Merge branch master into haskell-updates

2024-06-20 14:34:13 +02:00 · 2024-06-20 14:34:13 +02:00 · e66e7c4d8e
commit e66e7c4d8e
parent 49f3b031c4 d549d0c29e
143 changed files with 9037 additions and 6238 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4260,6 +4260,12 @@
    github = "d4ilyrun";
    githubId = 34611103;
  };
+  d4rkstar = {
+    name = "Bruno Salzano";
+    email = "d4rkstar@gmail.com";
+    github = "d4rkstar";
+    githubId = 4957015;
+  };
  dadada = {
    name = "dadada";
    email = "dadada@dadada.li";
@ -13629,6 +13635,12 @@
    githubId = 3856390;
    email = "mschwaig+nixpkgs@eml.cc";
  };
+  msciabarra = {
+    email = "msciabarra@apache.org";
+    github = "sciabarracom";
+    githubId = 30654959;
+    name = "Michele Sciabarra";
+  };
  msiedlarek = {
    email = "mikolaj@siedlarek.pl";
    github = "msiedlarek";
--- a/maintainers/scripts/pluginupdate.py
+++ b/maintainers/scripts/pluginupdate.py
@ -788,7 +788,10 @@ def update_plugins(editor: Editor, args):
    fetch_config = FetchConfig(args.proc, args.github_token)
    update = editor.get_update(args.input_file, args.outfile, fetch_config)

+    start_time = time.time()
    redirects = update()
+    duration = time.time() - start_time
+    print(f"The plugin update took {duration}s.")
    editor.rewrite_input(fetch_config, args.input_file, editor.deprecated, redirects)

    autocommit = not args.no_commit
--- a/nixos/doc/manual/configuration/gpu-accel.chapter.md
+++ b/nixos/doc/manual/configuration/gpu-accel.chapter.md
@ -30,7 +30,7 @@ $ export \
 ```

 The second mechanism is to add the OpenCL driver package to
-[](#opt-hardware.opengl.extraPackages).
+[](#opt-hardware.graphics.extraPackages).
 This links the ICD file under `/run/opengl-driver`, where it will be visible
 to the ICD loader.

@ -51,12 +51,12 @@ Platform Vendor      Advanced Micro Devices, Inc.
 Modern AMD [Graphics Core
 Next](https://en.wikipedia.org/wiki/Graphics_Core_Next) (GCN) GPUs are
 supported through the rocmPackages.clr.icd package. Adding this package to
-[](#opt-hardware.opengl.extraPackages)
+[](#opt-hardware.graphics.extraPackages)
 enables OpenCL support:

 ```nix
 {
-  hardware.opengl.extraPackages = [
+  hardware.graphics.extraPackages = [
    rocmPackages.clr.icd
  ];
 }
@ -71,13 +71,13 @@ intel-compute-runtime package. The proprietary Intel OpenCL runtime, in
 the intel-ocl package, is an alternative for Gen7 GPUs.

 The intel-compute-runtime or intel-ocl package can be added to
-[](#opt-hardware.opengl.extraPackages)
+[](#opt-hardware.graphics.extraPackages)
 to enable OpenCL support. For example, for Gen8 and later GPUs, the following
 configuration can be used:

 ```nix
 {
-  hardware.opengl.extraPackages = [
+  hardware.graphics.extraPackages = [
    intel-compute-runtime
  ];
 }
@ -90,8 +90,8 @@ compute API for GPUs. It is used directly by games or indirectly though
 compatibility layers like
 [DXVK](https://github.com/doitsujin/dxvk/wiki).

-By default, if [](#opt-hardware.opengl.driSupport)
-is enabled, mesa is installed and provides Vulkan for supported hardware.
+By default, if [](#opt-hardware.graphics.enable)
+is enabled, Mesa is installed and provides Vulkan for supported hardware.

 Similar to OpenCL, Vulkan drivers are loaded through the *Installable
 Client Driver* (ICD) mechanism. ICD files for Vulkan are JSON files that
@ -110,7 +110,7 @@ $ export \
 ```

 The second mechanism is to add the Vulkan driver package to
-[](#opt-hardware.opengl.extraPackages).
+[](#opt-hardware.graphics.extraPackages).
 This links the ICD file under `/run/opengl-driver`, where it will be
 visible to the ICD loader.

@ -140,18 +140,18 @@ Modern AMD [Graphics Core
 Next](https://en.wikipedia.org/wiki/Graphics_Core_Next) (GCN) GPUs are
 supported through either radv, which is part of mesa, or the amdvlk
 package. Adding the amdvlk package to
-[](#opt-hardware.opengl.extraPackages)
+[](#opt-hardware.graphics.extraPackages)
 makes amdvlk the default driver and hides radv and lavapipe from the device list.
 A specific driver can be forced as follows:

 ```nix
 {
-  hardware.opengl.extraPackages = [
+  hardware.graphics.extraPackages = [
    pkgs.amdvlk
  ];

  # To enable Vulkan support for 32-bit applications, also add:
-  hardware.opengl.extraPackages32 = [
+  hardware.graphics.extraPackages32 = [
    pkgs.driversi686Linux.amdvlk
  ];

@ -171,7 +171,7 @@ graphics hardware acceleration capabilities for video processing.

 VA-API drivers are loaded by `libva`. The version in nixpkgs is built to search
 the opengl driver path, so drivers can be installed in
-[](#opt-hardware.opengl.extraPackages).
+[](#opt-hardware.graphics.extraPackages).

 VA-API can be tested using:

@ -185,7 +185,7 @@ Modern Intel GPUs use the iHD driver, which can be installed with:

 ```nix
 {
-  hardware.opengl.extraPackages = [
+  hardware.graphics.extraPackages = [
    intel-media-driver
  ];
 }
@ -195,7 +195,7 @@ Older Intel GPUs use the i965 driver, which can be installed with:

 ```nix
 {
-  hardware.opengl.extraPackages = [
+  hardware.graphics.extraPackages = [
    intel-vaapi-driver
  ];
 }
--- a/nixos/doc/manual/configuration/x-windows.chapter.md
+++ b/nixos/doc/manual/configuration/x-windows.chapter.md
@ -79,7 +79,7 @@ Wine, you should also set the following:

 ```nix
 {
-  hardware.opengl.driSupport32Bit = true;
+  hardware.graphics.enable32Bit = true;
 }
 ```

@ -183,23 +183,6 @@ If you have an older card, you may have to use one of the legacy drivers:
 You may need to reboot after enabling this driver to prevent a clash
 with other kernel modules.

-## Proprietary AMD drivers {#sec-x11--graphics-cards-amd}
-
-AMD provides a proprietary driver for its graphics cards that is not
-enabled by default because it's not Free Software, is often broken in
-nixpkgs and as of this writing doesn't offer more features or
-performance. If you still want to use it anyway, you need to explicitly
-set:
-
-```nix
-{
-  services.xserver.videoDrivers = [ "amdgpu-pro" ];
-}
-```
-
-You will need to reboot after enabling this driver to prevent a clash
-with other kernel modules.
-
 ## Touchpads {#sec-x11-touchpads}

 Support for Synaptics touchpads (found in many laptops such as the Dell
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -207,6 +207,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - [xdg-terminal-exec](https://github.com/Vladimir-csp/xdg-terminal-exec), the proposed Default Terminal Execution Specification.

+- Convenience options for `amdgpu`, open source driver for Radeon cards, is now available under `hardware.amdgpu`.
+
 - [ydotool](https://github.com/ReimuNotMoe/ydotool), a generic command-line automation tool now has a module. Available as [programs.ydotool](#opt-programs.ydotool.enable).

 - [your_spotify](https://github.com/Yooooomi/your_spotify), a self hosted Spotify tracking dashboard. Available as [services.your_spotify](#opt-services.your_spotify.enable)
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -4,6 +4,8 @@

 ## Highlights {#sec-release-24.11-highlights}

+- Convenience options for `amdgpu`, open source driver for Radeon cards, is now available under `hardware.amdgpu`.
+
 - [AMDVLK](https://github.com/GPUOpen-Drivers/AMDVLK), AMD's open source Vulkan driver, is now available to be configured as `hardware.amdgpu.amdvlk` option.
  This also allows configuring runtime settings of AMDVLK and enabling experimental features.

--- a/nixos/modules/hardware/graphics.nix
+++ b/nixos/modules/hardware/graphics.nix
@ -0,0 +1,126 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.hardware.graphics;
+
+  driversEnv = pkgs.buildEnv {
+    name = "graphics-drivers";
+    paths = [ cfg.package ] ++ cfg.extraPackages;
+  };
+
+  driversEnv32 = pkgs.buildEnv {
+    name = "graphics-drivers-32bit";
+    paths = [ cfg.package32 ] ++ cfg.extraPackages32;
+  };
+in
+{
+  imports = [
+    (lib.mkRenamedOptionModule [ "services" "xserver" "vaapiDrivers" ] [ "hardware" "opengl" "extraPackages" ])
+    (lib.mkRemovedOptionModule [ "hardware" "opengl" "s3tcSupport" ] "S3TC support is now always enabled in Mesa.")
+    (lib.mkRemovedOptionModule [ "hardware" "opengl" "driSupport"] "The setting can be removed.")
+
+    (lib.mkRenamedOptionModule [ "hardware" "opengl" "enable"] [ "hardware" "graphics" "enable" ])
+    (lib.mkRenamedOptionModule [ "hardware" "opengl" "driSupport32Bit"] [ "hardware" "graphics" "enable32Bit" ])
+    (lib.mkRenamedOptionModule [ "hardware" "opengl" "package"] [ "hardware" "graphics" "package" ])
+    (lib.mkRenamedOptionModule [ "hardware" "opengl" "package32"] [ "hardware" "graphics" "package32" ])
+    (lib.mkRenamedOptionModule [ "hardware" "opengl" "extraPackages"] [ "hardware" "graphics" "extraPackages" ])
+    (lib.mkRenamedOptionModule [ "hardware" "opengl" "extraPackages32"] [ "hardware" "graphics" "extraPackages32" ])
+  ];
+
+  options.hardware.graphics = {
+    enable = lib.mkOption {
+      description = ''
+        Whether to enable hardware accelerated graphics drivers.
