrics";
-  version = "1.3.0";
+  version = "1.3.2";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/libusermetrics";
    rev = finalAttrs.version;
-    hash = "sha256-yO9wZcXJBKt1HZ1GKoQ1flqYuwW9PlXiWLE3bl21PSQ=";
+    hash = "sha256-jmJH5vByBnBqgQfyb7HNVe+eS/jHcU64R2dnvuLbqss=";
  };

  outputs = [
@ -39,22 +40,18 @@ stdenv.mkDerivation (finalAttrs: {
    "doc"
  ];

-  postPatch = ''
-    substituteInPlace data/CMakeLists.txt \
-      --replace '/etc' "$out/etc"
+  patches = [
+    # Not submitted yet, waiting for decision on how CMake testing should be handled
+    ./2001-Remove-custom-check-target.patch
+  ];

+  postPatch = ''
    # Tries to query QMake for QT_INSTALL_QML variable, would return broken paths into /build/qtbase-<commit> even if qmake was available
    substituteInPlace src/modules/UserMetrics/CMakeLists.txt \
-      --replace "\''${QT_IMPORTS_DIR}/UserMetrics" '${placeholder "out"}/${qtbase.qtQmlPrefix}/UserMetrics'
-
-    substituteInPlace src/libusermetricsinput/CMakeLists.txt \
-      --replace 'RUNTIME DESTINATION bin' 'RUNTIME DESTINATION ''${CMAKE_INSTALL_BINDIR}'
+      --replace 'query_qmake(QT_INSTALL_QML QT_IMPORTS_DIR)' 'set(QT_IMPORTS_DIR "''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}")'

    substituteInPlace doc/CMakeLists.txt \
      --replace "\''${CMAKE_INSTALL_DATAROOTDIR}/doc/libusermetrics-doc" "\''${CMAKE_INSTALL_DOCDIR}"
-  '' + lib.optionalString (!finalAttrs.finalPackage.doCheck) ''
-    # Only needed by tests
-    sed -i -e '/QTDBUSTEST/d' CMakeLists.txt
  '';

  strictDeps = true;
@ -64,6 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
    doxygen
    intltool
    pkg-config
+    validatePkgConfig
    wrapQtAppsHook
  ];

@ -91,22 +89,23 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  cmakeFlags = [
-    "-DGSETTINGS_LOCALINSTALL=ON"
-    "-DGSETTINGS_COMPILE=ON"
-    "-DENABLE_TESTS=${lib.boolToString finalAttrs.finalPackage.doCheck}"
+    (lib.cmakeBool "GSETTINGS_LOCALINSTALL" true)
+    (lib.cmakeBool "GSETTINGS_COMPILE" true)
+    (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" (lib.concatStringsSep ";" [
+      # Exclude tests
+      "-E" (lib.strings.escapeShellArg "(${lib.concatStringsSep "|" [
+        # Flaky, randomly failing in UserMetricsImplTest.AddTranslatedData (data not ready when signal is emitted?)
+        "^usermetricsoutput-unit-tests"
+      ]})")
+    ]))
  ];

  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

-  checkPhase = ''
-    runHook preCheck
-
+  preCheck = ''
    export QT_PLUGIN_PATH=${lib.getBin qtbase}/lib/qt-${qtbase.version}/plugins/
    export QML2_IMPORT_PATH=${lib.getBin qtdeclarative}/lib/qt-${qtbase.version}/qml/
-    dbus-run-session --config-file=${dbus}/share/dbus-1/session.conf -- \
-      make test "''${enableParallelChecking:+-j $NIX_BUILD_CORES}"
-
-    runHook postCheck
  '';

  passthru = {
@ -117,6 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = with lib; {
    description = "Enables apps to locally store interesting numerical data for later presentation";
    homepage = "https://gitlab.com/ubports/development/core/libusermetrics";
+    changelog = "https://gitlab.com/ubports/development/core/libusermetrics/-/blob/${finalAttrs.version}/ChangeLog";
    license = licenses.lgpl3Only;
    maintainers = teams.lomiri.members;
    platforms = platforms.linux;
--- a/pkgs/desktops/lomiri/development/lomiri-app-launch/default.nix
+++ b/pkgs/desktops/lomiri/development/lomiri-app-launch/default.nix
@ -20,6 +20,7 @@
 , python3
 , systemd
 , ubports-click
+, validatePkgConfig
 , zeitgeist
 , withDocumentation ? true
 , doxygen
@ -29,7 +30,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lomiri-app-launch";
-  version = "0.1.8";
+  version = "0.1.9";

  outputs = [
    "out"
@ -42,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "ubports";
    repo = "development/core/lomiri-app-launch";
    rev = finalAttrs.version;
-    hash = "sha256-NIBZk5H0bPwAwkI0Qiq2S9dZvchAFPBCHKi2inUVZmI=";
+    hash = "sha256-vuu6tZ5eDJN2rraOpmrDddSl1cIFFBSrILKMJqcUDVc=";
  };

