Merge branch 'master' into staging

2024-07-11 22:05:05 +02:00 · 2024-07-11 22:05:05 +02:00 · 2c053848df
commit 2c053848df
parent 9cec369c46 6c12901eb4
186 changed files with 2785 additions and 1502 deletions
--- a/.gitignore
+++ b/.gitignore
@ -7,6 +7,7 @@
 .idea/
 .nixos-test-history
 .vscode/
+.helix/
 outputs/
 result-*
 result
--- a/lib/default.nix
+++ b/lib/default.nix
@ -64,6 +64,9 @@ let
    # linux kernel configuration
    kernel = callLibs ./kernel.nix;

+    # network
+    network = callLibs ./network;
+
    # TODO: For consistency, all builtins should also be available from a sub-library;
    # these are the only ones that are currently not
    inherit (builtins) addErrorContext isPath trace typeOf unsafeGetAttrPos;
@ -73,7 +76,7 @@ let
      info showWarnings nixpkgsVersion version isInOldestRelease
      mod compare splitByAndCompare seq deepSeq lessThan add sub
      functionArgs setFunctionArgs isFunction toFunction mirrorFunctionArgs
-      toHexString toBaseDigits inPureEvalMode isBool isInt pathExists
+      fromHexString toHexString toBaseDigits inPureEvalMode isBool isInt pathExists
      genericClosure readFile;
    inherit (self.fixedPoints) fix fix' converge extends composeExtensions
      composeManyExtensions makeExtensible makeExtensibleWithCustomName;
--- a/lib/network/default.nix
+++ b/lib/network/default.nix
@ -0,0 +1,49 @@
+{ lib }:
+let
+  inherit (import ./internal.nix { inherit lib; }) _ipv6;
+in
+{
+  ipv6 = {
+    /**
+      Creates an `IPv6Address` object from an IPv6 address as a string. If
+      the prefix length is omitted, it defaults to 64. The parser is limited
+      to the first two versions of IPv6 addresses addressed in RFC 4291.
+      The form "x:x:x:x:x:x:d.d.d.d" is not yet implemented. Addresses are
+      NOT compressed, so they are not always the same as the canonical text
+      representation of IPv6 addresses defined in RFC 5952.
+
+      # Type
+
+      ```
+      fromString :: String -> IPv6Address
+      ```
+
+      # Examples
+
+      ```nix
+      fromString "2001:DB8::ffff/32"
+      => {
+        address = "2001:db8:0:0:0:0:0:ffff";
+        prefixLength = 32;
+      }
+      ```
+
+      # Arguments
+
+      - [addr] An IPv6 address with optional prefix length.
+    */
+    fromString =
+      addr:
+      let
+        splittedAddr = _ipv6.split addr;
+
+        addrInternal = splittedAddr.address;
+        prefixLength = splittedAddr.prefixLength;
+
+        address = _ipv6.toStringFromExpandedIp addrInternal;
+      in
+      {
+        inherit address prefixLength;
+      };
+  };
+}
--- a/lib/network/internal.nix
+++ b/lib/network/internal.nix
@ -0,0 +1,209 @@
+{
+  lib ? import ../.,
+}:
+let
+  inherit (builtins)
+    map
+    match
+    genList
+    length
+    concatMap
+    head
+    toString
+    ;
+
+  inherit (lib) lists strings trivial;
+
+  inherit (lib.lists) last;
+
+  /*
+    IPv6 addresses are 128-bit identifiers. The preferred form is 'x:x:x:x:x:x:x:x',
+    where the 'x's are one to four hexadecimal digits of the eight 16-bit pieces of
+    the address. See RFC 4291.
+  */
+  ipv6Bits = 128;
+  ipv6Pieces = 8; # 'x:x:x:x:x:x:x:x'
+  ipv6PieceBits = 16; # One piece in range from 0 to 0xffff.
+  ipv6PieceMaxValue = 65535; # 2^16 - 1
+in
+let
+  /**
+    Expand an IPv6 address by removing the "::" compression and padding them
+    with the necessary number of zeros. Converts an address from the string to
+    the list of strings which then can be parsed using `_parseExpanded`.
+    Throws an error when the address is malformed.
+
+    # Type: String -> [ String ]
+
+    # Example:
+
+    ```nix
+    expandIpv6 "2001:DB8::ffff"
+    => ["2001" "DB8" "0" "0" "0" "0" "0" "ffff"]
+    ```
+  */
+  expandIpv6 =
+    addr:
+    if match "^[0-9A-Fa-f:]+$" addr == null then
+      throw "${addr} contains malformed characters for IPv6 address"
+    else
+      let
+        pieces = strings.splitString ":" addr;
+        piecesNoEmpty = lists.remove "" pieces;
+        piecesNoEmptyLen = length piecesNoEmpty;
+        zeros = genList (_: "0") (ipv6Pieces - piecesNoEmptyLen);
+        hasPrefix = strings.hasPrefix "::" addr;
+        hasSuffix = strings.hasSuffix "::" addr;
+        hasInfix = strings.hasInfix "::" addr;
+      in
+      if addr == "::" then
+        zeros
+      else if
+        let
+          emptyCount = length pieces - piecesNoEmptyLen;
+          emptyExpected =
+            # splitString produces two empty pieces when "::" in the beginning
+            # or in the end, and only one when in the middle of an address.
+            if hasPrefix || hasSuffix then
+              2
+            else if hasInfix then
+              1
+            else
+              0;
+        in
+        emptyCount != emptyExpected
+        || (hasInfix && piecesNoEmptyLen >= ipv6Pieces) # "::" compresses at least one group of zeros.
+        || (!hasInfix && piecesNoEmptyLen != ipv6Pieces)
+      then
+        throw "${addr} is not a valid IPv6 address"
+      # Create a list of 8 elements, filling some of them with zeros depending
+      # on where the "::" was found.
+      else if hasPrefix then
+        zeros ++ piecesNoEmpty
+      else if hasSuffix then
+        piecesNoEmpty ++ zeros
+      else if hasInfix then
+        concatMap (piece: if piece == "" then zeros else [ piece ]) pieces
+      else
+        pieces;
+
+  /**
+    Parses an expanded IPv6 address (see `expandIpv6`), converting each part
+    from a string to an u16 integer. Returns an internal representation of IPv6
+    address (list of integers) that can be easily processed by other helper
+    functions.
+    Throws an error some element is not an u16 integer.
+
+    # Type: [ String ] -> IPv6
+
+    # Example:
+
+    ```nix
+    parseExpandedIpv6 ["2001" "DB8" "0" "0" "0" "0" "0" "ffff"]
+    => [8193 3512 0 0 0 0 0 65535]
+    ```
+  */
+  parseExpandedIpv6 =
+    addr:
+    assert lib.assertMsg (
+      length addr == ipv6Pieces
+    ) "parseExpandedIpv6: expected list of integers with ${ipv6Pieces} elements";
+    let
+      u16FromHexStr =
+        hex:
+        let
+          parsed = trivial.fromHexString hex;
+        in
+        if 0 <= parsed && parsed <= ipv6PieceMaxValue then
+          parsed
+        else
+          throw "0x${hex} is not a valid u16 integer";
+    in
+    map (piece: u16FromHexStr piece) addr;
+in
+let
+  /**
+    Parses an IPv6 address from a string to the internal representation (list
+    of integers).
+
+    # Type: String -> IPv6
+
+    # Example:
+
+    ```nix
+    parseIpv6FromString "2001:DB8::ffff"
+    => [8193 3512 0 0 0 0 0 65535]
+    ```
+  */
+  parseIpv6FromString = addr: parseExpandedIpv6 (expandIpv6 addr);
+in
+{
+  /*
+    Internally, an IPv6 address is stored as a list of 16-bit integers with 8
+    elements. Wherever you see `IPv6` in internal functions docs, it means that
+    it is a list of integers produced by one of the internal parsers, such as
+    `parseIpv6FromString`
+  */
+  _ipv6 = {
+    /**
+      Converts an internal representation of an IPv6 address (i.e, a list
+      of integers) to a string. The returned string is not a canonical
+      representation as defined in RFC 5952, i.e zeros are not compressed.
+
+      # Type: IPv6 -> String
+
+      # Example:
+
+      ```nix
+      parseIpv6FromString [8193 3512 0 0 0 0 0 65535]
+      => "2001:db8:0:0:0:0:0:ffff"
+      ```
+    */
+    toStringFromExpandedIp =
+      pieces: strings.concatMapStringsSep ":" (piece: strings.toLower (trivial.toHexString piece)) pieces;
+
+    /**
+      Extract an address and subnet prefix length from a string. The subnet
+      prefix length is optional and defaults to 128. The resulting address and
+      prefix length are validated and converted to an internal representation
+      that can be used by other functions.
+
+      # Type: String -> [ {address :: IPv6, prefixLength :: Int} ]
+
+      # Example:
+
+      ```nix
+      split "2001:DB8::ffff/32"
+      => {
+        address = [8193 3512 0 0 0 0 0 65535];
+        prefixLength = 32;
+      }
+      ```
+    */
+    split =
+      addr:
+      let
+        splitted = strings.splitString "/" addr;
+        splittedLength = length splitted;
+      in
+      if splittedLength == 1 then # [ ip ]
+        {
+          address = parseIpv6FromString addr;
+          prefixLength = ipv6Bits;
+        }
+      else if splittedLength == 2 then # [ ip subnet ]
+        {
+          address = parseIpv6FromString (head splitted);
+          prefixLength =
+            let
+              n = strings.toInt (last splitted);
+            in
+            if 1 <= n && n <= ipv6Bits then
+              n
+            else
+              throw "${addr} IPv6 subnet should be in range [1;${toString ipv6Bits}], got ${toString n}";
+        }
+      else
+        throw "${addr} is not a valid IPv6 address in CIDR notation";
+  };
+}
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -102,6 +102,7 @@ let
    testAllTrue
    toBaseDigits
    toHexString
+    fromHexString
    toInt
    toIntBase10
    toShellVars
@ -286,6 +287,21 @@ runTests {
    expected = "FA";
  };

+  testFromHexStringFirstExample = {
+    expr = fromHexString "FF";
+    expected = 255;
+  };
+
+  testFromHexStringSecondExample = {
+    expr = fromHexString (builtins.hashString "sha256" "test");
+    expected = 9223372036854775807;
+  };
+
+  testFromHexStringWithPrefix = {
+    expr = fromHexString "0Xf";
+    expected = 15;
+  };
+
  testToBaseDigits = {
    expr = toBaseDigits 2 6;
    expected = [ 1 1 0 ];
--- a/lib/tests/network.sh
+++ b/lib/tests/network.sh
@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+
+# Tests lib/network.nix
+# Run:
+# [nixpkgs]$ lib/tests/network.sh
+# or:
+# [nixpkgs]$ nix-build lib/tests/release.nix
+
+set -euo pipefail
+shopt -s inherit_errexit
+
+if [[ -n "${TEST_LIB:-}" ]]; then
+  NIX_PATH=nixpkgs="$(dirname "$TEST_LIB")"
+else
+  NIX_PATH=nixpkgs="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.."; pwd)"
+fi
+export NIX_PATH
+
+die() {
+  echo >&2 "test case failed: " "$@"
+  exit 1
+}
+
+tmp="$(mktemp -d)"
+clean_up() {
+    rm -rf "$tmp"
+}
+trap clean_up EXIT SIGINT SIGTERM
+work="$tmp/work"
+mkdir "$work"
+cd "$work"
+
+prefixExpression='
+  let
+    lib = import <nixpkgs/lib>;
+    internal = import <nixpkgs/lib/network/internal.nix> {
+      inherit lib;
+    };
+  in
+  with lib;
+  with lib.network;
+'
+
+expectSuccess() {
+    local expr=$1
+    local expectedResult=$2
+    if ! result=$(nix-instantiate --eval --strict --json --show-trace \
+        --expr "$prefixExpression ($expr)"); then
+        die "$expr failed to evaluate, but it was expected to succeed"
+    fi
+    if [[ ! "$result" == "$expectedResult" ]]; then
+        die "$expr == $result, but $expectedResult was expected"
+    fi
+}
+
+expectSuccessRegex() {
+    local expr=$1
+    local expectedResultRegex=$2
+    if ! result=$(nix-instantiate --eval --strict --json --show-trace \
+        --expr "$prefixExpression ($expr)"); then
+        die "$expr failed to evaluate, but it was expected to succeed"
+    fi
+    if [[ ! "$result" =~ $expectedResultRegex ]]; then
+        die "$expr == $result, but $expectedResultRegex was expected"
+    fi
+}
+
+expectFailure() {
+    local expr=$1
+    local expectedErrorRegex=$2
+    if result=$(nix-instantiate --eval --strict --json --show-trace 2>"$work/stderr" \
+        --expr "$prefixExpression ($expr)"); then
+        die "$expr evaluated successfully to $result, but it was expected to fail"
+    fi
+    if [[ ! "$(<"$work/stderr")" =~ $expectedErrorRegex ]]; then
+        die "Error was $(<"$work/stderr"), but $expectedErrorRegex was expected"
+    fi
+}
+
+# Internal functions
+expectSuccess '(internal._ipv6.split "0:0:0:0:0:0:0:0").address'                         '[0,0,0,0,0,0,0,0]'
+expectSuccess '(internal._ipv6.split "000a:000b:000c:000d:000e:000f:ffff:aaaa").address' '[10,11,12,13,14,15,65535,43690]'
+expectSuccess '(internal._ipv6.split "::").address'                                      '[0,0,0,0,0,0,0,0]'
+expectSuccess '(internal._ipv6.split "::0000").address'                                  '[0,0,0,0,0,0,0,0]'
+expectSuccess '(internal._ipv6.split "::1").address'                                     '[0,0,0,0,0,0,0,1]'
+expectSuccess '(internal._ipv6.split "::ffff").address'                                  '[0,0,0,0,0,0,0,65535]'
+expectSuccess '(internal._ipv6.split "::000f").address'                                  '[0,0,0,0,0,0,0,15]'
+expectSuccess '(internal._ipv6.split "::1:1:1:1:1:1:1").address'                         '[0,1,1,1,1,1,1,1]'
+expectSuccess '(internal._ipv6.split "1::").address'                                     '[1,0,0,0,0,0,0,0]'
+expectSuccess '(internal._ipv6.split "1:1:1:1:1:1:1::").address'                         '[1,1,1,1,1,1,1,0]'
+expectSuccess '(internal._ipv6.split "1:1:1:1::1:1:1").address'                          '[1,1,1,1,0,1,1,1]'
+expectSuccess '(internal._ipv6.split "1::1").address'                                    '[1,0,0,0,0,0,0,1]'
+
+expectFailure 'internal._ipv6.split "0:0:0:0:0:0:0:-1"' "contains malformed characters for IPv6 address"
+expectFailure 'internal._ipv6.split "::0:"'              "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split ":0::"'              "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split "0::0:"'             "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split "0:0:"'              "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split "0:0:0:0:0:0:0:0:0"' "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split "0:0:0:0:0:0:0:0:"'  "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split "::0:0:0:0:0:0:0:0"' "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split "0::0:0:0:0:0:0:0"'  "is not a valid IPv6 address"
+expectFailure 'internal._ipv6.split "::10000"'           "0x10000 is not a valid u16 integer"
+
+expectSuccess '(internal._ipv6.split "::").prefixLength'     '128'
+expectSuccess '(internal._ipv6.split "::/1").prefixLength'   '1'
+expectSuccess '(internal._ipv6.split "::/128").prefixLength' '128'
+
+expectFailure '(internal._ipv6.split "::/0").prefixLength'   "IPv6 subnet should be in range \[1;128\], got 0"
+expectFailure '(internal._ipv6.split "::/129").prefixLength' "IPv6 subnet should be in range \[1;128\], got 129"
+expectFailure '(internal._ipv6.split "/::/").prefixLength'   "is not a valid IPv6 address in CIDR notation"
+
+# Library API
+expectSuccess 'lib.network.ipv6.fromString "2001:DB8::ffff/64"' '{"address":"2001:db8:0:0:0:0:0:ffff","prefixLength":64}'
+expectSuccess 'lib.network.ipv6.fromString "1234:5678:90ab:cdef:fedc:ba09:8765:4321/44"' '{"address":"1234:5678:90ab:cdef:fedc:ba09:8765:4321","prefixLength":44}'
+
+echo >&2 tests ok
--- a/lib/tests/test-with-nix.nix
+++ b/lib/tests/test-with-nix.nix
@ -65,6 +65,9 @@ pkgs.runCommand "nixpkgs-lib-tests-nix-${nix.version}" {
  echo "Running lib/tests/sources.sh"
  TEST_LIB=$PWD/lib bash lib/tests/sources.sh

+  echo "Running lib/tests/network.sh"
+  TEST_LIB=$PWD/lib bash lib/tests/network.sh
+
  echo "Running lib/fileset/tests.sh"
  TEST_LIB=$PWD/lib bash lib/fileset/tests.sh

--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@ -1074,6 +1074,32 @@ in {
    then v
    else k: v;

+  /**
+    Convert a hexadecimal string to it's integer representation.
+
+    # Type
+
+    ```
+    fromHexString :: String -> [ String ]
+    ```
+
+    # Examples
+
+    ```nix
+    fromHexString "FF"
+    => 255
+
+    fromHexString (builtins.hashString "sha256" "test")
+    => 9223372036854775807
+    ```
+  */
+  fromHexString = value:
+  let
+    noPrefix = lib.strings.removePrefix "0x" (lib.strings.toLower value);
+  in let
+    parsed = builtins.fromTOML "v=0x${noPrefix}";
+  in parsed.v;
+
  /**
    Convert the given positive integer to a string of its hexadecimal
    representation. For example:
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -20551,6 +20551,12 @@
    githubId = 1312290;
    name = "Trevor Joynson";
  };
+  treyfortmuller = {
+    email = "treyunofficial@gmail.com";
+    github = "treyfortmuller";
+    githubId = 5715025;
+    name = "Trey Fortmuller";
+  };
  tricktron = {
    email = "tgagnaux@gmail.com";
    github = "tricktron";
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -30,6 +30,8 @@

 - [Envision](https://gitlab.com/gabmus/envision), a UI for building, configuring and running Monado, the open source OpenXR runtime. Available as [programs.envision](#opt-programs.envision.enable).

+- [realm](https://github.com/zhboner/realm), a simple, high performance relay server written in rust. Available as [services.realm.enable](#opt-services.realm.enable).
+
 - [Playerctld](https://github.com/altdesktop/playerctl), a daemon to track media player activity. Available as [services.playerctld](option.html#opt-services.playerctld).

 - [Glance](https://github.com/glanceapp/glance), a self-hosted dashboard that puts all your feeds in one place. Available as [services.glance](option.html#opt-services.glance).
@ -147,6 +149,8 @@
  services.shiori.environmentFile = "/path/to/env-file";
  ```

+- `/share/nano` is now only linked when `programs.nano.enable` is enabled.
+
 - `libe57format` has been updated to `>= 3.0.0`, which contains some backward-incompatible API changes. See the [release note](https://github.com/asmaloney/libE57Format/releases/tag/v3.0.0) for more details.

