Merge branch 'staging-next' into staging

2024-07-02 22:23:14 +02:00 · 2024-07-02 22:23:14 +02:00 · 89195a5313
commit 89195a5313
parent aeba07ddb1 f5a7e092f3
93 changed files with 1752 additions and 874 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1792,12 +1792,6 @@
    githubId = 104313094;
    name = "Andrey Shaat";
  };
-  ashkitten = {
-    email = "ashlea@protonmail.com";
-    github = "ashkitten";
-    githubId = 9281956;
-    name = "ash lea";
-  };
  ashley = {
    email = "ashley@kira64.xyz";
    github = "kira64xyz";
@ -2811,6 +2805,12 @@
    githubId = 3465841;
    name = "Boris Sukholitko";
  };
+  bot-wxt1221 = {
+    email = "3264117476@qq.com";
+    github = "Bot-wxt1221";
+    githubId = 74451279;
+    name = "Bot-wxt1221";
+  };
  bouk = {
    name = "Bouke van der Bijl";
    email = "i@bou.ke";
@ -4362,6 +4362,12 @@
    githubId = 24708079;
    name = "Dan Eads";
  };
+  danid3v = {
+    email = "sch220233@spengergasse.at";
+    github = "DaniD3v";
+    githubId = 124387056;
+    name = "DaniD3v";
+  };
  danielalvsaaker = {
    email = "daniel.alvsaaker@proton.me";
    github = "danielalvsaaker";
@ -11431,15 +11437,6 @@
    githubId = 3696783;
    name = "Leroy Hopson";
  };
-  liketechnik = {
-    name = "Florian Warzecha";
-
-    email = "liketechnik@disroot.org";
-    github = "liketechnik";
-    githubId = 24209689;
-
-    keys = [ { fingerprint = "92D8 A09D 03DD B774 AABD 53B9 E136 2F07 D750 DB5C"; } ];
-  };
  lilacious = {
    email = "yuchenhe126@gmail.com";
    github = "Lilacious";
@ -11452,12 +11449,6 @@
    githubId = 54189319;
    name = "Lilly Cham";
  };
-  lilyball = {
-    email = "lily@sb.org";
-    github = "lilyball";
-    githubId = 714;
-    name = "Lily Ballard";
-  };
  limeytexan = {
    email = "limeytexan@gmail.com";
    github = "limeytexan";
@ -14044,10 +14035,6 @@
    githubId = 4532582;
    keys = [ { fingerprint = "BDEA AB07 909D B96F 4106 85F1 CC15 0758 46BC E91B"; } ];
  };
-  nayala = {
-    name = "Nia";
-    matrix = "@fly:asra.gr";
-  };
  nazarewk = {
    name = "Krzysztof Nazarewski";
    email = "nixpkgs@kdn.im";
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -60,6 +60,20 @@
  it is set, instead of the previous hardcoded default of
  `${networking.hostName}.${security.ipa.domain}`.

+- The fcgiwrap module now allows multiple instances running as distinct users.
+  The option `services.fgciwrap` now takes an attribute set of the
+  configuration of each individual instance.
+  This requires migrating any previous configuration keys from
+  `services.fcgiwrap.*` to `services.fcgiwrap.some-instance.*`.
+  The ownership and mode of the UNIX sockets created by this service are now
+  configurable and private by default.
+  Processes also now run as a dynamically allocated user by default instead of
+  root.
+
+- `services.cgit` now runs as the cgit user by default instead of root.
+  This change requires granting access to the repositories to this user or
+  setting the appropriate one through `services.cgit.some-instance.user`.
+
 - `nvimpager` was updated to version 0.13.0, which changes the order of user and
  nvimpager settings: user commands in `-c` and `--cmd` now override the
  respective default settings because they are executed later.
@ -126,6 +140,8 @@
  GitLab administrators should migrate to the [new runner registration workflow](https://docs.gitlab.com/17.0/ee/ci/runners/new_creation_workflow.html#using-registration-tokens-after-gitlab-170)
  with *runner authentication tokens* until the release of GitLab 18.0.

+- `gitlab` has been updated from 16.x to 17.x and requires at least `postgresql` 14.9, as stated in the [documentation](https://docs.gitlab.com/17.1/ee/install/requirements.html#postgresql-requirements). Check the [upgrade guide](#module-services-postgres-upgrading) in the NixOS manual on how to upgrade your PostgreSQL installation.
+
 - `zx` was updated to v8, which introduces several breaking changes.
  See the [v8 changelog](https://github.com/google/zx/releases/tag/8.0.0) for more information.

--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -12,7 +12,7 @@ let
  postgresqlPackage = if config.services.postgresql.enable then
                        config.services.postgresql.package
                      else
-                        pkgs.postgresql_13;
+                        pkgs.postgresql_14;

  gitlabSocket = "${cfg.statePath}/tmp/sockets/gitlab.socket";
  gitalySocket = "${cfg.statePath}/tmp/sockets/gitaly.socket";
@ -1119,8 +1119,8 @@ in {
        message = "services.gitlab.secrets.jwsFile must be set!";
      }
      {
-        assertion = versionAtLeast postgresqlPackage.version "13.6.0";
-        message = "PostgreSQL >=13.6 is required to run GitLab 16. Follow the instructions in the manual section for upgrading PostgreSQL here: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading";
+        assertion = versionAtLeast postgresqlPackage.version "14.9";
+        message = "PostgreSQL >= 14.9 is required to run GitLab 17. Follow the instructions in the manual section for upgrading PostgreSQL here: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading";
      }
    ];

@ -1282,6 +1282,7 @@ in {
      "d ${gitlabConfig.production.shared.path}/registry 0750 ${cfg.user} ${cfg.group} -"
      "d ${gitlabConfig.production.shared.path}/terraform_state 0750 ${cfg.user} ${cfg.group} -"
      "d ${gitlabConfig.production.shared.path}/ci_secure_files 0750 ${cfg.user} ${cfg.group} -"
+      "d ${gitlabConfig.production.shared.path}/external-diffs 0750 ${cfg.user} ${cfg.group} -"
      "L+ /run/gitlab/config - - - - ${cfg.statePath}/config"
      "L+ /run/gitlab/log - - - - ${cfg.statePath}/log"
      "L+ /run/gitlab/tmp - - - - ${cfg.statePath}/tmp"
--- a/nixos/modules/services/misc/zoneminder.nix
+++ b/nixos/modules/services/misc/zoneminder.nix
@ -202,10 +202,10 @@ in {
    ];

    services = {
-      fcgiwrap = lib.mkIf useNginx {
-        enable = true;
-        preforkProcesses = cfg.cameras;
-        inherit user group;
+      fcgiwrap.zoneminder = lib.mkIf useNginx {
+        process.prefork = cfg.cameras;
+        process.user = user;
+        process.group = group;
      };

      mysql = lib.mkIf cfg.database.createLocally {
@ -225,9 +225,7 @@ in {
            default = true;
            root = "${pkg}/share/zoneminder/www";
            listen = [ { addr = "0.0.0.0"; inherit (cfg) port; } ];
-            extraConfig = let
-              fcgi = config.services.fcgiwrap;
-            in ''
+            extraConfig = ''
              index index.php;

              location / {
@ -257,7 +255,7 @@ in {
                  fastcgi_param HTTP_PROXY "";
                  fastcgi_intercept_errors on;

-                  fastcgi_pass ${fcgi.socketType}:${fcgi.socketAddress};
+                  fastcgi_pass unix:${config.services.fcgiwrap.zoneminder.socket.address};
                }

                location /cache/ {
--- a/nixos/modules/services/networking/cgit.nix
+++ b/nixos/modules/services/networking/cgit.nix
@ -25,14 +25,14 @@ let

  regexLocation = cfg: regexEscape (stripLocation cfg);

-  mkFastcgiPass = cfg: ''
+  mkFastcgiPass = name: cfg: ''
    ${if cfg.nginx.location == "/" then ''
      fastcgi_param PATH_INFO $uri;
    '' else ''
      fastcgi_split_path_info ^(${regexLocation cfg})(/.+)$;
      fastcgi_param PATH_INFO $fastcgi_path_info;
    ''
-    }fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
+    }fastcgi_pass unix:${config.services.fcgiwrap."cgit-${name}".socket.address};
  '';

  cgitrcLine = name: value: "${name}=${
@ -72,25 +72,11 @@ let
    ${cfg.extraConfig}
  '';

-  mkCgitReposDir = cfg:
-    if cfg.scanPath != null then
-      cfg.scanPath
-    else
-      pkgs.runCommand "cgit-repos" {
-        preferLocalBuild = true;
-        allowSubstitutes = false;
-      } ''
-        mkdir -p "$out"
-        ${
-          concatStrings (
-            mapAttrsToList
-              (name: value: ''
-                ln -s ${escapeShellArg value.path} "$out"/${escapeShellArg name}
-              '')
-              cfg.repos
-          )
-        }
-      '';
+  fcgiwrapUnitName = name: "fcgiwrap-cgit-${name}";
+  fcgiwrapRuntimeDir = name: "/run/${fcgiwrapUnitName name}";
+  gitProjectRoot = name: cfg: if cfg.scanPath != null
+    then cfg.scanPath
+    else "${fcgiwrapRuntimeDir name}/repos";

 in
 {
@ -154,6 +140,18 @@ in
            type = types.lines;
            default = "";
          };
+
+          user = mkOption {
+            description = "User to run the cgit service as.";
+            type = types.str;
+            default = "cgit";
+          };
+
+          group = mkOption {
+            description = "Group to run the cgit service as.";
+            type = types.str;
+            default = "cgit";
+          };
        };
      }));
    };
@ -165,18 +163,46 @@ in
      message = "Exactly one of services.cgit.${vhost}.scanPath or services.cgit.${vhost}.repos must be set.";
    }) cfgs;

-    services.fcgiwrap.enable = true;
+    users = mkMerge (flip mapAttrsToList cfgs (_: cfg: {
+      users.${cfg.user} = {
+        isSystemUser = true;
+        inherit (cfg) group;
+      };
+      groups.${cfg.group} = { };
+    }));
+
+    services.fcgiwrap = flip mapAttrs' cfgs (name: cfg:
+      nameValuePair "cgit-${name}" {
+        process = { inherit (cfg) user group; };
+        socket = { inherit (config.services.nginx) user group; };
+      }
+    );
+
+    systemd.services = flip mapAttrs' cfgs (name: cfg:
+      nameValuePair (fcgiwrapUnitName name)
+      (mkIf (cfg.repos != { }) {
+        serviceConfig.RuntimeDirectory = fcgiwrapUnitName name;
+        preStart = ''
+          GIT_PROJECT_ROOT=${escapeShellArg (gitProjectRoot name cfg)}
+          mkdir -p "$GIT_PROJECT_ROOT"
+          cd "$GIT_PROJECT_ROOT"
+          ${concatLines (flip mapAttrsToList cfg.repos (name: repo: ''
+            ln -s ${escapeShellArg repo.path} ${escapeShellArg name}
+          ''))}
+        '';
+      }
+    ));

    services.nginx.enable = true;

-    services.nginx.virtualHosts = mkMerge (mapAttrsToList (_: cfg: {
+    services.nginx.virtualHosts = mkMerge (mapAttrsToList (name: cfg: {
      ${cfg.nginx.virtualHost} = {
        locations = (
          genAttrs'
            [ "cgit.css" "cgit.png" "favicon.ico" "robots.txt" ]
-            (name: nameValuePair "= ${stripLocation cfg}/${name}" {
+            (fileName: nameValuePair "= ${stripLocation cfg}/${fileName}" {
              extraConfig = ''
-                alias ${cfg.package}/cgit/${name};
+                alias ${cfg.package}/cgit/${fileName};
              '';
            })
        ) // {
@ -184,10 +210,10 @@ in
            fastcgiParams = rec {
              SCRIPT_FILENAME = "${pkgs.git}/libexec/git-core/git-http-backend";
              GIT_HTTP_EXPORT_ALL = "1";
-              GIT_PROJECT_ROOT = mkCgitReposDir cfg;
+              GIT_PROJECT_ROOT = gitProjectRoot name cfg;
              HOME = GIT_PROJECT_ROOT;
            };
-            extraConfig = mkFastcgiPass cfg;
+            extraConfig = mkFastcgiPass name cfg;
          };
          "${stripLocation cfg}/" = {
            fastcgiParams = {
@ -196,7 +222,7 @@ in
              HTTP_HOST = "$server_name";
              CGIT_CONFIG = mkCgitrc cfg;
            };
-            extraConfig = mkFastcgiPass cfg;
+            extraConfig = mkFastcgiPass name cfg;
          };
        };
      };
--- a/nixos/modules/services/networking/mihomo.nix
+++ b/nixos/modules/services/networking/mihomo.nix
@ -2,10 +2,11 @@
 # cfg.configFile contains secrets such as proxy servers' credential!
 # we dont want plaintext secrets in world-readable `/nix/store`.