  postPatch = ''
@ -50,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {

    # used pkg_get_variable, cannot replace prefix
    substituteInPlace data/CMakeLists.txt \
-      --replace 'DESTINATION "''${SYSTEMD_USER_UNIT_DIR}"' 'DESTINATION "${placeholder "out"}/lib/systemd/user"'
+      --replace 'pkg_get_variable(SYSTEMD_USER_UNIT_DIR systemd systemduserunitdir)' 'set(SYSTEMD_USER_UNIT_DIR "''${CMAKE_INSTALL_PREFIX}/lib/systemd/user")'

    substituteInPlace tests/jobs-systemd.cpp \
      --replace '^(/usr)?' '^(/nix/store/\\w+-bash-.+)?'
@ -63,6 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
    dpkg # for setting LOMIRI_APP_LAUNCH_ARCH
    gobject-introspection
    pkg-config
+    validatePkgConfig
  ] ++ lib.optionals withDocumentation [
    doxygen
    python3Packages.breathe
@ -96,8 +98,8 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  cmakeFlags = [
-    "-DENABLE_MIRCLIENT=OFF"
-    "-DENABLE_TESTS=${lib.boolToString finalAttrs.doCheck}"
+    (lib.cmakeBool "ENABLE_MIRCLIENT" false)
+    (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
  ];

  postBuild = lib.optionalString withDocumentation ''
@ -119,6 +121,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = with lib; {
    description = "System and associated utilities to launch applications in a standard and confined way";
    homepage = "https://gitlab.com/ubports/development/core/lomiri-app-launch";
+    changelog = "https://gitlab.com/ubports/development/core/lomiri-app-launch/-/blob/${finalAttrs.version}/ChangeLog";
    license = licenses.gpl3Only;
    maintainers = teams.lomiri.members;
    platforms = platforms.linux;
--- a/pkgs/desktops/lomiri/development/trust-store/default.nix
+++ b/pkgs/desktops/lomiri/development/trust-store/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitLab
+, gitUpdater
 , testers
 , boost
 , cmake
@ -19,17 +20,18 @@
 , properties-cpp
 , qtbase
 , qtdeclarative
+, validatePkgConfig
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "trust-store";
-  version = "0-unstable-2023-12-27";
+  version = "2.0.2";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/trust-store";
-    rev = "c91e5ac54c4032525f930f0651d673ad3a1095a2";
-    hash = "sha256-zqs40tKo2AOd9yL2Xfbk52Uh8hy4uT1XDT6YtKufAaY=";
+    rev = finalAttrs.version;
+    hash = "sha256-tVwqBu4py8kdydyKECZfLvcLijpZSQszeo8ytTDagy0=";
  };

  outputs = [
@ -58,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
    gettext
    graphviz
    pkg-config
+    validatePkgConfig
  ];

  buildInputs = [
@ -106,7 +109,10 @@ stdenv.mkDerivation (finalAttrs: {
  # Starts & talks to DBus
  enableParallelChecking = false;

-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = gitUpdater { };
+  };

  meta = with lib; {
    description = "Common implementation of a trust store to be used by trusted helpers";
--- a/pkgs/desktops/lomiri/qml/lomiri-action-api/default.nix
+++ b/pkgs/desktops/lomiri/qml/lomiri-action-api/default.nix
@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitLab
-, fetchpatch
 , gitUpdater
 , testers
 , cmake
@ -10,17 +9,18 @@
 , pkg-config
 , qtbase
 , qtdeclarative
+, validatePkgConfig
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "lomiri-action-api";
-  version = "1.1.2";
+  version = "1.1.3";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/lomiri-action-api";
    rev = finalAttrs.version;
-    hash = "sha256-FOHjZ5F4IkjSn/SpZEz25CbTR/gaK4D7BRxDVSDuAl8=";
+    hash = "sha256-JDcUq7qEp6Z8TjdNspIz4FE/euH+ytGWa4rSxy4voiU=";
  };

  outputs = [
@ -28,19 +28,10 @@ stdenv.mkDerivation (finalAttrs: {
    "dev"
  ];

-  patches = [
-    # Drop deprecated qt5_use_modules usage
-    # Remove when https://gitlab.com/ubports/development/core/lomiri-action-api/-/merge_requests/4 merged & in release
-    (fetchpatch {
-      url = "https://gitlab.com/OPNA2608/lomiri-action-api/-/commit/ff1d7f7eb127f6a00a99e8b278c963899d0303f0.patch";
-      hash = "sha256-nLUoRl260hMbtEPjOQJI/3w54xgFxjcxerAqNN5FU/0=";
-    })
-  ];
-
  postPatch = ''
    # Queries QMake for broken Qt variable: '/build/qtbase-<commit>/$(out)/$(qtQmlPrefix)'
    substituteInPlace qml/Lomiri/Action/CMakeLists.txt \
-      --replace "\''${QT_IMPORTS_DIR}/Lomiri" '${qtbase.qtQmlPrefix}/Lomiri'
+      --replace 'exec_program(''${QMAKE_EXECUTABLE} ARGS "-query QT_INSTALL_QML" OUTPUT_VARIABLE QT_IMPORTS_DIR)' 'set(QT_IMPORTS_DIR "''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}")'
  '';