+
+        This is required to allow most graphical applications and
+        environments to use hardware rendering, video encode/decode
+        acceleration, etc.
+
+        This option should be enabled by default by the corresponding modules,
+        so you do not usually have to set it yourself.
+      '';
+      type = lib.types.bool;
+      default = false;
+    };
+
+    enable32Bit = lib.mkOption {
+      description = ''
+        On 64-bit systems, whether to also install 32-bit drivers for
+        32-bit applications (such as Wine).
+      '';
+      type = lib.types.bool;
+      default = false;
+    };
+
+    package = lib.mkOption {
+      description = ''
+        The package that provides the default driver set.
+      '';
+      type = lib.types.package;
+      internal = true;
+    };
+
+    package32 = lib.mkOption {
+      description = ''
+        The package that provides the 32-bit driver set. Used when {option}`enable32Bit` is enabled.
+        set.
+      '';
+      type = lib.types.package;
+      internal = true;
+    };
+
+    extraPackages = lib.mkOption {
+      description = ''
+        Additional packages to add to the default graphics driver lookup path.
+        This can be used to add OpenCL drivers, VA-API/VDPAU drivers, etc.
+
+        ::: {.note}
+        intel-media-driver supports hardware Broadwell (2014) or newer. Older hardware should use the mostly unmaintained intel-vaapi-driver driver.
+        :::
+      '';
+      type = lib.types.listOf lib.types.package;
+      default = [];
+      example = lib.literalExpression "with pkgs; [ intel-media-driver intel-ocl intel-vaapi-driver ]";
+    };
+
+    extraPackages32 = lib.mkOption {
+      description = ''
+        Additional packages to add to 32-bit graphics driver lookup path on 64-bit systems.
+        Used when {option}`enable32Bit` is set. This can be used to add OpenCL drivers, VA-API/VDPAU drivers, etc.
+
+        ::: {.note}
+        intel-media-driver supports hardware Broadwell (2014) or newer. Older hardware should use the mostly unmaintained intel-vaapi-driver driver.
+        :::
+      '';
+      type = lib.types.listOf lib.types.package;
+      default = [];
+      example = lib.literalExpression "with pkgs.pkgsi686Linux; [ intel-media-driver intel-vaapi-driver ]";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.enable32Bit -> pkgs.stdenv.isx86_64;
+        message = "`hardware.graphics.enable32Bit` only makes sense on a 64-bit system.";
+      }
+      {
+        assertion = cfg.enable32Bit -> (config.boot.kernelPackages.kernel.features.ia32Emulation or false);
+        message = "`hardware.graphics.enable32Bit` requires a kernel that supports 32-bit emulation";
+      }
+    ];
+
+    systemd.tmpfiles.settings.graphics-driver = {
+      "/run/opengl-driver"."L+".argument = toString driversEnv;
+      "/run/opengl-driver-32" =
+        if pkgs.stdenv.isi686 then
+          { "L+".argument = "opengl-driver"; }
+        else if cfg.enable32Bit then
+          { "L+".argument = toString driversEnv32; }
+        else
+          { "r" = {}; };
+    };
+
+    hardware.graphics.package = lib.mkDefault pkgs.mesa.drivers;
+    hardware.graphics.package32 = lib.mkDefault pkgs.pkgsi686Linux.mesa.drivers;
+  };
+}
--- a/nixos/modules/hardware/opengl.nix
+++ b/nixos/modules/hardware/opengl.nix
@ -1,158 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-
-  cfg = config.hardware.opengl;
-
-  kernelPackages = config.boot.kernelPackages;
-
-  videoDrivers = config.services.xserver.videoDrivers;
-
-  package = pkgs.buildEnv {
-    name = "opengl-drivers";
-    paths = [ cfg.package ] ++ cfg.extraPackages;
-  };
-
-  package32 = pkgs.buildEnv {
-    name = "opengl-drivers-32bit";
-    paths = [ cfg.package32 ] ++ cfg.extraPackages32;
-  };
-
-in
-
-{
-
-  imports = [
-    (lib.mkRenamedOptionModule [ "services" "xserver" "vaapiDrivers" ] [ "hardware" "opengl" "extraPackages" ])
-    (lib.mkRemovedOptionModule [ "hardware" "opengl" "s3tcSupport" ] "S3TC support is now always enabled in Mesa.")
-  ];
-
-  options = {
-
-    hardware.opengl = {
-      enable = lib.mkOption {
-        description = ''
-          Whether to enable OpenGL drivers. This is needed to enable
-          OpenGL support in X11 systems, as well as for Wayland compositors
-          like sway and Weston. It is enabled by default
-          by the corresponding modules, so you do not usually have to
-          set it yourself, only if there is no module for your wayland
-          compositor of choice. See services.xserver.enable and
-          programs.sway.enable.
-        '';
-        type = lib.types.bool;
-        default = false;
-      };
-
-      driSupport = lib.mkOption {
-        type = lib.types.bool;
-        default = true;
-        description = ''
-          Whether to enable accelerated OpenGL rendering through the
-          Direct Rendering Interface (DRI).
-        '';
-      };
-
-      driSupport32Bit = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = ''
-          On 64-bit systems, whether to support Direct Rendering for
-          32-bit applications (such as Wine).  This is currently only
-          supported for the `nvidia` as well as
-          `Mesa`.
-        '';
-      };
-
-      package = lib.mkOption {
-        type = lib.types.package;
-        internal = true;
-        description = ''
-          The package that provides the OpenGL implementation.
-        '';
-      };
-
-      package32 = lib.mkOption {
-        type = lib.types.package;
-        internal = true;
-        description = ''
-          The package that provides the 32-bit OpenGL implementation on
-          64-bit systems. Used when {option}`driSupport32Bit` is
-          set.
-        '';
-      };
-
-      extraPackages = lib.mkOption {
-        type = lib.types.listOf lib.types.package;
-        default = [];
-        example = lib.literalExpression "with pkgs; [ intel-media-driver intel-ocl intel-vaapi-driver ]";
-        description = ''
-          Additional packages to add to OpenGL drivers.
-          This can be used to add OpenCL drivers, VA-API/VDPAU drivers etc.
-
-          ::: {.note}
-          intel-media-driver supports hardware Broadwell (2014) or newer. Older hardware should use the mostly unmaintained intel-vaapi-driver driver.
-          :::
-        '';
-      };
-
-      extraPackages32 =lib. mkOption {
-        type = lib.types.listOf lib.types.package;
-        default = [];
-        example = lib.literalExpression "with pkgs.pkgsi686Linux; [ intel-media-driver intel-vaapi-driver ]";
-        description = ''
-          Additional packages to add to 32-bit OpenGL drivers on 64-bit systems.
-          Used when {option}`driSupport32Bit` is set. This can be used to add OpenCL drivers, VA-API/VDPAU drivers etc.
-
-          ::: {.note}
-          intel-media-driver supports hardware Broadwell (2014) or newer. Older hardware should use the mostly unmaintained intel-vaapi-driver driver.
-          :::
-        '';
-      };
-
-      setLdLibraryPath = lib.mkOption {
-        type = lib.types.bool;
-        internal = true;
-        default = false;
-        description = ''
-          Whether the `LD_LIBRARY_PATH` environment variable
-          should be set to the locations of driver libraries. Drivers which
-          rely on overriding libraries should set this to true. Drivers which
-          support `libglvnd` and other dispatch libraries
-          instead of overriding libraries should not set this.
-        '';
-      };
-    };
-
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      { assertion = cfg.driSupport32Bit -> pkgs.stdenv.isx86_64;
-        message = "Option driSupport32Bit only makes sense on a 64-bit system.";
-      }
-      { assertion = cfg.driSupport32Bit -> (config.boot.kernelPackages.kernel.features.ia32Emulation or false);
-        message = "Option driSupport32Bit requires a kernel that supports 32bit emulation";
-      }
-    ];
-
-    systemd.tmpfiles.settings.opengl = {
-      "/run/opengl-driver"."L+".argument = toString package;
-      "/run/opengl-driver-32" =
-        if pkgs.stdenv.isi686 then
-          { "L+".argument = "opengl-driver"; }
-        else if cfg.driSupport32Bit then
-          { "L+".argument = toString package32; }
-        else
-          { "r" = {}; };
-    };
-
-    environment.sessionVariables.LD_LIBRARY_PATH = lib.mkIf cfg.setLdLibraryPath
-      ([ "/run/opengl-driver/lib" ] ++ lib.optional cfg.driSupport32Bit "/run/opengl-driver-32/lib");
-
-    hardware.opengl.package = lib.mkDefault pkgs.mesa.drivers;
-    hardware.opengl.package32 = lib.mkDefault pkgs.pkgsi686Linux.mesa.drivers;
-
-    boot.extraModulePackages = lib.optional (lib.elem "virtualbox" videoDrivers) kernelPackages.virtualboxGuestAdditions;
-  };
-}
--- a/nixos/modules/hardware/video/amdgpu-pro.nix
+++ b/nixos/modules/hardware/video/amdgpu-pro.nix
@ -1,69 +0,0 @@
-# This module provides the proprietary AMDGPU-PRO drivers.