-{ lib
-, config
-, pkgs
-, ...
+{
+  lib,
+  config,
+  pkgs,
+  ...
 }:
 let
  cfg = config.services.mihomo;
@ -17,7 +18,6 @@ in
    package = lib.mkPackageOption pkgs "mihomo" { };

    configFile = lib.mkOption {
-      default = null;
      type = lib.types.nullOr lib.types.path;
      description = "Configuration file to use.";
    };
@ -67,7 +67,7 @@ in
          ExecStart = lib.concatStringsSep " " [
            (lib.getExe cfg.package)
            "-d /var/lib/private/mihomo"
-            (lib.optionalString (cfg.configFile != null) "-f \${CREDENTIALS_DIRECTORY}/config.yaml")
+            "-f \${CREDENTIALS_DIRECTORY}/config.yaml"
            (lib.optionalString (cfg.webui != null) "-ext-ui ${cfg.webui}")
            (lib.optionalString (cfg.extraOpts != null) cfg.extraOpts)
          ];
--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@ -716,6 +716,17 @@ in
        description = "Additional prosody configuration";
      };

+      log = mkOption {
+        type = types.lines;
+        default = ''"*syslog"'';
+        description = "Logging configuration. See [](https://prosody.im/doc/logging) for more details";
+        example = ''
+          {
+            { min = "warn"; to = "*syslog"; };
+          }
+        '';
+      };
+
    };
  };

@ -764,7 +775,7 @@ in

      pidfile = "/run/prosody/prosody.pid"

-      log = "*syslog"
+      log = ${cfg.log}

      data_path = "${cfg.dataDir}"
      plugin_paths = {
--- a/nixos/modules/services/networking/smokeping.nix
+++ b/nixos/modules/services/networking/smokeping.nix
@ -337,7 +337,11 @@ in
    };

    # use nginx to serve the smokeping web service
-    services.fcgiwrap.enable = mkIf cfg.webService true;
+    services.fcgiwrap.smokeping = mkIf cfg.webService {
+      process.user = cfg.user;
+      process.group = cfg.user;
+      socket = { inherit (config.services.nginx) user group; };
+    };
    services.nginx = mkIf cfg.webService {
      enable = true;
      virtualHosts."smokeping" = {
@ -349,7 +353,7 @@ in
        locations."/smokeping.fcgi" = {
          extraConfig = ''
            include ${config.services.nginx.package}/conf/fastcgi_params;
-            fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
+            fastcgi_pass unix:${config.services.fcgiwrap.smokeping.socket.address};
            fastcgi_param SCRIPT_FILENAME ${smokepingHome}/smokeping.fcgi;
            fastcgi_param DOCUMENT_ROOT ${smokepingHome};
          '';
--- a/nixos/modules/services/web-servers/apache-httpd/default.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/default.nix
@ -435,7 +435,7 @@ in
        example = literalExpression ''
          [
            "proxy_connect"
-            { name = "jk"; path = "''${pkgs.tomcat_connectors}/modules/mod_jk.so"; }
+            { name = "jk"; path = "''${pkgs.apacheHttpdPackages.mod_jk}/modules/mod_jk.so"; }
          ]
        '';
        description = ''
--- a/nixos/modules/services/web-servers/fcgiwrap.nix
+++ b/nixos/modules/services/web-servers/fcgiwrap.nix
@ -3,70 +3,128 @@
 with lib;

 let
-  cfg = config.services.fcgiwrap;
+  forEachInstance = f: flip mapAttrs' config.services.fcgiwrap (name: cfg:
+    nameValuePair "fcgiwrap-${name}" (f cfg)
+  );
+
 in {
-
-  options = {
-    services.fcgiwrap = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Whether to enable fcgiwrap, a server for running CGI applications over FastCGI.";
-      };
-
-      preforkProcesses = mkOption {
-        type = types.int;
+  options.services.fcgiwrap = mkOption {
+    description = "Configuration for fcgiwrap instances.";
+    default = { };
+    type = types.attrsOf (types.submodule ({ config, ... }: { options = {
+      process.prefork = mkOption {
+        type = types.ints.positive;
        default = 1;
        description = "Number of processes to prefork.";
      };

-      socketType = mkOption {
+      process.user = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          User as which this instance of fcgiwrap will be run.
+          Set to `null` (the default) to use a dynamically allocated user.
+        '';
+      };
+
+      process.group = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = "Group as which this instance of fcgiwrap will be run.";
+      };
+
+      socket.type = mkOption {
        type = types.enum [ "unix" "tcp" "tcp6" ];
        default = "unix";
        description = "Socket type: 'unix', 'tcp' or 'tcp6'.";
      };

-      socketAddress = mkOption {
+      socket.address = mkOption {
        type = types.str;
-        default = "/run/fcgiwrap.sock";
+        default = "/run/fcgiwrap-${config._module.args.name}.sock";
        example = "1.2.3.4:5678";
-        description = "Socket address. In case of a UNIX socket, this should be its filesystem path.";
+        description = ''
+          Socket address.
+          In case of a UNIX socket, this should be its filesystem path.
+        '';
      };

-      user = mkOption {
+      socket.user = mkOption {
        type = types.nullOr types.str;
        default = null;
-        description = "User permissions for the socket.";
+        description = ''
+          User to be set as owner of the UNIX socket.
+          Defaults to the process running user.
+        '';
      };

-      group = mkOption {
+      socket.group = mkOption {
        type = types.nullOr types.str;
        default = null;
-        description = "Group permissions for the socket.";
+        description = ''
+          Group to be set as owner of the UNIX socket.
+          Defaults to the process running group.
+        '';
      };
-    };
+
+      socket.mode = mkOption {
+        type = types.nullOr types.str;
+        default = if config.socket.type == "unix" then "0600" else null;
+        defaultText = literalExpression ''
+          if config.socket.type == "unix" then "0600" else null
+        '';
+        description = ''
+          Mode to be set on the UNIX socket.
+          Defaults to private to the socket's owner.
+        '';
+      };
+    }; }));
  };

-  config = mkIf cfg.enable {
-    systemd.services.fcgiwrap = {
+  config = {
+    assertions = concatLists (mapAttrsToList (name: cfg: [
+      {
+        assertion = cfg.socket.user != null -> cfg.socket.type == "unix";
+        message = "Socket owner can only be set for the UNIX socket type.";
+      }
+      {
+        assertion = cfg.socket.group != null -> cfg.socket.type == "unix";
+        message = "Socket owner can only be set for the UNIX socket type.";
+      }
+      {
+        assertion = cfg.socket.mode != null -> cfg.socket.type == "unix";
+        message = "Socket mode can only be set for the UNIX socket type.";
+      }
+    ]) config.services.fcgiwrap);
+
+    systemd.services = forEachInstance (cfg: {
      after = [ "nss-user-lookup.target" ];
-      wantedBy = optional (cfg.socketType != "unix") "multi-user.target";
+      wantedBy = optional (cfg.socket.type != "unix") "multi-user.target";

      serviceConfig = {
-        ExecStart = "${pkgs.fcgiwrap}/sbin/fcgiwrap -c ${builtins.toString cfg.preforkProcesses} ${
-          optionalString (cfg.socketType != "unix") "-s ${cfg.socketType}:${cfg.socketAddress}"
-        }";
-      } // (if cfg.user != null && cfg.group != null then {
-        User = cfg.user;
-        Group = cfg.group;
-      } else { } );
-    };
+        ExecStart = ''
+          ${pkgs.fcgiwrap}/sbin/fcgiwrap ${cli.toGNUCommandLineShell {} ({
+            c = cfg.process.prefork;
+          } // (optionalAttrs (cfg.socket.type != "unix") {
+            s = "${cfg.socket.type}:${cfg.socket.address}";
+          }))}
+        '';
+      } // (if cfg.process.user != null then {
+        User = cfg.process.user;
+        Group = cfg.process.group;
+      } else {
+        DynamicUser = true;
+      });
+    });

-    systemd.sockets = if (cfg.socketType == "unix") then {
-      fcgiwrap = {
-        wantedBy = [ "sockets.target" ];
-        socketConfig.ListenStream = cfg.socketAddress;
+    systemd.sockets = forEachInstance (cfg: mkIf (cfg.socket.type == "unix") {
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = cfg.socket.address;
+        SocketUser = cfg.socket.user;
+        SocketGroup = cfg.socket.group;
+        SocketMode = cfg.socket.mode;
      };
-    } else { };
+    });
  };
 }
--- a/nixos/tests/cgit.nix
+++ b/nixos/tests/cgit.nix
@ -23,7 +23,7 @@ in {
        nginx.location = "/(c)git/";
        repos = {
          some-repo = {
-            path = "/srv/git/some-repo";
+            path = "/tmp/git/some-repo";
            desc = "some-repo description";
          };
        };
@ -50,12 +50,12 @@ in {

    server.fail("curl -fsS http://localhost/robots.txt")

-    server.succeed("${pkgs.writeShellScript "setup-cgit-test-repo" ''
+    server.succeed("sudo -u cgit ${pkgs.writeShellScript "setup-cgit-test-repo" ''
      set -e
-      git init --bare -b master /srv/git/some-repo
+      git init --bare -b master /tmp/git/some-repo
      git init -b master reference
      cd reference
-      git remote add origin /srv/git/some-repo
+      git remote add origin /tmp/git/some-repo
      date > date.txt
      git add date.txt
      git -c user.name=test -c user.email=test@localhost commit -m 'add date'
--- a/nixos/tests/gitolite-fcgiwrap.nix
+++ b/nixos/tests/gitolite-fcgiwrap.nix
@ -24,7 +24,12 @@ import ./make-test-python.nix (
              {
                networking.firewall.allowedTCPPorts = [ 80 ];

-                services.fcgiwrap.enable = true;
+                services.fcgiwrap.gitolite = {
+                  process.user = "gitolite";
+                  process.group = "gitolite";
+                  socket = { inherit (config.services.nginx) user group; };
+                };
+
                services.gitolite = {
                  enable = true;
                  adminPubkey = adminPublicKey;
@ -59,7 +64,7 @@ import ./make-test-python.nix (
                    fastcgi_param SCRIPT_FILENAME ${pkgs.gitolite}/bin/gitolite-shell;

                    # use Unix domain socket or inet socket
-                    fastcgi_pass unix:/run/fcgiwrap.sock;
+                    fastcgi_pass unix:${config.services.fcgiwrap.gitolite.socket.address};
                  '';
                };

@ -82,7 +87,7 @@ import ./make-test-python.nix (

          server.wait_for_unit("gitolite-init.service")
          server.wait_for_unit("nginx.service")
-          server.wait_for_file("/run/fcgiwrap.sock")
+          server.wait_for_file("/run/fcgiwrap-gitolite.sock")

          client.wait_for_unit("multi-user.target")
          client.succeed(
--- a/pkgs/applications/editors/android-studio-for-platform/common.nix
+++ b/pkgs/applications/editors/android-studio-for-platform/common.nix
@ -0,0 +1,186 @@
+{ channel, pname, version, sha256Hash }:
+
+{ android-tools
+, bash
+, buildFHSEnv
+, coreutils
+, dpkg
+, e2fsprogs
+, fetchurl
+, findutils
+, git
+, gnugrep
+, gnused
+, gnutar
+, gtk2, gnome_vfs, glib, GConf
+, gzip
+, fontsConf
+, fontconfig
+, freetype
+, libX11
+, libXext
+, libXi
+, libXrandr
+, libXrender
+, libXtst
+, makeFontsConf
+, makeWrapper
+, ncurses5
+, openssl
+, ps
+, python3
+, lib
+, stdenv
+, unzip
+, usbutils
+, which
+, runCommand
+, xkeyboard_config
+, zip
+, zlib
+, makeDesktopItem
+, tiling_wm ? false # if we are using a tiling wm, need to set _JAVA_AWT_WM_NONREPARENTING in wrapper
+}:
+
+let
+  drvName = "${pname}-${version}";
+  filename = "asfp-${version}-linux.deb";
+
+  androidStudioForPlatform = stdenv.mkDerivation {
+    name = "${drvName}-unwrapped";
+
+    src = fetchurl {
+      url = "https://dl.google.com/android/asfp/${filename}";
+      sha256 = sha256Hash;
+    };
+
+    nativeBuildInputs = [
+      dpkg
+      makeWrapper
+    ];
+
+    installPhase = ''
+      cp -r "./opt/${pname}/" $out
+      wrapProgram $out/bin/studio.sh \
+        --set-default JAVA_HOME "$out/jbr" \
+        --set QT_XKB_CONFIG_ROOT "${xkeyboard_config}/share/X11/xkb" \
+        ${lib.optionalString tiling_wm "--set _JAVA_AWT_WM_NONREPARENTING 1"} \
+        --set FONTCONFIG_FILE ${fontsConf} \
+        --prefix PATH : "${lib.makeBinPath [
+
+          # Checked in studio.sh
+          coreutils
+          findutils
+          gnugrep
+          which
+          gnused
+
+          # Used during setup wizard
+          gnutar
+          gzip
+
+          # Runtime stuff
+          git
+          ps
+          usbutils
+          android-tools
+
+          # For Soong sync
+          openssl
+          python3
+          unzip
+          zip
+          e2fsprogs
+        ]}" \
+        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [
+          # Crash at startup without these
+          fontconfig
+          freetype
+          libXext
+          libXi
+          libXrender
+          libXtst
+          libX11
+
+          # Support multiple monitors
+          libXrandr
+
+          # For GTKLookAndFeel
+          gtk2
+          gnome_vfs
+          glib
+          GConf
+
+          # For Soong sync
+          e2fsprogs
+        ]}"
+    '';
+  };
+
+  desktopItem = makeDesktopItem {
+    name = pname;
+    exec = pname;
+    icon = pname;
+    desktopName = "Android Studio for Platform (${channel} channel)";
+    comment = "The official Android IDE for Android platform development";
+    categories = [ "Development" "IDE" ];
+    startupNotify = true;
+    startupWMClass = "jetbrains-studio";
+  };
+
+  # Android Studio for Platform downloads prebuilt binaries as part of the SDK. These tools
+  # (e.g. `mksdcard`) have `/lib/ld-linux.so.2` set as the interpreter. An FHS
+  # environment is used as a work around for that.
+  fhsEnv = buildFHSEnv {
+    name = "${drvName}-fhs-env";
+    multiPkgs = pkgs: [
+      zlib
+      ncurses5
+      ncurses5.dev
+    ];
+    profile = ''
+      export ALLOW_NINJA_ENV=true
+      export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib:/usr/lib32
+    '';
+  };
+in runCommand
+  drvName
+  {
+    startScript = ''
+      #!${bash}/bin/bash
+      ${fhsEnv}/bin/${drvName}-fhs-env ${androidStudioForPlatform}/bin/studio.sh "$@"
+    '';
+    preferLocalBuild = true;
+    allowSubstitutes = false;
+    passthru = {
+      unwrapped = androidStudioForPlatform;
+    };
+    meta = with lib; {
+      description = "The Official IDE for Android platform development";
+      longDescription = ''
+        Android Studio for Platform (ASfP) is the version of the Android Studio IDE
+        for Android Open Source Project (AOSP) platform developers who build with the Soong build system.
+      '';
+      homepage = "https://developer.android.com/studio/platform.html";
+      license = with licenses; [ asl20 unfree ]; # The code is under Apache-2.0, but:
+      # If one selects Help -> Licenses in Android Studio, the dialog shows the following:
+      # "Android Studio includes proprietary code subject to separate license,
+      # including JetBrains CLion(R) (www.jetbrains.com/clion) and IntelliJ(R)
+      # IDEA Community Edition (www.jetbrains.com/idea)."
+      # Also: For actual development the Android SDK is required and the Google
+      # binaries are also distributed as proprietary software (unlike the
+      # source-code itself).
+      platforms = [ "x86_64-linux" ];
+      maintainers = with maintainers; [ robbins ];
+      mainProgram = pname;
+    };
+  }
+  ''
+    mkdir -p $out/{bin,share/pixmaps}
+
+    echo -n "$startScript" > $out/bin/${pname}
+    chmod +x $out/bin/${pname}
+
+    ln -s ${androidStudioForPlatform}/bin/studio.png $out/share/pixmaps/${pname}.png
+    ln -s ${desktopItem}/share/applications $out/share/applications
+  ''
--- a/pkgs/applications/editors/android-studio-for-platform/default.nix
+++ b/pkgs/applications/editors/android-studio-for-platform/default.nix
@ -0,0 +1,32 @@
+{ callPackage, makeFontsConf, gnome2, buildFHSEnv, tiling_wm ? false }:
+
+let
+  mkStudio = opts: callPackage (import ./common.nix opts) {
+    fontsConf = makeFontsConf {
+      fontDirectories = [];
+    };
+    inherit (gnome2) GConf gnome_vfs;
+    inherit buildFHSEnv;
+    inherit tiling_wm;
+  };
+  stableVersion = {
+    version = "2023.2.1.20"; # Android Studio Iguana | 2023.2.1 Beta 2
+    sha256Hash = "sha256-cM/pkSghqLUUvJVF/OVLDOxVBJlJLH8ge1bfZtDUegY=";
+  };
+  canaryVersion = {
+    version = "2023.3.2.1"; # Android Studio Jellyfish | 2023.3.2 Canary 1
+    sha256Hash = "sha256-XOsbMyNentklfEp1k49H3uFeiRNMCV/Seisw9K1ganM=";
+  };
+in {
+  # Attributes are named by their corresponding release channels
+
+  stable = mkStudio (stableVersion // {
+    channel = "stable";
+    pname = "android-studio-for-platform";
+  });
+
+  canary = mkStudio (canaryVersion // {
+    channel = "canary";
+    pname = "android-studio-for-platform-canary";
+  });
+}
--- a/pkgs/applications/editors/vim/macvim.nix
+++ b/pkgs/applications/editors/vim/macvim.nix
@ -205,7 +205,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Vim - the text editor - for macOS";
    homepage = "https://macvim.org/";
    license = licenses.vim;
-    maintainers = with maintainers; [ lilyball ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.darwin;
    hydraPlatforms = []; # hydra can't build this as long as we rely on Xcode and sandboxProfile
  };
--- a/pkgs/applications/emulators/dolphin-emu/default.nix
+++ b/pkgs/applications/emulators/dolphin-emu/default.nix
@ -188,8 +188,6 @@ stdenv.mkDerivation rec {
    branch = "master";
    license = licenses.gpl2Plus;
    platforms = platforms.unix;
-    maintainers = with maintainers; [
-      ashkitten
-    ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/emulators/dolphin-emu/primehack.nix
+++ b/pkgs/applications/emulators/dolphin-emu/primehack.nix
@ -143,7 +143,7 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/shiiion/dolphin";
    description = "Gamecube/Wii/Triforce emulator for x86_64 and ARMv8";
    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ ashkitten Madouura ];
+    maintainers = with maintainers; [ Madouura ];
    broken = stdenv.isDarwin;
    platforms = platforms.unix;
  };
--- a/pkgs/applications/graphics/drawpile/default.nix
+++ b/pkgs/applications/graphics/drawpile/default.nix
@ -2,10 +2,14 @@
 , lib
 , mkDerivation
 , fetchFromGitHub
+, cargo
 , extra-cmake-modules
+, rustc
+, rustPlatform