  strictDeps = true;
@ -48,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    cmake
    pkg-config
+    validatePkgConfig
  ];

  buildInputs = [
@ -61,9 +53,11 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  cmakeFlags = [
-    "-DENABLE_TESTING=${lib.boolToString finalAttrs.finalPackage.doCheck}"
-    "-Duse_libhud2=OFF" # Use vendored libhud2, TODO package libhud2 separately?
-    "-DGENERATE_DOCUMENTATION=OFF" # QML docs need qdoc, https://github.com/NixOS/nixpkgs/pull/245379
+    (lib.cmakeBool "ENABLE_TESTING" finalAttrs.finalPackage.doCheck)
+    # Use vendored libhud2, TODO package libhud2 separately?
+    (lib.cmakeBool "use_libhud2" false)
+    # QML docs need qdoc, https://github.com/NixOS/nixpkgs/pull/245379
+    (lib.cmakeBool "GENERATE_DOCUMENTATION" false)
  ];

  dontWrapQtApps = true;
@ -83,6 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = with lib; {
    description = "Allow applications to export actions in various forms to the Lomiri Shell";
    homepage = "https://gitlab.com/ubports/development/core/lomiri-action-api";
+    changelog = "https://gitlab.com/ubports/development/core/lomiri-action-api/-/blob/${finalAttrs.version}/ChangeLog";
    license = licenses.lgpl3Only;
    maintainers = teams.lomiri.members;
    platforms = platforms.linux;
--- a/pkgs/desktops/lomiri/qml/lomiri-settings-components/default.nix
+++ b/pkgs/desktops/lomiri/qml/lomiri-settings-components/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lomiri-settings-components";
-  version = "1.1.0";
+  version = "1.1.1";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/lomiri-settings-components";
    rev = finalAttrs.version;
-    hash = "sha256-13uxUBM+uOmt8X0uLGWNP8YbwCdb2QCChB8IP3td5a4=";
+    hash = "sha256-2Wyh+2AW6EeKRv26D4l+GIoH5sWC9SmOODNHOveFZPg=";
  };

  postPatch = ''
@ -58,6 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = with lib; {
    description = "QML settings components for the Lomiri Desktop Environment";
    homepage = "https://gitlab.com/ubports/development/core/lomiri-settings-components";
+    changelog = "https://gitlab.com/ubports/development/core/lomiri-settings-components/-/blob/${finalAttrs.version}/ChangeLog";
    license = licenses.lgpl3Only;
    maintainers = teams.lomiri.members;
    platforms = platforms.linux;
--- a/pkgs/desktops/lomiri/qml/lomiri-ui-extras/default.nix
+++ b/pkgs/desktops/lomiri/qml/lomiri-ui-extras/default.nix
@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitLab
-, fetchpatch
 , gitUpdater
 , cmake
 , cmake-extras
@ -17,48 +16,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lomiri-ui-extras";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/lomiri-ui-extras";
    rev = finalAttrs.version;
-    hash = "sha256-RZTGTe18ebqKz8kWOpRgFJO2sR97sVbdPQMW/XLHs68=";
+    hash = "sha256-SF/UF84K9kNtLHO9FDuIFdQId0NfbmRiRZiPrOKvE9o=";
  };

-  patches = [
-    # Fix compatibility with Exiv2 0.28.0
-    # Remove when version > 0.6.2
-    (fetchpatch {
-      name = "0001-lomiri-ui-extras-Fix-for-exiv2-0.28.0.patch";
-      url = "https://gitlab.com/ubports/development/core/lomiri-ui-extras/-/commit/f337ceefa7c4f8f39dc7c75d51df8b86f148891a.patch";
-      hash = "sha256-dm50un46eTeBZsyHJF1npGBqOAF1BopJZ1Uln1PqSOE=";
-    })
-
-    # Remove deprecated qt5_use_modules usage
-    # Remove when version > 0.6.2
-    (fetchpatch {
-      name = "0002-lomiri-ui-extras-Stop-using-qt5_use_modules.patch";
-      url = "https://gitlab.com/ubports/development/core/lomiri-ui-extras/-/commit/df506e7ebe7107dd0465d7d65727753f07abd122.patch";
-      hash = "sha256-VmOhJaUgjp9BHoYAO780uxI5tE7F0Gtp9gRNe0QCrhs=";
-    })
-
-    # Find qmltestrunner via PATH instead of hardcoded path
-    # https://gitlab.com/ubports/development/core/lomiri-ui-extras/-/merge_requests/84
-    (fetchpatch {
-      name = "0003-lomiri-ui-extras-Dont-insist-on-finding-qmltestrunner-only-at-hardcoded-guess.patch";
-      url = "https://gitlab.com/OPNA2608/lomiri-ui-extras/-/commit/b0c4901818761b516a45b7f0524ac713ddf33cfe.patch";
-      hash = "sha256-oFeaGiYEDr9XHRlCpXX+0ALlVdfb0FmGBFF1RzIXSBE=";
-    })
-  ];
-
  postPatch = ''
    substituteInPlace modules/Lomiri/Components/Extras{,/{plugin,PamAuthentication}}/CMakeLists.txt \
      --replace "\''${CMAKE_INSTALL_LIBDIR}/qt5/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
-
-    # tst_busy_indicator runs into a codepath in lomiri-ui-toolkit that expects a working GL context
-    sed -i tests/qml/CMakeLists.txt \
-      -e '/declare_qml_test("tst_busy_indicator"/d'
  '';