 - `gitlab` deprecated support for *runner registration tokens* in GitLab 16.0, disabled their support in GitLab 17.0 and will
@ -178,6 +182,10 @@
 - `keycloak` was updated to version 25, which introduces new hostname related options.
  See [Upgrading Guide](https://www.keycloak.org/docs/25.0.1/upgrading/#migrating-to-25-0-0) for instructions.

+- `programs.vim.defaultEditor` now only works if `programs.vim.enable` is enabled.
+
+- `/share/vim-plugins` now only gets linked if `programs.vim.enable` is enabled
+
 - The `tracy` package no longer works on X11, since it's moved to Wayland
  support, which is the intended default behavior by Tracy maintainers.
  X11 users have to switch to the new package `tracy-x11`.
--- a/nixos/modules/config/system-path.nix
+++ b/nixos/modules/config/system-path.nix
@ -153,10 +153,8 @@ in
        "/sbin"
        "/share/emacs"
        "/share/hunspell"
-        "/share/nano"
        "/share/org"
        "/share/themes"
-        "/share/vim-plugins"
        "/share/vulkan"
        "/share/kservices5"
        "/share/kservicetypes5"
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@ -96,7 +96,11 @@ in
        Enabling this fixes screen tearing when using Optimus via PRIME (see
        {option}`hardware.nvidia.prime.sync.enable`. This is not enabled
        by default because it is not officially supported by NVIDIA and would not
-        work with SLI
+        work with SLI.
+
+        Enabling this and using version 545 or newer of the proprietary NVIDIA
+        driver causes it to provide its own framebuffer device, which can cause
+        Wayland compositors to work when they otherwise wouldn't.
      '';

      prime.nvidiaBusId = lib.mkOption {
@ -568,9 +572,10 @@ in
              "nvidia_drm"
            ];

-            # If requested enable modesetting via kernel parameter.
+            # If requested enable modesetting via kernel parameters.
            kernelParams =
              lib.optional (offloadCfg.enable || cfg.modesetting.enable) "nvidia-drm.modeset=1"
+              ++ lib.optional ((offloadCfg.enable || cfg.modesetting.enable) && lib.versionAtLeast nvidia_x11.version "545") "nvidia-drm.fbdev=1"
              ++ lib.optional cfg.powerManagement.enable "nvidia.NVreg_PreserveVideoMemoryAllocations=1"
              ++ lib.optional cfg.open "nvidia.NVreg_OpenRmEnableUnsupportedGpus=1"
              ++ lib.optional (config.boot.kernelPackages.kernel.kernelAtLeast "6.2" && !ibtSupport) "ibt=off";
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@ -1,7 +1,7 @@
 {
-  x86_64-linux = "/nix/store/1w4b47zhp33md29wjhgg549pc281vv02-nix-2.18.4";
-  i686-linux = "/nix/store/hz02kn0ffn3wdi2xs7lndpr88v4v4fp2-nix-2.18.4";
-  aarch64-linux = "/nix/store/90zwqa9z2fgldc7ki1p5gfvglchjh9r6-nix-2.18.4";
-  x86_64-darwin = "/nix/store/bd1ix5mj9lj2yh7bqnmdjc24zlg5jivk-nix-2.18.4";
-  aarch64-darwin = "/nix/store/5hvsmklhqiay5i4q5vdkg60p8qpc69rz-nix-2.18.4";
+  x86_64-linux = "/nix/store/f409bhlpp0xkzvdz95qr2yvfjfi8r9jc-nix-2.18.5";
+  i686-linux = "/nix/store/ra39jzrxq3bcpf55aahwv5037akvylf5-nix-2.18.5";
+  aarch64-linux = "/nix/store/xiw8a4jbnw18svgdb04hyqzg5bsjspqf-nix-2.18.5";
+  x86_64-darwin = "/nix/store/k2gzx7i90x3h2c8g6xdi1jkwbl6ic895-nix-2.18.5";
+  aarch64-darwin = "/nix/store/rqwymbndaqxma6p8s5brcl9k32n5xx54-nix-2.18.5";
 }
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -973,6 +973,7 @@
  ./services/networking/clatd.nix
  ./services/networking/cloudflare-dyndns.nix
  ./services/networking/cloudflared.nix
+  ./services/networking/cloudflare-warp.nix
  ./services/networking/cntlm.nix
  ./services/networking/connman.nix
  ./services/networking/consul.nix
@ -1150,6 +1151,7 @@
  ./services/networking/radicale.nix
  ./services/networking/radvd.nix
  ./services/networking/rdnssd.nix
+  ./services/networking/realm.nix
  ./services/networking/redsocks.nix
  ./services/networking/resilio.nix
  ./services/networking/robustirc-bridge.nix
--- a/nixos/modules/programs/envision.nix
+++ b/nixos/modules/programs/envision.nix
@ -31,6 +31,14 @@ in
      };
    };

+    services.udev = {
+      enable = true;
+      packages = with pkgs; [
+        android-udev-rules
+        xr-hardware
+      ];
+    };
+
    environment.systemPackages = [ cfg.package ];

    networking.firewall = lib.mkIf cfg.openFirewall {
--- a/nixos/modules/programs/nano.nix
+++ b/nixos/modules/programs/nano.nix
@ -43,6 +43,7 @@ in
        include "${cfg.package}/share/nano/extra/*.nanorc"
      '') + cfg.nanorc;
      systemPackages = [ cfg.package ];
+      pathsToLink = [ "/share/nano" ];
    };
  };
 }
--- a/nixos/modules/programs/vim.nix
+++ b/nixos/modules/programs/vim.nix
@ -1,25 +1,31 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:

 let
  cfg = config.programs.vim;
-in {
+in
+{
  options.programs.vim = {
-    defaultEditor = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = ''
-        When enabled, installs vim and configures vim to be the default editor
-        using the EDITOR environment variable.
-      '';
+    enable = lib.mkEnableOption "Vi IMproved, an advanced text";
+
+    defaultEditor = lib.mkEnableOption "vim as the default editor";
+
+    package = lib.mkPackageOption pkgs "vim" { example = "vim-full"; };
  };

-    package = lib.mkPackageOption pkgs "vim" {
-      example = "vim-full";
+  # TODO: convert it into assert after 24.11 release
+  config = lib.mkIf (cfg.enable || cfg.defaultEditor) {
+    warnings = lib.mkIf (cfg.defaultEditor && !cfg.enable) [
+      "programs.vim.defaultEditor will only work if programs.vim.enable is enabled, will be encfored after the 24.11 release"
+    ];
+    environment = {
+      systemPackages = [ cfg.package ];
+      variables.EDITOR = lib.mkIf cfg.defaultEditor (lib.mkOverride 900 "vim");
+      pathsToLink = [ "/share/vim-plugins" ];
    };
  };
-
-  config = lib.mkIf cfg.defaultEditor {
-    environment.systemPackages = [ cfg.package ];
-    environment.variables = { EDITOR = lib.mkOverride 900 "vim"; };
-  };
 }
--- a/nixos/modules/services/cluster/rke2/default.nix
+++ b/nixos/modules/services/cluster/rke2/default.nix
@ -241,7 +241,7 @@ in
      "kernel.panic_on_oops" = 1;
    };

-    systemd.services.rke2 = {
+    systemd.services."rke2-${cfg.role}" = {
      description = "Rancher Kubernetes Engine v2";
      documentation = [ "https://github.com/rancher/rke2#readme" ];
      after = [ "network-online.target" ];
--- a/nixos/modules/services/games/terraria.nix
+++ b/nixos/modules/services/games/terraria.nix
@ -19,15 +19,28 @@ let
    (boolFlag "secure" cfg.secure)
    (boolFlag "noupnp" cfg.noUPnP)
  ];
-  stopScript = pkgs.writeScript "terraria-stop" ''
-    #!${pkgs.runtimeShell}

+  tmuxCmd = "${lib.getExe pkgs.tmux} -S ${lib.escapeShellArg cfg.dataDir}/terraria.sock";
+
+  stopScript = pkgs.writeShellScript "terraria-stop" ''
    if ! [ -d "/proc/$1" ]; then
      exit 0
    fi

-    ${getBin pkgs.tmux}/bin/tmux -S ${cfg.dataDir}/terraria.sock send-keys Enter exit Enter
-    ${getBin pkgs.coreutils}/bin/tail --pid="$1" -f /dev/null
+    lastline=$(${tmuxCmd} capture-pane -p | grep . | tail -n1)
+
+    # If the service is not configured to auto-start a world, it will show the world selection prompt
+    # If the last non-empty line on-screen starts with "Choose World", we know the prompt is open
+    if [[ "$lastline" =~ ^'Choose World' ]]; then
+      # In this case, nothing needs to be saved, so we can kill the process
+      ${tmuxCmd} kill-session
+    else
+      # Otherwise, we send the `exit` command
+      ${tmuxCmd} send-keys Enter exit Enter
+    fi
+
+    # Wait for the process to stop
+    tail --pid="$1" -f /dev/null
  '';
 in
 {
@ -152,7 +165,7 @@ in
        Type = "forking";
        GuessMainPID = true;
        UMask = 007;
-        ExecStart = "${getBin pkgs.tmux}/bin/tmux -S ${cfg.dataDir}/terraria.sock new -d ${pkgs.terraria-server}/bin/TerrariaServer ${concatStringsSep " " flags}";
+        ExecStart = "${tmuxCmd} new -d ${pkgs.terraria-server}/bin/TerrariaServer ${concatStringsSep " " flags}";
        ExecStop = "${stopScript} $MAINPID";
      };
    };
--- a/nixos/modules/services/monitoring/opentelemetry-collector.nix
+++ b/nixos/modules/services/monitoring/opentelemetry-collector.nix
@ -6,8 +6,9 @@ let
  cfg = config.services.opentelemetry-collector;
  opentelemetry-collector = cfg.package;

-  settingsFormat = pkgs.formats.yaml {};
-in {
+  settingsFormat = pkgs.formats.yaml { };
+in
+{
  options.services.opentelemetry-collector = {
    enable = mkEnableOption "Opentelemetry Collector";

@ -15,7 +16,7 @@ in {

    settings = mkOption {
      type = settingsFormat.type;
-      default = {};
+      default = { };
      description = ''
        Specify the configuration for Opentelemetry Collector in Nix.

@ -35,7 +36,7 @@ in {
  config = mkIf cfg.enable {
    assertions = [{
      assertion = (
-        (cfg.settings == {}) != (cfg.configFile == null)
+        (cfg.settings == { }) != (cfg.configFile == null)
      );
      message = ''
        Please specify a configuration for Opentelemetry Collector with either
@ -48,8 +49,10 @@ in {
      description = "Opentelemetry Collector Service Daemon";
      wantedBy = [ "multi-user.target" ];

-      serviceConfig = let
-        conf = if cfg.configFile == null
+      serviceConfig =
+        let
+          conf =
+            if cfg.configFile == null
            then settingsFormat.generate "config.yaml" cfg.settings
            else cfg.configFile;
        in
@ -60,8 +63,12 @@ in {
          ProtectSystem = "full";
          DevicePolicy = "closed";
          NoNewPrivileges = true;
-        WorkingDirectory = "/var/lib/opentelemetry-collector";
+          WorkingDirectory = "%S/opentelemetry-collector";
          StateDirectory = "opentelemetry-collector";
+          SupplementaryGroups = [
+            # allow to read the systemd journal for opentelemetry-collector
+            "systemd-journal"
+          ];
        };
    };
  };
--- a/nixos/modules/services/networking/cloudflare-warp.nix
+++ b/nixos/modules/services/networking/cloudflare-warp.nix
@ -0,0 +1,91 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.cloudflare-warp;
+in
+{
+  options.services.cloudflare-warp = {
+    enable = lib.mkEnableOption "Cloudflare Zero Trust client daemon";
+
+    package = lib.mkPackageOption pkgs "cloudflare-warp" { };
+
+    rootDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/cloudflare-warp";
+      description = ''
+        Working directory for the warp-svc daemon.
+      '';
+    };
+
+    udpPort = lib.mkOption {
+      type = lib.types.port;
+      default = 2408;
+      description = ''
+        The UDP port to open in the firewall. Warp uses port 2408 by default, but fallback ports can be used
+        if that conflicts with another service. See the [firewall documentation](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/firewall#warp-udp-ports)
+        for the pre-configured available fallback ports.
+      '';
+    };
+
+    openFirewall = lib.mkEnableOption "opening UDP ports in the firewall" // {
+      default = true;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedUDPPorts = [ cfg.udpPort ];
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.rootDir}    - root root"
+      "z ${cfg.rootDir}    - root root"
+    ];
+
+    systemd.services.cloudflare-warp = {
+      enable = true;
+      description = "Cloudflare Zero Trust Client Daemon";
+
+      # lsof is used by the service to determine which UDP port to bind to
+      # in the case that it detects collisions.
+      path = [ pkgs.lsof ];
+      requires = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig =
+        let
+          caps = [
+            "CAP_NET_ADMIN"
+            "CAP_NET_BIND_SERVICE"
+            "CAP_SYS_PTRACE"
+          ];
+        in
+        {
+          Type = "simple";
+          ExecStart = "${cfg.package}/bin/warp-svc";
+          ReadWritePaths = [ "${cfg.rootDir}" "/etc/resolv.conf" ];
+          CapabilityBoundingSet = caps;
+          AmbientCapabilities = caps;
+          Restart = "always";
+          RestartSec = 5;
+          Environment = [ "RUST_BACKTRACE=full" ];
+          WorkingDirectory = cfg.rootDir;
+
+          # See the systemd.exec docs for the canonicalized paths, the service
+          # makes use of them for logging, and account state info tracking.
+          # https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#RuntimeDirectory=
+          StateDirectory = "cloudflare-warp";
+          RuntimeDirectory = "cloudflare-warp";
+          LogsDirectory = "cloudflare-warp";
+
+          # The service needs to write to /etc/resolv.conf to configure DNS, so that file would have to
+          # be world read/writable to run as anything other than root.
+          User = "root";
+          Group = "root";
+        };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ treyfortmuller ];
+}
--- a/nixos/modules/services/networking/magic-wormhole-mailbox-server.nix
+++ b/nixos/modules/services/networking/magic-wormhole-mailbox-server.nix
@ -1,18 +1,27 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:

 let
  cfg = config.services.magic-wormhole-mailbox-server;
+  # keep semicolon in dataDir for backward compatibility
  dataDir = "/var/lib/magic-wormhole-mailbox-server;";
-  python = pkgs.python3.withPackages (py: [ py.magic-wormhole-mailbox-server py.twisted ]);
+  python = pkgs.python311.withPackages (
+    py: with py; [
+      magic-wormhole-mailbox-server
+      twisted
+    ]
+  );
 in
 {
  options.services.magic-wormhole-mailbox-server = {
-    enable = mkEnableOption "Magic Wormhole Mailbox Server";
+    enable = lib.mkEnableOption "Magic Wormhole Mailbox Server";
  };

-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
    systemd.services.magic-wormhole-mailbox-server = {
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
@ -23,6 +32,7 @@ in
        StateDirectory = baseNameOf dataDir;
      };
    };
-
  };
+
+  meta.maintainers = [ lib.maintainers.mjoerg ];
 }
--- a/nixos/modules/services/networking/realm.nix
+++ b/nixos/modules/services/networking/realm.nix
@ -0,0 +1,50 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+let
+  cfg = config.services.realm;
+  configFormat = pkgs.formats.json { };
+  configFile = configFormat.generate "config.json" cfg.config;
+  inherit (lib)
+    mkEnableOption mkPackageOption mkOption mkIf types getExe;
+in
+{
+
+  meta.maintainers = with lib.maintainers; [ ocfox ];
+
+  options = {
+    services.realm = {
+      enable = mkEnableOption "A simple, high performance relay server written in rust";
+      package = mkPackageOption pkgs "realm" { };
+      config = mkOption {
+        type = types.submodule {
+          freeformType = configFormat.type;
+        };
+        default = { };
+        description = ''
+          The realm configuration, see <https://github.com/zhboner/realm#overview> for documentation.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.realm = {
+      serviceConfig = {
+        DynamicUser = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectProc = "invisible";
+        ProtectKernelTunables = true;
+        ExecStart = "${getExe cfg.package} --config ${configFile}";
+        AmbientCapabilities = [ "CAP_NET_ADMIN" "CAP_NET_BIND_SERVICE" ];
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+  };
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -811,6 +811,7 @@ in {
  ragnarwm = handleTest ./ragnarwm.nix {};
  rasdaemon = handleTest ./rasdaemon.nix {};
  readarr = handleTest ./readarr.nix {};
+  realm = handleTest ./realm.nix {};
  redis = handleTest ./redis.nix {};
  redlib = handleTest ./redlib.nix {};
  redmine = handleTest ./redmine.nix {};
--- a/nixos/tests/realm.nix
+++ b/nixos/tests/realm.nix
@ -0,0 +1,39 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "realm";
+
+  meta = {
+    maintainers = with lib.maintainers; [ ocfox ];
+  };
+
+  nodes.machine = { pkgs, ... }: {
+    services.nginx = {
+      enable = true;
+      statusPage = true;
+    };
+    # realm need DNS resolv server to run or use config.dns.nameserver
+    services.resolved.enable = true;
+
+    services.realm = {
+      enable = true;
+      config = {
+        endpoints = [
+          {
+            listen = "0.0.0.0:1000";
+            remote = "127.0.0.1:80";
+          }
+        ];
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_unit("realm.service")
+
+    machine.wait_for_open_port(80)
+    machine.wait_for_open_port(1000)
+
+    machine.succeed("curl --fail http://localhost:1000/")
+  '';
+
+})
--- a/nixos/tests/systemd-homed.nix
+++ b/nixos/tests/systemd-homed.nix
@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, lib, ... }:
 let
-  password = "foobar";
-  newPass = "barfoo";
+  password = "foobarfoo";
+  newPass = "barfoobar";
 in
 {
  name = "systemd-homed";
--- a/pkgs/applications/audio/g4music/default.nix
+++ b/pkgs/applications/audio/g4music/default.nix
@ -15,14 +15,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "g4music";
-  version = "3.6.2";
+  version = "3.7.2";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "neithern";
    repo = "g4music";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-yNKDTcLunTLhAtOBrjuycw0rrdCSwmhhVyBg3AfMUCQ=";
+    hash = "sha256-fG8OBAzdCdr3Yo8Vei93HlNa2TIL5gxWG+0jFYjSDZ8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/picard/default.nix
+++ b/pkgs/applications/audio/picard/default.nix
@ -1,5 +1,7 @@
 { lib
-, python3Packages
+# Python 3.12 demonstrates a peculiar segmentation fault with pyqt5. Using
+# pyqt6 with Python 3.12 should work, but this is not released yet.