 # common deps
 , karchive
+, qtwebsockets

 # client deps
 , qtbase
@ -20,7 +24,6 @@
 , kdnssd
 , libvpx
 , miniupnpc
-, qtx11extras # kis

 # optional server deps
 , libmicrohttpd
@ -33,10 +36,10 @@
 , buildServer ? true
 , buildServerGui ? true # if false builds a headless server
 , buildExtraTools ? false
-, enableKisTablet ? false # enable improved graphics tablet support
 }:

-with lib;
+assert lib.assertMsg (buildClient || buildServer || buildExtraTools)
+  "You must specify at least one of buildClient, buildServer, or buildExtraTools.";

 let
  clientDeps = [
@ -57,54 +60,57 @@ let
    # optional:
    libmicrohttpd # HTTP admin api
    libsodium # ext-auth support
-  ] ++ optional withSystemd systemd;
-
-  kisDeps = [
-    qtx11extras
-  ];
-
-  boolToFlag = bool:
-    if bool then "ON" else "OFF";
+  ] ++ lib.optional withSystemd systemd;

 in mkDerivation rec {
  pname = "drawpile";
-  version = "2.1.20";
+  version = "2.2.1";

  src = fetchFromGitHub {
    owner = "drawpile";
    repo = "drawpile";
    rev = version;
-    sha256 = "sha256-HjGsaa2BYRNxaQP9e8Z7BkVlIKByC/ta92boGbYHRWQ=";
+    sha256 = "sha256-NS1aQlWpn3f+SW0oUjlYwHtOS9ZgbjFTrE9grjK5REM=";
  };

-  nativeBuildInputs = [ extra-cmake-modules ];
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    hash = "sha256-V36yiwraXK7qlJd1r8EtEA4ULxlgvMEmpn/ka3m9GjA=";
+  };
+
+  nativeBuildInputs = [
+    cargo
+    extra-cmake-modules
+    rustc
+    rustPlatform.cargoSetupHook
+  ];

  buildInputs = [
    karchive
+    qtwebsockets
  ]
-  ++ optionals buildClient      clientDeps
-  ++ optionals buildServer      serverDeps
-  ++ optionals enableKisTablet  kisDeps;
+  ++ lib.optionals buildClient clientDeps
+  ++ lib.optionals buildServer serverDeps;

  cmakeFlags = [
-    "-Wno-dev"
-    "-DINITSYS=systemd"
-    "-DCLIENT=${boolToFlag buildClient}"
-    "-DSERVER=${boolToFlag buildServer}"
-    "-DSERVERGUI=${boolToFlag buildServerGui}"
-    "-DTOOLS=${boolToFlag buildExtraTools}"
-    "-DKIS_TABLET=${boolToFlag enableKisTablet}"
+    (lib.cmakeFeature "INITSYS" (lib.optionalString withSystemd "systemd"))
+    (lib.cmakeBool "CLIENT" buildClient)
+    (lib.cmakeBool "SERVER" buildServer)
+    (lib.cmakeBool "SERVERGUI" buildServerGui)
+    (lib.cmakeBool "TOOLS" buildExtraTools)
  ];

  meta = {
    description = "Collaborative drawing program that allows multiple users to sketch on the same canvas simultaneously";
-    mainProgram = "drawpile-srv";
    homepage = "https://drawpile.net/";
    downloadPage = "https://drawpile.net/download/";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ fgaz ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ fgaz ];
+    platforms = lib.platforms.unix;
    broken = stdenv.isDarwin;
+  } // lib.optionalAttrs buildServer {
+    mainProgram = "drawpile-srv";
+  } // lib.optionalAttrs buildClient {
+    mainProgram = "drawpile";
  };
 }
-
--- a/pkgs/applications/networking/instant-messengers/cinny/default.nix
+++ b/pkgs/applications/networking/instant-messengers/cinny/default.nix
@ -60,7 +60,7 @@ buildNpmPackage rec {
  meta = with lib; {
    description = "Yet another Matrix client for the web";
    homepage = "https://cinny.in/";
-    maintainers = with maintainers; [ abbe ashkitten ];
+    maintainers = with maintainers; [ abbe ];
    license = licenses.agpl3Only;
    platforms = platforms.all;
  };
--- a/pkgs/applications/networking/instant-messengers/qq/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qq/default.nix
@ -1,4 +1,5 @@
 { alsa-lib
+, libuuid
 , cups
 , dpkg
 , fetchurl
@ -86,7 +87,7 @@ stdenv.mkDerivation {
    makeShellWrapper $out/opt/QQ/qq $out/bin/qq \
      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
      --prefix LD_PRELOAD : "${lib.makeLibraryPath [ libssh2 ]}/libssh2.so.1" \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL ]}" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL libuuid]}" \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
      --add-flags ${lib.escapeShellArg commandLineArgs} \
      "''${gappsWrapperArgs[@]}"
@ -115,6 +116,6 @@ stdenv.mkDerivation {
    platforms = [ "x86_64-linux" "aarch64-linux" ];
    license = licenses.unfree;
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    maintainers = with lib.maintainers; [ fee1-dead ];
+    maintainers = with lib.maintainers; [ fee1-dead bot-wxt1221 ];
  };
 }
--- a/pkgs/applications/networking/instant-messengers/qq/sources.nix
+++ b/pkgs/applications/networking/instant-messengers/qq/sources.nix
@ -1,9 +1,9 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2024-06-07
+# Last updated: 2024-06-17
 {
  version = "3.2.9";
-  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.9_240606_amd64_01.deb";
-  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.9_240606_arm64_01.deb";
-  arm64_hash = "sha256-wZyaIkJdGDvIw8PrRlOiKpo3rdeELlxYBPyS6llbL4w=";
-  amd64_hash = "sha256-DcQWwep4p4aWUAoBNQ9Ge1QBiCxk6BhcziTDSHmRpgY=";
+  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.9_240617_amd64_01.deb";
+  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.9_240617_arm64_01.deb";
+  arm64_hash = "sha256-qC3eUc3Hs1nolZJhAds0Qx+tAlD/AR3scGxmcA8dtEw=";
+  amd64_hash = "sha256-ofoelAzbuCgxSHsZciWSVkDFDv+zsW+AzZqjeNlaja0=";
 }
--- a/pkgs/applications/networking/trayscale/default.nix
+++ b/pkgs/applications/networking/trayscale/default.nix
@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "trayscale";
-  version = "0.12.4";
+  version = "0.12.5";

  src = fetchFromGitHub {
    owner = "DeedleFake";
    repo = "trayscale";
    rev = "v${version}";
-    hash = "sha256-quy1maeC1ebVzMvN+JzKf8AmMbipju9vvdTU03SyNnc=";
+    hash = "sha256-EwfICUKlDnlkD1vxR1jpNybvUG4mOHfRRgk8VB9T+hs=";
  };

-  vendorHash = "sha256-lGjJLqEGBFd2aYm82xrDfLK90Mcrhb7bMtXSNZpp/bM=";
+  vendorHash = "sha256-lEGFOBR0d8IfqBYdrC8awRhGcPqt0y4oOWU+xu4ClfE=";

  subPackages = [ "cmd/trayscale" ];

@ -46,7 +46,7 @@ buildGoModule rec {
  '';

  meta = with lib; {
-    changelog = "https://github.com/DeedleFake/trayscale/releases/tag/${version}";
+    changelog = "https://github.com/DeedleFake/trayscale/releases/tag/${src.rev}";
    description = "Unofficial GUI wrapper around the Tailscale CLI client";
    homepage = "https://github.com/DeedleFake/trayscale";
    license = licenses.mit;
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,15 +1,15 @@
 {
-  "version": "16.11.5",
-  "repo_hash": "1bhg6glb644m55m50q2kp0azf3c4if11vymjn823rhs68jw3jqcp",
-  "yarn_hash": "03q7h8dyssvsr91klr1jk65f5jz1ac71lx0114zq9c7awxrgp6kq",
+  "version": "17.1.1",
+  "repo_hash": "1ivaicgz4lgl6l06fnr9wfpn71b88yd22ryi3qn2r40rg3vjl1vf",
+  "yarn_hash": "1xyc3c3hhfp5lgrpacj4gsfbql3wn0brdp16ivnqg4n0csjlizq7",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v16.11.5-ee",
+  "rev": "v17.1.1-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "16.11.5",
-    "GITLAB_PAGES_VERSION": "16.11.5",
-    "GITLAB_SHELL_VERSION": "14.35.0",
-    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "4.8.0",
-    "GITLAB_WORKHORSE_VERSION": "16.11.5"
+    "GITALY_SERVER_VERSION": "17.1.1",
+    "GITLAB_PAGES_VERSION": "17.1.1",
+    "GITLAB_SHELL_VERSION": "14.36.0",
+    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.0.0",
+    "GITLAB_WORKHORSE_VERSION": "17.1.1"
  }
 }
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -1,10 +1,37 @@
-{ stdenv, lib, fetchFromGitLab, bundlerEnv
-, ruby_3_1, tzdata, git, nettools, nixosTests, nodejs, openssl
-, defaultGemConfig, buildRubyGem
-, gitlabEnterprise ? false, callPackage, yarn
-, fixup-yarn-lock, replace, file, cacert, fetchYarnDeps, makeWrapper, pkg-config
-, cargo, rustc, rustPlatform
-, icu, zlib, which
+{ bundlerEnv
+, cacert
+, defaultGemConfig
+, fetchFromGitLab
+, fetchYarnDeps
+, fixup-yarn-lock
+, git
+, gitlabEnterprise ? false
+, lib
+, makeWrapper
+, nettools
+, nixosTests
+, nodejs
+, replace
+, ruby_3_2
+, stdenv
+, tzdata
+, yarn
+
+# gem dependencies:
+# gitlab-glfm-markdown
+, buildRubyGem, cargo, rustc, rustPlatform
+
+# gpgme
+, pkg-config
+
+# openssl
+, openssl
+
+# ruby-magic
+, file
+
+# static-holmes
+, icu, which, zlib
 }:

 let
@ -20,7 +47,7 @@ let

  rubyEnv = bundlerEnv rec {
    name = "gitlab-env-${version}";
-    ruby = ruby_3_1;
+    ruby = ruby_3_2;
    gemdir = ./rubyEnv;
    gemset = import (gemdir + "/gemset.nix") src;
    gemConfig = defaultGemConfig // {
@ -50,7 +77,7 @@ let
                cp Cargo.lock $out
              '';
            };
-            hash = "sha256-SncgYYnoSaWA4kQWonoXXbSMu1mnwTyhdLXFagqgH+o=";
+            hash = "sha256-VYjCYUikORuXx27OYWyumBxeHw9aj/S1wcr9vLIsXeo=";
          };

          dontBuild = false;
@ -75,12 +102,17 @@ let
            find $out -type f -name .rustc_info.json -delete
          '';
        };
+
        static_holmes = attrs: {
-          buildInputs = [ which icu zlib ];
+          nativeBuildInputs = [
+            icu
+            which
+            zlib.dev
+          ];
        };
      };
    groups = [
-      "default" "unicorn" "ed25519" "metrics" "development" "puma" "test" "kerberos"
+      "default" "unicorn" "ed25519" "metrics" "development" "puma" "test" "kerberos" "opentelemetry"
    ];
    # N.B. omniauth_oauth2_generic and apollo_upload_server both provide a
    # `console` executable.
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -5,7 +5,7 @@
 }:

 let
-  version = "16.11.5";
+  version = "17.1.1";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@ -17,10 +17,10 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      hash = "sha256-iBLRhkFPsopy6m3y+9Qc+v3FCbV5nOWMs+DMwW+JiSk=";
+      hash = "sha256-c9gLVVRNSkl4RI7LN0UZc6CAzcLIbWGIvsjoiaPdUKY=";
    };

-    vendorHash = "sha256-WCZF7XVW6J1zyPx8e/Mcn+HmHElAUGcEICxiF5HLzBg=";
+    vendorHash = "sha256-yOm0cPC8v6L3gkekUMpf5U86XzpnmeoLTgZSFBb02BA=";

    ldflags = [ "-X ${gitaly_package}/internal/version.version=${version}" "-X ${gitaly_package}/internal/version.moduleVersion=${version}" ];