  strictDeps = true;
@ -89,11 +58,19 @@ stdenv.mkDerivation (finalAttrs: {
  dontWrapQtApps = true;

  cmakeFlags = [
-    "-DENABLE_TESTS=${lib.boolToString finalAttrs.finalPackage.doCheck}"
+    (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" (lib.concatStringsSep ";" [
+      # Exclude tests
+      "-E" (lib.strings.escapeShellArg "(${lib.concatStringsSep "|" [
+        # tst_busy_indicator runs into a codepath in lomiri-ui-toolkit that expects a working GL context
+        "^tst_busy_indicator"
+        # Photo & PhotoImageProvider Randomly fail, unsure why
+        "^tst_PhotoEditorPhoto"
+      ]})")
+    ]))
  ];

-  # tst_PhotoEditorPhoto and tst_PhotoEditorPhotoImageProvider randomly fail, haven't had time to debug
-  doCheck = false;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

  # Parallelism breaks xvfb-run-launched script for QML tests
  enableParallelChecking = false;
@ -118,6 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
      documentation and/or lack of automated tests.
    '';
    homepage = "https://gitlab.com/ubports/development/core/lomiri-ui-extras";
+    changelog = "https://gitlab.com/ubports/development/core/lomiri-ui-extras/-/blob/${finalAttrs.version}/ChangeLog";
    license = licenses.gpl3Only;
    maintainers = teams.lomiri.members;
    platforms = platforms.linux;
--- a/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix
+++ b/pkgs/desktops/lomiri/qml/lomiri-ui-toolkit/default.nix
@ -23,6 +23,7 @@
 , qtsvg
 , qtsystems
 , suru-icon-theme
+, validatePkgConfig
 , wrapQtAppsHook
 , xvfb-run
 }:
@ -34,13 +35,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "lomiri-ui-toolkit";
-  version = "1.3.5011";
+  version = "1.3.5012";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/lomiri-ui-toolkit";
    rev = finalAttrs.version;
-    hash = "sha256-z/EEmC9LjQtBx5MRDLeImxpRrzH4w6v6o+NmqX+L4dw=";
+    hash = "sha256-Azz2IOm/7XRvDbyIKaYxrkR47evSB17ejtssuEJayPc=";
  };

  outputs = [ "out" "dev" ];
@ -58,22 +59,6 @@ stdenv.mkDerivation (finalAttrs: {
      hash = "sha256-x8Zk7+VBSlM16a3V1yxJqIB63796H0lsS+F4dvR/z80=";
    })

-    # Small fixes to statesaver & tst_imageprovider.11.qml tests
-    # Remove when version > 1.3.5011
-    (fetchpatch {
-      name = "0003-lomiri-ui-toolkit-tests-Minor-fixes.patch";
-      url = "https://gitlab.com/ubports/development/core/lomiri-ui-toolkit/-/commit/a8324d670b813a48ac7d48aa0bc013773047a01d.patch";
-      hash = "sha256-W6q3LuQqWmUVSBzORcJsTPoLfbWwytABMDR6JITHrDI=";
-    })
-
-    # Fix Qt 5.15.11 compatibility
-    # Remove when version > 1.3.5011
-    (fetchpatch {
-      name = "0004-lomiri-ui-toolkit-Fix-compilation-with-Qt-5.15.11.patch";
-      url = "https://gitlab.com/ubports/development/core/lomiri-ui-toolkit/-/commit/4f999077dc6bc5591bdfede64fd21cb3acdcaac1.patch";
-      hash = "sha256-5VCQFOykxgspNBxH94XYuBpdHsH9a3+8FwV6xQE55Xc=";
-    })
-
    ./2001-Mark-problematic-tests.patch
    (substituteAll {
      src = ./2002-Nixpkgs-versioned-QML-path.patch.in;
@ -136,6 +121,7 @@ stdenv.mkDerivation (finalAttrs: {
    pkg-config
    python3
    qmake
+    validatePkgConfig
    wrapQtAppsHook
  ];