+, python311Packages
 , fetchFromGitHub

 , chromaprint
@ -11,7 +13,7 @@
 }:

 let
-  pythonPackages = python3Packages;
+  pythonPackages = python311Packages;
  pyqt5 =
    if enablePlayback then
      pythonPackages.pyqt5-multimedia
@ -20,14 +22,15 @@ let
 in
 pythonPackages.buildPythonApplication rec {
  pname = "picard";
-  version = "2.11";
+  # nix-update --commit picard --version-regex 'release-(.*)'
+  version = "2.12";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "metabrainz";
    repo = "picard";
    rev = "refs/tags/release-${version}";
-    hash = "sha256-2RGKHJKJ/QXR6Rehch4r1UtI+frRXa4G+n0bUmCGSu8=";
+    hash = "sha256-+++NDJzXw4tA5eQd24r+l3UK3YS8Jy1t9WNiEU9sH0Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@ -22,9 +22,13 @@ stdenv.mkDerivation (finalAttrs: {

  postInstall = ''
    install -Dm444 "$src/release/other/Freedesktop.org Resources/ProTracker 2 clone.desktop" \
-      -t $out/share/applications
+      $out/share/applications/pt2-clone.desktop
    install -Dm444 "$src/release/other/Freedesktop.org Resources/ProTracker 2 clone.png" \
-      -t $out/share/icons/hicolor/512x512/apps
+      $out/share/icons/hicolor/512x512/apps/pt2-clone.png
+    # gtk-update-icon-cache does not like whitespace. Note that removing this
+    # will not make the build fail, but it will make the NixOS test fail.
+    substituteInPlace $out/share/applications/pt2-clone.desktop \
+      --replace-fail "Icon=ProTracker 2 clone" Icon=pt2-clone
  '';

  passthru.tests = {
--- a/pkgs/applications/graphics/cloudcompare/default.nix
+++ b/pkgs/applications/graphics/cloudcompare/default.nix
@ -25,13 +25,13 @@

 mkDerivation rec {
  pname = "cloudcompare";
-  version = "2.13.1";
+  version = "2.13.2";

  src = fetchFromGitHub {
    owner = "CloudCompare";
    repo = "CloudCompare";
    rev = "v${version}";
-    hash = "sha256-QQwQt63tXxJnGaBLu+GvWkEazumYPhXnDe+giSu7wjk=";
+    hash = "sha256-KVbFGim2Nqhs5PAQiBNTmJStmnEINTeopiqqEBBniHc=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/graphics/gthumb/default.nix
+++ b/pkgs/applications/graphics/gthumb/default.nix
@ -22,7 +22,6 @@
 , libwebp
 , libX11
 , json-glib
-, webkitgtk
 , lcms2
 , bison
 , flex
@ -32,6 +31,7 @@
 , python3
 , desktop-file-utils
 , itstool
+, withWebservices ? true, webkitgtk
 }:

 stdenv.mkDerivation rec {
@ -79,11 +79,11 @@ stdenv.mkDerivation rec {
    libtiff
    libwebp
    libX11
-    webkitgtk
-  ];
+  ] ++ lib.optional withWebservices webkitgtk;

  mesonFlags = [
    "-Dlibchamplain=true"
+    (lib.mesonBool "webservices" withWebservices)
  ];

  postPatch = ''
--- a/pkgs/applications/misc/mysql-workbench/default.nix
+++ b/pkgs/applications/misc/mysql-workbench/default.nix
@ -48,11 +48,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mysql-workbench";
-  version = "8.0.36";
+  version = "8.0.38";

  src = fetchurl {
    url = "https://cdn.mysql.com/Downloads/MySQLGUITools/mysql-workbench-community-${finalAttrs.version}-src.tar.gz";
-    hash = "sha256-Y02KZrbCd3SRBYpgq6gYfpR+TEmg566D3zEvpwcUY3w=";
+    hash = "sha256-W2RsA2hIRUaNRK0Q5pN1YODbEiw6HE3cfeisPdUcYPY=";
  };

  patches = [
@ -78,9 +78,6 @@ stdenv.mkDerivation (finalAttrs: {
      cairoDev = "${cairo.dev}";
    })

-    # a newer libxml2 version has changed some interfaces
-    ./fix-xml2.patch
-
    # Don't try to override the ANTLR_JAR_PATH specified in cmakeFlags
    ./dont-search-for-antlr-jar.patch
  ];
@ -141,10 +138,6 @@ stdenv.mkDerivation (finalAttrs: {
    zstd
  ];

-  # GCC 13: error: 'int64_t' in namespace 'std' does not name a type
-  # when updating the version make sure this is still needed
-  env.CXXFLAGS = "-include cstdint";
-
  env.NIX_CFLAGS_COMPILE = toString ([
    # error: 'OGRErr OGRSpatialReference::importFromWkt(char**)' is deprecated
    "-Wno-error=deprecated-declarations"
--- a/pkgs/applications/misc/mysql-workbench/fix-xml2.patch
+++ b/pkgs/applications/misc/mysql-workbench/fix-xml2.patch
@ -1,25 +0,0 @@
-diff --git a/library/grt/src/grt.h b/library/grt/src/grt.h
-index 47bfd63..59e664b 100644
--- a/library/grt/src/grt.h
-+++ b/library/grt/src/grt.h
-@@ -35,6 +35,7 @@
- #include <stdexcept>
- #include <boost/function.hpp>
- #include <libxml/xmlmemory.h>
-+#include <libxml/tree.h>
- #include "base/threading.h"
- #include <string>
- #include <gmodule.h>
-diff --git a/library/grt/src/unserializer.cpp b/library/grt/src/unserializer.cpp
-index 6dda76d..a6f6a3c 100644
--- a/library/grt/src/unserializer.cpp
-+++ b/library/grt/src/unserializer.cpp
-@@ -401,7 +401,7 @@ ValueRef internal::Unserializer::unserialize_xmldata(const char *data, size_t si
-   xmlDocPtr doc = xmlReadMemory(data, (int)size, NULL, NULL, XML_PARSE_NOENT);
- 
-   if (!doc) {
-    xmlErrorPtr error = xmlGetLastError();
-+    const xmlError* error = xmlGetLastError();
- 
-     if (error)
-       throw std::runtime_error(base::strfmt("Could not parse XML data. Line %d, %s", error->line, error->message));
--- a/pkgs/applications/misc/mysql-workbench/hardcode-paths.patch
+++ b/pkgs/applications/misc/mysql-workbench/hardcode-paths.patch
@ -1,7 +1,8 @@
-diff -u -r a/frontend/linux/workbench/mysql-workbench.in b/frontend/linux/workbench/mysql-workbench.in
--- a/frontend/linux/workbench/mysql-workbench.in	2022-03-25 09:06:06.000000000 +0200
-+++ b/frontend/linux/workbench/mysql-workbench.in	2022-06-17 00:22:51.290117109 +0300
-@@ -100,8 +100,8 @@
+diff --git a/frontend/linux/workbench/mysql-workbench.in b/frontend/linux/workbench/mysql-workbench.in
+index cbecde4..ea5d3cc 100755
+--- a/frontend/linux/workbench/mysql-workbench.in
+++ b/frontend/linux/workbench/mysql-workbench.in
+@@ -100,8 +100,8 @@ fi
 if test "$WB_DEBUG" != ""; then
   $WB_DEBUG $MWB_BINARIES_DIR/mysql-workbench-bin "$@"
 else
@ -12,28 +13,29 @@ diff -u -r a/frontend/linux/workbench/mysql-workbench.in b/frontend/linux/workbe
   else
   $MWB_BINARIES_DIR/mysql-workbench-bin "$@"
   fi
-diff -u -r a/plugins/migration/frontend/migration_bulk_copy_data.py b/plugins/migration/frontend/migration_bulk_copy_data.py
--- a/plugins/migration/frontend/migration_bulk_copy_data.py	2022-03-25 09:06:06.000000000 +0200
-+++ b/plugins/migration/frontend/migration_bulk_copy_data.py	2022-06-17 00:13:29.430055453 +0300
-@@ -110,7 +110,7 @@
+diff --git a/plugins/migration/frontend/migration_bulk_copy_data.py b/plugins/migration/frontend/migration_bulk_copy_data.py
+index da6aa9f..9f4fe78 100644
+--- a/plugins/migration/frontend/migration_bulk_copy_data.py
+++ b/plugins/migration/frontend/migration_bulk_copy_data.py
+@@ -111,7 +111,7 @@ class ImportScriptLinux(ImportScript):
         return 'sh'
 
     def generate_import_script(self, connection_args, path_to_file, schema_name):
 -        output = ['#!/bin/bash']
 +        output = ['#!/usr/bin/env bash']
-         output.append('MYPATH=\`pwd\`')
+         output.append(r'MYPATH=\`pwd\`')
         
-         output.append('if [ -f \$MYPATH/%s ] ; then' % self.error_log_name)
-@@ -164,7 +164,7 @@
+         output.append(r'if [ -f \$MYPATH/%s ] ; then' % self.error_log_name)
+@@ -165,7 +165,7 @@ class ImportScriptDarwin(ImportScript):
         return 'sh'
 
     def generate_import_script(self, connection_args, path_to_file, schema_name):
 -        output = ['#!/bin/bash']
 +        output = ['#!/usr/bin/env bash']
-         output.append('MYPATH=\`pwd\`')
+         output.append(r'MYPATH=\`pwd\`')
         
-         output.append('if [ -f \$MYPATH/%s ] ; then' % self.error_log_name)
-@@ -417,7 +417,7 @@
+         output.append(r'if [ -f \$MYPATH/%s ] ; then' % self.error_log_name)
+@@ -418,7 +418,7 @@ class DataCopyScriptLinux(DataCopyScript):
     
         with open(script_path, 'w+') as f:
             os.chmod(script_path, 0o700)
@ -42,7 +44,7 @@ diff -u -r a/plugins/migration/frontend/migration_bulk_copy_data.py b/plugins/mi
             f.write('MYPATH=`pwd`\n')
             
             f.write("arg_source_password=\"<put source password here>\"\n")
-@@ -521,7 +521,7 @@
+@@ -522,7 +522,7 @@ class DataCopyScriptDarwin(DataCopyScript):
     
         with open(script_path, 'w+') as f:
             os.chmod(script_path, 0o700)
@ -51,10 +53,11 @@ diff -u -r a/plugins/migration/frontend/migration_bulk_copy_data.py b/plugins/mi
             f.write('MYPATH=`pwd`\n')
             
             f.write("arg_source_password=\"<put source password here>\"\n")
-diff -u -r a/plugins/wb.admin/backend/wb_server_control.py b/plugins/wb.admin/backend/wb_server_control.py
--- a/plugins/wb.admin/backend/wb_server_control.py	2022-03-25 09:06:06.000000000 +0200
-+++ b/plugins/wb.admin/backend/wb_server_control.py	2022-06-17 00:14:26.937905324 +0300
-@@ -39,7 +39,7 @@
+diff --git a/plugins/wb.admin/backend/wb_server_control.py b/plugins/wb.admin/backend/wb_server_control.py
+index 353f461..f7daa9e 100644
+--- a/plugins/wb.admin/backend/wb_server_control.py
+++ b/plugins/wb.admin/backend/wb_server_control.py
+@@ -40,7 +40,7 @@ import re
 
 UnixVariant = {
     "" : {
@ -63,10 +66,11 @@ diff -u -r a/plugins/wb.admin/backend/wb_server_control.py b/plugins/wb.admin/ba
     }
 }
 
-diff -u -r a/plugins/wb.admin/backend/wb_server_management.py b/plugins/wb.admin/backend/wb_server_management.py
--- a/plugins/wb.admin/backend/wb_server_management.py	2022-03-25 09:06:06.000000000 +0200
-+++ b/plugins/wb.admin/backend/wb_server_management.py	2022-06-17 00:18:58.034028354 +0300
-@@ -40,7 +40,7 @@
+diff --git a/plugins/wb.admin/backend/wb_server_management.py b/plugins/wb.admin/backend/wb_server_management.py
+index 40ed515..00da327 100644
+--- a/plugins/wb.admin/backend/wb_server_management.py
+++ b/plugins/wb.admin/backend/wb_server_management.py
+@@ -41,7 +41,7 @@ default_sudo_prefix = ''
 
 def reset_sudo_prefix():
     global default_sudo_prefix
@ -75,7 +79,7 @@ diff -u -r a/plugins/wb.admin/backend/wb_server_management.py b/plugins/wb.admin
 
 reset_sudo_prefix()
 
-@@ -100,7 +100,7 @@
+@@ -101,7 +101,7 @@ def wrap_for_sudo(command, sudo_prefix, as_user = Users.ADMIN, to_spawn = False)
 
     if to_spawn:
         command += ' &'
@ -84,7 +88,7 @@ diff -u -r a/plugins/wb.admin/backend/wb_server_management.py b/plugins/wb.admin
       
     # If as_user is the CURRENT then there's no need to sudo
     if as_user != Users.CURRENT:
-@@ -111,7 +111,7 @@
+@@ -112,7 +112,7 @@ def wrap_for_sudo(command, sudo_prefix, as_user = Users.ADMIN, to_spawn = False)
         if '/bin/sh' in sudo_prefix or '/bin/bash' in sudo_prefix:
             command = "LANG=C " + sudo_prefix + " \"" + command.replace('\\', '\\\\').replace('"', r'\"').replace('$','\\$') + "\""
         else:
@ -93,7 +97,7 @@ diff -u -r a/plugins/wb.admin/backend/wb_server_management.py b/plugins/wb.admin
 
     return command
 
-@@ -878,9 +878,9 @@
+@@ -879,9 +879,9 @@ class FileOpsLinuxBase(object):
     @useAbsPath("path")
     def get_file_owner(self, path, as_user = Users.CURRENT, user_password = None):
         if self.target_os == wbaOS.linux:
@ -105,7 +109,7 @@ diff -u -r a/plugins/wb.admin/backend/wb_server_management.py b/plugins/wb.admin
       
         output = io.StringIO()
         command = command + quote_path(path)
-@@ -904,9 +904,9 @@
+@@ -905,9 +905,9 @@ class FileOpsLinuxBase(object):
             if as_user == Users.CURRENT:
                 raise PermissionDeniedError("Cannot set owner of directory %s" % path)        
             else:
@ -117,7 +121,7 @@ diff -u -r a/plugins/wb.admin/backend/wb_server_management.py b/plugins/wb.admin
             
         res = self.process_ops.exec_cmd(command,
                                         as_user   = as_user,
-@@ -935,7 +935,7 @@
+@@ -936,7 +936,7 @@ class FileOpsLinuxBase(object):
     @useAbsPath("path")
     def remove_directory(self, path, as_user = Users.CURRENT, user_password = None):
         output = io.StringIO()
@ -126,7 +130,7 @@ diff -u -r a/plugins/wb.admin/backend/wb_server_management.py b/plugins/wb.admin
                                         as_user   = as_user,
                                         user_password = user_password,
                                         output_handler = output.write,
-@@ -948,7 +948,7 @@
+@@ -949,7 +949,7 @@ class FileOpsLinuxBase(object):
     @useAbsPath("path")
     def remove_directory_recursive(self, path, as_user = Users.CURRENT, user_password = None):
         output = io.StringIO()
@ -135,7 +139,7 @@ diff -u -r a/plugins/wb.admin/backend/wb_server_management.py b/plugins/wb.admin
                                         as_user   = as_user,
                                         user_password = user_password,
                                         output_handler = output.write,
-@@ -961,7 +961,7 @@
+@@ -962,7 +962,7 @@ class FileOpsLinuxBase(object):
     @useAbsPath("path")
     def delete_file(self, path, as_user = Users.CURRENT, user_password = None):
         output = io.StringIO()
@ -144,7 +148,7 @@ diff -u -r a/plugins/wb.admin/backend/wb_server_management.py b/plugins/wb.admin
                                         as_user   = as_user,
                                         user_password = user_password,
                                         output_handler = output.write,
-@@ -1009,7 +1009,7 @@
+@@ -1010,7 +1010,7 @@ class FileOpsLinuxBase(object):
     def _copy_file(self, source, dest, as_user = Users.CURRENT, user_password = None):
         output = io.StringIO()
         
@ -153,7 +157,7 @@ diff -u -r a/plugins/wb.admin/backend/wb_server_management.py b/plugins/wb.admin
                       as_user   = as_user,
                       user_password = user_password,
                       output_handler = output.write,
-@@ -1085,9 +1085,9 @@
+@@ -1086,9 +1086,9 @@ class FileOpsLinuxBase(object):
             # for ls -l, the output format changes depending on stdout being a terminal or not
             # since both cases are possible, we need to handle both at the same time (1st line being total <nnnn> or not)
             # the good news is that if the line is there, then it will always start with total, regardless of the locale
@ -165,7 +169,7 @@ diff -u -r a/plugins/wb.admin/backend/wb_server_management.py b/plugins/wb.admin
             
         output = io.StringIO()
         res = self.process_ops.exec_cmd(command,
-@@ -2163,9 +2163,9 @@
+@@ -2164,9 +2164,9 @@ class SudoTailInputFile(object):
     def get_range(self, start, end):
         f = io.StringIO()
         if not self._need_sudo:
@ -177,7 +181,7 @@ diff -u -r a/plugins/wb.admin/backend/wb_server_management.py b/plugins/wb.admin
 
         if ret != 0:
             raise RuntimeError("Could not get data from file %s" % self.path)
-@@ -2173,9 +2173,9 @@
+@@ -2174,9 +2174,9 @@ class SudoTailInputFile(object):
 
     def read_task(self, offset, file):
         if not self._need_sudo:
@ -189,7 +193,7 @@ diff -u -r a/plugins/wb.admin/backend/wb_server_management.py b/plugins/wb.admin
         # this will signal the reader end that there's no more data
         file.close()
 
-@@ -2202,9 +2202,9 @@
+@@ -2203,9 +2203,9 @@ class SudoTailInputFile(object):
         self._pos = offset
         f = io.StringIO()
         if not self._need_sudo:
--- a/pkgs/applications/networking/cluster/pachyderm/default.nix
+++ b/pkgs/applications/networking/cluster/pachyderm/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "pachyderm";
-  version = "2.10.2";
+  version = "2.10.6";

  src = fetchFromGitHub {
    owner = "pachyderm";
    repo = "pachyderm";
    rev = "v${version}";
-    hash = "sha256-5Q3T4yusnJVHU8QdXxbDuePToGp+hu+GnwqD7TG/0Rw=";