--- a/pkgs/applications/version-management/gitlab/gitlab-elasticsearch-indexer/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-elasticsearch-indexer/default.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "gitlab-elasticsearch-indexer";
-  version = "4.8.0";
+  version = "5.0.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-elasticsearch-indexer";
    rev = "v${version}";
-    sha256 = "sha256-JHUDZmGlZGyvsB4wgAnNyIEtosZG4ajZ4eBGumH97ZI=";
+    sha256 = "sha256-856lRCW4+FIiXjOzMkfoYws6SMIKXWVtvr+867QEjCk=";
  };

-  vendorHash = "sha256-ztRKXoXncY66XJVwlPn4ShLWTD4Cr0yYHoUdquJItDM=";
+  vendorHash = "sha256-2XdbTqNGt97jQUJmE06D6M/VxF9+vJAwMM/fF8MP2oo=";

  buildInputs = [ icu ];
  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "gitlab-pages";
-  version = "16.11.5";
+  version = "17.1.1";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${version}";
-    hash = "sha256-mJKzaFICE7f4aIFGeV/4PbbQkaxwmRd9QO2pRXpM2ag=";
+    hash = "sha256-cwFqzKXDWuIESdDjuPYos73Ly+zd+J20aJJi0RiRdus=";
  };

-  vendorHash = "sha256-WrR4eZRAuYkhr7ZqP7OXqJ6uwvxzn+t+3OdBNcNaq0M=";
+  vendorHash = "sha256-uVpkCl5rSAtg6gDnL3d11AaOlGNpS2xaPtJrthUNbfE=";
  subPackages = [ "." ];

  meta = with lib; {
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@ -2,24 +2,23 @@

 buildGoModule rec {
  pname = "gitlab-shell";
-  version = "14.35.0";
+  version = "14.36.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-shell";
    rev = "v${version}";
-    sha256 = "sha256-WyIUdDKPKQE1Ddz40WaMA5lDs37OyDuZl/6/nKDYY/8=";
+    sha256 = "sha256-SclRIIUZm1D5fYDrTH1L8opQpxxIoi+SrG2GO7wtScU=";
  };

  buildInputs = [ ruby libkrb5 ];

  patches = [
    ./remove-hardcoded-locations.patch
-    ./go-mod-tidy.patch
  ];

-  vendorHash = "sha256-7TUHD14/aCs3lkpTy5CH9WYUc1Ud6rDFCx+JgsINvxU=";
+  vendorHash = "sha256-Ebs9HnHhK4y6+vwLRvVwQnG8I7Gk6leBBezjkc+bhJo=";

  postInstall = ''
    cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/go-mod-tidy.patch
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/go-mod-tidy.patch
@ -1,12 +0,0 @@
-diff --git a/go.mod b/go.mod
-index 513ccc40..30ba0f6e 100644
--- a/go.mod
-+++ b/go.mod
-@@ -1,6 +1,6 @@
- module gitlab.com/gitlab-org/gitlab-shell/v14
- 
-go 1.20
-+go 1.21
- 
- require (
- 	github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20240402115927-f0b226fa61cc
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations.patch
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations.patch
@ -28,8 +28,8 @@ index c6f2422..fb0426b 100644
 }
 
 func (k *KeyLine) ToString() string {
-	command := fmt.Sprintf("%s %s-%s", path.Join(k.Config.RootDir, executable.BinDir, executable.GitlabShell), k.Prefix, k.Id)
-+	command := fmt.Sprintf("%s %s-%s", path.Join("/run/current-system/sw/bin", executable.GitlabShell), k.Prefix, k.Id)
+-	command := fmt.Sprintf("%s %s-%s", path.Join(k.Config.RootDir, executable.BinDir, executable.GitlabShell), k.Prefix, k.ID)
+	command := fmt.Sprintf("%s %s-%s", path.Join("/run/current-system/sw/bin", executable.GitlabShell), k.Prefix, k.ID)
 
 	return fmt.Sprintf(`command="%s",%s %s`, command, SshOptions, k.Value)
 }
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "16.11.5";
+  version = "17.1.1";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
@ -17,7 +17,7 @@ buildGoModule rec {

  sourceRoot = "${src.name}/workhorse";

-  vendorHash = "sha256-44EtpjYsxYqDH035/ruPfshfejiO011HybKD2inp8bU=";
+  vendorHash = "sha256-7iit/YJHxvrFYfnppwPox+gEAHea7/eq83vMPojWUWU=";
  buildInputs = [ git ];
  ldflags = [ "-X main.Version=${version}" ];
  doCheck = false;
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@ -24,7 +24,7 @@ gem 'bundler-checksum', '~> 0.1.0', path: 'vendor/gems/bundler-checksum', requir
 # https://gitlab.com/gitlab-org/gitlab/-/issues/375713
 #
 # See https://docs.gitlab.com/ee/development/gemfile.html#upgrade-rails for guidelines when upgrading Rails
-gem 'rails', '~> 7.0.8.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'rails', '~> 7.0.8.4' # rubocop:todo Gemfile/MissingFeatureCategory

 gem 'activerecord-gitlab', path: 'gems/activerecord-gitlab' # rubocop:todo Gemfile/MissingFeatureCategory

@ -49,12 +49,12 @@ gem 'responders', '~> 3.0' # rubocop:todo Gemfile/MissingFeatureCategory

 gem 'sprockets', '~> 3.7.0' # rubocop:todo Gemfile/MissingFeatureCategory

-gem 'view_component', '~> 3.11.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'view_component', '~> 3.12.1' # rubocop:todo Gemfile/MissingFeatureCategory

 # Supported DBs
-gem 'pg', '~> 1.5.6' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'pg', '~> 1.5.6', feature_category: :database

-gem 'neighbor', '~> 0.2.3' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'neighbor', '~> 0.3.2', feature_category: :duo_chat

 gem 'rugged', '~> 1.6' # rubocop:todo Gemfile/MissingFeatureCategory

@ -64,6 +64,9 @@ gem 'marginalia', '~> 1.11.1' # rubocop:todo Gemfile/MissingFeatureCategory
 # Authorization
 gem 'declarative_policy', '~> 1.1.0' # rubocop:todo Gemfile/MissingFeatureCategory

+# For source code paths mapping
+gem 'coverband', '6.1.2', require: false, feature_category: :shared
+
 # Authentication libraries
 gem 'devise', '~> 4.9.3', feature_category: :system_access
 gem 'devise-pbkdf2-encryptable', '~> 0.0.0', path: 'vendor/gems/devise-pbkdf2-encryptable' # rubocop:todo Gemfile/MissingFeatureCategory
@ -75,17 +78,13 @@ gem 'ruby-saml', '~> 1.15.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth', '~> 2.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-auth0', '~> 3.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-azure-activedirectory-v2', '~> 2.0' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'omniauth-azure-oauth2', '~> 0.0.9', path: 'vendor/gems/omniauth-azure-oauth2' # See gem README.md # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'omniauth-dingtalk-oauth2', '~> 1.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-alicloud', '~> 3.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'omniauth-facebook', '~> 4.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-github', '2.0.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-gitlab', '~> 4.0.0', path: 'vendor/gems/omniauth-gitlab' # See vendor/gems/omniauth-gitlab/README.md # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-google-oauth2', '~> 1.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-oauth2-generic', '~> 0.2.2' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-saml', '~> 2.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth-shibboleth-redux', '~> 2.0', require: 'omniauth-shibboleth' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'omniauth-twitter', '~> 1.4' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth_crowd', '~> 2.4.0', path: 'vendor/gems/omniauth_crowd' # See vendor/gems/omniauth_crowd/README.md # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'omniauth_openid_connect', '~> 0.6.1' # rubocop:todo Gemfile/MissingFeatureCategory
 # Locked until Ruby 3.0 upgrade since upgrading will pull in an updated net-smtp gem.
@ -134,17 +133,17 @@ gem 'net-ldap', '~> 0.17.1' # rubocop:todo Gemfile/MissingFeatureCategory

 # API
 gem 'grape', '~> 2.0.0', feature_category: :api
-gem 'grape-entity', '~> 0.10.2', feature_category: :api
-gem 'grape-swagger', '~> 2.0.2', group: [:development, :test], feature_category: :api
+gem 'grape-entity', '~> 1.0.1', feature_category: :api
+gem 'grape-swagger', '~> 2.1.0', group: [:development, :test], feature_category: :api
 gem 'grape-swagger-entity', '~> 0.5.1', group: [:development, :test], feature_category: :api
 gem 'grape-path-helpers', '~> 2.0.1', feature_category: :api
 gem 'rack-cors', '~> 2.0.1', require: 'rack/cors' # rubocop:todo Gemfile/MissingFeatureCategory

 # GraphQL API
-gem 'graphql', '~> 2.2.5', feature_category: :api
+gem 'graphql', '~> 2.3.4', feature_category: :api
 gem 'graphql-docs', '~> 4.0.0', group: [:development, :test], feature_category: :api
 gem 'graphiql-rails', '~> 1.8.0', feature_category: :api
-gem 'apollo_upload_server', '~> 2.1.5', feature_category: :api
+gem 'apollo_upload_server', '~> 2.1.6', feature_category: :api
 gem 'graphlient', '~> 0.6.0', feature_category: :importers # Used by BulkImport feature (group::import)

 # Generate Fake data
@ -167,7 +166,7 @@ gem 'fog-aws', '~> 3.18' # rubocop:todo Gemfile/MissingFeatureCategory
 # Locked until fog-google resolves https://github.com/fog/fog-google/issues/421.
 # Also see config/initializers/fog_core_patch.rb.
 gem 'fog-core', '= 2.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'fog-google', '~> 1.19', require: 'fog/google' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'fog-google', '~> 1.24.1', require: 'fog/google' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'fog-local', '~> 0.8' # rubocop:todo Gemfile/MissingFeatureCategory
 # NOTE:
 # the fog-aliyun gem since v0.4 pulls in aliyun-sdk transitively, which monkey-patches
@ -207,9 +206,9 @@ gem 'seed-fu', '~> 2.3.7' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'elasticsearch-model', '~> 7.2' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'elasticsearch-api',   '7.13.3' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'aws-sdk-core', '~> 3.191.6' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'aws-sdk-core', '~> 3.197.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'aws-sdk-cloudformation', '~> 1' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'aws-sdk-s3', '~> 1.146.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'aws-sdk-s3', '~> 1.151.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'faraday_middleware-aws-sigv4', '~>0.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive connections # rubocop:todo Gemfile/MissingFeatureCategory

@ -230,7 +229,7 @@ gem 'asciidoctor-kroki', '~> 0.8.0', require: false # rubocop:todo Gemfile/Missi
 gem 'rouge', '~> 4.2.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'truncato', '~> 0.7.12' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'nokogiri', '~> 1.16' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'gitlab-glfm-markdown', '~> 0.0.14', feature_category: :team_planning
+gem 'gitlab-glfm-markdown', '~> 0.0.17', feature_category: :team_planning

 # Calendar rendering
 gem 'icalendar' # rubocop:todo Gemfile/MissingFeatureCategory
@ -256,9 +255,12 @@ gem 'state_machines-activerecord', '~> 0.8.0' # rubocop:todo Gemfile/MissingFeat
 gem 'acts-as-taggable-on', '~> 10.0' # rubocop:todo Gemfile/MissingFeatureCategory

 # Background jobs
-gem 'sidekiq', path: 'vendor/gems/sidekiq-7.1.6', require: 'sidekiq' # rubocop:todo Gemfile/MissingFeatureCategory
-gem 'sidekiq-cron', '~> 1.12.0', feature_category: :shared
-gem 'gitlab-sidekiq-fetcher', path: 'vendor/gems/sidekiq-reliable-fetch', require: 'sidekiq-reliable-fetch' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'sidekiq', path: 'vendor/gems/sidekiq-7.1.6', require: 'sidekiq', feature_category: :scalability
+gem 'sidekiq-cron', '~> 1.12.0', feature_category: :scalability
+gem 'gitlab-sidekiq-fetcher',
+  path: 'vendor/gems/sidekiq-reliable-fetch',
+  require: 'sidekiq-reliable-fetch',
+  feature_category: :scalability

 # Cron Parser
 gem 'fugit', '~> 1.8.1' # rubocop:todo Gemfile/MissingFeatureCategory
@ -277,7 +279,7 @@ gem 're2', '2.7.0' # rubocop:todo Gemfile/MissingFeatureCategory

 # Misc

-gem 'semver_dialects', '~> 2.0', '>= 2.0.2', feature_category: :static_application_security_testing
+gem 'semver_dialects', '~> 3.0', feature_category: :software_composition_analysis
 gem 'version_sorter', '~> 2.3' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'csv_builder', path: 'gems/csv_builder' # rubocop:todo Gemfile/MissingFeatureCategory

@ -288,13 +290,13 @@ gem 'js_regex', '~> 3.8' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'device_detector' # rubocop:todo Gemfile/MissingFeatureCategory

 # Redis
-gem 'redis-namespace', '~> 1.10.0', feature_category: :redis
-gem 'redis', '~> 5.0.0', feature_category: :redis
-gem 'redis-clustering', '~> 5.0.0', feature_category: :redis
+gem 'redis-namespace', '~> 1.11.0', feature_category: :redis
+gem 'redis', '~> 5.2.0', feature_category: :redis
+gem 'redis-clustering', '~> 5.2.0', feature_category: :redis
 gem 'connection_pool', '~> 2.4' # rubocop:todo Gemfile/MissingFeatureCategory

 # Redis session store
-gem 'redis-actionpack', '~> 5.4.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'redis-actionpack', '~> 5.4.0', feature_category: :redis

 # Discord integration
 gem 'discordrb-webhooks', '~> 3.5', require: false, feature_category: :integrations
@ -353,16 +355,15 @@ gem 'gon', '~> 6.4.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'request_store', '~> 1.5.1' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'base32', '~> 0.3.0' # rubocop:todo Gemfile/MissingFeatureCategory

-gem 'gitlab-license', '~> 2.4', feature_category: :shared
+gem 'gitlab-license', '~> 2.5', feature_category: :shared

 # Protect against bruteforcing
 gem 'rack-attack', '~> 6.7.0' # rubocop:todo Gemfile/MissingFeatureCategory

 # Sentry integration
-gem 'sentry-raven', '~> 3.1', feature_category: :error_tracking
-gem 'sentry-ruby', '~> 5.10.0', feature_category: :error_tracking
-gem 'sentry-rails', '~> 5.10.0', feature_category: :error_tracking
-gem 'sentry-sidekiq', '~> 5.10.0', feature_category: :error_tracking
+gem 'sentry-ruby', '~> 5.17.3', feature_category: :error_tracking
+gem 'sentry-rails', '~> 5.17.3', feature_category: :error_tracking
+gem 'sentry-sidekiq', '~> 5.17.3', feature_category: :error_tracking