-
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  drivers = config.services.xserver.videoDrivers;
-
-  enabled = elem "amdgpu-pro" drivers;
-
-  package = config.boot.kernelPackages.amdgpu-pro;
-  package32 = pkgs.pkgsi686Linux.linuxPackages.amdgpu-pro.override { kernel = null; };
-
-  opengl = config.hardware.opengl;
-
-in
-
-{
-
-  config = mkIf enabled {
-    services.xserver.drivers = singleton
-      { name = "amdgpu"; modules = [ package ]; display = true; };
-
-    hardware.opengl.package = package;
-    hardware.opengl.package32 = package32;
-    hardware.opengl.setLdLibraryPath = true;
-
-    boot.extraModulePackages = [ package.kmod ];
-
-    boot.kernelPackages = pkgs.linuxKernel.packagesFor
-      (pkgs.linuxKernel.kernels.linux_5_10.override {
-        structuredExtraConfig = {
-          DEVICE_PRIVATE = kernel.yes;
-          KALLSYMS_ALL = kernel.yes;
-        };
-      });
-
-    hardware.firmware = [ package.fw ];
-
-    systemd.tmpfiles.settings.amdgpu-pro = {
-      "/run/amdgpu"."L+".argument = "${package}/opt/amdgpu";
-      "/run/amdgpu-pro"."L+".argument = "${package}/opt/amdgpu-pro";
-    };
-
-    system.requiredKernelConfig = with config.lib.kernelConfig; [
-      (isYes "DEVICE_PRIVATE")
-      (isYes "KALLSYMS_ALL")
-    ];
-
-    boot.initrd.extraUdevRulesCommands = mkIf (!config.boot.initrd.systemd.enable) ''
-      cp -v ${package}/etc/udev/rules.d/*.rules $out/
-    '';
-    boot.initrd.services.udev.packages = [ package ];
-
-    environment.systemPackages =
-      [ package.vulkan ] ++
-      # this isn't really DRI, but we'll reuse this option for now
-      optional config.hardware.opengl.driSupport32Bit package32.vulkan;
-
-    environment.etc = {
-      "modprobe.d/blacklist-radeon.conf".source = package + "/etc/modprobe.d/blacklist-radeon.conf";
-      amd.source = package + "/etc/amd";
-    };
-
-  };
-
-}
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@ -297,7 +297,7 @@ in
            KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 0'"
            KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm-tools c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 1'"
          '';
-          hardware.opengl = {
+          hardware.graphics = {
            extraPackages = [ nvidia_x11.out ];
            extraPackages32 = [ nvidia_x11.lib32 ];
          };
@ -467,7 +467,7 @@ in
            "egl/egl_external_platform.d".source = "/run/opengl-driver/share/egl/egl_external_platform.d/";
          };

-          hardware.opengl = {
+          hardware.graphics = {
            extraPackages = [ pkgs.nvidia-vaapi-driver ];
            extraPackages32 = [ pkgs.pkgsi686Linux.nvidia-vaapi-driver ];
          };
--- a/nixos/modules/hardware/video/virtualbox.nix
+++ b/nixos/modules/hardware/video/virtualbox.nix
@ -0,0 +1,7 @@
+{ lib, config, ... }:
+let
+  inherit (config.boot) kernelPackages;
+  inherit (config.services.xserver) videoDrivers;
+in {
+  boot.extraModulePackages = lib.mkIf (lib.elem "virtualbox" videoDrivers) [ kernelPackages.virtualboxGuestAdditions ];
+}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -67,6 +67,7 @@
  ./hardware/gkraken.nix
  ./hardware/glasgow.nix
  ./hardware/gpgsmartcards.nix
+  ./hardware/graphics.nix
  ./hardware/hackrf.nix
  ./hardware/i2c.nix
  ./hardware/infiniband.nix
@ -84,7 +85,6 @@
  ./hardware/new-lg4ff.nix
  ./hardware/nitrokey.nix
  ./hardware/onlykey/default.nix
-  ./hardware/opengl.nix
  ./hardware/openrazer.nix
  ./hardware/opentabletdriver.nix
  ./hardware/pcmcia.nix
@ -103,7 +103,6 @@
  ./hardware/uni-sync.nix
  ./hardware/usb-modeswitch.nix
  ./hardware/usb-storage.nix
-  ./hardware/video/amdgpu-pro.nix
  ./hardware/video/bumblebee.nix
  ./hardware/video/capture/mwprocapture.nix
  ./hardware/video/displaylink.nix
@ -111,6 +110,7 @@
  ./hardware/video/nvidia.nix
  ./hardware/video/switcheroo-control.nix
  ./hardware/video/uvcvideo/default.nix
+  ./hardware/video/virtualbox.nix
  ./hardware/video/webcam/facetimehd.nix
  ./hardware/video/webcam/ipu6.nix
  ./hardware/wooting.nix
@ -549,6 +549,7 @@
  ./services/games/xonotic.nix
  ./services/hardware/acpid.nix
  ./services/hardware/actkbd.nix
+  ./services/hardware/amdgpu.nix
  ./services/hardware/amdvlk.nix
  ./services/hardware/argonone.nix
  ./services/hardware/asusd.nix
--- a/nixos/modules/programs/miriway.nix
+++ b/nixos/modules/programs/miriway.nix
@ -65,7 +65,7 @@ in {
      };
    };

-    hardware.opengl.enable = lib.mkDefault true;
+    hardware.graphics.enable = lib.mkDefault true;
    fonts.enableDefaultPackages = lib.mkDefault true;
    programs.dconf.enable = lib.mkDefault true;
    programs.xwayland.enable = lib.mkDefault true;
--- a/nixos/modules/programs/steam.nix
+++ b/nixos/modules/programs/steam.nix
@ -50,7 +50,7 @@ in {
        }) // (prev.extraEnv or {});
        extraLibraries = pkgs: let
          prevLibs = if prev ? extraLibraries then prev.extraLibraries pkgs else [ ];
-          additionalLibs = with config.hardware.opengl;
+          additionalLibs = with config.hardware.graphics;
            if pkgs.stdenv.hostPlatform.is64bit
            then [ package ] ++ extraPackages
            else [ package32 ] ++ extraPackages32;
@ -176,10 +176,9 @@ in {
  };

  config = lib.mkIf cfg.enable {
-    hardware.opengl = { # this fixes the "glXChooseVisual failed" bug, context: https://github.com/NixOS/nixpkgs/issues/47932
+    hardware.graphics = { # this fixes the "glXChooseVisual failed" bug, context: https://github.com/NixOS/nixpkgs/issues/47932
      enable = true;
-      driSupport = true;
-      driSupport32Bit = true;
+      enable32Bit = true;
    };

    security.wrappers = lib.mkIf (cfg.gamescopeSession.enable && gamescopeCfg.capSysNice) {
--- a/nixos/modules/programs/turbovnc.nix
+++ b/nixos/modules/programs/turbovnc.nix
@ -17,7 +17,7 @@ in
          Whether to set up NixOS such that TurboVNC's built-in software OpenGL
          implementation works.

-          This will enable {option}`hardware.opengl.enable` so that OpenGL
+          This will enable {option}`hardware.graphics.enable` so that OpenGL
          programs can find Mesa's llvmpipe drivers.

          Setting this option to `false` does not mean that software
@ -46,7 +46,7 @@ in
    # can find the llvmpipe `swrast.so` software rendering DRI lib via `libglvnd`.
    # This comment exists to explain why `hardware.` is involved,
    # even though 100% software rendering is used.
-    hardware.opengl.enable = true;
+    hardware.graphics.enable = true;

  };
 }
--- a/nixos/modules/programs/wayland/wayland-session.nix
+++ b/nixos/modules/programs/wayland/wayland-session.nix
@ -11,7 +11,7 @@
    pam.services.swaylock = {};
  };

-  hardware.opengl.enable = lib.mkDefault true;
+  hardware.graphics.enable = lib.mkDefault true;
  fonts.enableDefaultPackages = lib.mkDefault true;

  programs = {
--- a/nixos/modules/services/desktop-managers/lomiri.nix
+++ b/nixos/modules/services/desktop-managers/lomiri.nix
@ -63,7 +63,7 @@ in {
    ];

    # Copy-pasted basic stuff
-    hardware.opengl.enable = lib.mkDefault true;
+    hardware.graphics.enable = lib.mkDefault true;
    fonts.enableDefaultPackages = lib.mkDefault true;
    programs.dconf.enable = lib.mkDefault true;

--- a/nixos/modules/services/display-managers/default.nix
+++ b/nixos/modules/services/display-managers/default.nix
@ -212,9 +212,7 @@ in
      after = [ "acpid.service" "systemd-logind.service" "systemd-user-sessions.service" ];
      restartIfChanged = false;

-      environment = lib.optionalAttrs config.hardware.opengl.setLdLibraryPath {
-        LD_LIBRARY_PATH = lib.makeLibraryPath [ pkgs.addOpenGLRunpath.driverLink ];
-      } // cfg.environment;
+      environment = cfg.environment;

      preStart = cfg.preStart;
      script = lib.mkIf (config.systemd.services.display-manager.enable == true) cfg.execCmd;
--- a/nixos/modules/services/hardware/amdgpu.nix
+++ b/nixos/modules/services/hardware/amdgpu.nix
@ -0,0 +1,43 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.hardware.amdgpu;
+in {
+  options.hardware.amdgpu = {
+    legacySupport.enable = lib.mkEnableOption ''
+      using `amdgpu` kernel driver instead of `radeon` for Southern Islands
+      (Radeon HD 7000) series and Sea Islands (Radeon HD 8000)
+      series cards. Note: this removes support for analog video outputs,
+      which is only available in the `radeon` driver
+    '';
+    initrd.enable = lib.mkEnableOption ''
+      loading `amdgpu` kernelModule in stage 1.