+    hash = "sha256-kn2vpc+KcIQXZgSbGf1aAANQ/OW807jhGpVZbfwcFMM=";
  };

  vendorHash = "sha256-NShVyjNyG06cLmt8rd71lFLvkd8KRWQjj6xUCx7NgSk=";
--- a/pkgs/applications/networking/cluster/rke2/builder.nix
+++ b/pkgs/applications/networking/cluster/rke2/builder.nix
@ -7,6 +7,9 @@ lib: { rke2Version, rke2RepoSha256, rke2VendorHash, updateScript
 # Runtime dependencies
 , procps, coreutils, util-linux, ethtool, socat, iptables, bridge-utils, iproute2, kmod, lvm2

+# Killall Script dependencies
+, systemd, gnugrep, gnused
+
 # Testing dependencies
 , nixosTests, testers, rke2
 }:
@ -72,6 +75,11 @@ buildGoModule rec {
    install -D $GOPATH/bin/rke2 $out/bin/rke2
    wrapProgram $out/bin/rke2 \
      --prefix PATH : ${lib.makeBinPath buildInputs}
+
+    install -D ./bundle/bin/rke2-killall.sh $out/bin/rke2-killall.sh
+    wrapProgram $out/bin/rke2-killall.sh \
+      --prefix PATH : ${lib.makeBinPath [ systemd gnugrep gnused ]} \
+      --prefix PATH : ${lib.makeBinPath buildInputs}
  '';

  doCheck = false;
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -165,9 +165,9 @@ rec {
  mkTerraform = attrs: pluggable (generic attrs);

  terraform_1 = mkTerraform {
-    version = "1.8.5";
-    hash = "sha256-5PzP0LUJPpOQQ8YqwBFyEFcsHF2O1uDD8Yh8wB3uJ8s=";
-    vendorHash = "sha256-PXA2AWq1IFmnqhhU92S9UaIYTUAAn5lsg3S7h5hBOQE=";
+    version = "1.9.2";
+    hash = "sha256-g1CsDWjwjBVfSNFZ9PRGlPlJOrqXP2eMYk1P+ohtYNU=";
+    vendorHash = "sha256-cPWJtrGad8VsvyjJHQwpfDitsJY/Q0iCtp1MRyzGT+U=";
    patches = [ ./provider-path-0_15.patch ];
    passthru = {
      inherit plugins;
--- a/pkgs/applications/networking/cluster/terraform/provider-path-0_15.patch
+++ b/pkgs/applications/networking/cluster/terraform/provider-path-0_15.patch
@ -1,23 +1,23 @@
 diff -Naur terraform.old/internal/command/init.go terraform.new/internal/command/init.go
 --- terraform.old/internal/command/init.go
 +++ terraform.new/internal/command/init.go
-@@ -3,6 +3,7 @@
- import (
+@@ -7,6 +7,7 @@
 	"context"
+ 	"errors"
 	"fmt"
 +	"os"
 	"log"
- 	"strings"
- 
-@@ -55,6 +56,11 @@
- 
- 	var diags tfdiags.Diagnostics
+ 	"reflect"
+ 	"sort"
+@@ -79,6 +80,11 @@
+ 		c.migrateState = true
+ 	}

 +	val, ok := os.LookupEnv("NIX_TERRAFORM_PLUGIN_DIR")
 +	if ok {
-+		flagPluginPath = append(flagPluginPath, val)
+		initArgs.PluginPath = append(initArgs.PluginPath, val)
 +	}
 +
- 	if len(flagPluginPath) > 0 {
- 		c.pluginPath = flagPluginPath
+ 	if len(initArgs.PluginPath) > 0 {
+ 		c.pluginPath = initArgs.PluginPath
 	}
--- a/pkgs/applications/networking/cluster/yor/default.nix
+++ b/pkgs/applications/networking/cluster/yor/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "yor";
-  version = "0.1.194";
+  version = "0.1.196";

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = pname;
    rev = version;
-    hash = "sha256-8JkxCkDYalu3IMoGbyNOEJ28CgU87gTq0bX+o+5sV2Q=";
+    hash = "sha256-3jM5UaI8kmcW4z9YU7GJKHCNoX10BpO10C47/b/1I74=";
  };

  vendorHash = "sha256-uT/jGD4hDVes4h+mlSIT2p+C9TjxnUWsmKv9haPjjLc=";
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -2,52 +2,52 @@
 let
  versions =
    if stdenv.isLinux then {
-      stable = "0.0.58";
-      ptb = "0.0.92";
-      canary = "0.0.438";
-      development = "0.0.21";
+      stable = "0.0.59";
+      ptb = "0.0.93";
+      canary = "0.0.450";
+      development = "0.0.22";
    } else {
-      stable = "0.0.309";
-      ptb = "0.0.121";
-      canary = "0.0.547";
-      development = "0.0.43";
+      stable = "0.0.310";
+      ptb = "0.0.122";
+      canary = "0.0.559";
+      development = "0.0.44";
    };
  version = versions.${branch};
  srcs = rec {
    x86_64-linux = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-YkyniFgkD4GMxUya+/Ke5fxosZKHKyc4+cAx3HI4w8c=";
+        hash = "sha256-wv0HcbPlFRb8OTvnkCdb1MAuvl/7LHTUfE5UxpeSIPw=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-1HbTRWl1w9cu7D4NNFGVbHk1hvRmMywH+q2qA4+nokc=";
+        hash = "sha256-MO940dRAJ0J/fa8I+nU8483AH8PA7eIJ9ZUF15iqbgE=";
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-z2SsI1vmaW1HjBDkJEH468xPuyAqigOIbRDtaL4Lgxc=";
+        hash = "sha256-qKg27ysy3kUAPL5YrB2BKu5FCwXMfQZtDUT23Yge5No=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-LgRrQ2z0/mx9Xvkb7hOrhmOqaETiBITgJDO9vce/wtk=";
+        hash = "sha256-dSoi/YZra8SRbV1rvbtKkyHmhfTb+A6mja8zZ9Y5JNo=";
      };
    };
    x86_64-darwin = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-9Tfn+dxvhgNjSdfj8Irb/5VU3kn39DX6hdKkppJ6HeU=";
+        hash = "sha256-zQ4/S2BpQDuU3ReKaNh31DRHS4S6FFUo6Y6YjGB1/mE=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-3Lk+kPZcBqznIELVMdA6dRpCOaOuRrchmfHv/EAyyOQ=";
+        hash = "sha256-DckRIoLKmAqUtdXUvvSKeNZUq/77Acy0Np0fPhQjUa4=";
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-ec2XF3023bQn/85i1xO8tTuYuprtsaL9exqRiZam36A=";
+        hash = "sha256-HrgWpmqyn4k3DDM/LE4JUN6DeJKklm7kzyry4ZiL7pA=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-PZS7LHJExi+fb7G4CnIFk4KQx9/cL4ALXwzOcLx4sWU=";
+        hash = "sha256-Ryk43s8peXIvifcrxeot2nIGpqOfpgWKmVEYQkuX4I0=";
      };
    };
    aarch64-darwin = x86_64-darwin;
--- a/pkgs/applications/networking/mailreaders/ayatana-webmail/default.nix
+++ b/pkgs/applications/networking/mailreaders/ayatana-webmail/default.nix
@ -2,7 +2,7 @@
 , fetchFromGitHub
 , gettext
 , gtk3
-, python3Packages
+, python311Packages
 , gdk-pixbuf
 , libnotify
 , glib
@ -16,6 +16,10 @@
 , libcanberra-gtk3
 }:

+let
+  # https://github.com/AyatanaIndicators/ayatana-webmail/issues/38
+  python3Packages = python311Packages;
+in
 python3Packages.buildPythonApplication rec {
  pname = "ayatana-webmail";
  version = "22.12.15";
--- a/pkgs/applications/office/gtg/default.nix
+++ b/pkgs/applications/office/gtg/default.nix
@ -55,7 +55,6 @@ python3Packages.buildPythonApplication rec {
  ];

  nativeCheckInputs = with python3Packages; [
-    nose
    mock
    xvfb-run
    pytest
--- a/pkgs/applications/office/ib/controller/default.nix
+++ b/pkgs/applications/office/ib/controller/default.nix
@ -155,6 +155,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Automation Controller for the Trader Work Station of Interactive Brokers";
+    broken = true;  # Ref: https://github.com/NixOS/nixpkgs/issues/40784
    homepage = "https://github.com/ib-controller/ib-controller";
    sourceProvenance = with sourceTypes; [ binaryBytecode ];
    license = licenses.gpl3;
--- a/pkgs/applications/office/ib/tws/default.nix
+++ b/pkgs/applications/office/ib/tws/default.nix
@ -86,6 +86,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Trader Work Station of Interactive Brokers";
+    broken = true;  # Ref: https://github.com/NixOS/nixpkgs/issues/40784
    homepage = "https://www.interactivebrokers.com";
    sourceProvenance = with sourceTypes; [ binaryBytecode ];
    license = licenses.unfree;
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@ -20,6 +20,8 @@
 , qttools
 , exiv2
 , nlopt
+, testers
+, xvfb-run
 }:

 stdenv.mkDerivation (finalAttrs: {
@ -93,6 +95,18 @@ stdenv.mkDerivation (finalAttrs: {
    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
  '';

+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    command = ''
+      # Create a temporary home directory because stellarium aborts with an
+      # error if it can't write some configuration files.
+      tmpdir=$(mktemp -d)
+
+      # stellarium can't be run in headless mode, therefore we need xvfb-run.
+      HOME="$tmpdir" ${xvfb-run}/bin/xvfb-run stellarium --version
+    '';
+  };
+
  meta =  {
    description = "Free open-source planetarium";
    mainProgram = "stellarium";
--- a/pkgs/applications/video/freetube/default.nix
+++ b/pkgs/applications/video/freetube/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "freetube";
-  version = "0.21.0";
+  version = "0.21.1";

  src = fetchurl {
    url = "https://github.com/FreeTubeApp/FreeTube/releases/download/v${version}-beta/freetube_${version}_amd64.AppImage";
-    sha256 = "sha256-jTDJ0oyDrgOM6T+nwiOakm3QUqKfK2UNY6AfpoaJzd0=";
+    sha256 = "sha256-HAtOWa/2j8xIICz8BQcG9X4t5Wu+VjlpWUGcTVteeME=";
  };

  passthru.tests = nixosTests.freetube;
--- a/pkgs/applications/video/gpac/default.nix
+++ b/pkgs/applications/video/gpac/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, zlib }:
+{ lib, stdenv, fetchFromGitHub, cctools, pkg-config, Carbon, zlib }:

 stdenv.mkDerivation rec {
  pname = "gpac";
@ -13,9 +13,17 @@ stdenv.mkDerivation rec {

  # this is the bare minimum configuration, as I'm only interested in MP4Box
  # For most other functionality, this should probably be extended
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ] ++ lib.optionals stdenv.isDarwin [
+    cctools
+  ];

-  buildInputs = [ zlib ];
+  buildInputs = [
+    zlib
+  ] ++ lib.optionals stdenv.isDarwin [
+    Carbon
+  ];

  enableParallelBuilding = true;

@ -36,6 +44,6 @@ stdenv.mkDerivation rec {
    homepage = "https://gpac.wp.imt.fr";
    license = licenses.lgpl21;
    maintainers = with maintainers; [ bluescreen303 mgdelacroix ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/window-managers/jay/default.nix
+++ b/pkgs/applications/window-managers/jay/default.nix
@ -15,16 +15,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "jay";
-  version = "1.3.0";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "mahkoh";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-D+dG0/MSC6LzGZBMNofU8WKVYvn52kNWunXExQPoOu8=";
+    sha256 = "sha256-iZTdhWHlorTAJTd3p2ZJbD5LRYkUmDAFjSEIR5E0JDI=";
  };

-  cargoHash = "sha256-WEEAFr5lemyOfeIKC9Pvr9sYMz8rLO6k1BFgbxXJ0Pk=";
+  cargoHash = "sha256-SEL7hpHcW+p49vFRedC1hDRZ/Vq9zMzMAACyyBXHwZM=";

  SHADERC_LIB_DIR = "${lib.getLib shaderc}/lib";

--- a/pkgs/build-support/rust/default-crate-overrides.nix
+++ b/pkgs/build-support/rust/default-crate-overrides.nix
@ -62,6 +62,7 @@ in
  cairo-sys-rs = attrs: {
    nativeBuildInputs = [ pkg-config ];
    buildInputs = [ cairo ];
+    extraLinkFlags = [ "-L${zlib.out}/lib" ];
  };

  capnp-rpc = attrs: {
@ -134,6 +135,7 @@ in
  glib-sys = attrs: {
    nativeBuildInputs = [ pkg-config ];
    buildInputs = [ glib ];
+    extraLinkFlags = [ "-L${zlib.out}/lib" ];
  };

  gobject-sys = attrs: {
@ -328,6 +330,7 @@ in
  soup3-sys = attrs: {
    nativeBuildInputs = [ pkg-config ];
    buildInputs = [ libsoup_3 ];
+    extraLinkFlags = [ "-L${zlib.out}/lib" ];
  };

  thrussh-libsodium = attrs: {
@ -342,6 +345,7 @@ in
  webkit2gtk-sys = attrs: {
    nativeBuildInputs = [ pkg-config ];
    buildInputs = [ webkitgtk_4_1 ];
+    extraLinkFlags = [ "-L${zlib.out}/lib" ];
  };

  xcb = attrs: {
--- a/pkgs/by-name/an/ananicy-cpp/package.nix
+++ b/pkgs/by-name/an/ananicy-cpp/package.nix
@ -55,7 +55,7 @@ clangStdenv.mkDerivation rec {
  ];

  # BPF A call to built-in function '__stack_chk_fail' is not supported.
-  hardeningDisable = [ "stackprotector" ];
+  hardeningDisable = [ "stackprotector" "zerocallusedregs" ];

  cmakeFlags = [
    "-DUSE_EXTERNAL_JSON=ON"
--- a/pkgs/by-name/ar/artalk/package.nix
+++ b/pkgs/by-name/ar/artalk/package.nix
@ -3,8 +3,10 @@
  buildGoModule,
  fetchFromGitHub,
  artalk,
-  testers,
  fetchurl,
+  installShellFiles,
+  stdenv,
+  testers,
 }:
 buildGoModule rec {
  pname = "artalk";
@ -13,7 +15,7 @@ buildGoModule rec {
  src = fetchFromGitHub {
    owner = "ArtalkJS";
    repo = "artalk";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
    hash = "sha256-fOuZiFomXGvRUXkpEM3BpJyMOtSm6/RHd0a7dPOsoT4=";
  };
  web = fetchurl {
@ -31,20 +33,37 @@ buildGoModule rec {
    "-X github.com/ArtalkJS/Artalk/internal/config.Version=${version}"
    "-X github.com/ArtalkJS/Artalk/internal/config.CommitHash=${version}"
  ];
+
  preBuild = ''
    tar -xzf ${web}
    cp -r ./artalk_ui/* ./public
  '';

+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall =
+    ''
+      # work around case insensitive file systems
+      mv $out/bin/Artalk $out/bin/artalk.tmp
+      mv $out/bin/artalk.tmp $out/bin/artalk
+    ''
+    + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      installShellCompletion --cmd artalk \
+        --bash <($out/bin/artalk completion bash) \
+        --fish <($out/bin/artalk completion fish) \
+        --zsh <($out/bin/artalk completion zsh)
+    '';
+
  passthru.tests = {
    version = testers.testVersion { package = artalk; };
  };

-  meta = with lib; {
+  meta = {
    description = "Self-hosted comment system";
    homepage = "https://github.com/ArtalkJS/Artalk";
-    license = licenses.mit;
-    maintainers = with maintainers; [ moraxyc ];
-    mainProgram = "Artalk";
+    changelog = "https://github.com/ArtalkJS/Artalk/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ moraxyc ];
+    mainProgram = "artalk";
  };
 }
--- a/pkgs/by-name/as/assemblyscript/package.nix
+++ b/pkgs/by-name/as/assemblyscript/package.nix
@ -5,16 +5,16 @@

 buildNpmPackage rec {
  pname = "assemblyscript";
-  version = "0.27.23";
+  version = "0.27.29";

  src = fetchFromGitHub {
    owner = "AssemblyScript";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-pKb46AfL5MGKiH1AjyPeHw7ZeLnIiPYmf8b2bOkuRe0=";
+    sha256 = "sha256-Jhjq+kLRzDesTPHHonImCnuzt1Ay04n7+O9aK4knb5g=";
  };

-  npmDepsHash = "sha256-io/3T0LE1kupjtMg8rpQlRmIn048X0jqhKKj/W7Ilo0=";
+  npmDepsHash = "sha256-mWRQPQVprM+9SCYd8M7NMDtiwDjSH5cr4Xlr5VP9eHo=";

  meta = with lib; {
    homepage = "https://github.com/AssemblyScript/${pname}";
--- a/pkgs/by-name/au/autotools-language-server/package.nix
+++ b/pkgs/by-name/au/autotools-language-server/package.nix
@ -1,9 +1,12 @@
 { lib
-, python3
+, python311
 , fetchFromGitHub
 , fetchpatch
 }:

+let
+  python3 = python311;
+in
 python3.pkgs.buildPythonApplication rec {
  pname = "autotools-language-server";
  version = "0.0.19";
--- a/pkgs/by-name/ba/basedpyright/package.nix
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@ -11,13 +11,13 @@
 }:

 let
-  version = "1.13.2";
+  version = "1.13.3";

  src = fetchFromGitHub {
    owner = "detachhead";
    repo = "basedpyright";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Qi5MYyNrEH56hNa2HHeSrnZQvJTkLXVIpCHUJCzOM+c=";
+    hash = "sha256-75RT7HsM1Z4b7KIMep73HxyJpyg1cq37OJZ9ebXc47Q=";
  };

  patchedPackageJSON = runCommand "package.json" { } ''
@ -47,7 +47,7 @@ let
    pname = "pyright-internal";
    inherit version src;
    sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-eEBlX2F3B/njTb2sONXzDqe+a2TVddam7NDXt5s8QFs=";
+    npmDepsHash = "sha256-3l5FqDDJnS52IjqDWf4ZLk2AP4gTAp4oQtCxBQSntp8=";
    dontNpmBuild = true;
    # FIXME: Remove this flag when TypeScript 5.5 is released
    npmFlags = [ "--legacy-peer-deps" ];
@ -94,7 +94,7 @@ buildNpmPackage rec {
  inherit version src;

  sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-JIpbef6ADktKILifRra4jrfdLHY1o/eFsdVkwQupMZw=";
+  npmDepsHash = "sha256-WybdMzg70V+VxyvlMCiHkEqPO+nZA0b4nODEZQFgI/E=";

  postPatch = ''
    chmod +w ../../
--- a/pkgs/by-name/ch/charmcraft/package.nix
+++ b/pkgs/by-name/ch/charmcraft/package.nix
@ -22,6 +22,9 @@ python3Packages.buildPythonApplication rec {
  postPatch = ''
    substituteInPlace setup.py \
      --replace-fail 'version=determine_version()' 'version="${version}"'
+
+    substituteInPlace charmcraft/env.py \
+      --replace-fail "distutils.util" "setuptools.dist"
  '';

  propagatedBuildInputs = with python3Packages; [
@ -44,22 +47,22 @@ python3Packages.buildPythonApplication rec {
    urllib3
  ];

-  nativeBuildInputs = with python3Packages; [
-    setuptools
-  ];
+  nativeBuildInputs = with python3Packages; [ setuptools ];