 # PostgreSQL query parsing
 #
@ -372,19 +373,18 @@ gem 'gitlab-schema-validation', path: 'gems/gitlab-schema-validation' # rubocop:
 gem 'gitlab-http', path: 'gems/gitlab-http' # rubocop:todo Gemfile/MissingFeatureCategory

 gem 'premailer-rails', '~> 1.10.3' # rubocop:todo Gemfile/MissingFeatureCategory
-
-gem 'gitlab-labkit', '~> 0.35.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'gitlab-labkit', '~> 0.36.0', feature_category: :shared
 gem 'thrift', '>= 0.16.0' # rubocop:todo Gemfile/MissingFeatureCategory

 # I18n
-gem 'rails-i18n', '~> 7.0', feature_category: :internationalization
+gem 'rails-i18n', '~> 7.0', '>= 7.0.9', feature_category: :internationalization
 gem 'gettext_i18n_rails', '~> 1.12.0', feature_category: :internationalization
 gem 'gettext', '~> 3.4', '>= 3.4.9',
  require: false,
  group: [:development, :test],
  feature_category: :internationalization

-gem 'batch-loader', '~> 2.0.1' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'batch-loader', '~> 2.0.5' # rubocop:todo Gemfile/MissingFeatureCategory

 # Perf bar
 gem 'peek', '~> 1.1' # rubocop:todo Gemfile/MissingFeatureCategory
@ -399,6 +399,36 @@ gem 'snowplow-tracker', '~> 0.8.0' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'webrick', '~> 1.8.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'prometheus-client-mmap', '~> 1.1', '>= 1.1.1', require: 'prometheus/client' # rubocop:todo Gemfile/MissingFeatureCategory

+# OpenTelemetry
+group :opentelemetry do
+  # Core OpenTelemetry gems
+  gem 'opentelemetry-sdk', feature_category: :tooling
+  gem 'opentelemetry-exporter-otlp', feature_category: :tooling
+
+  # OpenTelemetry gems selected from full set in `opentelemetry-instrumentation-all` metagem
+  gem 'opentelemetry-instrumentation-active_support', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-action_pack', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-active_job', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-active_record', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-action_view', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-aws_sdk', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-http', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-concurrent_ruby', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-ethon', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-excon', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-faraday', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-grape', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-graphql', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-http_client', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-net_http', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-pg', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-rack', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-rails', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-rake', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-redis', feature_category: :tooling
+  gem 'opentelemetry-instrumentation-sidekiq', feature_category: :tooling
+end
+
 gem 'warning', '~> 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory

 group :development do
@ -407,7 +437,7 @@ group :development do
  gem 'solargraph', '~> 0.47.2', require: false # rubocop:todo Gemfile/MissingFeatureCategory

  gem 'letter_opener_web', '~> 2.0.0' # rubocop:todo Gemfile/MissingFeatureCategory
-  gem 'lookbook', '~> 2.2', '>= 2.2.2' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'lookbook', '~> 2.3' # rubocop:todo Gemfile/MissingFeatureCategory

  # Better errors handler
  gem 'better_errors', '~> 2.10.1' # rubocop:todo Gemfile/MissingFeatureCategory
@ -416,19 +446,20 @@ group :development do

  gem 'listen', '~> 3.7' # rubocop:todo Gemfile/MissingFeatureCategory

-  gem 'ruby-lsp', "~> 0.14.6", require: false, feature_category: :tooling
+  gem 'ruby-lsp', "~> 0.16.7", require: false, feature_category: :tooling

-  gem 'ruby-lsp-rails', "~> 0.3.3", feature_category: :tooling
+  gem 'ruby-lsp-rails', "~> 0.3.6", feature_category: :tooling

  gem 'ruby-lsp-rspec', "~> 0.1.10", require: false, feature_category: :tooling

-  gem 'gdk-toogle', '~> 0.9', require: 'toogle', feature_category: :tooling
+  gem 'gdk-toogle', '~> 0.9', '>= 0.9.5', require: 'toogle', feature_category: :tooling
 end

 group :development, :test do
  gem 'deprecation_toolkit', '~> 1.5.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory
  gem 'bullet', '~> 7.1.2' # rubocop:todo Gemfile/MissingFeatureCategory
-  gem 'parser', '~> 3.3', '>= 3.3.0.5' # rubocop:todo Gemfile/MissingFeatureCategory
+  # Locked on 3.3.0.5 until inspec-core is updated in Omnibus: https://github.com/inspec/inspec/pull/7030
+  gem 'parser', '= 3.3.0.5', feature_category: :shared
  gem 'pry-byebug' # rubocop:todo Gemfile/MissingFeatureCategory
  gem 'pry-rails', '~> 0.3.9' # rubocop:todo Gemfile/MissingFeatureCategory
  gem 'pry-shell', '~> 0.6.4' # rubocop:todo Gemfile/MissingFeatureCategory
@ -436,8 +467,8 @@ group :development, :test do
  gem 'awesome_print', require: false # rubocop:todo Gemfile/MissingFeatureCategory

  gem 'database_cleaner-active_record', '~> 2.1.0', feature_category: :database
-  gem 'factory_bot_rails', '~> 6.4.3' # rubocop:todo Gemfile/MissingFeatureCategory
  gem 'rspec-rails', '~> 6.1.1', feature_category: :shared
+  gem 'factory_bot_rails', '~> 6.4.3', feature_category: :tooling

  # Prevent occasions where minitest is not bundled in packaged versions of ruby (see #3826)
  gem 'minitest', '~> 5.11.0' # rubocop:todo Gemfile/MissingFeatureCategory
@ -445,8 +476,8 @@ group :development, :test do
  gem 'spring', '~> 4.1.0' # rubocop:todo Gemfile/MissingFeatureCategory
  gem 'spring-commands-rspec', '~> 1.0.4' # rubocop:todo Gemfile/MissingFeatureCategory

-  gem 'gitlab-styles', '~> 11.0.0', feature_category: :tooling
-  gem 'haml_lint', '~> 0.53', feature_category: :tooling
+  gem 'gitlab-styles', '~> 12.0.1', feature_category: :tooling
+  gem 'haml_lint', '~> 0.58', feature_category: :tooling

  gem 'bundler-audit', '~> 0.9.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory

@ -455,7 +486,7 @@ group :development, :test do
  gem 'benchmark-memory', '~> 0.1', require: false # rubocop:todo Gemfile/MissingFeatureCategory

  # Profiling data from CI/CD pipelines
-  gem 'influxdb-client', '~> 2.9', require: false # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'influxdb-client', '~> 3.1', require: false, feature_category: :tooling

  gem 'knapsack', '~> 1.22.0', feature_category: :tooling
  gem 'crystalball', '~> 0.7.0', require: false, feature_category: :tooling
@ -506,12 +537,12 @@ group :test do
  gem 'rspec-retry', '~> 0.6.2', feature_category: :tooling
  gem 'rspec_profiling', '~> 0.0.9', feature_category: :tooling
  gem 'rspec-benchmark', '~> 0.6.0', feature_category: :tooling
-  gem 'rspec-parameterized', '~> 1.0', require: false, feature_category: :tooling
+  gem 'rspec-parameterized', '~> 1.0', '>= 1.0.2', require: false, feature_category: :tooling
  gem 'os', '~> 1.1', '>= 1.1.4', feature_category: :tooling

  gem 'capybara', '~> 3.40' # rubocop:todo Gemfile/MissingFeatureCategory
  gem 'capybara-screenshot', '~> 1.0.26' # rubocop:todo Gemfile/MissingFeatureCategory
-  gem 'selenium-webdriver', '~> 4.19' # rubocop:todo Gemfile/MissingFeatureCategory
+  gem 'selenium-webdriver', '~> 4.21', '>= 4.21.1' # rubocop:todo Gemfile/MissingFeatureCategory

  gem 'graphlyte', '~> 1.0.0' # rubocop:todo Gemfile/MissingFeatureCategory

@ -520,7 +551,7 @@ group :test do
  gem 'webmock', '~> 3.23.0', feature_category: :shared
  gem 'rails-controller-testing' # rubocop:todo Gemfile/MissingFeatureCategory
  gem 'concurrent-ruby', '~> 1.1' # rubocop:todo Gemfile/MissingFeatureCategory
-  gem 'test-prof', '~> 1.3.2', feature_category: :tooling
+  gem 'test-prof', '~> 1.3.3', feature_category: :tooling
  gem 'rspec_junit_formatter' # rubocop:todo Gemfile/MissingFeatureCategory
  gem 'guard-rspec' # rubocop:todo Gemfile/MissingFeatureCategory
  gem 'axe-core-rspec', '~> 4.9.0', feature_category: :tooling
@ -528,7 +559,7 @@ group :test do
  # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
  gem 'derailed_benchmarks', require: false # rubocop:todo Gemfile/MissingFeatureCategory

-  gem 'gitlab_quality-test_tooling', '~> 1.21.1', require: false, feature_category: :tooling
+  gem 'gitlab_quality-test_tooling', '~> 1.28.0', require: false, feature_category: :tooling
 end

 gem 'octokit', '~> 8.1', feature_category: :importers
@ -563,12 +594,12 @@ gem 'ssh_data', '~> 1.3' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'spamcheck', '~> 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory

 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 16.11.0.pre.rc1', feature_category: :gitaly
+gem 'gitaly', '~> 17.0.1', feature_category: :gitaly

 # KAS GRPC protocol definitions
-gem 'kas-grpc', '~> 0.4.0', feature_category: :deployment_management
+gem 'kas-grpc', '~> 0.5.0', feature_category: :deployment_management

-gem 'grpc', '~> 1.60.0' # rubocop:todo Gemfile/MissingFeatureCategory
+gem 'grpc', '~> 1.63', feature_category: :shared

 gem 'google-protobuf', '~> 3.25', '>= 3.25.3' # rubocop:todo Gemfile/MissingFeatureCategory

@ -657,9 +688,10 @@ gem 'telesignenterprise', '~> 2.2' # rubocop:todo Gemfile/MissingFeatureCategory
 # BufferedIO patch
 # Updating this version will require updating scripts/allowed_warnings.txt
 gem 'net-protocol', '~> 0.1.3' # rubocop:todo Gemfile/MissingFeatureCategory
-# Lock this until we make DNS rebinding work with the updated net-http:
-# https://gitlab.com/gitlab-org/gitlab/-/issues/413528
-gem 'net-http', '= 0.1.1' # rubocop:todo Gemfile/MissingFeatureCategory
+
+# This is locked to 0.4.1 because we patch Net::HTTP#connect in
+# gems/gitlab-http/lib/net_http/connect_patch.rb.
+gem 'net-http', '= 0.4.1', feature_category: :shared

 gem 'duo_api', '~> 1.3' # rubocop:todo Gemfile/MissingFeatureCategory

--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
--- a/pkgs/applications/video/obs-studio/plugins/obs-vertical-canvas.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-vertical-canvas.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-vertical-canvas";
-  version = "1.4.4";
+  version = "1.4.5";

  src = fetchFromGitHub {
    owner = "Aitum";
    repo = "obs-vertical-canvas";
    rev = version;
-    sha256 = "sha256-RBsdYG73SoX+dB4sUq641SL0ETUFE+PVAmr/DaqMuLI=";
+    sha256 = "sha256-4BmTp/PrR01H9IrKNX9ZpK4kLaiNG/G9rTMf9dsoV0s=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/_4/_4d-minesweeper/package.nix
+++ b/pkgs/by-name/_4/_4d-minesweeper/package.nix
@ -83,7 +83,7 @@ stdenv.mkDerivation {
    description = "4D Minesweeper game written in Godot";
    license = licenses.mpl20;
    platforms   = platforms.linux;
-    maintainers = with maintainers; [ nayala ];
+    maintainers = with maintainers; [];
    mainProgram = "4d-minesweeper";
  };
 }
--- a/pkgs/by-name/ba/bat/package.nix
+++ b/pkgs/by-name/ba/bat/package.nix
@ -75,6 +75,6 @@ rustPlatform.buildRustPackage rec {
    changelog = "https://github.com/sharkdp/bat/raw/v${version}/CHANGELOG.md";
    license = with licenses; [ asl20 /* or */ mit ];
    mainProgram = "bat";
-    maintainers = with maintainers; [ dywedir lilyball zowoq SuperSandro2000 ];
+    maintainers = with maintainers; [ dywedir zowoq SuperSandro2000 ];
  };
 }
--- a/pkgs/by-name/dt/dtools/package.nix
+++ b/pkgs/by-name/dt/dtools/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dtools";
-  version = "2.109.0";
+  version = "2.109.1";

  src = fetchFromGitHub {
    owner = "dlang";
    repo = "tools";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-C4hSs4zsFC8hWkhmDmNzVfK7Ctfnd1IQUphibUPiVzE=";
+    hash = "sha256-Pfj8Kwf5AlcrHhLs5A/0vIFWLZaNR3ro+esbs7oWN9I=";
    name = "dtools";
  };

--- a/pkgs/by-name/fg/fgqcanvas/package.nix
+++ b/pkgs/by-name/fg/fgqcanvas/package.nix
@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
    description = "Qt-based remote canvas application for FlightGear";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ nayala ];
+    maintainers = with maintainers; [];
    mainProgram = "fgqcanvas";
  };
 }
--- a/pkgs/by-name/gi/git-instafix/package.nix
+++ b/pkgs/by-name/gi/git-instafix/package.nix
@ -13,7 +13,7 @@ let
    maintainers
    ;

-  version = "0.2.5";
+  version = "0.2.7";
 in
 rustPlatform.buildRustPackage {
  pname = "git-instafix";
@ -23,10 +23,10 @@ rustPlatform.buildRustPackage {
    owner = "quodlibetor";
    repo = "git-instafix";
    rev = "v${version}";
-    hash = "sha256-tizA5BLZZ/9gfHv2X8is7EJD1reMvfA7c6JETUoUgvI=";
+    hash = "sha256-Uz+KQ8cQT3v97EtmbAv2II30dUrFD0hMo/GhnqcdBOs=";
  };