+      Can fix lower resolution in boot screen during initramfs phase
+    '';
+    opencl.enable = lib.mkEnableOption ''OpenCL support using ROCM runtime library'';
+    # cfg.amdvlk option is defined in ./amdvlk.nix module
+  };
+
+  config = {
+    boot.kernelParams = lib.optionals cfg.legacySupport.enable [
+      "amdgpu.si_support=1"
+      "amdgpu.cik_support=1"
+      "radeon.si_support=0"
+      "radeon.cik_support=0"
+    ];
+
+    boot.initrd.kernelModules = lib.optionals cfg.initrd.enable [ "amdgpu" ];
+
+    hardware.opengl = lib.mkIf cfg.opencl.enable {
+      enable = lib.mkDefault true;
+      extraPackages = [
+        pkgs.rocmPackages.clr
+        pkgs.rocmPackages.clr.icd
+      ];
+    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ johnrtitor ];
+  };
+}
--- a/nixos/modules/services/hardware/amdvlk.nix
+++ b/nixos/modules/services/hardware/amdvlk.nix
@ -31,11 +31,9 @@ in {
  };

  config = lib.mkIf cfg.enable {
-    hardware.opengl = {
+    hardware.graphics = {
      enable = true;
-      driSupport = true;
      extraPackages = [ cfg.package ];
-      driSupport32Bit = cfg.support32Bit.enable;
      extraPackages32 = [ cfg.support32Bit.package ];
    };

--- a/nixos/modules/services/misc/graphical-desktop.nix
+++ b/nixos/modules/services/misc/graphical-desktop.nix
@ -38,7 +38,7 @@ in

    fonts.enableDefaultPackages = lib.mkDefault true;

-    hardware.opengl.enable = lib.mkDefault true;
+    hardware.graphics.enable = lib.mkDefault true;

    programs.gnupg.agent.pinentryPackage = lib.mkOverride 1100 pkgs.pinentry-gnome3;

--- a/nixos/modules/services/network-filesystems/samba.nix
+++ b/nixos/modules/services/network-filesystems/samba.nix
@ -201,14 +201,10 @@ in
              message   = "If samba.nsswins is enabled, then samba.enableWinbindd must also be enabled";
            }
          ];
-        # Always provide a smb.conf to shut up programs like smbclient and smbspool.
-        environment.etc."samba/smb.conf".source = mkOptionDefault (
-          if cfg.enable then configFile
-          else pkgs.writeText "smb-dummy.conf" "# Samba is disabled."
-        );
      }

      (mkIf cfg.enable {
+        environment.etc."samba/smb.conf".source = configFile;

        system.nssModules = optional cfg.nsswins samba;
        system.nssDatabases.hosts = optional cfg.nsswins "wins";
--- a/nixos/modules/services/ttys/kmscon.nix
+++ b/nixos/modules/services/ttys/kmscon.nix
@ -107,7 +107,7 @@ in {
        fonts = optional (cfg.fonts != null) "font-name=${lib.concatMapStringsSep ", " (f: f.name) cfg.fonts}";
      in lib.concatStringsSep "\n" (render ++ fonts);

-    hardware.opengl.enable = mkIf cfg.hwRender true;
+    hardware.graphics.enable = mkIf cfg.hwRender true;

    fonts = mkIf (cfg.fonts != null) {
      fontconfig.enable = true;
--- a/nixos/modules/services/wayland/cage.nix
+++ b/nixos/modules/services/wayland/cage.nix
@ -101,7 +101,7 @@ in {
      session required ${config.systemd.package}/lib/security/pam_systemd.so
    '';

-    hardware.opengl.enable = mkDefault true;
+    hardware.graphics.enable = mkDefault true;

    systemd.targets.graphical.wants = [ "cage-tty1.service" ];

--- a/nixos/modules/services/x11/desktop-managers/phosh.nix
+++ b/nixos/modules/services/x11/desktop-managers/phosh.nix
@ -216,7 +216,7 @@ in

    security.pam.services.phosh = {};

-    hardware.opengl.enable = mkDefault true;
+    hardware.graphics.enable = mkDefault true;

    services.gnome.core-shell.enable = true;
    services.gnome.core-os-services.enable = true;
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -302,7 +302,7 @@ in
        default = [ "modesetting" "fbdev" ];
        example = [
          "nvidia"
-          "amdgpu-pro"
+          "amdgpu"
        ];
        # TODO(@oxij): think how to easily add the rest, like those nvidia things
        relatedPackages = concatLists
@ -716,10 +716,7 @@ in

        restartIfChanged = false;

-        environment =
-          optionalAttrs config.hardware.opengl.setLdLibraryPath
-            { LD_LIBRARY_PATH = lib.makeLibraryPath [ pkgs.addOpenGLRunpath.driverLink ]; }
-          // config.services.displayManager.environment;
+        environment = config.services.displayManager.environment;

        preStart =
          ''
--- a/nixos/modules/virtualisation/docker.nix
+++ b/nixos/modules/virtualisation/docker.nix
@ -244,8 +244,8 @@ in
      };

      assertions = [
-        { assertion = cfg.enableNvidia && pkgs.stdenv.isx86_64 -> config.hardware.opengl.driSupport32Bit or false;
-          message = "Option enableNvidia on x86_64 requires 32bit support libraries";
+        { assertion = cfg.enableNvidia && pkgs.stdenv.isx86_64 -> config.hardware.graphics.enable32Bit or false;
+          message = "Option enableNvidia on x86_64 requires 32-bit support libraries";
        }];

      virtualisation.docker.daemon.settings = {
--- a/nixos/tests/armagetronad.nix
+++ b/nixos/tests/armagetronad.nix
@ -12,7 +12,7 @@ let
    { pkgs, ... }:

    { imports = [ ./common/user-account.nix ./common/x11.nix ];
-      hardware.opengl.driSupport = true;
+      hardware.graphics.enable = true;
      virtualisation.memorySize = 256;
      environment = {
        systemPackages = [ pkgs.armagetronad ];
--- a/nixos/tests/cagebreak.nix
+++ b/nixos/tests/cagebreak.nix
@ -14,9 +14,7 @@ in
  };

  nodes.machine = { config, ... }:
-  let
-    alice = config.users.users.alice;
-  in {
+  {
    # Automatically login on tty1 as a normal user:
    imports = [ ./common/user-account.nix ];
    services.getty.autologinUser = "alice";
@ -31,7 +29,7 @@ in
      fi
    '';

-    hardware.opengl.enable = true;
+    hardware.graphics.enable = true;
    programs.xwayland.enable = true;
    security.polkit.enable = true;
    environment.systemPackages = [ pkgs.cagebreak pkgs.wayland-utils ];
--- a/nixos/tests/monado.nix
+++ b/nixos/tests/monado.nix
@ -5,7 +5,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
    { pkgs, ... }:

    {
-      hardware.opengl.enable = true;
+      hardware.graphics.enable = true;
      users.users.alice = {
        isNormalUser = true;
        uid = 1000;
--- a/nixos/tests/openarena.nix
+++ b/nixos/tests/openarena.nix
@ -5,7 +5,7 @@ let
    { pkgs, ... }:

    { imports = [ ./common/x11.nix ];
-      hardware.opengl.driSupport = true;
+      hardware.graphics.enable = true;
      environment.systemPackages = [ pkgs.openarena ];
    };

--- a/nixos/tests/quake3.nix
+++ b/nixos/tests/quake3.nix
@ -21,7 +21,7 @@ let
    { pkgs, ... }:

    { imports = [ ./common/x11.nix ];
-      hardware.opengl.driSupport = true;
+      hardware.graphics.enable = true;
      environment.systemPackages = [ pkgs.quake3demo ];
      nixpkgs.config.packageOverrides = overrides;
      nixpkgs.config.allowUnfreePredicate = unfreePredicate;
--- a/nixos/tests/seatd.nix
+++ b/nixos/tests/seatd.nix
@ -39,7 +39,7 @@ in
          dwl -s 'foot touch /tmp/foot_started'
    '';

-    hardware.opengl.enable = true;
+    hardware.graphics.enable = true;
    virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
    services.seatd.enable = true;
  };
--- a/nixos/tests/tinywl.nix
+++ b/nixos/tests/tinywl.nix
@ -16,7 +16,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
        systemPackages = with pkgs; [ tinywl foot wayland-utils ];
      };

-      hardware.opengl.enable = true;
+      hardware.graphics.enable = true;

      # Automatically start TinyWL when logging in on tty1:
      programs.bash.loginShellInit = ''
--- a/pkgs/applications/audio/waylyrics/default.nix
+++ b/pkgs/applications/audio/waylyrics/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "waylyrics";
-  version = "0.3.11";
+  version = "0.3.12";

  src = fetchFromGitHub {
    owner = "waylyrics";
    repo = "waylyrics";
    rev = "v${version}";
-    hash = "sha256-8jmB6kJUNHTT0w/1ADgjoMAP1zNpohsPl9FIGoh8UG4=";
+    hash = "sha256-FfrgeUDKiM9m0mvKlu02KEuvsq+3Gv3yPFW1DIQw05I=";
  };

-  cargoHash = "sha256-hH9EQAH1uSD6uRUxKv7O3ewZsijrbCSWWY7EmC0Z7tI=";
+  cargoHash = "sha256-xD46aKT18Kl+81Pfv+zleUUKhSV1Px7JFjhXw1/4cBA=";

  nativeBuildInputs = [ pkg-config wrapGAppsHook4 ];