-  pythonRelaxDeps = [
-    "urllib3"
-  ];
+  pythonRelaxDeps = [ "urllib3" ];

-  nativeCheckInputs = with python3Packages; [
+  nativeCheckInputs =
+    with python3Packages;
+    [
      pyfakefs
      pytest-check
      pytest-mock
      pytest-subprocess
      pytestCheckHook
      responses
-  ] ++ [ git ];
+      setuptools
+    ]
+    ++ [ git ];

  preCheck = ''
    mkdir -p check-phase
--- a/pkgs/by-name/di/displaycal/package.nix
+++ b/pkgs/by-name/di/displaycal/package.nix
@ -1,5 +1,5 @@
 { lib
-, python3
+, python311
 , fetchPypi
 , wrapGAppsHook3
 , gtk3
@ -8,7 +8,8 @@
 , argyllcms
 }:

-python3.pkgs.buildPythonApplication rec {
+# wxPython-4.2.1 requires python < 3.12
+python311.pkgs.buildPythonApplication rec {
  pname = "displaycal";
  version = "3.9.12";
  format = "setuptools";
@ -24,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
    gtk3
  ];

-  propagatedBuildInputs = with python3.pkgs; [
+  propagatedBuildInputs = with python311.pkgs; [
    build
    certifi
    wxpython
--- a/pkgs/applications/audio/friture/default.nix
+++ b/pkgs/applications/audio/friture/default.nix
@ -1,18 +1,38 @@
-{ lib, fetchFromGitHub, python3Packages, wrapQtAppsHook }:
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  qt5,
+}:

 python3Packages.buildPythonApplication rec {
  pname = "friture";
-  version = "0.49";
+  version = "0.49-unstable-2024-06-02";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "tlecomte";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-xKgyBV/Qc+9PgXyxcT0xG1GXLC6KnjavJ/0SUE+9VSY=";
+    rev = "405bffa585ece0cb535c32d0f4f6ace932b40103";
+    hash = "sha256-4xvIlRuJ7WCFj1dEyvO9UOsye70nFlWjb9XU0owwgiM=";
  };

-  nativeBuildInputs = (with python3Packages; [ numpy cython scipy ]) ++
-    [ wrapQtAppsHook ];
+  pythonRelaxDeps = true;
+
+  postPatch = ''
+    sed -i -e '/packages=\[/a "friture.playback",' pyproject.toml
+  '';
+
+  nativeBuildInputs =
+    (with python3Packages; [
+      numpy
+      cython
+      scipy
+      setuptools
+    ])
+    ++ (with qt5; [ wrapQtAppsHook ]);
+
+  buildInputs = with qt5; [ qtquickcontrols2 ];

  propagatedBuildInputs = with python3Packages; [
    sounddevice
@ -26,11 +46,6 @@ python3Packages.buildPythonApplication rec {
    rtmixer
  ];

-  postPatch = ''
-    # Remove version constraints from Python dependencies in setup.py
-    sed -i -E "s/\"([A-Za-z0-9]+)(=|>|<)=[0-9\.]+\"/\"\1\"/g" setup.py
-  '';
-
  preFixup = ''
    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
  '';
@ -53,6 +68,9 @@ python3Packages.buildPythonApplication rec {
    homepage = "https://friture.org/";
    license = licenses.gpl3;
    platforms = platforms.linux; # fails on Darwin
-    maintainers = with maintainers; [ laikq alyaeanyx ];
+    maintainers = with maintainers; [
+      laikq
+      alyaeanyx
+    ];
  };
 }
--- a/pkgs/by-name/ge/getmail6/package.nix
+++ b/pkgs/by-name/ge/getmail6/package.nix
@ -5,14 +5,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "getmail6";
-  version = "6.19.02";
+  version = "6.19.03";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "getmail6";
    repo = "getmail6";
    rev = "refs/tags/v${version}";
-    hash = "sha256-ThyK30IT7ew5zQ3QAoxdr6ElQEWp2yJcmkLT5NmMfY0=";
+    hash = "sha256-BBsQ3u8CL3Aom+hqjeOErOBtWB8imU2PGgzP8+dq4mM=";
  };

  build-system = with python3.pkgs; [
--- a/pkgs/by-name/gi/gitlab-ci-local/package.nix
+++ b/pkgs/by-name/gi/gitlab-ci-local/package.nix
@ -6,16 +6,16 @@

 buildNpmPackage rec {
  pname = "gitlab-ci-local";
-  version = "4.52.0";
+  version = "4.52.1";

  src = fetchFromGitHub {
    owner = "firecow";
    repo = "gitlab-ci-local";
    rev = version;
-    hash = "sha256-qNrZInSLb7IA8YTRPKlTWJ42uavrNTV5A62twwjuOag=";
+    hash = "sha256-yNOlcb1I8BiR9rbqxeE7PEshEAudw62M77QBgTCBETg=";
  };

-  npmDepsHash = "sha256-3Teow+CyUB6LrkSuOs1YYsdrxsorgJnU2g6k3XBL9S0=";
+  npmDepsHash = "sha256-8Fxkd3JPyspcZeENpvvuguPNXbnWL1WrcYL9c77+Gok=";

  postPatch = ''
    # remove cleanup which runs git commands
--- a/pkgs/by-name/ha/handheld-daemon/package.nix
+++ b/pkgs/by-name/ha/handheld-daemon/package.nix
@ -9,14 +9,14 @@
 }:
 python3.pkgs.buildPythonApplication rec {
  pname = "handheld-daemon";
-  version = "2.7.2";
+  version = "3.1.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "hhd-dev";
    repo = "hhd";
    rev = "v${version}";
-    hash = "sha256-jWLL1nmKam1iJ1R1l/OuIp+isgZ7toRhVamx1nOID/8=";
+    hash = "sha256-XUnAgQWnBb8Xsu88UVpdVXbFPxG13TNJFX1xgY06HT8=";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/by-name/im/imsprog/package.nix
+++ b/pkgs/by-name/im/imsprog/package.nix
@ -0,0 +1,55 @@
+{ lib, stdenv, fetchFromGitHub, cmake, makeWrapper, pkg-config, bash, libusb1, qt5, wget, zenity }:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "imsprog";
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "bigbigmdm";
+    repo = "IMSProg";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-eF6TGlFEnMgMw1i/sfuXIRzNySVZe7UTKVHSIqJ+cUs=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+    pkg-config
+    qt5.wrapQtAppsHook
+    qt5.qttools
+  ];
+
+  buildInputs = [
+    bash # for patching the shebang in bin/IMSProg_database_update
+    libusb1
+    qt5.qtbase
+    qt5.qtwayland
+  ];
+
+  # change default hardcoded path for chip database file, udev rules et al
+  postPatch = ''
+    while IFS= read -r -d "" file ; do
+      substituteInPlace "$file" \
+        --replace-quiet '/usr/bin/' "$out/bin/" \
+        --replace-quiet '/usr/lib/' "$out/lib/" \
+        --replace-quiet '/usr/share/' "$out/share/"
+    done < <(grep --files-with-matches --null --recursive '/usr/' .)
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/IMSProg_database_update \
+      --prefix PATH : "${lib.makeBinPath [ wget zenity ]}"
+  '';
+
+  meta = {
+    changelog = "https://github.com/bigbigmdm/IMSProg/releases/tag/v${finalAttrs.version}";
+    description = "A free I2C EEPROM programmer tool for CH341A device";
+    homepage = "https://github.com/bigbigmdm/IMSProg";
+    license = with lib.licenses; [ gpl3Plus gpl2Plus lgpl21Only ];
+    mainProgram = "IMSProg";
+    maintainers = with lib.maintainers; [ wucke13 ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/development/libraries/libtorrent-rasterbar/1.2.nix
+++ b/pkgs/development/libraries/libtorrent-rasterbar/1.2.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, automake, autoconf
-, zlib, boost, openssl, libtool, python, libiconv, ncurses, SystemConfiguration
+, zlib, boost, openssl, libtool, python311, libiconv, ncurses, darwin
 }:

 let
@ -7,7 +7,7 @@ let

  # Make sure we override python, so the correct version is chosen
  # for the bindings, if overridden
-  boostPython = boost.override { enablePython = true; inherit python; };
+  boostPython = boost.override { enablePython = true; python = python311; };

 in stdenv.mkDerivation {
  pname = "libtorrent-rasterbar";
@ -24,14 +24,14 @@ in stdenv.mkDerivation {

  nativeBuildInputs = [ automake autoconf libtool pkg-config ];

-  buildInputs = [ boostPython openssl zlib python libiconv ncurses ]
-    ++ lib.optionals stdenv.isDarwin [ SystemConfiguration ];
+  buildInputs = [ boostPython openssl zlib python311 libiconv ncurses ]
+    ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.SystemConfiguration ];

  preConfigure = "./autotool.sh";

  postInstall = ''
    moveToOutput "include" "$dev"
-    moveToOutput "lib/${python.libPrefix}" "$python"
+    moveToOutput "lib/${python311.libPrefix}" "$python"
  '';

  outputs = [ "out" "dev" "python" ];
--- a/pkgs/development/libraries/libtorrent-rasterbar/distutils.patch
+++ b/pkgs/development/libraries/libtorrent-rasterbar/distutils.patch
--- a/pkgs/development/libraries/libtorrent-rasterbar/default.nix
+++ b/pkgs/development/libraries/libtorrent-rasterbar/default.nix
@ -1,12 +1,12 @@
 { lib, stdenv, fetchFromGitHub, cmake
-, zlib, boost, openssl, python, ncurses, SystemConfiguration
+, zlib, boost, openssl, python3, ncurses, darwin
 }:

 let
  version = "2.0.10";

  # Make sure we override python, so the correct version is chosen
-  boostPython = boost.override { enablePython = true; inherit python; };
+  boostPython = boost.override { enablePython = true; python = python3; };

 in stdenv.mkDerivation {
  pname = "libtorrent-rasterbar";
@ -22,8 +22,8 @@ in stdenv.mkDerivation {

  nativeBuildInputs = [ cmake ];

-  buildInputs = [ boostPython openssl zlib python ncurses ]
-    ++ lib.optionals stdenv.isDarwin [ SystemConfiguration ];
+  buildInputs = [ boostPython openssl zlib python3 ncurses ]
+    ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.SystemConfiguration ];

  patches = [
    # provide distutils alternative for python 3.12
@ -42,7 +42,7 @@ in stdenv.mkDerivation {

  postInstall = ''
    moveToOutput "include" "$dev"
-    moveToOutput "lib/${python.libPrefix}" "$python"
+    moveToOutput "lib/${python3.libPrefix}" "$python"
  '';

  postFixup = ''
--- a/pkgs/by-name/mi/microsoft-identity-broker/package.nix
+++ b/pkgs/by-name/mi/microsoft-identity-broker/package.nix
@ -12,11 +12,11 @@
 }:
 stdenv.mkDerivation rec {
  pname = "microsoft-identity-broker";
-  version = "2.0.0";
+  version = "2.0.1";

  src = fetchurl {
    url = "https://packages.microsoft.com/ubuntu/22.04/prod/pool/main/m/${pname}/${pname}_${version}_amd64.deb";
-    hash = "sha256-HJ5Q462ziYd+JB1paj0f0OENSJLHqNcX59Fxe+/5RYE=";
+    hash = "sha256-O9zbImSWMrRsaOozj5PsCRvQ3UsaJzLfoTohmLZvLkM=";
  };

  nativeBuildInputs = [ dpkg makeWrapper openjdk11 zip ];
--- a/pkgs/by-name/ne/neothesia/package.nix
+++ b/pkgs/by-name/ne/neothesia/package.nix
@ -51,6 +51,7 @@ rustPlatform.buildRustPackage {
  postInstall = ''
    wrapProgram $out/bin/neothesia --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ wayland libxkbcommon vulkan-loader xorg.libX11 xorg.libXcursor xorg.libXi xorg.libXrender ]}"
    install -Dm 644 flatpak/com.github.polymeilex.neothesia.desktop $out/share/applications/com.github.polymeilex.neothesia.desktop
+    install -Dm 644 flatpak/com.github.polymeilex.neothesia.png $out/share/icons/hicolor/256x256/apps/com.github.polymeilex.neothesia.png
  '';

  env = {
--- a/pkgs/by-name/no/nomacs/package.nix
+++ b/pkgs/by-name/no/nomacs/package.nix
@ -12,14 +12,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "nomacs";
-  version = "3.17.2295";
+  version = "3.19.0";

  src = fetchFromGitHub {
    owner = "nomacs";
    repo = "nomacs";
    rev = finalAttrs.version;
    fetchSubmodules = false; # We'll use our own
-    hash = "sha256-jHr7J0X1v2n/ZK0y3b/XPDISk7e08VWS6nicJU4fKKY=";
+    hash = "sha256-lpmM2GfMDlIp1vnbHMaOdicFcKH6LwEoKSETMt7C1NY=";
  };

  outputs = [ "out" ]
--- a/pkgs/by-name/op/openvswitch/generic.nix
+++ b/pkgs/by-name/op/openvswitch/generic.nix
@ -20,10 +20,12 @@
  pkg-config,
  procps,
  python3,
+  tcpdump,
  sphinxHook,
  util-linux,
  which,
  writeScript,
+  makeWrapper,
 }:

 let
@ -60,6 +62,7 @@ stdenv.mkDerivation rec {
    libtool
    pkg-config
    sphinxHook
+    makeWrapper
  ];

  sphinxBuilders = [ "man" ];
@ -96,6 +99,13 @@ stdenv.mkDerivation rec {
  postInstall = ''
    installShellCompletion --bash utilities/ovs-appctl-bashcomp.bash
    installShellCompletion --bash utilities/ovs-vsctl-bashcomp.bash
+
+    wrapProgram $out/bin/ovs-l3ping \
+      --prefix PYTHONPATH : $out/share/openvswitch/python
+
+    wrapProgram $out/bin/ovs-tcpdump \
+      --prefix PATH : ${lib.makeBinPath [tcpdump]} \
+      --prefix PYTHONPATH : $out/share/openvswitch/python
  '';

  doCheck = true;
--- a/pkgs/by-name/or/orchard/package.nix
+++ b/pkgs/by-name/or/orchard/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "orchard";
-  version = "0.21.0";
+  version = "0.22.0";

  src = fetchFromGitHub {
    owner = "cirruslabs";
    repo = pname;
    rev = version;
-    hash = "sha256-zHnrb0GU26VCfBeISjp6Ru4Vyul+CRAGMCCgLlJZNTA=";
+    hash = "sha256-SJZJN0IDR17hRd0NBER3CCys87vCTHOVz8+PNwFNt1M=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
--- a/pkgs/by-name/pc/pcsx2-bin/package.nix
+++ b/pkgs/by-name/pc/pcsx2-bin/package.nix
@ -0,0 +1,47 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  makeWrapper,
+  # To grab metadata
+  pcsx2,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "pcsx2";
+  version = "1.7.5919";
+
+  src = fetchurl {
+    url = "https://github.com/PCSX2/pcsx2/releases/download/v${finalAttrs.version}/pcsx2-v${finalAttrs.version}-macos-Qt.tar.xz";
+    hash = "sha256-NYgHsYXoIhI2pxqqiMgz5sKBAezEFf4AfEfu5S3diMg=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  dontPatch = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/{bin,Applications}
+    cp -r "PCSX2-v${finalAttrs.version}.app" $out/Applications/PCSX2.app
+    makeWrapper $out/Applications/PCSX2.app/Contents/MacOS/PCSX2 $out/bin/pcsx2-qt
+    runHook postInstall
+  '';
+
+  meta = {
+    inherit (pcsx2.meta) homepage longDescription license changelog downloadPage;
+    description = "Playstation 2 emulator; precompiled binary for MacOS, repacked from official website";
+    maintainers = with lib.maintainers; [
+      matteopacini
+    ];
+    mainProgram = "pcsx2-qt";
+    platforms = lib.systems.inspect.patternLogicalAnd
+      lib.systems.inspect.patterns.isDarwin
+      lib.systems.inspect.patterns.isx86_64;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
--- a/pkgs/by-name/pc/pcsx2/0000-define-rev.patch
+++ b/pkgs/by-name/pc/pcsx2/0000-define-rev.patch
--- a/pkgs/by-name/pc/pcsx2/darwin.nix
+++ b/pkgs/by-name/pc/pcsx2/darwin.nix
@ -1,32 +0,0 @@
-{
-  stdenvNoCC,
-  fetchurl,
-  pname,
-  version,
-  meta,
-  makeWrapper,
-}:
-stdenvNoCC.mkDerivation (finalAttrs: {
-  inherit pname version meta;
-
-  src = fetchurl {
-    url = "https://github.com/PCSX2/pcsx2/releases/download/v${version}/pcsx2-v${version}-macos-Qt.tar.xz";
-    hash = "sha256-NYgHsYXoIhI2pxqqiMgz5sKBAezEFf4AfEfu5S3diMg=";
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  dontPatch = true;
-  dontConfigure = true;
-  dontBuild = true;
-
-  sourceRoot = ".";
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/{bin,Applications}
-    cp -r "PCSX2-v${finalAttrs.version}.app" $out/Applications/PCSX2.app
-    makeWrapper $out/Applications/PCSX2.app/Contents/MacOS/PCSX2 $out/bin/pcsx2-qt
-    runHook postInstall
-  '';
-})
--- a/pkgs/by-name/pc/pcsx2/linux.nix
+++ b/pkgs/by-name/pc/pcsx2/linux.nix
@ -1,130 +0,0 @@
-{
-  cmake,
-  fetchFromGitHub,
-  lib,
-  llvmPackages_17,
-  callPackage,
-  cubeb,
-  curl,
-  extra-cmake-modules,
-  ffmpeg,
-  libaio,
-  libbacktrace,
-  libpcap,
-  libwebp,
-  libXrandr,
-  lz4,
-  makeWrapper,
-  pkg-config,
-  qt6,
-  SDL2,
-  soundtouch,
-  strip-nondeterminism,
-  vulkan-headers,
-  vulkan-loader,
-  wayland,
-  zip,
-  zstd,
-
-  pname,
-  version,
-  meta,
-}:
-
-let
-  shaderc-patched = callPackage ./shaderc-patched.nix { };
-  # The pre-zipped files in releases don't have a versioned link, we need to zip them ourselves
-  pcsx2_patches = fetchFromGitHub {
-    owner = "PCSX2";
-    repo = "pcsx2_patches";
-    rev = "9e71956797332471010e563a4b75a5934bef9d4e";
-    hash = "sha256-jpaRpvJox78zRGyrVIGYVoSEo/ICBlBfw3dTMz9QGuU=";
-  };
-  inherit (qt6)
-    qtbase
-    qtsvg
-    qttools
-    qtwayland
-    wrapQtAppsHook
-    ;
-in
-llvmPackages_17.stdenv.mkDerivation (finalAttrs: {
-  inherit pname version meta;
-
-  src = fetchFromGitHub {
-    owner = "PCSX2";
-    repo = "pcsx2";
-    rev = "v${finalAttrs.version}";
-    # NOTE: Don't forget to change the hash in shaderc-patched.nix as well.