-  cargoHash = "sha256-kIIwswj8mfpY382O0bdMoSk6+T+614l2QCeRgz3ZxEY=";
+  cargoHash = "sha256-12UkZyyu4KH3dcCadr8UhK8DTtVjcsjYzt7kiNLpUqU=";

  buildInputs = [ libgit2 ];
  nativeCheckInputs = [ git ];
--- a/pkgs/by-name/hi/hidviz/package.nix
+++ b/pkgs/by-name/hi/hidviz/package.nix
@ -43,6 +43,6 @@ stdenv.mkDerivation rec {
    description = "GUI application for in-depth analysis of USB HID class devices";
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ nayala ];
+    maintainers = with maintainers; [];
  };
 }
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@ -10,13 +10,13 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.128.0";
+  version = "0.128.1";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = "hugo";
    rev = "refs/tags/v${version}";
-    hash = "sha256-dyiCEWOiUtRppKgpqI68kC7Hv1AMK76kvCEaS8nIIJM=";
+    hash = "sha256-vSszDPyRvaWpf7m27R4rbS1R7z4vk3hHzn3I0siijTE=";
  };

  vendorHash = "sha256-iNI/5uAYMG+bfndpD17dp1v3rGbFdHnG9oQv/grb/XY=";
--- a/pkgs/applications/misc/keymapp/default.nix
+++ b/pkgs/applications/misc/keymapp/default.nix
@ -1,44 +1,48 @@
-{ stdenv
-, lib
-, fetchurl
-, autoPatchelfHook
-, wrapGAppsHook3
-, libusb1
-, webkitgtk
-, gtk3
-, writeShellScript
-, makeDesktopItem
-, copyDesktopItems
+{
+  stdenv,
+  lib,
+  fetchurl,
+  autoPatchelfHook,
+  wrapGAppsHook4,
+  libusb1,
+  libsoup_3,
+  webkitgtk_4_1,
+  writeShellScript,
+  makeDesktopItem,
+  copyDesktopItems,
 }:
 let
  desktopItem = makeDesktopItem {
    name = "keymapp";
    icon = "keymapp";
    desktopName = "Keymapp";
-    categories = [ "Settings" "HardwareSettings" ];
+    categories = [
+      "Settings"
+      "HardwareSettings"
+    ];
    type = "Application";
    exec = "keymapp";
  };
 in
 stdenv.mkDerivation rec {
  pname = "keymapp";
-  version = "1.1.1";
+  version = "1.2.1";

  src = fetchurl {
    url = "https://oryx.nyc3.cdn.digitaloceanspaces.com/keymapp/keymapp-${version}.tar.gz";
-    hash = "sha256-tbRlJ65hHPBDwoXAXf++OdcW67RcqR1x1vfhbPCo1Ls=";
+    hash = "sha256-WiazQD40dG72B9tl4DwcMJgoVEl/Dgq55AHgeqK+sq8=";
  };

  nativeBuildInputs = [
    copyDesktopItems
    autoPatchelfHook
-    wrapGAppsHook3
+    wrapGAppsHook4
  ];

  buildInputs = [
    libusb1
-    webkitgtk
-    gtk3
+    webkitgtk_4_1
+    libsoup_3
  ];

  sourceRoot = ".";
@ -61,7 +65,10 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "https://www.zsa.io/flash/";
    description = "Application for ZSA keyboards";
-    maintainers = with lib.maintainers; [ jankaifer shawn8901 ];
+    maintainers = with lib.maintainers; [
+      jankaifer
+      shawn8901
+    ];
    platforms = platforms.linux;
    license = lib.licenses.unfree;
  };
--- a/pkgs/by-name/li/libetebase/package.nix
+++ b/pkgs/by-name/li/libetebase/package.nix
@ -0,0 +1,45 @@
+{ rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+, lib
+, stdenv
+, testers
+, libetebase
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "libetebase";
+  version = "0.5.6";
+
+  src = fetchFromGitHub {
+    owner = "etesync";
+    repo = "libetebase";
+    rev = "v${version}";
+    hash = "sha256-cXuOKfyMdk+YzDi0G8i44dyBRf4Ez5+AlCKG43BTSSU=";
+  };
+
+  cargoHash = "sha256-GUNj5GrY04CXnej3WDKZmW4EeJhoCl2blHSDfEkQKtE=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ];
+
+  postInstall = ''
+    install -d $out/lib/pkgconfig
+    sed s#@prefix@#$out#g etebase.pc.in > $out/lib/pkgconfig/etebase.pc
+    install -Dm644 EtebaseConfig.cmake -t $out/lib/cmake/Etebase
+    install -Dm644 target/etebase.h -t $out/include/etebase
+    ln -s $out/lib/libetebase.so $out/lib/libetebase.so.0
+  '';
+
+  passthru.tests.pkgs-config = testers.testMetaPkgConfig libetebase;
+
+  meta = with lib; {
+    description = "A C library for Etebase";
+    homepage = "https://www.etebase.com/";
+    license = licenses.bsd3;
+    broken = stdenv.isDarwin;
+    maintainers = with maintainers; [ laalsaas ];
+    pkgConfigModules = [ "etebase" ];
+  };
+}
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@ -12,7 +12,7 @@
 }:

 let
-  version = "7.8.0";
+  version = "7.9.1";
 in
 # The output of the derivation is a tool to create bootable images using Limine
 # as bootloader for various platforms and corresponding binary and helper files.
@ -24,7 +24,7 @@ stdenv.mkDerivation {
  # Packaging that in Nix is very cumbersome.
  src = fetchurl {
    url = "https://github.com/limine-bootloader/limine/releases/download/v${version}/limine-${version}.tar.gz";
-    sha256 = "sha256-Fue2KPyJ76Q1f+chvhwmJlmQ4QwXksyCeztd2d2cTH0=";
+    sha256 = "sha256-cR6ilV5giwvbqUoOGbnXQnqZzUz/oL7OGZPYNoFKvy0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/mi/minijinja/package.nix
+++ b/pkgs/by-name/mi/minijinja/package.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "minijinja";
-  version = "2.0.2";
+  version = "2.0.3";

  src = fetchFromGitHub {
    owner = "mitsuhiko";
    repo = "minijinja";
    rev = version;
-    hash = "sha256-aqoUsVj9XYlbi8wh2Rqxy+M9+RU9NLp97qlpTKUlJEI=";
+    hash = "sha256-3Frgeudh1Z4gpQJqyLxBZKi7gr4GIGLv7gW4Qf3LdVs=";
  };

-  cargoHash = "sha256-G9nIlri7VwojNRsCwZxseZxcSxLqAKtnm+AV7TLqJm4=";
+  cargoHash = "sha256-7ohhnuy8baELLDvf0FfdJmSf62wtmnEfI2rl9yZp03w=";

  # The tests relies on the presence of network connection
  doCheck = false;
--- a/pkgs/by-name/on/onlyoffice-bin_latest/package.nix
+++ b/pkgs/by-name/on/onlyoffice-bin_latest/package.nix
@ -65,11 +65,11 @@ let

  derivation = stdenv.mkDerivation rec {
    pname = "onlyoffice-desktopeditors";
-    version = "8.0.0";
+    version = "8.1.0";
    minor = null;
    src = fetchurl {
      url = "https://github.com/ONLYOFFICE/DesktopEditors/releases/download/v${version}/onlyoffice-desktopeditors_amd64.deb";
-      sha256 = "sha256-YtR2fiARMKw8dOgAPXYM+WFwmhKZRsIIBQYTxppu3F0=";
+      sha256 = "sha256-hS1+gLN17sP3EFud3fQXRWeFiQbrumBONLjqXEl89Js=";
    };

    nativeBuildInputs = [
--- a/pkgs/by-name/op/openpgp-card-tools/package.nix
+++ b/pkgs/by-name/op/openpgp-card-tools/package.nix
@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "openpgp-card-tools";
-  version = "0.11.2";
+  version = "0.11.3";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "openpgp-card";
    repo = "openpgp-card-tools";
    rev = "v${version}";
-    hash = "sha256-4PRUBzVy1sb15sYsbitBrOfQnsdbGKoR2OA4EjSc8B8=";
+    hash = "sha256-htFhNzBuinj9qiTzcW0eia74jvCT/+9b1aLli594JJQ=";
  };

-  cargoHash = "sha256-Jm1181WQfYZPKnu0f2om/hxkJ8Bm5AA/3IwBgZkpF0I=";
+  cargoHash = "sha256-I2ExtUUM0ZJyhtyzP+IsgiMPMUFVHqPiMHFlvuUMjRc=";

  nativeBuildInputs = [ pkg-config rustPlatform.bindgenHook ];

--- a/pkgs/by-name/qu/quarkus/package.nix
+++ b/pkgs/by-name/qu/quarkus/package.nix
@ -7,11 +7,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "quarkus-cli";
-  version = "3.11.3";
+  version = "3.12.0";

  src = fetchurl {
    url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-cZZoGU7v3SKe3dvYUR5T8jKwAkLnDJt+SWYzgMmdJwA=";
+    hash = "sha256-bausbHHKyX6ITYz1a0xb2AxPeyJlyp/ddzCRs1nYuOc=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/ri/ricochet-refresh/package.nix
+++ b/pkgs/by-name/ri/ricochet-refresh/package.nix
@ -10,14 +10,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ricochet-refresh";
-  version = "3.0.24";
+  version = "3.0.25";

  src = fetchFromGitHub {
    owner = "blueprint-freespeech";
    repo = "ricochet-refresh";
    rev = "v${finalAttrs.version}-release";
    fetchSubmodules = true;
-    hash = "sha256-xz1cyNQgmXUIZc56OHwWZCGVNpp7CFFyCd0EvAas4zw=";
+    hash = "sha256-MXbsNrF3y2DimXUuf6XbqqCxcNsTGfNHSAMstdX1MoU=";
  };

  sourceRoot = "${finalAttrs.src.name}/src";
--- a/pkgs/by-name/ri/ride/package.nix
+++ b/pkgs/by-name/ri/ride/package.nix
@ -12,6 +12,7 @@
  copyDesktopItems,
  makeDesktopItem,
  electron,
+  darwin,
 }:

 let
@ -31,6 +32,8 @@ let
  };

  platformInfo = platformInfos.${stdenv.system};
+
+  electronDist = electron + (if stdenv.isDarwin then "/Applications" else "/libexec/electron");
 in
 buildNpmPackage rec {
  pname = "ride";
@ -83,22 +86,33 @@ buildNpmPackage rec {
    popd
  '';

-  nativeBuildInputs = [
-    zip
-    makeWrapper
-    copyDesktopItems
-  ];
+  nativeBuildInputs =
+    [
+      zip
+      makeWrapper
+    ]
+    ++ lib.optionals (!stdenv.isDarwin) [ copyDesktopItems ]
+    ++ lib.optionals stdenv.isDarwin [ darwin.cctools ];

  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

+  # Fix error: no member named 'aligned_alloc' in the global namespace
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (
+    stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinSdkVersion "11.0"
+  ) "-D_LIBCPP_HAS_NO_LIBRARY_ALIGNED_ALLOCATION=1";
+
  npmBuildFlags = platformInfo.buildCmd;

  # This package uses electron-packager instead of electron-builder
  # Here, we create a local cache of electron zip-files, so electron-packager can copy from it
  postConfigure = ''
    mkdir local-cache
-    cp -r --no-preserve=all ${electron}/libexec/electron electron
-    pushd electron
+
+    # electron files need to be writable on Darwin
+    cp -r ${electronDist} electron-dist
+    chmod -R u+w electron-dist
+
+    pushd electron-dist
    zip -qr ../local-cache/electron-v${electron.version}-${platformInfo.zipSuffix}.zip *
    popd
  '';
@ -106,19 +120,27 @@ buildNpmPackage rec {
  installPhase = ''
    runHook preInstall

-    install -Dm644 D.png $out/share/icons/hicolor/64x64/apps/ride.png
-    install -Dm644 D.svg $out/share/icons/hicolor/scalable/apps/ride.svg
-
    pushd _/ride*/*

    install -Dm644 ThirdPartyNotices.txt -t $out/share/doc/ride

-    mkdir -p $out/share/ride
-    cp -r locales resources{,.pak} $out/share/ride
-    makeWrapper ${lib.getExe electron} $out/bin/ride \
-      --add-flags $out/share/ride/resources/app.asar \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
-      --inherit-argv0
+    ${lib.optionalString (!stdenv.isDarwin) ''
+      install -Dm644 $src/D.png $out/share/icons/hicolor/64x64/apps/ride.png
+      install -Dm644 $src/D.svg $out/share/icons/hicolor/scalable/apps/ride.svg
+
+      mkdir -p $out/share/ride
+      cp -r locales resources{,.pak} $out/share/ride
+      makeWrapper ${lib.getExe electron} $out/bin/ride \
+          --add-flags $out/share/ride/resources/app.asar \
+          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+          --inherit-argv0
+    ''}
+
+    ${lib.optionalString stdenv.isDarwin ''
+      mkdir -p $out/Applications
+      cp -r Ride-*.app $out/Applications
+      makeWrapper $out/Applications/Ride-*.app/Contents/MacOS/Ride-* $out/bin/ride
+    ''}

    popd

@ -141,7 +163,6 @@ buildNpmPackage rec {
  ];

  meta = {
-    broken = stdenv.isDarwin;
    changelog = "https://github.com/Dyalog/ride/releases/tag/${src.rev}";
    description = "Remote IDE for Dyalog APL";
    homepage = "https://github.com/Dyalog/ride";
--- a/pkgs/by-name/tr/trickest-cli/package.nix
+++ b/pkgs/by-name/tr/trickest-cli/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "trickest-cli";
-  version = "1.7.5";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "trickest";
    repo = "trickest-cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-erPcb+cHCAmhPGwfu+g0yyAFx252+tpIOFQiUBuPUcs=";
+    hash = "sha256-wzBUPotuv1natDB896Uu+O9Nj4ycT8jkcvIumjMdbqs=";
  };

  vendorHash = "sha256-gk8YMMvTHBL7yoXU9n0jhtUS472fqLW5m+mSl4Lio6c=";
--- a/pkgs/by-name/wb/wb32-dfu-updater/package.nix
+++ b/pkgs/by-name/wb/wb32-dfu-updater/package.nix
@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
    '';
    homepage = "https://github.com/WestberryTech/wb32-dfu-updater";
    license = licenses.asl20;
-    maintainers = [ maintainers.liketechnik ];
+    maintainers = [ ];
    mainProgram = "wb32-dfu-updater_cli";
    platforms = platforms.all;
  };
--- a/pkgs/data/themes/sddm-sugar-dark/default.nix
+++ b/pkgs/data/themes/sddm-sugar-dark/default.nix
@ -0,0 +1,40 @@
+{ pkgs, lib, stdenvNoCC, themeConfig ? null }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "sddm-sugar-dark";
+  version = "1.2";
+
+  src = pkgs.fetchFromGitHub {
+    owner = "MarianArlt";
+    repo = "sddm-sugar-dark";
+    rev = "v${version}";
+    hash = "sha256-C3qB9hFUeuT5+Dos2zFj5SyQegnghpoFV9wHvE9VoD8=";
+  };
+
+  dontWrapQtApps = true;
+
+  buildInputs = with pkgs.libsForQt5.qt5; [ qtgraphicaleffects ];
+
+  installPhase =
+    let
+      iniFormat = pkgs.formats.ini { };
+      configFile = iniFormat.generate "" { General = themeConfig; };
+
+      basePath = "$out/share/sddm/themes/sugar-dark";
+    in
+    ''
+      mkdir -p ${basePath}
+      cp -r $src/* ${basePath}
+    '' + lib.optionalString (themeConfig != null) ''
+      ln -sf ${configFile} ${basePath}/theme.conf.user
+    '';
+
+  meta = {
+    description = "Dark SDDM theme from the sugar family";
+    homepage = "https://github.com/${src.owner}/${pname}";
+    license = lib.licenses.gpl3;
+
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ danid3v ];
+  };
+}
--- a/pkgs/development/compilers/erg/default.nix
+++ b/pkgs/development/compilers/erg/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "erg";
-  version = "0.6.38";
+  version = "0.6.39";

  src = fetchFromGitHub {
    owner = "erg-lang";
    repo = "erg";
    rev = "v${version}";
-    hash = "sha256-byoOvJ4SsRxFSbF4SwdDPlXNdMhypOgktnj4CkmAZuU=";
+    hash = "sha256-eVf1pQJ0mIZURRDK2k6boZUs+m6hu6lbWqKYWSNC5ng=";
  };