  buildInputs = [ openssl dbus ];
--- a/pkgs/applications/editors/jetbrains/bin/linux.nix
+++ b/pkgs/applications/editors/jetbrains/bin/linux.nix
@ -110,7 +110,7 @@ with stdenv; lib.makeOverridable mkDerivation (rec {
      --set-default JDK_HOME "$jdk" \
      --set-default ANDROID_JAVA_HOME "$jdk" \
      --set-default JAVA_HOME "$jdk" \
-      --set-default JETBRAINSCLIENT_JDK "$jdk" \
+      --set-default JETBRAINS_CLIENT_JDK "$jdk" \
      --set-default ${hiName}_JDK "$jdk" \
      --set-default ${hiName}_VM_OPTIONS ${vmoptsFile}

--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -9676,6 +9676,18 @@ final: prev:
    meta.homepage = "https://github.com/mfukar/robotframework-vim/";
  };

+  rocks-nvim = buildNeovimPlugin {
+    pname = "rocks.nvim";
+    version = "2024-06-19";
+    src = fetchFromGitHub {
+      owner = "nvim-neorocks";
+      repo = "rocks.nvim";
+      rev = "6737e01a76eaaae06d11b45c8b5b774fa97c283b";
+      sha256 = "0vl6rm3rv1730iw3bwzrwjsgr1hw5h4ksdgpir5spd3vqj7i97lz";
+    };
+    meta.homepage = "https://github.com/nvim-neorocks/rocks.nvim/";
+  };
+
  ron-vim = buildVimPlugin {
    pname = "ron.vim";
    version = "2022-08-19";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -813,6 +813,7 @@ https://github.com/vim-scripts/restore_view.vim/,HEAD,restore-view-vim
 https://github.com/gu-fan/riv.vim/,,
 https://github.com/kevinhwang91/rnvimr/,,
 https://github.com/mfukar/robotframework-vim/,,
+https://github.com/nvim-neorocks/rocks.nvim/,,
 https://github.com/ron-rs/ron.vim/,,
 https://github.com/jmederosalvarado/roslyn.nvim/,HEAD,
 https://github.com/keith/rspec.vim/,,
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -6,17 +6,17 @@ callPackage ./make-brave.nix (removeAttrs args [ "callPackage" ])
    if stdenv.isAarch64 then
      {
        pname = "brave";
-        version = "1.66.118";
-        url = "https://github.com/brave/brave-browser/releases/download/v1.66.118/brave-browser_1.66.118_arm64.deb";
-        hash = "sha256-H2f6i86lDToHEkJ9JZCBp3tlpnI+zoFHY3YzLdp5lE4=";
+        version = "1.67.116";
+        url = "https://github.com/brave/brave-browser/releases/download/v1.67.116/brave-browser_1.67.116_arm64.deb";
+        hash = "sha256-YOvfXI+bSX3WZRBYXxGYhNme9NZl3ob/JYw6KshXn54=";
        platform = "aarch64-linux";
      }
    else if stdenv.isx86_64 then
      {
        pname = "brave";
-        version = "1.66.118";
-        url = "https://github.com/brave/brave-browser/releases/download/v1.66.118/brave-browser_1.66.118_amd64.deb";
-        hash = "sha256-r7lpEOxECOqJ23XxTHqSy6KhyNPRwOkuJvnZUuuBN4k=";
+        version = "1.67.116";
+        url = "https://github.com/brave/brave-browser/releases/download/v1.67.116/brave-browser_1.67.116_amd64.deb";
+        hash = "sha256-J4ap0bEAg5Q40U155AdAyzereBAo8Q/YDedDVqYvaT4=";
        platform = "x86_64-linux";
      }
    else
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -1,11 +1,11 @@
 {
  stable = {
    chromedriver = {
-      hash_darwin = "sha256-OvRkO/mBXOk3IqZtvjKzOsBPBaZzq+YOb//SsXtgB9k=";
+      hash_darwin = "sha256-BWZaa1+3EUG11RmZjjbwG2UPZhlCpW3X9rkpiWrjgzM=";
      hash_darwin_aarch64 =
-        "sha256-ODR4fFW24yh4vIGcWjBVH+mfK+LECU/LXlWVq+NBNlI=";
-      hash_linux = "sha256-7vWid5i9bOyuGL2v9kdzv2yW2ZqWNNZDQScSDriaxxM=";
-      version = "126.0.6478.61";
+        "sha256-wkUIFolVdvcnEQKKehKCyD5GS5Q42fVFKj/iHtiIj8I=";
+      hash_linux = "sha256-owTmkkgMcmuuhGv23uNjFjBdC49IJt+v6rjWu7xuchQ=";
+      version = "126.0.6478.62";
    };
    deps = {
      gn = {
@ -15,8 +15,8 @@
        version = "2024-05-13";
      };
    };
-    hash = "sha256-cB2jrasrtaFWM8tpG9leuC+jUAvoU8g5977cn4r7rbw=";
-    version = "126.0.6478.61";
+    hash = "sha256-sXP+/KXDoy3QnRoa9acGbsXKVCPspyNGtZTLMHBqxvw=";
+    version = "126.0.6478.114";
  };
  ungoogled-chromium = {
    deps = {
--- a/pkgs/applications/networking/cluster/k9s/default.nix
+++ b/pkgs/applications/networking/cluster/k9s/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "k9s";
-  version = "0.32.4";
+  version = "0.32.5";

  src = fetchFromGitHub {
    owner = "derailed";
    repo = "k9s";
    rev = "v${version}";
-    hash = "sha256-0MAnN1ekzHLs25EspDN3xacmDvwXGwKO/5RsCMMwTI8=";
+    hash = "sha256-H0PimkPXs2/iirOpN82az3Bge71k1RZOhMtr0UmGOy8=";
  };

  ldflags = [
@ -23,7 +23,7 @@ buildGoModule rec {

  proxyVendor = true;

-  vendorHash = "sha256-Eaz56iU862KDAlVPuMo8qPuWSFCxEFcJ3Qubl9TUiyI=";
+  vendorHash = "sha256-U/tIsYpoog3S8V2yQGGqaQ+Av7TfvCYt3zn74qWuQKs=";

  # TODO investigate why some config tests are failing
  doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
--- a/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-cursed/default.nix
@ -7,7 +7,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "deltachat-cursed";
-  version = "0.8.0";
+  version = "0.9.0";

  pyproject = true;

@ -15,17 +15,17 @@ python3.pkgs.buildPythonApplication rec {
    owner = "adbenitez";
    repo = "deltachat-cursed";
    rev = "v${version}";
-    hash = "sha256-1QNhNPa6ZKn0lGQXs/cmfdSFHscwlYwFC/2DpnMoHvY=";
+    hash = "sha256-z4JKe5soR4FdIn8hugxtnxQr/9V8m8a7QRzE1liIexc=";
  };

-  nativeBuildInputs = with python3.pythonOnBuildForHost.pkgs; [
+  build-system = with python3.pythonOnBuildForHost.pkgs; [
    setuptools
    setuptools-scm
  ];

-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
    appdirs
-    deltachat
+    deltachat2
    emoji
    notify-py
    setuptools # for pkg_resources
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@ -1,11 +1,12 @@
 { lib
 , buildNpmPackage
 , copyDesktopItems
-, electron_28
+, electron
 , buildGoModule
 , esbuild
 , fetchFromGitHub
 , jq
+, deltachat-rpc-server
 , libdeltachat
 , makeDesktopItem
 , makeWrapper
@ -36,16 +37,16 @@ let
 in
 buildNpmPackage rec {
  pname = "deltachat-desktop";
-  version = "1.44.1";
+  version = "1.46.1";

  src = fetchFromGitHub {
    owner = "deltachat";
    repo = "deltachat-desktop";
    rev = "v${version}";
-    hash = "sha256-fL+9oPQ5dAgvQREZ7A+hKo2MnZKeVvadQDvDPsDNbnQ=";
+    hash = "sha256-90/Wmh0h75i3kvqj3Wo+A3KlKW8LLDWfPza2gDrDY6E=";
  };

-  npmDepsHash = "sha256-rUxJLDsAfp+brecTThYTdHIVIfVkKwZ/W5sHV0hHHIk=";
+  npmDepsHash = "sha256-UzWxMd+DYH5A8Zo1rzi8oIsoKbmzsVbGpr3uWtc02rY=";

  postPatch = ''
    test \
@ -64,6 +65,7 @@ buildNpmPackage rec {
  ];

  buildInputs = [
+    deltachat-rpc-server
    libdeltachat
  ] ++ lib.optionals stdenv.isDarwin [
    CoreServices
@ -77,7 +79,8 @@ buildNpmPackage rec {
  };

  preBuild = ''
-    rm -r node_modules/deltachat-node/node/prebuilds
+    rm node_modules/@deltachat/stdio-rpc-server-*/deltachat-rpc-server
+    ln -s ${lib.getExe deltachat-rpc-server} node_modules/@deltachat/stdio-rpc-server-linux-*
  '';

  npmBuildScript = "build4production";
@ -93,6 +96,9 @@ buildNpmPackage rec {
    awk '!/^#/ && NF' build/packageignore_list \
      | xargs -I {} sh -c "rm -rf $out/lib/node_modules/deltachat-desktop/{}" || true

+    # required for electron to import index.js as a module
+    cp package.json $out/lib/node_modules/deltachat-desktop
+
    install -D build/icon.png \
      $out/share/icons/hicolor/scalable/apps/deltachat.png

@ -103,7 +109,7 @@ buildNpmPackage rec {
        $out/lib/node_modules/deltachat-desktop/html-dist/fonts
    done

-    makeWrapper ${lib.getExe electron_28} $out/bin/deltachat \
+    makeWrapper ${lib.getExe electron} $out/bin/deltachat \
      --set LD_PRELOAD ${sqlcipher}/lib/libsqlcipher${stdenv.hostPlatform.extensions.sharedLibrary} \
      --add-flags $out/lib/node_modules/deltachat-desktop

--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
  pname = "signal-desktop";
  dir = "Signal";
-  version = "7.11.1";
+  version = "7.12.0";
  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-ROJ2aQY0NPZD2GcjdQ1OxbeXKC+60n791Nxs93CyJ/Y=";
+  hash = "sha256-k8Dp3MiWRNpWEGqYtt5o8FtL3fJ9AkIm+hjvW8r6qG0=";
 }
--- a/pkgs/applications/science/electronics/gtkwave/default.nix
+++ b/pkgs/applications/science/electronics/gtkwave/default.nix
@ -16,11 +16,11 @@

 stdenv.mkDerivation rec {
  pname = "gtkwave";
-  version = "3.3.119";
+  version = "3.3.120";

  src = fetchurl {