@ -248,6 +234,7 @@ stdenv.mkDerivation (finalAttrs: {
        - localisation through gettext
    '';
    homepage = "https://gitlab.com/ubports/development/core/lomiri-ui-toolkit";
+    changelog = "https://gitlab.com/ubports/development/core/lomiri-ui-toolkit/-/blob/${finalAttrs.version}/ChangeLog";
    license = with licenses; [ gpl3Only cc-by-sa-30 ];
    maintainers = teams.lomiri.members;
    platforms = platforms.linux;
--- a/pkgs/desktops/lomiri/services/biometryd/default.nix
+++ b/pkgs/desktops/lomiri/services/biometryd/default.nix
@ -18,17 +18,18 @@
 , qtbase
 , qtdeclarative
 , sqlite
+, validatePkgConfig
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "biometryd";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/biometryd";
    rev = finalAttrs.version;
-    hash = "sha256-b095rsQnd63Ziqe+rn3ROo4LGXZxZ3Sa6h3apzCuyCs=";
+    hash = "sha256-derU7pKdNf6pwhskaW7gCLcU9ixBG3U0EI/qtANmmTs=";
  };

  outputs = [
@ -36,48 +37,10 @@ stdenv.mkDerivation (finalAttrs: {
    "dev"
  ];

-  patches = [
-    # https://gitlab.com/ubports/development/core/biometryd/-/merge_requests/31
-    (fetchpatch {
-      url = "https://gitlab.com/OPNA2608/biometryd/-/commit/d01d979e4f98c6473761d1ace308aa182017804e.patch";
-      hash = "sha256-JxL3BLuh33ptfneU1y2qNGFKpeMlZlTMwCK97Rk3aTA=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.com/OPNA2608/biometryd/-/commit/3cec6a3d42ea6aba8892da2c771b317f44daf9e2.patch";
-      hash = "sha256-Ij/aio38WmZ+NsUSbM195Gwb83goWIcCnJvGwAOJi50=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.com/OPNA2608/biometryd/-/commit/e89bd9444bc1cfe84a9aa93faa23057c80f39564.patch";
-      hash = "sha256-1vEG349X9+SvY/f3no/l5cMVGpdzC8h/8XOZwL/70Dc=";
-    })
-
-    # https://gitlab.com/ubports/development/core/biometryd/-/merge_requests/32
-    (fetchpatch {
-      url = "https://gitlab.com/OPNA2608/biometryd/-/commit/9e52fad0139c5a45f69e6a6256b2b5ff54f77740.patch";
-      hash = "sha256-DZSdzKq6EYgAllKSDgkGk2g57zHN+gI5fOoj7U5AcKY=";
-    })
-
-    # Fix GCC13 & musl compat
-    # Remove when version > 0.3.0
-    (fetchpatch {
-      url = "https://gitlab.com/ubports/development/core/biometryd/-/commit/bc6f1a743dbb0eda6310bd13229f650be62aa3b3.patch";
-      hash = "sha256-Pr3zHrMNxTKYHsqHEcVv4fYVknjUwBFRTSuBxZhqUi8=";
-    })
-  ];
-
  postPatch = ''
-    # Remove with !31 patches, fetchpatch can't apply renames
-    pushd data
-    for type in conf service; do
-      mv biometryd.$type biometryd.$type.in
-      substituteInPlace biometryd.$type.in \
-        --replace '/usr/bin' "\''${CMAKE_INSTALL_FULL_BINDIR}"
-    done
-    popd
-
    # Uses pkg_get_variable, cannot substitute prefix with that
-    substituteInPlace CMakeLists.txt \
-      --replace 'pkg_get_variable(SYSTEMD_SYSTEM_UNIT_DIR systemd systemdsystemunitdir)' 'set(SYSTEMD_SYSTEM_UNIT_DIR "${placeholder "out"}/lib/systemd/system")'
+    substituteInPlace data/CMakeLists.txt \
+      --replace 'pkg_get_variable(SYSTEMD_SYSTEM_UNIT_DIR systemd systemdsystemunitdir)' 'set(SYSTEMD_SYSTEM_UNIT_DIR "''${CMAKE_INSTALL_PREFIX}/lib/systemd/system")'

    substituteInPlace src/biometry/qml/Biometryd/CMakeLists.txt \
      --replace "\''${CMAKE_INSTALL_LIBDIR}/qt5/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
@ -91,6 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
    cmake
    pkg-config
    qtdeclarative # qmlplugindump
+    validatePkgConfig
  ];

  buildInputs = [
@ -114,8 +78,9 @@ stdenv.mkDerivation (finalAttrs: {
  dontWrapQtApps = true;

  cmakeFlags = [
-    "-DENABLE_WERROR=OFF"
-    "-DWITH_HYBRIS=OFF"
+    # maybe-uninitialized warnings
+    (lib.cmakeBool "ENABLE_WERROR" false)
+    (lib.cmakeBool "WITH_HYBRIS" false)
  ];