-  cargoHash = "sha256-QNykB9tXXlEyJupO5hkSN2ZqBZDwi0kl6IPHxkkaUxo=";
+  cargoHash = "sha256-H7JorE6Psg/rndYpNMiyxOfsifBEi4l4bk4CvhDRFjE=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/development/compilers/go/1.22.nix
+++ b/pkgs/development/compilers/go/1.22.nix
@ -47,11 +47,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "go";
-  version = "1.22.4";
+  version = "1.22.5";

  src = fetchurl {
    url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-/tcgZ45yinyjC6jR3tHKr+J9FgKPqwIyuLqOIgCPt4Q=";
+    hash = "sha256-rJxyPyJJaa7mJLw0/TTJ4T8qIS11xxyAfeZEu0bhEvY=";
  };

  strictDeps = true;
--- a/pkgs/development/embedded/svdtools/default.nix
+++ b/pkgs/development/embedded/svdtools/default.nix
@ -5,14 +5,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "svdtools";
-  version = "0.3.14";
+  version = "0.3.15";

  src = fetchCrate {
    inherit version pname;
-    hash = "sha256-sTogOCpcfJHy+e3T4pEvclCddCUX+RHCQ238oz5bAEo=";
+    hash = "sha256-P4XwIJnXnIQcp/l8GR7Mx8ybn1GdtiXVpQcky1JYVuU=";
  };

-  cargoHash = "sha256-lRSt46yxFWSlhU6Pns3PCLJ4c6Fvi4EbOIqVx9IoPCc=";
+  cargoHash = "sha256-dBqbZWVTrIj2ji7JmLnlglvt4GkKef48kcl/V54thaQ=";

  meta = with lib; {
    description = "Tools to handle vendor-supplied, often buggy SVD files";
--- a/pkgs/development/julia-modules/depot.nix
+++ b/pkgs/development/julia-modules/depot.nix
@ -56,6 +56,7 @@ runCommand "julia-depot" {
  # See https://github.com/NixOS/nixpkgs/issues/315890
  git config --global --add safe.directory '*'

+  # Tell Julia to use the Git binary we provide, rather than internal libgit2.
  export JULIA_PKG_USE_CLI_GIT="true"

  # At time of writing, this appears to be the only way to turn precompiling's
--- a/pkgs/development/julia-modules/python/minimal_registry.py
+++ b/pkgs/development/julia-modules/python/minimal_registry.py
@ -75,7 +75,7 @@ for (uuid, versions) in uuid_to_versions.items():
    os.makedirs(out_path / path)

    # Copy some files to the minimal repo unchanged
-    for f in ["Compat.toml", "Deps.toml"]:
+    for f in ["Compat.toml", "Deps.toml", "WeakCompat.toml", "WeakDeps.toml"]:
      if (registry_path / path / f).exists():
        shutil.copy2(registry_path / path / f, out_path / path)

--- a/pkgs/development/julia-modules/registry.nix
+++ b/pkgs/development/julia-modules/registry.nix
@ -3,7 +3,7 @@
 fetchFromGitHub {
  owner = "CodeDownIO";
  repo = "General";
-  rev = "de80ad56e87f222ca6a7a517c69039d35437ab42";
-  sha256 = "0pz1jmmcb2vn854w8w0zlpnihi470649cd8djh1wzgq2i2fy83bl";
-  # date = "2023-12-22T03:28:12+00:00";
+  rev = "998c6da1553dc0776dfff314d2f1bd5af488ed71";
+  sha256 = "sha256-57RiIPTu9895mdk3oSfo7I3PYw7G0BfJG1u+mYkJeLk=";
+  # date = "2024-07-01T12:22:35+00:00";
 }
--- a/pkgs/development/libraries/intel-gmmlib/default.nix
+++ b/pkgs/development/libraries/intel-gmmlib/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "intel-gmmlib";
-  version = "22.3.20";
+  version = "22.4.0";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "gmmlib";
    rev = "intel-gmmlib-${version}";
-    sha256 = "sha256-AqHzWm0ZWCJK0gMXxxBSHemKx3U1fOXCUGo/ORny2hI=";
+    sha256 = "sha256-8Tjc7rm38pgRE/8ZXRLOqazZHmj5jQJFooSe31Chpww=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/java/swt/default.nix
+++ b/pkgs/development/libraries/java/swt/default.nix
@ -11,7 +11,6 @@
 , libGLU
 , libXt
 , libXtst
-, gnome2
 }:

 let
@ -68,9 +67,6 @@ in stdenv.mkDerivation rec {
    libGL
    libGLU
    libXtst
-    gnome2.gnome_vfs
-    gnome2.libgnome
-    gnome2.libgnomeui
  ] ++ lib.optionals (lib.hasPrefix "8u" jdk.version) [
    libXt
  ];
--- a/pkgs/development/libraries/libdatachannel/default.nix
+++ b/pkgs/development/libraries/libdatachannel/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "libdatachannel";
-  version = "0.21.1";
+  version = "0.21.2";

  src = fetchFromGitHub {
    owner = "paullouisageneau";
    repo = "libdatachannel";
    rev = "v${version}";
-    hash = "sha256-sTdA4kCIdY3l/YUNKbXzRDS1O0AFx90k94W3cJpfLIY=";
+    hash = "sha256-3fax57oaJvOgbTDPCiiUdtsfAGhICfPkuMihawq06SA=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/nco/default.nix
+++ b/pkgs/development/libraries/nco/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "nco";
-  version = "5.2.5";
+  version = "5.2.6";

  src = fetchFromGitHub {
    owner = "nco";
    repo = "nco";
    rev = finalAttrs.version;
-    hash = "sha256-QGHmet7Tbuyue48hjtqdl6F2PzQLuWAVwW4xvPEI3NU=";
+    hash = "sha256-v4kK1+tn/pgY2vz5BYzCBKfvLe5hti0ofUChUvQ++JU=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/quarto/default.nix
+++ b/pkgs/development/libraries/quarto/default.nix
@ -19,10 +19,10 @@

 stdenv.mkDerivation (final: {
  pname = "quarto";
-  version = "1.4.557";
+  version = "1.5.53";
  src = fetchurl {
    url = "https://github.com/quarto-dev/quarto-cli/releases/download/v${final.version}/quarto-${final.version}-linux-amd64.tar.gz";
-    sha256 = "sha256-RcEkmPMcfNGDmu2bQwUHvlHgM/ySQQwDgf/NpTQMxcI=";
+    sha256 = "sha256-6/gq1yD4almO+CUY5xVnhWCjmu3teiJEGE7ONE1Zk8A=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/gflanguages/default.nix
+++ b/pkgs/development/python-modules/gflanguages/default.nix
@ -13,13 +13,13 @@

 buildPythonPackage rec {
  pname = "gflanguages";
-  version = "0.6.1";
+  version = "0.6.2";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-mlRNzrAgeEt1/VbQEXWIxCD9NkULMOnkFsALO5H+1SY=";
+    hash = "sha256-v93mXDwHT/8Tau78ApLUR+dQCpL9jmRQp0BT5y/sfq4=";
  };

  pyproject = true;
--- a/pkgs/development/python-modules/types-aiobotocore/default.nix
+++ b/pkgs/development/python-modules/types-aiobotocore/default.nix
@ -364,13 +364,13 @@

 buildPythonPackage rec {
  pname = "types-aiobotocore";
-  version = "2.13.0";
+  version = "2.13.1";
  pyproject = true;

  src = fetchPypi {
    pname = "types_aiobotocore";
    inherit version;
-    hash = "sha256-CDDY60I1eMMIChOCvbSQi7ZsKSo0mlOccNlvjypq3+U=";
+    hash = "sha256-iJCVMd8HK22CsAbOg3c4hlnatiyMNFw97V8XtjWJwPQ=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/unearth/default.nix
+++ b/pkgs/development/python-modules/unearth/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "unearth";
-  version = "0.15.5";
+  version = "0.16.0";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-mLAX9B+9nPSBHJTDgBOLU1l58LkAkdywfdN58eSqP+I=";
+    hash = "sha256-fbqR8SCat+n4pn8HoVveSa4tobikb9rYsCIroYuRAhI=";
  };

  build-system = [ pdm-backend ];
--- a/pkgs/development/tools/analysis/snyk/default.nix
+++ b/pkgs/development/tools/analysis/snyk/default.nix
@ -8,16 +8,16 @@

 buildNpmPackage rec {
  pname = "snyk";
-  version = "1.1291.0";
+  version = "1.1292.1";

  src = fetchFromGitHub {
    owner = "snyk";
    repo = "cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-m70XujX2KOTvObjeBtoAbrYddi/+pLDLPXf/o+/DtmU=";
+    hash = "sha256-N54fSRYTFOlmfpommEFIqbMP5IBkhatMwx4CQ8fd5QI=";
  };

-  npmDepsHash = "sha256-f7sY7eCF8k28UnGyKqOP/exhsZQzUC70nIIjEOXEeC4=";
+  npmDepsHash = "sha256-VHZqc111cC8AANogxXVg4BFlngdmrrt7E+tCMF5Rl7g=";

  postPatch = ''
    substituteInPlace package.json \
--- a/pkgs/development/tools/chit/default.nix
+++ b/pkgs/development/tools/chit/default.nix
@ -51,6 +51,6 @@ rustPlatform.buildRustPackage rec {
    '';
    homepage = "https://github.com/peterheesterman/chit";
    license = licenses.mit;
-    maintainers = with maintainers; [ figsoda lilyball ];
+    maintainers = with maintainers; [ figsoda ];
  };
 }
--- a/pkgs/development/tools/cocoapods/default.nix
+++ b/pkgs/development/tools/cocoapods/default.nix
@ -19,7 +19,6 @@ bundlerApp {
    platforms       = platforms.darwin;
    maintainers     = with maintainers; [
      peterromfeldhk
-      lilyball
    ];
    mainProgram = "pod";
  };
--- a/pkgs/development/tools/jazzy/default.nix
+++ b/pkgs/development/tools/jazzy/default.nix
@ -14,7 +14,6 @@ bundlerApp {
    platforms       = platforms.darwin;
    maintainers     = with maintainers; [
      peterromfeldhk
-      lilyball
      nicknovitski
    ];
  };
--- a/pkgs/development/tools/konf/default.nix
+++ b/pkgs/development/tools/konf/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "konf";
-  version = "0.5.1";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "SimonTheLeg";
    repo = "konf-go";
    rev = "v${version}";
-    hash = "sha256-uzB3quuex00Gp7YRkgo7gF92oPcBoQtLwG6hqMzK6oo=";
+    hash = "sha256-GSrR2uLeGodmE1egRtvTyWhJckYUnI97n7dnmjPvu3k=";
  };

  vendorHash = "sha256-sB3j19HrTtaRqNcooqNy8vBvuzxxyGDa7MOtiGoVgN8=";
--- a/pkgs/development/tools/language-servers/helm-ls/default.nix
+++ b/pkgs/development/tools/language-servers/helm-ls/default.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "helm-ls";
-  version = "0.0.17";
+  version = "0.0.18";

  src = fetchFromGitHub {
    owner = "mrjosh";
    repo = "helm-ls";
    rev = "v${version}";
-    hash = "sha256-c72QFlsCPBW4biTMh1nxQIEkKPjmSmxOD93Kzduswyo=";
+    hash = "sha256-nOb7hoUOQfmpCYqui+hw5hcL/pURvsMXlksa8KUBjSY=";
  };

  vendorHash = "sha256-jGC8JNlorw0FSc0HhFdUVZJDCNaX4PWPaFKRklufIsQ=";
--- a/pkgs/development/tools/misc/tokei/default.nix
+++ b/pkgs/development/tools/misc/tokei/default.nix
@ -29,7 +29,7 @@ rustPlatform.buildRustPackage rec {
    '';
    homepage = "https://github.com/XAMPPRocky/tokei";
    license = with licenses; [ asl20 /* or */ mit ];
-    maintainers = with maintainers; [ gebner lilyball ];
+    maintainers = with maintainers; [ gebner ];
    mainProgram = "tokei";
  };
 }
--- a/pkgs/servers/home-assistant/custom-components/moonraker/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/moonraker/default.nix
@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
  owner = "marcolivierarsenault";
  domain = "moonraker";
-  version = "1.2.1";
+  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "marcolivierarsenault";
    repo = "moonraker-home-assistant";
    rev = "refs/tags/${version}";
-    hash = "sha256-utxCHXVpP4FQT2poVuS4cMZGgn7yO89lUw5KhIHRXKQ=";
+    hash = "sha256-e1Bdhv6YSz9yhIx5SDKfRxq0f6Fr0oc0vzpOqPPMxmc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/servers/http/apache-modules/tomcat-connectors/default.nix
+++ b/pkgs/servers/http/apache-modules/tomcat-connectors/default.nix
@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, apacheHttpd, jdk }:

 stdenv.mkDerivation rec {
-  pname = "tomcat-connectors";
-  version = "1.2.48";
+  pname = "mod_jk";
+  version = "1.2.49";

  src = fetchurl {
-    url = "mirror://apache/tomcat/tomcat-connectors/jk/${pname}-${version}-src.tar.gz";
-    sha256 = "15wfj1mvad15j1fqw67qbpbpwrcz3rb0zdhrq6z2sax1l05kc6yb";
+    url = "mirror://apache/tomcat/tomcat-connectors/jk/tomcat-connectors-${version}-src.tar.gz";
+    hash = "sha256-Q8sCg8koeOnU7xEGMdvSvra1VxPBJ84EMZCyswh1fpw=";
  };

  configureFlags = [
@ -28,7 +28,9 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Provides web server plugins to connect web servers with Tomcat";
    homepage = "https://tomcat.apache.org/download-connectors.cgi";
+    changelog = "https://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html";
    license = licenses.asl20;
+    maintainers = with maintainers; [ anthonyroussel ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/servers/sql/rqlite/default.nix
+++ b/pkgs/servers/sql/rqlite/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "rqlite";
-  version = "8.26.2";
+  version = "8.26.3";

  src = fetchFromGitHub {
    owner = "rqlite";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-GGqnhsEvv8pnaRmJO+IX64VNQVnBaGZcUKMOiW/PJaQ=";
+    sha256 = "sha256-YtAQc2Qb7wo4whT7UMXItgbufDfNZPGR2XxL1oEtitk=";
  };