    url = "mirror://sourceforge/gtkwave/${pname}-gtk3-${version}.tar.gz";
-    sha256 = "sha256-6rPgnnZBEVwHhIv7MPfdDDu+K4y+RQF+leB327pqwDg=";
+    sha256 = "sha256-XalIY/suXYjMAZ4r/cZ2AiOYETiUtYXYZOEcqDQbJNg=";
  };

  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];
--- a/pkgs/applications/science/logic/lean4/default.nix
+++ b/pkgs/applications/science/logic/lean4/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lean4";
-  version = "4.7.0";
+  version = "4.8.0";

  src = fetchFromGitHub {
    owner = "leanprover";
    repo = "lean4";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-jHY8BhDotfGcMS0Xzl5iawqCaug3dDEKuD5Y1WcM06I=";
+    hash = "sha256-R75RrAQb/tRTtMvy/ddLl1KQaA7V71nocvjIS9geMrg=";
  };

  postPatch = ''
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, bzip2, gfortran, libX11, libXmu, libXt, libjpeg, libpng
+{ lib, stdenv, fetchurl, bzip2, gfortran, libX11, libXmu, libXt, libjpeg, libpng
 , libtiff, ncurses, pango, pcre2, perl, readline, tcl, texlive, texliveSmall, tk, xz, zlib
 , less, texinfo, graphviz, icu, pkg-config, bison, imake, which, jdk, blas, lapack
 , curl, Cocoa, Foundation, libobjc, libcxx, tzdata
@ -15,13 +15,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);

 stdenv.mkDerivation (finalAttrs: {
  pname = "R";
-  version = "4.3.3";
+  version = "4.4.1";

  src = let
    inherit (finalAttrs) pname version;
  in fetchurl {
    url = "https://cran.r-project.org/src/base/R-${lib.versions.major version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-gIUSMTk7hb84d+6eObKC51Dthkxexgy9aObhOfBSAzA=";
+    sha256 = "sha256-tMtnXequtymdOyZdIYzeQ/GSlRzluJt7saUUijay2U0=";
  };

  outputs = [ "out" "tex" ];
@ -37,12 +37,6 @@ stdenv.mkDerivation (finalAttrs: {

  patches = [
    ./no-usr-local-search-paths.patch
-    (fetchpatch {
-      # https://hiddenlayer.com/research/r-bitrary-code-execution/
-      name = "CVE-2024-27322.patch";
-      url = "https://github.com/r-devel/r-svn/commit/f7c46500f455eb4edfc3656c3fa20af61b16abb7.patch";
-      hash = "sha256-CH2mMmie9E96JeGSC7UGm7/roUNhK5xv6HO53N2ixEI=";
-    })
  ];

  # Test of the examples for package 'tcltk' fails in Darwin sandbox. See:
--- a/pkgs/applications/science/misc/boinc/default.nix
+++ b/pkgs/applications/science/misc/boinc/default.nix
@ -27,14 +27,14 @@

 stdenv.mkDerivation rec {
  pname = "boinc";
-  version = "8.0.2";
+  version = "8.0.3";

  src = fetchFromGitHub {
    name = "${pname}-${version}-src";
    owner = "BOINC";
    repo = "boinc";
    rev = "client_release/${lib.versions.majorMinor version}/${version}";
-    hash = "sha256-e0zEdiN3QQHj6MNGd1pfaZf3o9rOpCTmuNSJQb3sss4=";
+    hash = "sha256-kkEEJp7NTpHwbo03BGjjJAraFQIJcoNyV+oDsCZlzPQ=";
  };

  nativeBuildInputs = [ libtool automake autoconf m4 pkg-config ];
--- a/pkgs/applications/version-management/git-branchless/default.nix
+++ b/pkgs/applications/version-management/git-branchless/default.nix
@ -27,12 +27,14 @@ rustPlatform.buildRustPackage rec {
  patches = [
    # Fix tests with Git 2.44.0+
    (fetchpatch {
-      url = "https://github.com/arxanas/git-branchless/pull/1245.patch";
+      name = "1245.patch"; # https://github.com/arxanas/git-branchless/pull/1245
+      url = "https://github.com/arxanas/git-branchless/commit/c8436aed3d616409b4d6fb1eedb383077f435497.patch";
      hash = "sha256-gBm0A478Uhg9IQVLQppvIeTa8s1yHUMddxiUbpHUvGw=";
    })
    # Fix tests with Git 2.44.0+
    (fetchpatch {
-      url = "https://github.com/arxanas/git-branchless/pull/1161.patch";
+      name = "1161.patch"; # https://github.com/arxanas/git-branchless/pull/1161
+      url = "https://github.com/arxanas/git-branchless/commit/6e1f26900a0dd60d10d9aa3552cab9181fa7be03.patch";
      hash = "sha256-KHobEIXhlDar8CvIVUi4I695jcJZXgGRhU86b99x86Y=";
    })
  ];
--- a/pkgs/applications/video/mpv/scripts/mpv-notify-send.nix
+++ b/pkgs/applications/video/mpv/scripts/mpv-notify-send.nix
@ -21,7 +21,8 @@ buildLua rec {
  patches = [
    # show title of online videos instead of url
    (fetchpatch {
-      url = "https://github.com/emilazy/mpv-notify-send/pull/6.patch";
+      name = "6.patch"; # https://github.com/emilazy/mpv-notify-send/pull/6
+      url = "https://github.com/emilazy/mpv-notify-send/commit/948347e14890e15e89cd1e069beb1140e2d01dce.patch";
      hash = "sha256-7aXQ8qeqG4yX0Uyn09xCIESnwPZsb6Frd7C49XgbpFw=";
    })
  ];
--- a/pkgs/applications/video/webtorrent_desktop/default.nix
+++ b/pkgs/applications/video/webtorrent_desktop/default.nix
@ -12,12 +12,14 @@ buildNpmPackage {
  patches = [
    # electron 27 fix
    (fetchpatch {
-      url = "https://github.com/webtorrent/webtorrent-desktop/pull/2388.patch";
+      name = "2388.patch"; # https://github.com/webtorrent/webtorrent-desktop/pull/2388
+      url = "https://github.com/webtorrent/webtorrent-desktop/compare/ebaf9cf8487dbd9e14a9a0c5adc3eab23b199e58...0c3e55d1f091bf66a342e2732550ebeccc2e4169.patch";
      hash = "sha256-gam5oAZtsaiCNFwecA5ff0nhraySLx3SOHlb/js+cPM=";
    })
    # startup fix
    (fetchpatch {
-      url = "https://github.com/webtorrent/webtorrent-desktop/pull/2389.patch";
+      name = "2389.patch"; # https://github.com/webtorrent/webtorrent-desktop/pull/2389
+      url = "https://github.com/webtorrent/webtorrent-desktop/commit/407046d150ed7ff876a5e1978f68630e9c8f0074.patch";
      hash = "sha256-hBJGLNNjcGRhYOFlLm/RL0po+70tEeJtR6Y/CfacPAI=";
    })
  ];
--- a/pkgs/by-name/an/ananicy-cpp/match-wrappers.patch
+++ b/pkgs/by-name/an/ananicy-cpp/match-wrappers.patch
@ -0,0 +1,16 @@
+diff --git a/src/worker.cpp b/src/worker.cpp
+index 0cf8955..b9dc70f 100644
+--- a/src/worker.cpp
+++ b/src/worker.cpp
+@@ -29,7 +29,10 @@ void Worker::work(const std::stop_token &stop_token) {
+   while (!stop_token.stop_requested()) {
+     while ((proc = process_queue->poll(500ms)).has_value()) {
+       const auto &p = proc.value();
+-      const auto &rule = rules->get_rule(p.name);
+      auto name = p.name;
+      if (name.starts_with('.') && name.ends_with("-wrapped"))
+        name = name.substr(1, name.find_last_of('-') - 1);
+      const auto &rule = rules->get_rule(name);
+ 
+       processed_count++;
+ 
--- a/pkgs/by-name/an/ananicy-cpp/package.nix
+++ b/pkgs/by-name/an/ananicy-cpp/package.nix
@ -33,6 +33,7 @@ clangStdenv.mkDerivation rec {
      url = "https://gitlab.com/ananicy-cpp/ananicy-cpp/-/commit/6ea2dccceec39b6c4913f617dad81d859aa20f24.patch";
      hash = "sha256-C+7x/VpVwewXEPwibi7GxGfjuhDkhcjTyGbZHlYL2Bs=";
    })
+    ./match-wrappers.patch
  ];

  strictDeps = true;
@ -80,6 +81,7 @@ clangStdenv.mkDerivation rec {
    maintainers = with lib.maintainers; [
      artturin
      johnrtitor
+      diniamo
    ];
    mainProgram = "ananicy-cpp";
  };
--- a/pkgs/by-name/ar/arkenfox-userjs/package.nix
+++ b/pkgs/by-name/ar/arkenfox-userjs/package.nix
@ -0,0 +1,41 @@
+{
+  lib,
+  fetchurl,
+  stdenvNoCC,
+  nix-update-script,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "arkenfox-userjs";
+  version = "126.1";
+
+  src = fetchurl {
+    url = "https://raw.githubusercontent.com/arkenfox/user.js/${finalAttrs.version}/user.js";
+    hash = "sha256-XRtG0iLKh8uqbeX7Rc2H6VJwZYJoNZPBlAfZEfrSCP4=";
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 $src $out/user.js
+    install -Dm644 $src $out/user.cfg
+    substituteInPlace $out/user.cfg \
+      --replace-fail "user_pref" "defaultPref"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "A comprehensive user.js template for configuration and hardening";
+    homepage = "https://github.com/arkenfox/user.js";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      linsui
+      Guanran928
+    ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/ca/cargo-i18n/package.nix
+++ b/pkgs/by-name/ca/cargo-i18n/package.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-i18n";
-  version = "0.2.12";
+  version = "0.2.13";

  src = fetchFromGitHub {
    owner = "kellpossible";
    repo = "cargo-i18n";
    rev = "v${version}";
-    hash = "sha256-ck0GYy9DLngOunpItGQ4+qrlzaWDk0zTnIzuRQt2/Gw=";
+    hash = "sha256-azwQlXsoCgNB/TjSBBE+taUR1POBJXaPnS5Sr+HVR90=";
  };

-  cargoHash = "sha256-nvZx2wJDs7PZQLCl8Hrf2blR+lNUBVr6k664VSVQ5iI=";