  preBuild = ''
@ -125,6 +90,11 @@ stdenv.mkDerivation (finalAttrs: {

  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = gitUpdater { };
+  };
+
  meta = with lib; {
    description = "Mediates/multiplexes access to biometric devices";
    longDescription = ''
@ -133,6 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
      them for identification and verification of users.
    '';
    homepage = "https://gitlab.com/ubports/development/core/biometryd";
+    changelog = "https://gitlab.com/ubports/development/core/biometryd/-/${finalAttrs.version}/ChangeLog";
    license = licenses.lgpl3Only;
    maintainers = teams.lomiri.members;
    mainProgram = "biometryd";
--- a/pkgs/desktops/lomiri/services/content-hub/default.nix
+++ b/pkgs/desktops/lomiri/services/content-hub/default.nix
@ -67,6 +67,18 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://gitlab.com/ubports/development/core/content-hub/-/commit/3c5ca4a8ec125e003aca78c14521b70140856c25.patch";
      hash = "sha256-kYN0eLwMyM/9yK+zboyEsoPKZMZ4SCXodVYsvkQr2F8=";
    })
+
+    # Remove when https://gitlab.com/ubports/development/core/content-hub/-/merge_requests/37 merged & in release
+    (fetchpatch {
+      name = "0004-content-hub-Fix-generation-of-transfer_files.patch";
+      url = "https://gitlab.com/ubports/development/core/content-hub/-/commit/7ab3a4421356f83515f0deffb5f97a5b38601c13.patch";
+      hash = "sha256-MJZm3ny5t0/GX0bd5hGQbPM2k7M4KUvKqce/0cYYgvM=";
+    })
+    (fetchpatch {
+      name = "0005-content-hub-Fix-generation-of-moc_test_harness.patch";
+      url = "https://gitlab.com/ubports/development/core/content-hub/-/commit/6e30f4f10ef90e817ca01d32959b6c782de48955.patch";
+      hash = "sha256-TAbYn265RpHpulaRVaHy9XqNF+qoDE7YQIfFMPfqEhw=";
+    })
  ];

  postPatch = ''
--- a/pkgs/desktops/lomiri/services/hfd-service/default.nix
+++ b/pkgs/desktops/lomiri/services/hfd-service/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "hfd-service";
-  version = "0.2.1";
+  version = "0.2.2";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/hfd-service";
    rev = finalAttrs.version;
-    hash = "sha256-KcHwLTSdo86YCteUsPndoxmLf23SOEhROc5cJQ8GS1Q=";
+    hash = "sha256-OpT1vNjnyq66v54EoGOZOUb4HECD4WRJRh9hYMB0GI0=";
  };

  postPatch = ''
@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  cmakeFlags = [
-    "-DENABLE_LIBHYBRIS=OFF"
+    (lib.cmakeBool "ENABLE_LIBHYBRIS" false)
  ];

  dontWrapQtApps = true;
@ -69,6 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = with lib; {
    description = "DBus-activated service that manages human feedback devices such as LEDs and vibrators on mobile devices";
    homepage = "https://gitlab.com/ubports/development/core/hfd-service";
+    changelog = "https://gitlab.com/ubports/development/core/hfd-service/-/blob/${finalAttrs.version}/ChangeLog";
    license = licenses.lgpl3Only;
    maintainers = teams.lomiri.members;
    platforms = platforms.linux;
--- a/pkgs/desktops/lomiri/services/history-service/default.nix
+++ b/pkgs/desktops/lomiri/services/history-service/default.nix
@ -19,6 +19,7 @@
 , sqlite
 , telepathy
 , telepathy-mission-control
+, validatePkgConfig
 , wrapQtAppsHook
 , xvfb-run
 }:
@ -28,13 +29,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "history-service";
-  version = "0.4";
+  version = "0.5";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/history-service";
    rev = finalAttrs.version;
-    hash = "sha256-oCX+moGQewzstbpddEYYp1kQdO2mVXpWJITfvzDzQDI=";
+    hash = "sha256-m/ytJoHxW0q1vlVKK6Z9ovHzjoiS1AodCSGHTeKygfQ=";
  };

  outputs = [
@ -43,38 +44,31 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  patches = [
-    # Deprecation warnings with Qt5.15, allow disabling -Werror
-    # Remove when version > 0.4
-    (fetchpatch {
-      url = "https://gitlab.com/ubports/development/core/history-service/-/commit/1370777952c6a2efb85f582ff8ba085c2c0e290a.patch";
-      hash = "sha256-Z/dFrFo7WoPZlKto6wNGeWdopsi8iBjmd5ycbqMKgxo=";
-    })
-
    # Drop deprecated qt5_use_modules usage
    # Remove when https://gitlab.com/ubports/development/core/history-service/-/merge_requests/36 merged & in release
    (fetchpatch {
-      url = "https://gitlab.com/OPNA2608/history-service/-/commit/b36ab377aca93555b29d1471d6eaa706b5c843ca.patch";
+      url = "https://gitlab.com/ubports/development/core/history-service/-/commit/b36ab377aca93555b29d1471d6eaa706b5c843ca.patch";
      hash = "sha256-mOpXqqd4JI7lHtcWDm9LGCrtB8ERge04jMpHIagDM2k=";
    })

    # Add more / correct existing GNUInstallDirs usage
    # Remove when https://gitlab.com/ubports/development/core/history-service/-/merge_requests/37 merged & in release
    (fetchpatch {
-      url = "https://gitlab.com/OPNA2608/history-service/-/commit/bb4dbdd16e80dcd286d8edfb86b08f0b61bc7fec.patch";
+      url = "https://gitlab.com/ubports/development/core/history-service/-/commit/bb4dbdd16e80dcd286d8edfb86b08f0b61bc7fec.patch";
      hash = "sha256-C/XaygI663yaU06klQD9g0NnbqYxHSmzdbrRxcfiJkk=";
    })