-    hash = "sha256-cDugEbbz40uLPW64bcDGxfo1Y3ahYnEVaalfMp/J95s=";
-  };
-
-  patches = [ ./define-rev.patch ];
-
-  cmakeFlags = [
-    (lib.cmakeBool "DISABLE_ADVANCE_SIMD" true)
-    (lib.cmakeBool "USE_LINKED_FFMPEG" true)
-    (lib.cmakeFeature "PCSX2_GIT_REV" finalAttrs.src.rev)
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    extra-cmake-modules
-    pkg-config
-    strip-nondeterminism
-    wrapQtAppsHook
-    zip
-  ];
-
-  buildInputs = [
-    curl
-    ffmpeg
-    libaio
-    libbacktrace
-    libpcap
-    libwebp
-    libXrandr
-    lz4
-    qtbase
-    qtsvg
-    qttools
-    qtwayland
-    SDL2
-    shaderc-patched
-    soundtouch
-    vulkan-headers
-    wayland
-    zstd
-  ] ++ cubeb.passthru.backendLibs;
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp -a bin/pcsx2-qt bin/resources $out/bin/
-
-    install -Dm644 $src/pcsx2-qt/resources/icons/AppIcon64.png $out/share/pixmaps/PCSX2.png
-    install -Dm644 $src/.github/workflows/scripts/linux/pcsx2-qt.desktop $out/share/applications/PCSX2.desktop
-
-    zip -jq $out/bin/resources/patches.zip ${pcsx2_patches}/patches/*
-    strip-nondeterminism $out/bin/resources/patches.zip
-  '';
-
-  qtWrapperArgs =
-    let
-      libs = lib.makeLibraryPath (
-        [
-          vulkan-loader
-          shaderc-patched
-        ]
-        ++ cubeb.passthru.backendLibs
-      );
-    in
-    [ "--prefix LD_LIBRARY_PATH : ${libs}" ];
-
-  # https://github.com/PCSX2/pcsx2/pull/10200
-  # Can't avoid the double wrapping, the binary wrapper from qtWrapperArgs doesn't support --run
-  postFixup = ''
-    source "${makeWrapper}/nix-support/setup-hook"
-    wrapProgram $out/bin/pcsx2-qt \
-      --run 'if [[ -z $I_WANT_A_BROKEN_WAYLAND_UI ]]; then export QT_QPA_PLATFORM=xcb; fi'
-  '';
-})
--- a/pkgs/by-name/pc/pcsx2/package.nix
+++ b/pkgs/by-name/pc/pcsx2/package.nix
@ -1,39 +1,146 @@
 {
-  stdenv,
  lib,
+  SDL2,
  callPackage,
+  cmake,
+  cubeb,
+  curl,
+  extra-cmake-modules,
+  fetchFromGitHub,
+  ffmpeg,
+  libXrandr,
+  libaio,
+  libbacktrace,
+  libpcap,
+  libwebp,
+  llvmPackages_17,
+  lz4,
+  makeWrapper,
+  pkg-config,
+  qt6,
+  soundtouch,
+  strip-nondeterminism,
+  vulkan-headers,
+  vulkan-loader,
+  wayland,
+  zip,
+  zstd,
 }:
+
 let
-  pname = "pcsx2";
-  version = "1.7.5919";
-  meta = with lib; {
+  sources = callPackage ./sources.nix { };
+  inherit (qt6)
+    qtbase
+    qtsvg
+    qttools
+    qtwayland
+    wrapQtAppsHook
+    ;
+in
+llvmPackages_17.stdenv.mkDerivation (finalAttrs: {
+  inherit (sources.pcsx2) pname version src;
+
+  patches = [
+    # Remove PCSX2_GIT_REV
+    ./0000-define-rev.patch
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "DISABLE_ADVANCE_SIMD" true)
+    (lib.cmakeBool "USE_LINKED_FFMPEG" true)
+    (lib.cmakeFeature "PCSX2_GIT_REV" finalAttrs.src.rev)
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    strip-nondeterminism
+    wrapQtAppsHook
+    zip
+  ];
+
+  buildInputs = [
+    curl
+    extra-cmake-modules
+    ffmpeg
+    libaio
+    libbacktrace
+    libpcap
+    libwebp
+    libXrandr
+    lz4
+    qtbase
+    qtsvg
+    qttools
+    qtwayland
+    SDL2
+    sources.shaderc-patched
+    soundtouch
+    vulkan-headers
+    wayland
+    zstd
+  ] ++ cubeb.passthru.backendLibs;
+
+  strictDeps = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    cp -a bin/pcsx2-qt bin/resources $out/bin/
+
+    install -Dm644 $src/pcsx2-qt/resources/icons/AppIcon64.png $out/share/pixmaps/PCSX2.png
+    install -Dm644 $src/.github/workflows/scripts/linux/pcsx2-qt.desktop $out/share/applications/PCSX2.desktop
+
+    zip -jq $out/bin/resources/patches.zip ${sources.pcsx2_patches.src}/patches/*
+    strip-nondeterminism $out/bin/resources/patches.zip
+    runHook postInstall
+  '';
+
+  qtWrapperArgs =
+    let
+      libs = lib.makeLibraryPath (
+        [
+          vulkan-loader
+          sources.shaderc-patched
+        ]
+        ++ cubeb.passthru.backendLibs
+      );
+    in
+    [ "--prefix LD_LIBRARY_PATH : ${libs}" ];
+
+  # https://github.com/PCSX2/pcsx2/pull/10200
+  # Can't avoid the double wrapping, the binary wrapper from qtWrapperArgs doesn't support --run
+  postFixup = ''
+    source "${makeWrapper}/nix-support/setup-hook"
+    wrapProgram $out/bin/pcsx2-qt \
+      --run 'if [[ -z $I_WANT_A_BROKEN_WAYLAND_UI ]]; then export QT_QPA_PLATFORM=xcb; fi'
+  '';
+
+  meta = {
+    homepage = "https://pcsx2.net";
    description = "Playstation 2 emulator";
    longDescription = ''
-      PCSX2 is an open-source PlayStation 2 (AKA PS2) emulator. Its purpose
-      is to emulate the PS2 hardware, using a combination of MIPS CPU
-      Interpreters, Recompilers and a Virtual Machine which manages hardware
-      states and PS2 system memory. This allows you to play PS2 games on your
-      PC, with many additional features and benefits.
+      PCSX2 is an open-source PlayStation 2 (AKA PS2) emulator. Its purpose is
+      to emulate the PS2 hardware, using a combination of MIPS CPU Interpreters,
+      Recompilers and a Virtual Machine which manages hardware states and PS2
+      system memory. This allows you to play PS2 games on your PC, with many
+      additional features and benefits.
    '';
-    hydraPlatforms = platforms.linux;
-    homepage = "https://pcsx2.net";
-    license = with licenses; [
+    changelog = "https://github.com/PCSX2/pcsx2/releases/tag/v${finalAttrs.version}";
+    downloadPage = "https://github.com/PCSX2/pcsx2";
+    license = with lib.licenses; [
      gpl3Plus
      lgpl3Plus
    ];
-    maintainers = with maintainers; [
+    mainProgram = "pcsx2-qt";
+    maintainers = with lib.maintainers; [
+      AndersonTorres
      hrdinka
      govanify
      matteopacini
    ];
-    mainProgram = "pcsx2-qt";
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
-    sourceProvenance =
-      lib.optional stdenv.isDarwin sourceTypes.binaryNativeCode
-      ++ lib.optional stdenv.isLinux sourceTypes.fromSource;
+    platforms = lib.systems.inspect.patternLogicalAnd
+      lib.systems.inspect.patterns.isLinux
+      lib.systems.inspect.patterns.isx86_64;
  };
-in
-if stdenv.isDarwin then
-  callPackage ./darwin.nix { inherit pname version meta; }
-else
-  callPackage ./linux.nix { inherit pname version meta; }
+})
--- a/pkgs/by-name/pc/pcsx2/shaderc-patched.nix
+++ b/pkgs/by-name/pc/pcsx2/shaderc-patched.nix
@ -1,35 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  fetchpatch,
-  pcsx2,
-  shaderc,
-}:
-
-let
-  version = "2024.1";
-in
-shaderc.overrideAttrs (old: {
-  inherit version;
-  pname = "shaderc-patched-for-pcsx2";
-  src = fetchFromGitHub {
-    owner = "google";
-    repo = "shaderc";
-    rev = "v${version}";
-    hash = "sha256-2L/8n6KLVZWXt6FrYraVlZV5YqbPHD7rzXPCkD0d4kg=";
-  };
-  patches = (old.patches or [ ]) ++ [
-    (fetchpatch {
-      url = "file://${pcsx2.src}/.github/workflows/scripts/common/shaderc-changes.patch";
-      hash = "sha256-/qX2yD0RBuPh4Cf7n6OjVA2IyurpaCgvCEsIX/hXFdQ=";
-      excludes = [
-        "libshaderc/CMakeLists.txt"
-        "third_party/CMakeLists.txt"
-      ];
-    })
-  ];
-  cmakeFlags = (old.cmakeFlags or [ ]) ++ [
-    (lib.cmakeBool "SHADERC_SKIP_EXAMPLES" true)
-    (lib.cmakeBool "SHADERC_SKIP_TESTS" true)
-  ];
-})
--- a/pkgs/by-name/pc/pcsx2/sources.nix
+++ b/pkgs/by-name/pc/pcsx2/sources.nix
@ -0,0 +1,64 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  pcsx2,
+  shaderc,
+}:
+
+{
+  pcsx2 = let
+    self = {
+      pname = "pcsx2";
+      version = "1.7.5919";
+      src = fetchFromGitHub {
+        owner = "PCSX2";
+        repo = "pcsx2";
+        rev = "v${self.version}";
+        hash = "sha256-cDugEbbz40uLPW64bcDGxfo1Y3ahYnEVaalfMp/J95s=";
+      };
+    };
+  in
+    self;
+
+  # The pre-zipped files in releases don't have a versioned link, we need to zip
+  # them ourselves
+  pcsx2_patches = {
+    pname = "pcsx2_patches";
+    version = "0-unstable-2024-06-23";
+    src = fetchFromGitHub {
+      owner = "PCSX2";
+      repo = "pcsx2_patches";
+      rev = "9e71956797332471010e563a4b75a5934bef9d4e";
+      hash = "sha256-jpaRpvJox78zRGyrVIGYVoSEo/ICBlBfw3dTMz9QGuU=";
+    };
+  };
+
+  shaderc-patched = let
+    pname = "shaderc-patched-for-pcsx2";
+    version = "2024.1";
+    src = fetchFromGitHub {
+      owner = "google";
+      repo = "shaderc";
+      rev = "v${version}";
+      hash = "sha256-2L/8n6KLVZWXt6FrYraVlZV5YqbPHD7rzXPCkD0d4kg=";
+    };
+  in
+    shaderc.overrideAttrs (old: {
+      inherit pname version src;
+      patches = (old.patches or [ ]) ++ [
+        (fetchpatch {
+          url = "file://${pcsx2.src}/.github/workflows/scripts/common/shaderc-changes.patch";
+          hash = "sha256-/qX2yD0RBuPh4Cf7n6OjVA2IyurpaCgvCEsIX/hXFdQ=";
+          excludes = [
+            "libshaderc/CMakeLists.txt"
+            "third_party/CMakeLists.txt"
+          ];
+        })
+      ];
+      cmakeFlags = (old.cmakeFlags or [ ]) ++ [
+        (lib.cmakeBool "SHADERC_SKIP_EXAMPLES" true)
+        (lib.cmakeBool "SHADERC_SKIP_TESTS" true)
+      ];
+    });
+}
--- a/pkgs/by-name/ph/phpactor/package.nix
+++ b/pkgs/by-name/ph/phpactor/package.nix
@ -19,6 +19,10 @@ php.buildComposerProject (finalAttrs: {

  nativeBuildInputs = [ installShellFiles ];

+  postPatch = ''
+    patchShebangs bin/phpactor
+  '';
+
  postInstall = ''
    installShellCompletion --cmd phpactor \
      --bash <($out/bin/phpactor completion bash)
--- a/pkgs/by-name/re/realm/package.nix
+++ b/pkgs/by-name/re/realm/package.nix
@ -0,0 +1,42 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, darwin
+, nix-update-script
+, nixosTests
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "realm";
+  version = "2.6.0";
+
+  src = fetchFromGitHub {
+    owner = "zhboner";
+    repo = "realm";
+    rev = "v${version}";
+    hash = "sha256-G3scFSOxbmR3Q2fkRdg115WN/GCYpys/8Y4JC4YMGdY=";
+  };
+
+  cargoHash = "sha256-EvXafTujqTdQwfK4NXgT7lGKGnrpyP9ouplD6DmJUKU=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];
+
+  env.RUSTC_BOOTSTRAP = 1;
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = { inherit (nixosTests) realm; };
+  };
+
+
+  meta = with lib; {
+    description = "A simple, high performance relay server written in rust";
+    homepage = "https://github.com/zhboner/realm";
+    mainProgram = "realm";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ocfox ];
+  };
+}
--- a/pkgs/by-name/ro/rockcraft/package.nix
+++ b/pkgs/by-name/ro/rockcraft/package.nix
@ -1,9 +1,10 @@
-{ lib
-, python3Packages
-, fetchFromGitHub
-, dpkg
-, nix-update-script
-, python3
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  dpkg,
+  nix-update-script,
+  python3,
 }:

 python3Packages.buildPythonApplication rec {
@ -20,6 +21,9 @@ python3Packages.buildPythonApplication rec {
  postPatch = ''
    substituteInPlace rockcraft/__init__.py \
      --replace-fail "dev" "${version}"
+
+    substituteInPlace rockcraft/utils.py \
+      --replace-fail "distutils.util" "setuptools.dist"
  '';

  propagatedBuildInputs = with python3Packages; [
@ -28,14 +32,16 @@ python3Packages.buildPythonApplication rec {
    spdx-lookup
  ];

-  nativeCheckInputs = with python3Packages; [
+  nativeCheckInputs =
+    with python3Packages;
+    [
      pytest-check
      pytest-mock
      pytest-subprocess
      pytestCheckHook
-  ] ++ [
-    dpkg
-  ];
+      setuptools
+    ]
+    ++ [ dpkg ];

  preCheck = ''
    mkdir -p check-phase
--- a/pkgs/by-name/sh/shpool/package.nix
+++ b/pkgs/by-name/sh/shpool/package.nix
@ -0,0 +1,57 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  linux-pam,
+  testers,
+  shpool,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "shpool";
+  version = "0.6.2";
+
+  src = fetchFromGitHub {
+    owner = "shell-pool";
+    repo = "shpool";
+    rev = "v${version}";
+    hash = "sha256-6gfK71uM6IOP571Jzv3QPPKITaRteXyySZAstH0e+/M=";
+  };
+
+
+  postPatch = ''
+    substituteInPlace systemd/shpool.service \
+      --replace-fail '/usr/bin/shpool' "$out/bin/shpool"
+  '';
+
+  cargoHash = "sha256-rJ+Avq/6y68xEcJ+EeFVhFaSWJyC+x0a46cclVsTE4Q=";
+
+  buildInputs = [
+    linux-pam
+  ];
+
+  # The majority of tests rely on impure environment
+  # (such as systemd socket, ssh socket), and some of them
+  # have race conditions. They don't print their full name,
+  # tried skipping them but failed
+  doCheck = false;
+
+  postInstall = ''
+    install -Dm444 systemd/shpool.service -t $out/lib/systemd/user
+    install -Dm444 systemd/shpool.socket -t $out/lib/systemd/user
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    command = "shpool version";
+    package = shpool;
+  };
+
+  meta = {
+    description = "Persistent session management like tmux, but more lightweight";
+    homepage = "https://github.com/shell-pool/shpool";
+    license = lib.licenses.asl20;
+    mainProgram = "shpool";
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/sn/snapcraft/os-platform.patch
+++ b/pkgs/by-name/sn/snapcraft/os-platform.patch
@ -1,16 +1,8 @@
 diff --git a/snapcraft/utils.py b/snapcraft/utils.py
-index 511effe2..4af5a029 100644
+index 999a64ec..4f38b4cd 100644
 --- a/snapcraft/utils.py
 +++ b/snapcraft/utils.py
-@@ -15,6 +15,7 @@
- # along with this program.  If not, see <http://www.gnu.org/licenses/>.
- 
- """Utilities for snapcraft."""