+  cargoHash = "sha256-vN62QmCuhu7AjL6xSpBU6/ul4WgNLZbjWDCFyHj6rIM=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.Foundation
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@ -12,16 +12,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "dbeaver-bin";
-  version = "24.0.5";
-
-  nativeBuildInputs =
-    [ makeWrapper ]
-    ++ lib.optionals (!stdenvNoCC.isDarwin) [
-      gnused
-      wrapGAppsHook3
-      autoPatchelfHook
-    ]
-    ++ lib.optionals stdenvNoCC.isDarwin [ undmg ];
+  version = "24.1.0";

  src =
    let
@ -34,10 +25,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
        aarch64-darwin = "macos-aarch64.dmg";
      };
      hash = selectSystem {
-        x86_64-linux = "sha256-q6VIr55hXn47kZrE2i6McEOfp2FBOvwB0CcUnRHFMZs=";
-        aarch64-linux = "sha256-Xn3X1C31UALBAsZIGyMWdp0HNhJEm5N+7Go7nMs8W64=";
-        x86_64-darwin = "sha256-XOQaMNQHOC4dVJXIUn4l4Oa7Gohbq+JMDFusIy/U+tc=";
-        aarch64-darwin = "sha256-554ea5p1MR4XIHtSeByd4S/Ke4cKRZbITTNRRDoRqPI=";
+        x86_64-linux = "sha256-cJcjUoZSpD87jy4GGIxMinZW4gxRZfcGO0GdGUGXI6g=";
+        aarch64-linux = "sha256-96t/T/VzzzaSWJbPBb1CH2FXqfhiH1d0MjRoPsRMRwo=";
+        x86_64-darwin = "sha256-8xqSL8fTveg1Y5huBTYZLyubajt27h4XUBzyYVF394A=";
+        aarch64-darwin = "sha256-r7WqJrNF1IgQHx3Na1fGk0ywsfh5t4Dl/u8hH6CPuoE=";
      };
    in
    fetchurl {
@ -45,15 +36,25 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      inherit hash;
    };

+  sourceRoot = lib.optional stdenvNoCC.isDarwin "dbeaver.app";
+
+  nativeBuildInputs =
+    [ makeWrapper ]
+    ++ lib.optionals (!stdenvNoCC.isDarwin) [
+      gnused
+      wrapGAppsHook3
+      autoPatchelfHook
+    ]
+    ++ lib.optionals stdenvNoCC.isDarwin [ undmg ];
+
  dontConfigure = true;
  dontBuild = true;

-  sourceRoot = lib.optional stdenvNoCC.isDarwin "dbeaver.app";
-
  installPhase =
    if !stdenvNoCC.isDarwin then
      ''
        runHook preInstall
+
        mkdir -p $out/opt/dbeaver $out/bin
        cp -r * $out/opt/dbeaver
        makeWrapper $out/opt/dbeaver/dbeaver $out/bin/dbeaver \
--- a/pkgs/by-name/db/dbeaver-bin/update.sh
+++ b/pkgs/by-name/db/dbeaver-bin/update.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -I nixpkgs=./. -i bash -p curl jq
+#!nix-shell -I nixpkgs=./. -i bash -p curl jq common-updater-scripts

 latestVersion=$(curl "https://api.github.com/repos/dbeaver/dbeaver/tags" | jq -r '.[0].name')
 currentVersion=$(nix-instantiate --eval -E "with import ./. {}; dbeaver-bin.version" | tr -d '"')
--- a/pkgs/by-name/de/design/package.nix
+++ b/pkgs/by-name/de/design/package.nix
@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, wrapGAppsHook4
+, appstream-glib
+, blueprint-compiler
+, desktop-file-utils
+, meson
+, ninja
+, pkg-config
+, glib
+, gjs
+, libadwaita
+}:
+
+stdenv.mkDerivation rec {
+  pname = "design";
+  version = "46-alpha1";
+
+  src = fetchFromGitHub {
+    owner = "dubstar-04";
+    repo = "Design";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    hash = "sha256-Q4R/Ztu4w8IRvq15xNXN/iP/6hIHe/W+me1jROGpYc8=";
+  };
+
+  nativeBuildInputs = [
+    appstream-glib
+    blueprint-compiler
+    desktop-file-utils
+    gjs
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    glib
+    libadwaita
+  ];
+
+  # Use a symlink here so that the basename isn't changed by the wrapper which is used to decide the resource path.
+  postInstall = ''
+    mv $out/bin/io.github.dubstar_04.design $out/share/design/
+    ln -s $out/share/design/io.github.dubstar_04.design $out/bin
+  '';
+
+  meta = {
+    homepage = "https://github.com/dubstar-04/Design";
+    description = "2D CAD For GNOME";
+    maintainers = with lib.maintainers; [ linsui ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    mainProgram = "io.github.dubstar_04.design";
+  };
+}
--- a/pkgs/by-name/gi/gitlab-ci-local/package.nix
+++ b/pkgs/by-name/gi/gitlab-ci-local/package.nix
@ -6,16 +6,16 @@

 buildNpmPackage rec {
  pname = "gitlab-ci-local";
-  version = "4.50.1";
+  version = "4.51.0";

  src = fetchFromGitHub {
    owner = "firecow";
    repo = "gitlab-ci-local";
    rev = version;
-    hash = "sha256-nlxYZY8SntMffmKiDpp/m8GfsB4lp+T8UoUPOLQlcC8=";
+    hash = "sha256-D1zviTj7isAuEyzRYEyjq4sx+jo/U3ZQZLFr35/1ZNo=";
  };

-  npmDepsHash = "sha256-uDhot9kGmF717itia6hyx0xZkyMYDpH7BmGl12xSJyI=";
+  npmDepsHash = "sha256-ocrSOPLbWkU0LBpWAdl54hWr+7gE3z2sy8lJilGsExo=";

  postPatch = ''
    # remove cleanup which runs git commands
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@ -64,11 +64,11 @@ let

 in stdenv.mkDerivation (finalAttrs: {
  pname = "google-chrome";
-  version = "126.0.6478.61";
+  version = "126.0.6478.114";

  src = fetchurl {
    url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-L7gBl4SMHIq0x+GZiaaK5Dxs+UJDandz0xYET7YO73o=";
+    hash = "sha256-CGqo6XnUwndOjODOxy+TCGxDXbAz4EwkZMOl7ZLFsAc=";
  };

  nativeBuildInputs = [ patchelf makeWrapper ];
--- a/pkgs/by-name/go/gosmee/package.nix
+++ b/pkgs/by-name/go/gosmee/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "gosmee";
-  version = "0.22.0";
+  version = "0.22.1";

  src = fetchFromGitHub {
    owner = "chmouel";
    repo = "gosmee";
    rev = "v${version}";
-    sha256 = "sha256-PP+N8BihgSvYL7yHlBJOK4zWkuM75iaGc7Gld+c0D6Y=";
+    sha256 = "sha256-UnGzPkbw7x8l1+9xEXFiJZFzJT5yu7MCgPKkKzaFqkk=";
  };
  vendorHash = null;

--- a/pkgs/by-name/hy/hyprutils/package.nix
+++ b/pkgs/by-name/hy/hyprutils/package.nix
@ -2,25 +2,34 @@
  lib,
  stdenv,
  cmake,
+  pkg-config,
+  pixman,
  fetchFromGitHub,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "hyprutils";
-  version = "0.1.2";
+  version = "0.1.4";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = "hyprutils";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-8KvVqtApNt4FWTdn1TqVvw00rpqyG9UuUPA2ilPVD1U=";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-CqRZne63BpYlPd/i8lXV0UInUt59oKogiwdVtBRHt60=";
  };

-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];

-  outputs = [ "out" "dev" ];
+  buildInputs = [
+    pixman
+  ];

-  doCheck = false;
+  outputs = ["out" "dev"];
+
+  cmakeBuildType = "RelWithDebInfo";

  meta = {
    homepage = "https://github.com/hyprwm/hyprutils";
--- a/pkgs/by-name/ic/ice-bar/package.nix
+++ b/pkgs/by-name/ic/ice-bar/package.nix
@ -0,0 +1,41 @@
+{
+  lib,
+  stdenvNoCC,
+  unzip,
+  fetchurl,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "ice-bar";
+  version = "0.9.0";
+
+  src = fetchurl {
+    url = "https://github.com/jordanbaird/Ice/releases/download/${finalAttrs.version}/Ice.zip";
+    hash = "sha256-MvkJRP8Stz9VIK3vBnWezVKq2KkPfUa/NUBxJtYzHhU=";
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ unzip ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications"
+    cp -r *.app "$out/Applications"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Powerful menu bar manager for macOS";
+    homepage = "https://icemenubar.app/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ donteatoreo ];
+    platforms = lib.platforms.darwin;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
--- a/pkgs/by-name/it/itools/package.nix
+++ b/pkgs/by-name/it/itools/package.nix
@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, pkgs
+, pkg-config
+, perl
+, libitl
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "itools";
+  version = "1.1";
+
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  buildInputs = [ libitl perl ];
+
+  outputs = [ "out" "man" ];
+
+  src = fetchFromGitHub {
+    owner = "arabeyes-org";
+    repo = "itools";
+    rev = finalAttrs.version;
+    hash = "sha256-DxTZaq2SlEmy9k7iAdjctpPkk+2rIaF+xEcfXj/ERWw=";
+  };
+
+  meta = {
+    description = "Islamic command-line tools for prayer times and hijri dates";
+    longDescription = ''
+      The itools package is a set of user friendly applications utilizing Arabeyes' ITL library.
+
+      The package addresses two main areas - hijri date and prayertime calculation. The package
+      is envisioned to mimick the development of the underlying ITL library and is meant to
+      always give the end-user a simple means to access its functions.