    # Correct version information
    # Remove when https://gitlab.com/ubports/development/core/history-service/-/merge_requests/38 merged & in release
    (fetchpatch {
-      url = "https://gitlab.com/OPNA2608/history-service/-/commit/30d9fbee203205ec1ea8fd19c9b6eb54c080a9e2.patch";
-      hash = "sha256-vSZ1ii5Yhw7pB+Pd1pjWnW7JsQxKnn+LeuBKo6qZjQs=";
+      url = "https://gitlab.com/ubports/development/core/history-service/-/commit/98458126f9f494b124134fb35c198af0545f6a98.patch";
+      hash = "sha256-4EfLsaueKTCovl8EilN30cmfNfg19wvyCsbKqOrXtuw=";
    })

    # Make tests optional
    # Remove when https://gitlab.com/ubports/development/core/history-service/-/merge_requests/39 merged & in release
    (fetchpatch {
-      url = "https://gitlab.com/OPNA2608/history-service/-/commit/cb5c80cffc35611657244e15a7eb10edcd598ccd.patch";
+      url = "https://gitlab.com/ubports/development/core/history-service/-/commit/cb5c80cffc35611657244e15a7eb10edcd598ccd.patch";
      hash = "sha256-MFHGu4OMScdThq9htUgFMpezP7Ym6YTIZUHWol20wqw=";
    })
  ];
@ -131,6 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
    cmake
    pkg-config
    sqlite
+    validatePkgConfig
    wrapQtAppsHook
  ];

@ -193,6 +188,7 @@ stdenv.mkDerivation (finalAttrs: {
      Database location: ~/.local/share/history-service/history.sqlite
    '';
    homepage = "https://gitlab.com/ubports/development/core/history-service";
+    changelog = "https://gitlab.com/ubports/development/core/history-service/-/blob/${finalAttrs.version}/ChangeLog";
    license = licenses.gpl3Only;
    maintainers = teams.lomiri.members;
    platforms = platforms.linux;
--- a/pkgs/desktops/lomiri/services/lomiri-download-manager/default.nix
+++ b/pkgs/desktops/lomiri/services/lomiri-download-manager/default.nix
@ -9,7 +9,8 @@
 , cmake-extras
 , dbus
 , dbus-test-runner
-, withDocumentation ? true
+# Needs qdoc, https://github.com/NixOS/nixpkgs/pull/245379
+, withDocumentation ? false
 , doxygen
 , glog
 , graphviz
@ -19,19 +20,20 @@
 , python3
 , qtbase
 , qtdeclarative
+, validatePkgConfig
 , wrapQtAppsHook
 , xvfb-run
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "lomiri-download-manager";
-  version = "0.1.2";
+  version = "0.1.3";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/lomiri-download-manager";
    rev = finalAttrs.version;
-    hash = "sha256-a9C+hactBMHMr31E+ImKDPgpzxajy1klkjDcSEkPHqI=";
+    hash = "sha256-LhhO/zZ4wNiRd235NB2b08SQcCZt1awN/flcsLs2m8U=";
  };

  outputs = [
@ -42,42 +44,17 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  patches = [
-    # Remove when version > 0.1.2
+    # This change seems incomplete, potentially breaks things on systems that don't use AppArmor mediation
+    # https://gitlab.com/ubports/development/core/lomiri-download-manager/-/merge_requests/24#note_1746801673
    (fetchpatch {
-      name = "0001-lomiri-download-manager-Make-documentation-build-optional.patch";
-      url = "https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/32d7369714c01bd425af9c6de5bdc04399a12e0a.patch";
-      hash = "sha256-UztcBAAFXDX2j0X5D3kMp9q0vFm3/PblUAKPJ5nZyiY=";
-    })
-
-    # Remove when version > 0.1.2
-    (fetchpatch {
-      name = "0002-lomiri-download-manager-Upgrade-C++-standard-to-C++17.patch";
-      url = "https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/a6bc7ae80f2ff4c4743978c6c694149707d9d2e2.patch";
-      hash = "sha256-iA1sZhHI8Osgo1ofL5RTqgVzUG32zx0dU/28qcEqmQc=";
-    })
-
-    # Remove when version > 0.1.2
-    (fetchpatch {
-      name = "0003-lomiri-download-manager-Bump-version-make-Werror-and-tests-optional.patch";
-      url = "https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/73ec04c429e5285f05dd72d5bb9720ba6ff31be2.patch";
-      hash = "sha256-0BrJSKCvUhITwfln05OrHgHEpldbgBoh4rivAvw+qrc=";
-    })
-
-    # Remove when version > 0.1.2
-    (fetchpatch {
-      name = "0004-lomiri-download-manager-Use-GNUInstallDirs-variables-for-more-install-destinations.patch";
-      url = "https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/5d40daf053de62150aa5ee618285e415d7d3f1c8.patch";
-      hash = "sha256-r5fpiJkZkDsYX9fcX5JuPsE/qli9z5/DatmGJ9/QauU=";
+      name = "0001-lomiri-download-manager-Revert-Drop-GetConnectionAppArmorSecurityContext.patch";
+      url = "https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/2367f3dff852b69457b1a65a487cb032c210569f.patch";
+      revert = true;
+      hash = "sha256-xS0Wz6d+bZWj/kDGK2WhOduzyP4Rgz3n9n2XY1Zu5hE=";
    })
  ];