-+
- import multiprocessing
- import os
- import pathlib
-@@ -91,7 +92,7 @@ def get_os_platform(
+@@ -94,7 +94,7 @@ def get_os_platform(
     release = platform.release()
     machine = platform.machine()
 
--- a/pkgs/by-name/sn/snapcraft/package.nix
+++ b/pkgs/by-name/sn/snapcraft/package.nix
@ -11,7 +11,7 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "snapcraft";
-  version = "8.2.5";
+  version = "8.2.12";

  pyproject = true;

@ -24,7 +24,7 @@ python3Packages.buildPythonApplication rec {
    owner = "canonical";
    repo = "snapcraft";
    rev = "refs/tags/${version}";
-    hash = "sha256-+1Gzseuq402m5FvlRAGXl7Lsy2VnRmd1cXNXhkMDDDE=";
+    hash = "sha256-1PwIbMweeYGi+jLfhFB3LYThqaN2VW7zdyzjD1m57ow=";
  };

  patches = [
@ -67,6 +67,9 @@ python3Packages.buildPythonApplication rec {
    substituteInPlace snapcraft/elf/elf_utils.py \
      --replace-fail 'arch_linker_path = Path(arch_config.dynamic_linker)' \
      'return str(Path("${glibc}/lib/ld-linux-x86-64.so.2"))'
+
+    substituteInPlace snapcraft_legacy/internal/xattrs.py \
+      --replace-fail 'distutils.util' 'setuptools.dist'
  '';

  buildInputs = [ makeWrapper ];
@ -104,9 +107,7 @@ python3Packages.buildPythonApplication rec {
    tinydb
  ];

-  nativeBuildInputs = with python3Packages; [
-    setuptools
-  ];
+  nativeBuildInputs = with python3Packages; [ setuptools ];

  pythonRelaxDeps = [
    "docutils"
@ -119,14 +120,18 @@ python3Packages.buildPythonApplication rec {
    wrapProgram $out/bin/snapcraft --prefix PATH : ${squashfsTools}/bin
  '';

-  nativeCheckInputs = with python3Packages; [
+  nativeCheckInputs =
+    with python3Packages;
+    [
      pytest-check
      pytest-cov
      pytest-mock
      pytest-subprocess
      pytestCheckHook
      responses
-  ] ++ [
+      setuptools
+    ]
+    ++ [
      git
      squashfsTools
    ];
@ -160,9 +165,7 @@ python3Packages.buildPythonApplication rec {
    "test_snap_command_fallback"
    "test_validate_architectures_supported"
    "test_validate_architectures_unsupported"
-  ] ++ lib.optionals stdenv.isAarch64 [
-    "test_load_project"
-  ];
+  ] ++ lib.optionals stdenv.isAarch64 [ "test_load_project" ];

  disabledTestPaths = [
    "tests/unit/commands/test_remote.py"
--- a/pkgs/by-name/sp/sploitscan/package.nix
+++ b/pkgs/by-name/sp/sploitscan/package.nix
@ -5,14 +5,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "sploitscan";
-  version = "0.10.1";
+  version = "0.10.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "xaitax";
    repo = "SploitScan";
    rev = "refs/tags/v${version}";
-    hash = "sha256-UsCGmOjrfk5qsSsnWHEbS3boiC2RFb0Za++yBcCfdJY=";
+    hash = "sha256-86+qX0agtDsEGYaMpP4Rb6OTPZj4KJVDCP8bbiA6K9c=";
  };

  pythonRelaxDeps = [
--- a/pkgs/by-name/sy/syshud/package.nix
+++ b/pkgs/by-name/sy/syshud/package.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "syshud";
-  version = "0-unstable-2024-07-01";
+  version = "0-unstable-2024-07-08";

  src = fetchFromGitHub {
    owner = "System64fumo";
    repo = "syshud";
-    rev = "cfe4a3a898c7f7b2e7065095c7fdcc33d99ed4bf";
-    hash = "sha256-UrAKFehcqsuFHJJC0Ske+tOr6Wquqm/BM536hKoGEWw=";
+    rev = "602d3b3062dfe589a00b0debd07c3aaae9b98390";
+    hash = "sha256-rEigWAkzR5ZclsLg/rFMBM0AuSOCVr2/lsPtKk46FYo=";
  };

  postPatch = ''
--- a/pkgs/by-name/tp/tpnote/package.nix
+++ b/pkgs/by-name/tp/tpnote/package.nix
@ -14,16 +14,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "tpnote";
-  version = "1.24.4";
+  version = "1.24.6";

  src = fetchFromGitHub {
    owner = "getreu";
    repo = "tp-note";
    rev = "v${version}";
-    hash = "sha256-otV00Lq3xen2kf90EonTbI4SPUob9M+el+5VaHeDPCw=";
+    hash = "sha256-koc1hm+zwvyoA77a2pf78P9I1Qg+SetHVHMUDHJYG3s=";
  };

-  cargoHash = "sha256-zkq1yho9K4WUyGbf8zsb5abP4jJPv1+RZi2kAlp9BCU=";
+  cargoHash = "sha256-a0wgpnaDUAiKB9yYKgsY9Z2xWi4rqWmXFpMIQfhI1O8=";

  nativeBuildInputs = [
    cmake
--- a/pkgs/by-name/tr/tribler/package.nix
+++ b/pkgs/by-name/tr/tribler/package.nix
@ -3,7 +3,7 @@
  stdenv,
  fetchurl,
  fetchPypi,
-  python3,
+  python311,
  makeWrapper,
  libtorrent-rasterbar-1_2_x,
  qt5,
@ -11,6 +11,8 @@
 }:

 let
+  # libtorrent-rasterbar-1_2_x requires python311
+  python3 = python311;
  libtorrent = (python3.pkgs.toPythonModule (libtorrent-rasterbar-1_2_x)).python;
 in
 stdenv.mkDerivation (finalAttrs: {
@ -75,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
      # requirements.txt
      pillow
      pyqt5
-      #pyqt5-sip
+      pyqt5-sip
      pyqtgraph
      pyqtwebengine
    ]);
--- a/pkgs/by-name/vu/vue-language-server/package-lock.json
+++ b/pkgs/by-name/vu/vue-language-server/package-lock.json
@ -1,19 +1,19 @@
 {
 	"name": "@vue/language-server",
-	"version": "2.0.24",
+	"version": "2.0.26",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@vue/language-server",
-			"version": "2.0.24",
+			"version": "2.0.26",
 			"license": "MIT",
 			"dependencies": {
-				"@volar/language-core": "~2.4.0-alpha.2",
-				"@volar/language-server": "~2.4.0-alpha.2",
-				"@vue/language-core": "2.0.24",
-				"@vue/language-service": "2.0.24",
-				"@vue/typescript-plugin": "2.0.24",
+				"@volar/language-core": "~2.4.0-alpha.15",
+				"@volar/language-server": "~2.4.0-alpha.15",
+				"@vue/language-core": "2.0.26",
+				"@vue/language-service": "2.0.26",
+				"@vue/typescript-plugin": "2.0.26",
 				"vscode-languageserver-protocol": "^3.17.5",
 				"vscode-uri": "^3.0.8"
 			},
@ -86,22 +86,22 @@
 			"integrity": "sha512-qqNS/YD0Nck5wtQLCPHAfGVgWbbGafxSPjNh0ekYPFSNNqnDH2kamnduzYly8IiADmeVx/MfAE1njMEjVeHTMA=="
 		},
 		"node_modules/@volar/language-core": {
-			"version": "2.4.0-alpha.7",
-			"resolved": "https://registry.npmjs.org/@volar/language-core/-/language-core-2.4.0-alpha.7.tgz",
-			"integrity": "sha512-3ncRpnoVHCTzJeTiUyKwFTLb3jGfe1r5+S3MwRDPEjsV4LID6Rq6EmdRoF+aKw+Iwg63x4nV+/KYZjeYrp5mNA==",
+			"version": "2.4.0-alpha.15",
+			"resolved": "https://registry.npmjs.org/@volar/language-core/-/language-core-2.4.0-alpha.15.tgz",
+			"integrity": "sha512-mt8z4Fm2WxfQYoQHPcKVjLQV6PgPqyKLbkCVY2cr5RSaamqCHjhKEpsFX66aL4D/7oYguuaUw9Bx03Vt0TpIIA==",
 			"dependencies": {
-				"@volar/source-map": "2.4.0-alpha.7"
+				"@volar/source-map": "2.4.0-alpha.15"
 			}
 		},
 		"node_modules/@volar/language-server": {
-			"version": "2.4.0-alpha.7",
-			"resolved": "https://registry.npmjs.org/@volar/language-server/-/language-server-2.4.0-alpha.7.tgz",
-			"integrity": "sha512-WxCFxHRy5SOEJAUEcStMW6OuC/V25y5AsJEyJaPq5sZ76EeJgc8BbImO6Yi7r6qXRENDjcVTE10t2JR4t5+qRw==",
+			"version": "2.4.0-alpha.15",
+			"resolved": "https://registry.npmjs.org/@volar/language-server/-/language-server-2.4.0-alpha.15.tgz",
+			"integrity": "sha512-epaF7Rllb29nr25F8hX5bq7ivgStNZzXGkhuPlHCUM+Ij/aQnsBeYQsfm7EttPqqO3abCctpRWyd+icklFEBoQ==",
 			"dependencies": {
-				"@volar/language-core": "2.4.0-alpha.7",
-				"@volar/language-service": "2.4.0-alpha.7",
-				"@volar/snapshot-document": "2.4.0-alpha.7",
-				"@volar/typescript": "2.4.0-alpha.7",
+				"@volar/language-core": "2.4.0-alpha.15",
+				"@volar/language-service": "2.4.0-alpha.15",
+				"@volar/snapshot-document": "2.4.0-alpha.15",
+				"@volar/typescript": "2.4.0-alpha.15",
 				"path-browserify": "^1.0.1",
 				"request-light": "^0.7.0",
 				"vscode-languageserver": "^9.0.1",
@ -111,36 +111,36 @@
 			}
 		},
 		"node_modules/@volar/language-service": {
-			"version": "2.4.0-alpha.7",
-			"resolved": "https://registry.npmjs.org/@volar/language-service/-/language-service-2.4.0-alpha.7.tgz",
-			"integrity": "sha512-vSuH2c0o7z9zDPcmUGqK9sT4l71B8Ooj6VKKB1H6F++ZAI0I9Uch7V7wc6VQjuB2LuYmojxwKxl1bydjnGxpHg==",
+			"version": "2.4.0-alpha.15",
+			"resolved": "https://registry.npmjs.org/@volar/language-service/-/language-service-2.4.0-alpha.15.tgz",
+			"integrity": "sha512-H5T5JvvqvWhG0PvvKPTM0nczTbTKQ+U87a8r0eahlH/ySi2HvIHO/7PiNKLxKqLNsiT8SX4U3QcGC8ZaNcC07g==",
 			"dependencies": {
-				"@volar/language-core": "2.4.0-alpha.7",
+				"@volar/language-core": "2.4.0-alpha.15",
 				"vscode-languageserver-protocol": "^3.17.5",
 				"vscode-languageserver-textdocument": "^1.0.11",
 				"vscode-uri": "^3.0.8"
 			}
 		},
 		"node_modules/@volar/snapshot-document": {
-			"version": "2.4.0-alpha.7",
-			"resolved": "https://registry.npmjs.org/@volar/snapshot-document/-/snapshot-document-2.4.0-alpha.7.tgz",
-			"integrity": "sha512-gBxnWi1ioC97bpynl9M0GE8XTiIDnslgCsCSi2WgNEaknrivYs9bR6dsA2G0iMz7lHScim47pmIlhtO9eSvY7A==",
+			"version": "2.4.0-alpha.15",
+			"resolved": "https://registry.npmjs.org/@volar/snapshot-document/-/snapshot-document-2.4.0-alpha.15.tgz",
+			"integrity": "sha512-8lnX0eZ7/lM+hakO5kspWABi4nijppxTy9XU0f9ns2lZ/JCE0t9EurNNiOaw4MWFO9USr0H72Ut0LCB9o4rpqA==",
 			"dependencies": {
 				"vscode-languageserver-protocol": "^3.17.5",
 				"vscode-languageserver-textdocument": "^1.0.11"
 			}
 		},
 		"node_modules/@volar/source-map": {
-			"version": "2.4.0-alpha.7",
-			"resolved": "https://registry.npmjs.org/@volar/source-map/-/source-map-2.4.0-alpha.7.tgz",
-			"integrity": "sha512-yn66qcUXxUCyyW8PXMHE4z9RdfTO1OhP6BMa/JI0Ed6I6bggzkxvXsJOaMqw3EalCskGPuIWAbWgxwa3Hlp7SA=="
+			"version": "2.4.0-alpha.15",
+			"resolved": "https://registry.npmjs.org/@volar/source-map/-/source-map-2.4.0-alpha.15.tgz",
+			"integrity": "sha512-8Htngw5TmBY4L3ClDqBGyfLhsB8EmoEXUH1xydyEtEoK0O6NX5ur4Jw8jgvscTlwzizyl/wsN1vn0cQXVbbXYg=="
 		},
 		"node_modules/@volar/typescript": {
-			"version": "2.4.0-alpha.7",
-			"resolved": "https://registry.npmjs.org/@volar/typescript/-/typescript-2.4.0-alpha.7.tgz",
-			"integrity": "sha512-MjvkhcIYPDZS5vbE4bSvbWi8z/VI47AY8MkPVgfa6xqTDLLxV6+QulJ8hIC3wYxh3dfVmA5MOoL5c3cZAsWbDQ==",
+			"version": "2.4.0-alpha.15",
+			"resolved": "https://registry.npmjs.org/@volar/typescript/-/typescript-2.4.0-alpha.15.tgz",
+			"integrity": "sha512-U3StRBbDuxV6Woa4hvGS4kz3XcOzrWUKgFdEFN+ba1x3eaYg7+ytau8ul05xgA+UNGLXXsKur7fTUhDFyISk0w==",
 			"dependencies": {
-				"@volar/language-core": "2.4.0-alpha.7",
+				"@volar/language-core": "2.4.0-alpha.15",
 				"path-browserify": "^1.0.1",
 				"vscode-uri": "^3.0.8"
 			}
@ -189,11 +189,11 @@
 			}
 		},
 		"node_modules/@vue/language-core": {
-			"version": "2.0.24",
-			"resolved": "https://registry.npmjs.org/@vue/language-core/-/language-core-2.0.24.tgz",
-			"integrity": "sha512-997YD6Lq/66LXr3ZOLNxDCmyn13z9NP8LU1UZn9hGCDWhzlbXAIP0hOgL3w3x4RKEaWTaaRtsHP9DzHvmduruQ==",
+			"version": "2.0.26",
+			"resolved": "https://registry.npmjs.org/@vue/language-core/-/language-core-2.0.26.tgz",
+			"integrity": "sha512-/lt6SfQ3O1yDAhPsnLv9iSUgXd1dMHqUm/t3RctfqjuwQf1LnftZ414X3UBn6aXT4MiwXWtbNJ4Z0NZWwDWgJQ==",
 			"dependencies": {
-				"@volar/language-core": "~2.4.0-alpha.2",
+				"@volar/language-core": "~2.4.0-alpha.15",
 				"@vue/compiler-dom": "^3.4.0",
 				"@vue/shared": "^3.4.0",
 				"computeds": "^0.0.1",
@ -212,27 +212,27 @@
 			}
 		},
 		"node_modules/@vue/language-service": {
-			"version": "2.0.24",
-			"resolved": "https://registry.npmjs.org/@vue/language-service/-/language-service-2.0.24.tgz",
-			"integrity": "sha512-CoiTPlc73I/LCji9rnI0Z89GVBOoejUfBzIzEg+6TFw8Eelp2fncgLAvgR8vmOWRVaLn0XgmL2wa0jgtLLderg==",
+			"version": "2.0.26",
+			"resolved": "https://registry.npmjs.org/@vue/language-service/-/language-service-2.0.26.tgz",
+			"integrity": "sha512-Lo4RJ+fcKrF09iIygcLFm3wdTEbmMb+l+/bpA3TXrgZk8+SbOkh6LSexJBvRQfStZSKYIV6FMgJ3ME6qpXpYqA==",
 			"dependencies": {
-				"@volar/language-core": "~2.4.0-alpha.2",
-				"@volar/language-service": "~2.4.0-alpha.2",
-				"@volar/typescript": "~2.4.0-alpha.2",
+				"@volar/language-core": "~2.4.0-alpha.15",
+				"@volar/language-service": "~2.4.0-alpha.15",
+				"@volar/typescript": "~2.4.0-alpha.15",
 				"@vue/compiler-dom": "^3.4.0",
-				"@vue/language-core": "2.0.24",
+				"@vue/language-core": "2.0.26",
 				"@vue/shared": "^3.4.0",
-				"@vue/typescript-plugin": "2.0.24",
+				"@vue/typescript-plugin": "2.0.26",
 				"computeds": "^0.0.1",
 				"path-browserify": "^1.0.1",
-				"volar-service-css": "0.0.56",
-				"volar-service-emmet": "0.0.56",
-				"volar-service-html": "0.0.56",
-				"volar-service-json": "0.0.56",
-				"volar-service-pug": "0.0.56",
-				"volar-service-pug-beautify": "0.0.56",
-				"volar-service-typescript": "0.0.56",
-				"volar-service-typescript-twoslash-queries": "0.0.56",
+				"volar-service-css": "volar-2.4",
+				"volar-service-emmet": "volar-2.4",
+				"volar-service-html": "volar-2.4",
+				"volar-service-json": "volar-2.4",
+				"volar-service-pug": "volar-2.4",
+				"volar-service-pug-beautify": "volar-2.4",
+				"volar-service-typescript": "volar-2.4",
+				"volar-service-typescript-twoslash-queries": "volar-2.4",
 				"vscode-html-languageservice": "^5.2.0",
 				"vscode-languageserver-textdocument": "^1.0.11",
 				"vscode-uri": "^3.0.8"
@ -244,12 +244,12 @@
 			"integrity": "sha512-Yp3wtJk//8cO4NItOPpi3QkLExAr/aLBGZMmTtW9WpdwBCJpRM6zj9WgWktXAl8IDIozwNMByT45JP3tO3ACWA=="
 		},
 		"node_modules/@vue/typescript-plugin": {
-			"version": "2.0.24",
-			"resolved": "https://registry.npmjs.org/@vue/typescript-plugin/-/typescript-plugin-2.0.24.tgz",
-			"integrity": "sha512-UjC6iKiyJ1pn0CbcsDW3IyiNb7z7vtABI3b9tDZ8xLGDvVLduZ0qwzq22b5jg2cVEIhLdjbQ4quaEoZflltfTw==",
+			"version": "2.0.26",
+			"resolved": "https://registry.npmjs.org/@vue/typescript-plugin/-/typescript-plugin-2.0.26.tgz",
+			"integrity": "sha512-C0F2lpv1m9LO1sEIJmZEN7tSzRwPObbYHtxftDlrvUKNWuEu4OqilnRuUCNyAQRq7UrkNR3fv1Dc+OcKOj0dEg==",
 			"dependencies": {
-				"@volar/typescript": "~2.4.0-alpha.2",
-				"@vue/language-core": "2.0.24",
+				"@volar/typescript": "~2.4.0-alpha.15",
+				"@vue/language-core": "2.0.26",
 				"@vue/shared": "^3.4.0"
 			}
 		},
@ -621,16 +621,16 @@
 			}
 		},
 		"node_modules/volar-service-css": {
-			"version": "0.0.56",
-			"resolved": "https://registry.npmjs.org/volar-service-css/-/volar-service-css-0.0.56.tgz",
-			"integrity": "sha512-Pdbk5QayLNWJislbik4Lo0QLLyd4pTqcgZCE2gaEQp9ozHCtrRNj3vY7KAh4BTgfiOqTSAj/UhViOXVAtdF3yg==",
+			"version": "0.0.59",
+			"resolved": "https://registry.npmjs.org/volar-service-css/-/volar-service-css-0.0.59.tgz",
+			"integrity": "sha512-gLNjJnECbalPvQB7qeJjhkDN8sR5M3ItbVYjnyio61aHaWptIiXm/HfDahcQ2ApwmvWidkMWWegjGq5L0BENDA==",
 			"dependencies": {
 				"vscode-css-languageservice": "^6.3.0",
 				"vscode-languageserver-textdocument": "^1.0.11",
 				"vscode-uri": "^3.0.8"
 			},
 			"peerDependencies": {
-				"@volar/language-service": "~2.4.0-alpha.1"
+				"@volar/language-service": "~2.4.0-alpha.12"
 			},
 			"peerDependenciesMeta": {
 				"@volar/language-service": {
@ -639,9 +639,9 @@
 			}
 		},
 		"node_modules/volar-service-emmet": {
-			"version": "0.0.56",
-			"resolved": "https://registry.npmjs.org/volar-service-emmet/-/volar-service-emmet-0.0.56.tgz",
-			"integrity": "sha512-2WqvOMTYBOpNAHtEWj0C9d8Wyco8aY4KL+9lfdFCWJd7RYU6R6mIlbrvcdSP2De8b5Z7gwTCUm6Kcjt8qOCvjQ==",
+			"version": "0.0.59",
+			"resolved": "https://registry.npmjs.org/volar-service-emmet/-/volar-service-emmet-0.0.59.tgz",
+			"integrity": "sha512-6EynHcuMwMBETpK29TbZvIMmvzdVG+Tkokk9VWfZeI+SwDptk2tgdhEqiXXvIkqYNgbuu73Itp66lpH76cAU+Q==",
 			"dependencies": {
 				"@emmetio/css-parser": "^0.4.0",
 				"@emmetio/html-matcher": "^1.3.0",