-  vendorHash = "sha256-x1W2niLqhAcroh67cssDuuiJA3Pd5W4Wkh12uKqSfDI=";
+  vendorHash = "sha256-bzK6PYSg9z1QS+5Vk6pPM10ddrLVRm0C7rmepZt4b0M=";

  subPackages = [ "cmd/rqlite" "cmd/rqlited" "cmd/rqbench" ];

--- a/pkgs/tools/audio/darkice/default.nix
+++ b/pkgs/tools/audio/darkice/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "darkice";
-  version = "1.4";
+  version = "1.5";

  src = fetchurl {
    url = "https://github.com/rafael2k/darkice/releases/download/v${version}/darkice-${version}.tar.gz";
-    sha256 = "05yq7lggxygrkd76yiqby3msrgdn082p0qlvmzzv9xbw8hmyra76";
+    sha256 = "sha256-GLTEVzp8z+CcEJTrV5gVniqYkhBupi11OTP28qdGBY4=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/tools/misc/bat-extras/default.nix
+++ b/pkgs/tools/misc/bat-extras/default.nix
@ -86,7 +86,7 @@ let
      description = "Bash scripts that integrate bat with various command line tools";
      homepage    = "https://github.com/eth-p/bat-extras";
      license     = with licenses; [ mit ];
-      maintainers = with maintainers; [ bbigras lilyball ];
+      maintainers = with maintainers; [ bbigras ];
      platforms   = platforms.all;
    };
  };
--- a/pkgs/tools/misc/ffsend/default.nix
+++ b/pkgs/tools/misc/ffsend/default.nix
@ -86,7 +86,7 @@ rustPlatform.buildRustPackage rec {
    '';
    homepage = "https://gitlab.com/timvisee/ffsend";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ lilyball equirosa ];
+    maintainers = with maintainers; [ equirosa ];
    platforms = platforms.unix;
    mainProgram = "ffsend";
  };
--- a/pkgs/tools/misc/mandown/default.nix
+++ b/pkgs/tools/misc/mandown/default.nix
@ -2,14 +2,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "mandown";
-  version = "0.1.3";
+  version = "0.1.4";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-8a4sImsjw+lzeVK4V74VpIKDcAhMR1bOmJYVWzfWEfc=";
+    sha256 = "sha256-8SHZR8frDHLGj2WYlnFGBWY3B6xv4jByET7CODt2TGw=";
  };

-  cargoHash = "sha256-Wf1+dxwgPZ4CHpas+3P6n6kKDIISbnfI01+XksjxQlQ=";
+  cargoHash = "sha256-/IvPvJo5zwvLY+P5+hsdbR56/pfopfwncEz9UGUS1Oc=";

  meta = with lib; {
    description = "Markdown to groff (man page) converter";
--- a/pkgs/tools/misc/xxv/default.nix
+++ b/pkgs/tools/misc/xxv/default.nix
@ -35,7 +35,7 @@ rustPlatform.buildRustPackage rec {
    '';
    homepage    = "https://chrisvest.github.io/xxv/";
    license     = with licenses; [ gpl3 ];
-    maintainers = with maintainers; [ lilyball ];
+    maintainers = with maintainers; [ ];
    mainProgram = "xxv";
  };
 }
--- a/pkgs/tools/networking/muffet/default.nix
+++ b/pkgs/tools/networking/muffet/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "muffet";
-  version = "2.10.1";
+  version = "2.10.2";

  src = fetchFromGitHub {
    owner = "raviqqe";
    repo = "muffet";
    rev = "v${version}";
-    hash = "sha256-/LkXFY7ThPuq3RvW0NLZNRjk9kblFiztG98sTfhQuGM=";
+    hash = "sha256-v4qyVaeqSSG9cmkSGeweZIVv3Dgk/mHHvUpA0Cbio3c=";
  };

-  vendorHash = "sha256-3kURSzwzM4QPCbb8C1vRb6Mr46XKNyZF0sAze5Z9xsg=";
+  vendorHash = "sha256-UJsncAKtjgF0dn7xAJQdKD8YEIwtFcpYJVWG9b66KRU=";

  meta = with lib; {
    description = "Website link checker which scrapes and inspects all pages in a website recursively";
--- a/pkgs/tools/networking/vpn-slice/default.nix
+++ b/pkgs/tools/networking/vpn-slice/default.nix
@ -43,6 +43,6 @@ buildPythonApplication rec {
      "vpnc-script replacement for easy and secure split-tunnel VPN setup";
    mainProgram = "vpn-slice";
    license = licenses.gpl3;
-    maintainers = with maintainers; [ liketechnik ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/tools/networking/zrok/default.nix
+++ b/pkgs/tools/networking/zrok/default.nix
@ -14,14 +14,14 @@ let
  }.${system} or throwSystem;

  hash = {
-    x86_64-linux = "sha256-1CdYmFKpjc3CAmHwpSJ3IL4ZrJqYo0QZ4a/yRy732IM=";
-    aarch64-linux = "sha256-Du/Kyb4UafEK3ssfWB3w0harAxUIlmsc5SGsxf1Dc18=";
-    armv7l-linux = "sha256-59tQ5sNk0QL1H+BjeiiJItTQUNWCNuWCp0wWe//VEhg=";
+    x86_64-linux = "sha256-8fEmiRKFOrF9v66OEfUGLUYK+DfZMkAXrCKu2DoGbLA=";
+    aarch64-linux = "sha256-p+YbWpyLfIgFdNvakQQFfi+P/9lhfVMM+Y0XynRJ/rY=";
+    armv7l-linux = "sha256-mMjtbAjylSjS+89T0qQoI4H/p316cqh+5fbgarFbv90=";
  }.${system} or throwSystem;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "zrok";
-  version = "0.4.32";
+  version = "0.4.34";

  src = fetchzip {
    url = "https://github.com/openziti/zrok/releases/download/v${finalAttrs.version}/zrok_${finalAttrs.version}_${plat}.tar.gz";
--- a/pkgs/tools/package-management/nix/common.nix
+++ b/pkgs/tools/package-management/nix/common.nix
@ -85,6 +85,7 @@ in

  # passthru tests
 , pkgsi686Linux
+, runCommand
 }: let
 self = stdenv.mkDerivation {
  pname = "nix";
@ -259,6 +260,21 @@ self = stdenv.mkDerivation {
      # Basic smoke test that needs to pass when upgrading nix.
      # Note that this test does only test the nixVersions.stable attribute.
      misc = nixosTests.nix-misc.default;
+
+      srcVersion = runCommand "nix-src-version" {
+        inherit version;
+      } ''
+        # This file is an implementation detail, but it's a good sanity check
+        # If upstream changes that, we'll have to adapt.
+        srcVersion=$(cat ${src}/.version)
+        echo "Version in nix nix expression: $version"
+        echo "Version in nix.src: $srcVersion"
+        if [ "$version" != "$srcVersion" ]; then
+          echo "Version mismatch!"
+          exit 1
+        fi
+        touch $out
+      '';
    };
  };

--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@ -183,7 +183,7 @@ in lib.makeExtensible (self: ({
  };

  git = common rec {
-    version = "2.23.1";
+    version = "2.24.0";
    suffix = "pre20240627_${lib.substring 0 8 src.rev}";
    src = fetchFromGitHub {
      owner = "NixOS";
--- a/pkgs/tools/security/kube-bench/default.nix
+++ b/pkgs/tools/security/kube-bench/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kube-bench";
-  version = "0.7.3";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "aquasecurity";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-BS/jJbseLcWtK9BX7ZbVokSrboUaaTCIr4cwpixl1QI=";
+    hash = "sha256-vP/BK3hOBrEAPrg+Bltg0GdyvAQyUffEtXoK3B3CEjs=";
  };

  vendorHash = "sha256-bq8nz4i40xd4O6/r2ZiUyAEKxmsoLCNKctqRV/GPQEU=";
--- a/pkgs/tools/system/tree/default.nix
+++ b/pkgs/tools/system/tree/default.nix
@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "tree";
-  version = "2.1.1";
+  version = "2.1.2";

  src = fetchFromGitLab {
    owner = "OldManProgrammer";
    repo = "unix-tree";
    rev = version;
-    sha256 = "sha256-aPz1ROUeAKDmMjEtAaL2AguF54/CbIYWpL4Qovv2ftQ=";
+    sha256 = "sha256-1iBGbzNwjUX7kqkk6XzKISO2e6b05MBH08XgIwR+nyI=";
  };

  preConfigure = ''
--- a/pkgs/tools/text/sad/default.nix
+++ b/pkgs/tools/text/sad/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "sad";
-  version = "0.4.30";
+  version = "0.4.31";

  src = fetchFromGitHub {
    owner = "ms-jpq";
    repo = "sad";
    rev = "refs/tags/v${version}";
-    hash = "sha256-pTCdoKY/+ubUY3adN/Cqop0Gvuqh6Bs55arjT9mjQ18=";
+    hash = "sha256-frsOfv98VdetlwgNA6O0KEhcCSY9tQeEwkl2am226ko=";
  };

-  cargoHash = "sha256-ndl0jFQA30h90nnEcIl2CXfF/+cuj/UqUV/7ilsUPb4=";
+  cargoHash = "sha256-2oZf2wim2h/krGZMg7Psxx0VLFE/Xf1d1vWqkVtjSmo=";

  nativeBuildInputs = [ python3 ];

--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -1356,6 +1356,7 @@ mapAliases ({
  tkcvs = tkrev; # Added 2022-03-07
  tokodon = plasma5Packages.tokodon;
  tokyo-night-gtk = tokyonight-gtk-theme; # Added 2024-01-28
+  tomcat_connectors = apacheHttpdPackages.mod_jk; # Added 2024-06-07
  tootle = throw "'tootle' has been removed as it is not maintained upstream. Consider using 'tuba' instead"; # Added 2024-02-11
  tor-browser-bundle-bin = tor-browser; # Added 2023-09-23
  transmission = lib.warn (transmission3Warning {}) transmission_3; # Added 2024-06-10
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -9453,8 +9453,6 @@ with pkgs;

  keyfuzz = callPackage ../tools/inputmethods/keyfuzz { };

-  keymapp = callPackage ../applications/misc/keymapp { };
-
  keyscope = callPackage ../tools/security/keyscope {
    inherit (darwin.apple_sdk.frameworks) DiskArbitration Foundation IOKit Security;
  };
@ -25247,39 +25245,26 @@ with pkgs;

  apacheHttpdPackagesFor = apacheHttpd: self: let callPackage = newScope self; in {
    inherit apacheHttpd;
-
    mod_auth_mellon = callPackage ../servers/http/apache-modules/mod_auth_mellon { };
-
-    # Redwax collection
    mod_ca = callPackage ../servers/http/apache-modules/mod_ca { };
    mod_crl = callPackage ../servers/http/apache-modules/mod_crl { };
-    mod_csr = callPackage ../servers/http/apache-modules/mod_csr { };
    mod_cspnonce = callPackage ../servers/http/apache-modules/mod_cspnonce { };
-    mod_ocsp = callPackage ../servers/http/apache-modules/mod_ocsp{ };
-    mod_scep = callPackage ../servers/http/apache-modules/mod_scep { };
-    mod_pkcs12 = callPackage ../servers/http/apache-modules/mod_pkcs12 { };
-    mod_spkac= callPackage ../servers/http/apache-modules/mod_spkac { };
-    mod_timestamp = callPackage ../servers/http/apache-modules/mod_timestamp { };
-
+    mod_csr = callPackage ../servers/http/apache-modules/mod_csr { };
    mod_dnssd = callPackage ../servers/http/apache-modules/mod_dnssd { };
-
-
-    mod_perl = callPackage ../servers/http/apache-modules/mod_perl { };
-
    mod_fastcgi = callPackage ../servers/http/apache-modules/mod_fastcgi { };
-
-    mod_python = callPackage ../servers/http/apache-modules/mod_python { };
-
-    mod_tile = callPackage ../servers/http/apache-modules/mod_tile { };
-
-    mod_wsgi3 = callPackage ../servers/http/apache-modules/mod_wsgi { };
-
    mod_itk = callPackage ../servers/http/apache-modules/mod_itk { };
-
+    mod_jk = callPackage ../servers/http/apache-modules/mod_jk { };
    mod_mbtiles = callPackage ../servers/http/apache-modules/mod_mbtiles { };
-
+    mod_ocsp = callPackage ../servers/http/apache-modules/mod_ocsp { };
+    mod_perl = callPackage ../servers/http/apache-modules/mod_perl { };
+    mod_pkcs12 = callPackage ../servers/http/apache-modules/mod_pkcs12 { };
+    mod_python = callPackage ../servers/http/apache-modules/mod_python { };
+    mod_scep = callPackage ../servers/http/apache-modules/mod_scep { };
+    mod_spkac = callPackage ../servers/http/apache-modules/mod_spkac { };
+    mod_tile = callPackage ../servers/http/apache-modules/mod_tile { };
+    mod_timestamp = callPackage ../servers/http/apache-modules/mod_timestamp { };
+    mod_wsgi3 = callPackage ../servers/http/apache-modules/mod_wsgi { };
    php = pkgs.php.override { inherit apacheHttpd; };
-
    subversion = pkgs.subversion.override { httpServer = true; inherit apacheHttpd; };
  } // lib.optionalAttrs config.allowAliases {
    mod_evasive = throw "mod_evasive is not supported on Apache httpd 2.4";
@ -25962,8 +25947,6 @@ with pkgs;

  pulseeffects-legacy = callPackage ../applications/audio/pulseeffects-legacy { };

-  tomcat_connectors = callPackage ../servers/http/apache-modules/tomcat-connectors { };
-
  tomcat-native = callPackage ../servers/http/tomcat/tomcat-native.nix { };

  pies = callPackage ../servers/pies { };
@ -27657,6 +27640,8 @@ with pkgs;

  sddm-chili-theme = libsForQt5.callPackage ../data/themes/chili-sddm { };

+  sddm-sugar-dark = libsForQt5.callPackage ../data/themes/sddm-sugar-dark { };
+
  sdparm = callPackage ../os-specific/linux/sdparm { };

  sdrangel = libsForQt5.callPackage ../applications/radio/sdrangel {
@ -29388,6 +29373,10 @@ with pkgs;
  android-studio = androidStudioPackages.stable;
  android-studio-full = android-studio.full;

+  androidStudioForPlatformPackages = recurseIntoAttrs
+    (callPackage ../applications/editors/android-studio-for-platform { });
+  android-studio-for-platform = androidStudioForPlatformPackages.stable;
+
  antfs-cli = callPackage ../applications/misc/antfs-cli { };

  antimony = libsForQt5.callPackage ../applications/graphics/antimony { };