  postPatch = ''
-    # fetchpatch strips renames
-    # Remove when version > 0.1.2
-    for service in src/{uploads,downloads}/daemon/{lomiri-*-manager,lomiri-*-manager-systemd,com.lomiri.*}.service; do
-      mv "$service" "$service".in
-    done
-
    # pkg_get_variable doesn't let us substitute prefix pkg-config variable from systemd
    substituteInPlace CMakeLists.txt \
      --replace 'pkg_get_variable(SYSTEMD_USER_DIR systemd systemduserunitdir)' 'set(SYSTEMD_USER_DIR "${placeholder "out"}/lib/systemd/user")' \
@ -89,6 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    cmake
    pkg-config
+    validatePkgConfig
    wrapQtAppsHook
  ] ++ lib.optionals withDocumentation [
    doxygen
@ -116,10 +94,10 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  cmakeFlags = [
-    "-DENABLE_DOC=${lib.boolToString withDocumentation}"
+    (lib.cmakeBool "ENABLE_DOC" withDocumentation)
    # Deprecation warnings on Qt 5.15
    # https://gitlab.com/ubports/development/core/lomiri-download-manager/-/issues/1
-    "-DENABLE_WERROR=OFF"
+    (lib.cmakeBool "ENABLE_WERROR" false)
  ];

  makeTargets = [
@ -146,6 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = with lib; {
    description = "Performs uploads and downloads from a centralized location";
    homepage = "https://gitlab.com/ubports/development/core/lomiri-download-manager";
+    changelog = "https://gitlab.com/ubports/development/core/lomiri-download-manager/-/blob/${finalAttrs.version}/ChangeLog";
    license = licenses.lgpl3Only;
    maintainers = teams.lomiri.members;
    platforms = platforms.linux;
--- a/pkgs/desktops/lomiri/services/lomiri-indicator-network/default.nix
+++ b/pkgs/desktops/lomiri/services/lomiri-indicator-network/default.nix
@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitLab
-, fetchpatch
 , gitUpdater
 , nixosTests
 , testers
@ -27,17 +26,18 @@
 , python3
 , qtdeclarative
 , qtbase
+, validatePkgConfig
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "lomiri-indicator-network";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/lomiri-indicator-network";
    rev = finalAttrs.version;
-    hash = "sha256-rJKWhW082ndVPEQHjuSriKtl0zQw86adxiINkZQq1hY=";
+    hash = "sha256-9AQCWCZFbt4XcmKsjoTXJlWOm02/kBhpPxbHRtftNFM=";
  };

  outputs = [
@ -46,22 +46,6 @@ stdenv.mkDerivation (finalAttrs: {
    "doc"
  ];

-  patches = [
-    # Remove when version > 1.0.1
-    (fetchpatch {
-      name = "0001-lomiri-indicator-network-Make-less-assumptions-about-where-files-will-end-up.patch";
-      url = "https://gitlab.com/ubports/development/core/lomiri-indicator-network/-/commit/065212b22ab9aa8d25a61b5482ad6511e4c8510b.patch";
-      hash = "sha256-WrDTBKusK1808W8LZRGWaTOExu7gKpYBvkQ8hzoHoHk=";
-    })
-
-    # Remove when version > 1.0.1
-    (fetchpatch {
-      name = "0002-lomiri-indicator-network-Honour-CMAKE_INSTALL_DOCDIR_fordocumentation-installation.patch";
-      url = "https://gitlab.com/ubports/development/core/lomiri-indicator-network/-/commit/79b9e12313f765ab6e95b4d4dfefbdbca50ef3c6.patch";
-      hash = "sha256-vRfdegEi892UlrC9c1+5Td7CHLh7u0foPggLNBfc8lw=";
-    })
-  ];
-
  postPatch = ''
    # Queried via pkg-config, would need to override a prefix variable
    # Needs CMake 3.28 or higher to do as part of the call, https://github.com/NixOS/nixpkgs/pull/275284
@ -79,6 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
    intltool
    pkg-config
    qtdeclarative
+    validatePkgConfig
  ];

  buildInputs = [
@ -138,6 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = with lib; {
    description = "Ayatana indiator exporting the network settings menu through D-Bus";
    homepage = "https://gitlab.com/ubports/development/core/lomiri-indicator-network";
+    changelog = "https://gitlab.com/ubports/development/core/lomiri-indicator-network/-/blob/${finalAttrs.version}/ChangeLog";
    license = licenses.gpl3Only;
    maintainers = teams.lomiri.members;
    platforms = platforms.linux;
--- a/Show More
+++ b/Show More