@ -649,7 +649,7 @@
 				"vscode-uri": "^3.0.8"
 			},
 			"peerDependencies": {
-				"@volar/language-service": "~2.4.0-alpha.1"
+				"@volar/language-service": "~2.4.0-alpha.12"
 			},
 			"peerDependenciesMeta": {
 				"@volar/language-service": {
@ -658,16 +658,16 @@
 			}
 		},
 		"node_modules/volar-service-html": {
-			"version": "0.0.56",
-			"resolved": "https://registry.npmjs.org/volar-service-html/-/volar-service-html-0.0.56.tgz",
-			"integrity": "sha512-OwDRiASNqFxAFdO55CZ0/XKnPt7WGw8CoaM/g6QzExikPZ92ySbK/kvh1zi6WR3w+hP6C4BNeVITzOk9tjgNGw==",
+			"version": "0.0.59",
+			"resolved": "https://registry.npmjs.org/volar-service-html/-/volar-service-html-0.0.59.tgz",
+			"integrity": "sha512-hEXOsYpILDlITZxnqRLV9OepVWD63GZBsyjMxszwdzlxvGZjzbGcBBinJGGJRwFIV8djdJwnt91bkdg1V5tj6Q==",
 			"dependencies": {
 				"vscode-html-languageservice": "^5.3.0",
 				"vscode-languageserver-textdocument": "^1.0.11",
 				"vscode-uri": "^3.0.8"
 			},
 			"peerDependencies": {
-				"@volar/language-service": "~2.4.0-alpha.1"
+				"@volar/language-service": "~2.4.0-alpha.12"
 			},
 			"peerDependenciesMeta": {
 				"@volar/language-service": {
@ -676,15 +676,15 @@
 			}
 		},
 		"node_modules/volar-service-json": {
-			"version": "0.0.56",
-			"resolved": "https://registry.npmjs.org/volar-service-json/-/volar-service-json-0.0.56.tgz",
-			"integrity": "sha512-eYXfOYTJLOw9UeA2YNtxGp/Lgu4pKk9u72I/HI+TcqLdMJKoXpOwLF6nUEhZVTy9LqTSRF0QvgXFa4q4mcLwIg==",
+			"version": "0.0.59",
+			"resolved": "https://registry.npmjs.org/volar-service-json/-/volar-service-json-0.0.59.tgz",
+			"integrity": "sha512-LfDOQhCvUpDBjA6CP9EogO0dn1yEFbInvV3Yk4OsEdyxwWUEYPLVjDacPlVUYcjCIKQN6NcTOWbVwpg4vYjw6A==",
 			"dependencies": {
 				"vscode-json-languageservice": "^5.4.0",
 				"vscode-uri": "^3.0.8"
 			},
 			"peerDependencies": {
-				"@volar/language-service": "~2.4.0-alpha.1"
+				"@volar/language-service": "~2.4.0-alpha.12"
 			},
 			"peerDependenciesMeta": {
 				"@volar/language-service": {
@ -693,28 +693,28 @@
 			}
 		},
 		"node_modules/volar-service-pug": {
-			"version": "0.0.56",
-			"resolved": "https://registry.npmjs.org/volar-service-pug/-/volar-service-pug-0.0.56.tgz",
-			"integrity": "sha512-NaobSQiuAFBTzBE7YHAyHyCZXqVNFFbXvuXTtXsJP6LR1lvBWg7IUgg45kzV1OS146qq2cmY3lryhlNRHwCmmg==",
+			"version": "0.0.59",
+			"resolved": "https://registry.npmjs.org/volar-service-pug/-/volar-service-pug-0.0.59.tgz",
+			"integrity": "sha512-kmch7yoqeGNlJuDzpw/YL2b89ilzBmWDd0lJbpG412/RXc3PJVA4usUK+SQHdVoF+qi5IcZL6IDxlvRiIrDgWg==",
 			"dependencies": {
-				"@volar/language-service": "~2.4.0-alpha.1",
+				"@volar/language-service": "~2.4.0-alpha.12",
 				"muggle-string": "^0.4.1",
 				"pug-lexer": "^5.0.1",
 				"pug-parser": "^6.0.0",
-				"volar-service-html": "0.0.56",
+				"volar-service-html": "0.0.59",
 				"vscode-html-languageservice": "^5.3.0",
 				"vscode-languageserver-textdocument": "^1.0.11"
 			}
 		},
 		"node_modules/volar-service-pug-beautify": {
-			"version": "0.0.56",
-			"resolved": "https://registry.npmjs.org/volar-service-pug-beautify/-/volar-service-pug-beautify-0.0.56.tgz",
-			"integrity": "sha512-ai79ljMfKH2bjcVjUET0zAwpVjDNtMCjizkttxCkNHCMTYIc1muhHIEj1+nNAw4zrDT51lxZgW6OJMTXQ+BW9A==",
+			"version": "0.0.59",
+			"resolved": "https://registry.npmjs.org/volar-service-pug-beautify/-/volar-service-pug-beautify-0.0.59.tgz",
+			"integrity": "sha512-SCLWHpBdgvWww3a9Vp8FX80ookozhnHx10gkKBTYW4wp7/rzEoVAPSyO7JKBwTdXmdKQv7YXfxLMVUGv0sYUKg==",
 			"dependencies": {
 				"@johnsoncodehk/pug-beautify": "^0.2.2"
 			},
 			"peerDependencies": {
-				"@volar/language-service": "~2.4.0-alpha.1"
+				"@volar/language-service": "~2.4.0-alpha.12"
 			},
 			"peerDependenciesMeta": {
 				"@volar/language-service": {
@ -723,9 +723,9 @@
 			}
 		},
 		"node_modules/volar-service-typescript": {
-			"version": "0.0.56",
-			"resolved": "https://registry.npmjs.org/volar-service-typescript/-/volar-service-typescript-0.0.56.tgz",
-			"integrity": "sha512-p16fn61j4IiNLhLl7ZxdnRRDpRLWiqIRhZm1xLgek4JshCCy5Z7KShYG6LVZXK3hNvXxM8f61PIl0KDCCzStKA==",
+			"version": "0.0.59",
+			"resolved": "https://registry.npmjs.org/volar-service-typescript/-/volar-service-typescript-0.0.59.tgz",
+			"integrity": "sha512-VCOpfiu+lUo5lapWLB5L5vmQGtwzmNWn5MueV915eku7blpphmE+Z7hCNcL1NApn7AetXWhiblv8ZhmUx/dGIA==",
 			"dependencies": {
 				"path-browserify": "^1.0.1",
 				"semver": "^7.6.2",
@ -735,7 +735,7 @@
 				"vscode-uri": "^3.0.8"
 			},
 			"peerDependencies": {
-				"@volar/language-service": "~2.4.0-alpha.1"
+				"@volar/language-service": "~2.4.0-alpha.12"
 			},
 			"peerDependenciesMeta": {
 				"@volar/language-service": {
@ -744,14 +744,14 @@
 			}
 		},
 		"node_modules/volar-service-typescript-twoslash-queries": {
-			"version": "0.0.56",
-			"resolved": "https://registry.npmjs.org/volar-service-typescript-twoslash-queries/-/volar-service-typescript-twoslash-queries-0.0.56.tgz",
-			"integrity": "sha512-VqOp3xQucUzLpJCOEQcAiAUlbv6c1laTbFsM/pc06S/+l78eHPDbnivoSwL+0MKbNoLwLsS5w0OwBfwQ2Dn2Jg==",
+			"version": "0.0.59",
+			"resolved": "https://registry.npmjs.org/volar-service-typescript-twoslash-queries/-/volar-service-typescript-twoslash-queries-0.0.59.tgz",
+			"integrity": "sha512-skm8e6yhCIkqLwJB6S9MqT5lO9LNFuMD3dYxKpmOZs1CKbXmCZZTmLfEaD5VkJae1xdleEDZFFTHl2O5HLjOGQ==",
 			"dependencies": {
 				"vscode-uri": "^3.0.8"
 			},
 			"peerDependencies": {
-				"@volar/language-service": "~2.4.0-alpha.1"
+				"@volar/language-service": "~2.4.0-alpha.12"
 			},
 			"peerDependenciesMeta": {
 				"@volar/language-service": {
--- a/pkgs/by-name/vu/vue-language-server/package.nix
+++ b/pkgs/by-name/vu/vue-language-server/package.nix
@ -6,14 +6,14 @@

 buildNpmPackage rec {
  pname = "vue-language-server";
-  version = "2.0.24";
+  version = "2.0.26";

  src = fetchurl {
    url = "https://registry.npmjs.org/@vue/language-server/-/language-server-${version}.tgz";
-    hash = "sha256-uEYDg4Sybqodb2/w2mmZqi0uWffBzSSTvttcNWt01MI=";
+    hash = "sha256-SKEc7ft0FxafU7vuN5MQY97gdLG65fMpMIhV2aGosRs=";
  };

-  npmDepsHash = "sha256-6idBvR+Ua6uwwX4doB1X8ERqgBI5bJ6e9G13JhPUFP4=";
+  npmDepsHash = "sha256-kx3axLCVD0obVDE0RE6EM+ZnHU5mjMA+lF8H9dR0X2I=";

  postPatch = ''
    ln -s ${./package-lock.json} package-lock.json
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@ -38,17 +38,10 @@ let
      version ? null,
    }@args:
    let
-      args' = {
-        name = null;
-        officialRelease = null;
-        gitRelease = null;
-        monorepoSrc = null;
-        version = null;
-      } // args;
      inherit
        (import ./common/common-let.nix {
          inherit lib;
-          inherit (args') gitRelease officialRelease version;
+          inherit gitRelease officialRelease version;
        })
        releaseInfo
        ;
@ -68,7 +61,7 @@ let
        else
          stdenv; # does not build with gcc13
      inherit bootBintoolsNoLibc bootBintools;
-      inherit (args')
+      inherit
        officialRelease
        gitRelease
        monorepoSrc
--- a/pkgs/development/compilers/nim/default.nix
+++ b/pkgs/development/compilers/nim/default.nix
@ -303,7 +303,7 @@ in {
        meta = nim'.meta // {
          description = nim'.meta.description
            + " (${targetPlatformConfig} wrapper)";
-          platforms = with lib.platforms; unix ++ genode;
+          platforms = with lib.platforms; unix ++ genode ++ windows;
        };
      });
 in {
--- a/pkgs/development/compilers/nim/nixbuild.patch
+++ b/pkgs/development/compilers/nim/nixbuild.patch
@ -6,7 +6,7 @@ index f31ae94dd..debed9c07 100644
 
 import strutils
 
-+when defined(nixbuild):
+when defined(nixbuild) and not defined(windows):
 +  import os
 +
 type
@ -16,7 +16,7 @@ index f31ae94dd..debed9c07 100644
       libCandidates(prefix & middle & suffix, dest)
   else:
     add(dest, s)
-+  when defined(nixbuild):
+  when defined(nixbuild) and not defined(windows):
 +    # Nix doesn't have a global library directory so
 +    # load libraries using an absolute path if one
 +    # can be derived from NIX_LDFLAGS.
--- a/pkgs/development/cuda-modules/cutensor/extension.nix
+++ b/pkgs/development/cuda-modules/cutensor/extension.nix
@ -40,6 +40,7 @@ let
    "1.5.0"
    "1.6.2"
    "1.7.0"
+    "2.0.2"
  ];

  # Manifests :: { redistrib, feature }
@ -96,11 +97,14 @@ let
  redistArch = flags.getRedistArch hostPlatform.system;
  # platformIsSupported :: Manifests -> Boolean
  platformIsSupported =
-    { feature, ... }:
+    { feature, redistrib, ... }:
    (attrsets.attrByPath [
      pname
      redistArch
-    ] null feature) != null;
+    ] null feature) != null
+
+    # NOTE: This is an ad hoc hack; manifest schemas do not support version constraints yet
+    && !(lib.versionOlder cudaVersion "11.0" && lib.versionAtLeast redistrib.${pname}.version "2.0.2");

  # TODO(@connorbaker): With an auxilliary file keeping track of the CUDA versions each release supports,
  # we could filter out releases that don't support our CUDA version.
--- a/pkgs/development/cuda-modules/cutensor/manifests/feature_2.0.2.json
+++ b/pkgs/development/cuda-modules/cutensor/manifests/feature_2.0.2.json
@ -0,0 +1,44 @@
+{
+  "libcutensor": {
+    "linux-ppc64le": {
+      "outputs": {
+        "bin": false,
+        "dev": true,
+        "doc": false,
+        "lib": true,
+        "sample": false,
+        "static": true
+      }
+    },
+    "linux-sbsa": {
+      "outputs": {
+        "bin": false,
+        "dev": true,
+        "doc": false,
+        "lib": true,
+        "sample": false,
+        "static": true
+      }
+    },
+    "linux-x86_64": {
+      "outputs": {
+        "bin": false,
+        "dev": true,
+        "doc": false,
+        "lib": true,
+        "sample": false,
+        "static": true
+      }
+    },
+    "windows-x86_64": {
+      "outputs": {
+        "bin": false,
+        "dev": true,
+        "doc": false,
+        "lib": false,
+        "sample": false,
+        "static": false
+      }
+    }
+  }
+}
--- a/pkgs/development/cuda-modules/cutensor/manifests/redistrib_2.0.2.json
+++ b/pkgs/development/cuda-modules/cutensor/manifests/redistrib_2.0.2.json
@ -0,0 +1,35 @@
+{
+    "release_date": "2024-06-24",
+    "release_label": "2.0.2",
+    "release_product": "cutensor",
+    "libcutensor": {
+        "name": "NVIDIA cuTENSOR",
+        "license": "cuTensor",
+        "license_path": "libcutensor/LICENSE.txt",
+        "version": "2.0.2.4",
+        "linux-x86_64": {
+            "relative_path": "libcutensor/linux-x86_64/libcutensor-linux-x86_64-2.0.2.4-archive.tar.xz",
+            "sha256": "957b04ef6343aca404fe5f4a3f1f1d3ac0bd04ceb3acecc93e53f4d63bd91157",
+            "md5": "2b994ecba434e69ee55043cf353e05b4",
+            "size": "545271628"
+        },
+        "linux-ppc64le": {
+            "relative_path": "libcutensor/linux-ppc64le/libcutensor-linux-ppc64le-2.0.2.4-archive.tar.xz",
+            "sha256": "db2c05e231a26fb5efee470e1d8e11cb1187bfe0726b665b87cbbb62a9901ba0",
+            "md5": "6b00e29407452333946744c4084157e8",
+            "size": "543070992"
+        },
+        "linux-sbsa": {
+            "relative_path": "libcutensor/linux-sbsa/libcutensor-linux-sbsa-2.0.2.4-archive.tar.xz",
+            "sha256": "9712b54aa0988074146867f9b6f757bf11a61996f3b58b21e994e920b272301b",
+            "md5": "c9bb31a92626a092d0c7152b8b3eaa18",
+            "size": "540299376"
+        },
+        "windows-x86_64": {
+            "relative_path": "libcutensor/windows-x86_64/libcutensor-windows-x86_64-2.0.2.4-archive.zip",
+            "sha256": "ab2fca16d410863d14f2716cec0d07fb21d20ecd24ee47d309e9970c9c01ed4a",
+            "md5": "f6cfdb29a9a421a1ee4df674dd54028c",
+            "size": "921154033"
+        }
+    }
+}
--- a/pkgs/development/libraries/spglib/default.nix
+++ b/pkgs/development/libraries/spglib/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "spglib";
-  version = "2.4.0"; # N.B: if you change this, please update: pythonPackages.spglib
+  version = "2.5.0"; # N.B: if you change this, please update: pythonPackages.spglib

  src = fetchFromGitHub {
    owner = "spglib";
    repo = "spglib";
    rev = "v${version}";
-    hash = "sha256-Y6WkN3Q1q4h2TqrlKSKFmFxQZQWKmleRHV74PmYyw2A=";
+    hash = "sha256-nooN4skbhEoUD+YuBtdI7TJq7PIdH9EN5dYAheILp5w=";
  };

  nativeBuildInputs = [ cmake gfortran gtest ];
--- a/pkgs/development/libraries/yyjson/default.nix
+++ b/pkgs/development/libraries/yyjson/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "yyjson";
-  version = "0.9.0";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "ibireme";
    repo = "yyjson";
    rev = finalAttrs.version;
-    hash = "sha256-iRMjiaVnsTclcdzHjlFOTmJvX3VP4omJLC8AWA/EOZk=";
+    hash = "sha256-mp9Oz08qTyhj3P6F1d81SX96vamUY/JWpD2DTYR+v04=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/php-packages/phalcon/default.nix
+++ b/pkgs/development/php-packages/phalcon/default.nix
@ -9,13 +9,13 @@

 buildPecl rec {
  pname = "phalcon";
-  version = "5.7.0";
+  version = "5.8.0";

  src = fetchFromGitHub {
    owner = "phalcon";
    repo = "cphalcon";
    rev = "v${version}";
-    hash = "sha256-nckc7LPhXuUBJJvsqWEhH37K8fKdm9hIdkmVdiM3vcc=";
+    hash = "sha256-Jgl/sBWgP4N4rYloaGn78T6XWF/yTYYCsSC9Q6gD6Wg=";
  };

  internalDeps = [
--- a/pkgs/development/php-packages/phpspy/default.nix
+++ b/pkgs/development/php-packages/phpspy/default.nix
@ -2,6 +2,9 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  gnugrep,
+  binutils,
+  makeBinaryWrapper,
  php,
  testers,
  phpPackages,
@ -19,19 +22,32 @@ stdenv.mkDerivation (finalAttrs: {
    fetchSubmodules = true;
  };

-  nativeBuildInputs = [ php.unwrapped ];
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    php.unwrapped
+  ];

  env.USE_ZEND = 1;

  installPhase = ''
    runHook preInstall

-    mkdir -p $out/bin
-    cp phpspy $out/bin
+    install -Dt "$out/bin" phpspy stackcollapse-phpspy.pl

    runHook postInstall
  '';

+  postFixup = ''
+    wrapProgram "$out/bin/phpspy" \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          gnugrep
+          # for objdump
+          binutils
+        ]
+      }"
+  '';
+
  passthru.tests.version = testers.testVersion {
    version = "v${finalAttrs.version}";
    package = phpPackages.phpspy;
--- a/pkgs/development/python-modules/aiomealie/default.nix
+++ b/pkgs/development/python-modules/aiomealie/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "aiomealie";
-  version = "0.5.0";
+  version = "0.6.0";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "joostlek";
    repo = "python-mealie";
    rev = "refs/tags/v${version}";
-    hash = "sha256-pchGl3bkbW2bOQenYoSb0NmDvJqsYYuHHd4oUA9aTFo=";
+    hash = "sha256-ECymJLcEL2385jcel8lxIzf0zjNcdp1FZpXSBIUcvZc=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/check-manifest/default.nix
+++ b/pkgs/development/python-modules/check-manifest/default.nix
@ -7,6 +7,7 @@
  git,
  pep517,
  pytestCheckHook,
+  setuptools,
  tomli,
  pythonOlder,
 }:
@ -26,6 +27,7 @@ buildPythonPackage rec {
  propagatedBuildInputs = [
    build
    pep517
+    setuptools
  ] ++ lib.optionals (pythonOlder "3.11") [ tomli ];

  nativeCheckInputs = [
--- a/Show More
+++ b/Show More