+    '';
+    homepage = "https://www.arabeyes.org/ITL";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ amyipdev ];
+  };
+})
--- a/pkgs/by-name/ja/jasp-desktop/modules.nix
+++ b/pkgs/by-name/ja/jasp-desktop/modules.nix
@ -33,6 +33,9 @@ let

    env.INCLUDE_DIR = "../inst/include/jaspColumnEncoder";

+    # necessary for R 4.4.0
+    hardeningDisable = [ "format" ];
+
    postPatch = ''
      mkdir -p inst/include
      cp -r --no-preserve=all ${jaspColumnEncoder-src} inst/include/jaspColumnEncoder
--- a/pkgs/by-name/ja/jasp-desktop/package.nix
+++ b/pkgs/by-name/ja/jasp-desktop/package.nix
@ -66,6 +66,9 @@ stdenv.mkDerivation {
    "-DCUSTOM_R_PATH=${customREnv}"
  ];

+  # necessary for R 4.4.0
+  hardeningDisable = [ "format" ];
+
  nativeBuildInputs = [
    cmake
    ninja
--- a/pkgs/by-name/li/libsbml/package.nix
+++ b/pkgs/by-name/li/libsbml/package.nix
@ -22,9 +22,9 @@ stdenv.mkDerivation (attrs: {

  patches = [
    # This should be in next release, remember to remove fetchpatch
-    (fetchpatch {
+    (fetchpatch { # https://github.com/sbmlteam/libsbml/pull/358
      name = "fix-xmlerror-conversion.patch";
-      url = "https://github.com/sbmlteam/libsbml/pull/358.patch";
+      url = "https://github.com/sbmlteam/libsbml/commit/de2f77ee6766fe933a1472200f5e08e7c5ba6f8c.patch";
      hash = "sha256-uirG6XJ+w0hqBUEAGDnzhHoVtJVRdN1eqBYeneKMBao=";
    })
  ];
--- a/pkgs/by-name/mo/modern-cpp-kafka/package.nix
+++ b/pkgs/by-name/mo/modern-cpp-kafka/package.nix
@ -21,14 +21,14 @@ stdenv.mkDerivation rec {
  };

  patches = [
-    (fetchpatch {
+    (fetchpatch { # https://github.com/morganstanley/modern-cpp-kafka/pull/221
      name = "fix-avoid-overwriting-library-paths.patch";
-      url = "https://github.com/morganstanley/modern-cpp-kafka/pull/221.patch";
+      url = "https://github.com/morganstanley/modern-cpp-kafka/compare/a146d10bcf166f55299c7a55728abaaea52cb0e5...a0b5ec08315759097ce656813be57b2c38d79091.patch";
      hash = "sha256-UsQcMvJoRTn5kgXhmXOyqfW3n59kGKO596U2WjtdqAY=";
    })
-    (fetchpatch {
+    (fetchpatch { # https://github.com/morganstanley/modern-cpp-kafka/pull/222
      name = "add-pkg-config-cmake-config.patch";
-      url = "https://github.com/morganstanley/modern-cpp-kafka/pull/222.patch";
+      url = "https://github.com/morganstanley/modern-cpp-kafka/commit/edc576ab83710412f6201e2bb8de5cb41682ee4a.patch";
      hash = "sha256-OjoSttnpgEwSZjCVKc888xJb5f1Dulu/rQqoGmqXNM4=";
    })
    # Fix gcc-13 build failure:
--- a/pkgs/by-name/nu/numi/package.nix
+++ b/pkgs/by-name/nu/numi/package.nix
@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  undmg,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "numi";
+  version = "3.32.721";
+
+  src = fetchurl {
+    url = "https://s3.numi.app/updates/${finalAttrs.version}/Numi.dmg";
+    hash = "sha256-IbX4nsrPqwOSlYdNJLeaRQwIDVJrzfMXFqRqixHd2zA=";
+  };
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications"
+    cp -R *.app "$out/Applications"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Beautiful calculator app for macOS";
+    homepage = "https://numi.app/";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ donteatoreo ];
+    platforms = lib.platforms.darwin;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
--- a/pkgs/by-name/nu/nuv/package.nix
+++ b/pkgs/by-name/nu/nuv/package.nix
@ -0,0 +1,75 @@
+{ lib
+, stdenv
+, symlinkJoin
+, callPackage
+, fetchFromGitHub
+, fetchurl
+, buildGoModule
+, makeWrapper
+, breakpointHook
+, jq
+, curl
+, kubectl
+, eksctl
+, kind
+, k3sup
+, coreutils
+}:
+
+let
+  branch = "3.0.0";
+  version = "3.0.1-beta.2405292059";
+  pname = "nuv";
+in
+buildGoModule {
+  inherit pname version;
+
+  src = fetchFromGitHub {
+    owner = "nuvolaris";
+    repo = "nuv";
+    rev = version;
+    hash = "sha256-MdnBvlA4S2Mi/bcbE+O02x+wvlIrsK1Zc0dySz4FB/w=";
+  };
+
+  subPackages = [ "." ];
+  vendorHash = "sha256-JkQbQ2NEaumXbAfsv0fNiQf/EwMs3SDLHvu7c/bU7fU=";
+
+  nativeBuildInputs = [ makeWrapper jq curl breakpointHook ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.NuvVersion=${version}"
+    "-X main.NuvBranch=${branch}"
+  ];
+
+  # false because tests require some modifications inside nix-env
+  doCheck = false;
+
+  postInstall = let
+    nuv-bin = symlinkJoin {
+      name = "nuv-bin";
+      paths = [
+        coreutils
+        kubectl
+        eksctl
+        kind
+        k3sup
+      ];
+    };
+  in ''
+    wrapProgram $out/bin/nuv --set NUV_BIN "${nuv-bin}/bin"
+  '';
+
+  passthru.tests = {
+    simple = callPackage ./tests.nix { inherit version; };
+  };
+
+  meta = {
+    homepage = "https://nuvolaris.io/";
+    description = "A CLI tool for running tasks using the Nuvolaris serverless engine";
+    license = lib.licenses.asl20;
+    mainProgram = "nuv";
+    maintainers = with lib.maintainers; [ msciabarra d4rkstar ];
+  };
+}
--- a/pkgs/by-name/nu/nuv/tests.nix
+++ b/pkgs/by-name/nu/nuv/tests.nix
@ -0,0 +1,17 @@
+{ runCommand, nuv, version }:
+
+runCommand "nuv-test-run"
+{
+  nativeBuildInputs = [ nuv ];
+} ''
+  export TMP_BASE=$(mktemp -d /tmp/.nuv-XXXXX)
+  export HOME=$TMP_BASE
+  export NUV_REPO=""
+  export NUV_ROOT=$TMP_BASE/.nuv/3.0.0/olaris
+  rm -rf $TMP_BASE/.nuv && \
+    mkdir -p $TMP_BASE/.nuv/3.0.0/olaris && \
+    mkdir $TMP_BASE/.nuv/tmp
+  V=$(nuv -version 2>/dev/null)
+  diff -U3 --color=auto <(echo "$V") <(echo "${version}")
+  touch $out
+''
--- a/pkgs/by-name/ow/owncloud-client/package.nix
+++ b/pkgs/by-name/ow/owncloud-client/package.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "owncloud-client";
-  version = "5.3.0";
+  version = "5.3.1";

  src = fetchFromGitHub {
    owner = "owncloud";
    repo = "client";
    rev = "refs/tags/v${version}";
-    hash = "sha256-2BM5XoblPwI2xr0e9VHiN4ePkyUx+NyMDY7HkWa9uZM=";
+    hash = "sha256-ot+2hxipeZ5eI6nPJ8XGE8gFMNQoblUq+koAFZpZDv4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pi/picom-pijulius/package.nix
+++ b/pkgs/by-name/pi/picom-pijulius/package.nix
@ -1,18 +1,20 @@
 {
  picom,
  lib,
+  writeShellScript,
  fetchFromGitHub,
-  pcre
+  pcre,
+  unstableGitUpdater
 }:
 picom.overrideAttrs (previousAttrs: {
  pname = "picom-pijulius";
-  version = "8.2-unstable-2024-04-30";
+  version = "8.2-unstable-2024-06-13";

  src = fetchFromGitHub {
    owner = "pijulius";
    repo = "picom";
-    rev = "e7b14886ae644aaa657383f7c4f44be7797fd5f6";
-    hash = "sha256-YQVp5HicO+jbvCYSY+hjDTnXCU6aS3aCvbux6NFcJ/Y=";
+    rev = "a0e818855daba0d2f11a298f7fd238f8a6049167";
+    hash = "sha256-w1SWYhPfFGX2EumEe8UBZA3atW4jvW54GsMYLGg59Ys=";
  };

  buildInputs = (previousAttrs.buildInputs or [ ]) ++ [ pcre ];
@ -29,4 +31,11 @@ picom.overrideAttrs (previousAttrs: {
    homepage = "https://github.com/pijulius/picom";
    maintainers = with lib.maintainers; [ YvesStraten ];
  };
+
+  passthru.updateScript = unstableGitUpdater {
+    tagFormat = "v([A-Z]+)([a-z]+)|v([1-9]).([1-9])|v([1-9])-rc([1-9])";
+    tagConverter = writeShellScript "picom-pijulius-tag-converter.sh" ''
+sed -e 's/v//g' -e 's/([A-Z])([a-z])+/8.2/g' -e 's/-rc([1-9])|-rc//g' -e 's/0/8.2/g'
+'';
+  };
 })
--- a/pkgs/by-name/pi/pid1/package.nix
+++ b/pkgs/by-name/pi/pid1/package.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "pid1";
-  version = "0.1.2";
+  version = "0.1.3";

  src = fetchFromGitHub {
    owner = "fpco";
    repo = "pid1-rs";
    rev = "v${version}";
-    hash = "sha256-BljIa+4BKI7WHlOhXfN/3VKMzs5G5E4tNlQ2oPpJV2g=";
+    hash = "sha256-2dnQj3AQxedyq1YvHKt+lVXNEtuB5sMRSCqX9YeifzI=";
  };

-  cargoHash = "sha256-7PANlw/SKxyAqymfXIXFT/v3U0GCiGfgStguSr0lrqQ=";
+  cargoHash = "sha256-/KK9U1dgCLglgn/MJ7+sov4EEnY/nluEsz0ooMp6ggI=";

  meta = with lib; {
    description = "Signal handling and zombie reaping for PID1 process";
--- a/pkgs/by-name/po/powerpipe/package.nix
+++ b/pkgs/by-name/po/powerpipe/package.nix
@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "powerpipe";
-  version = "0.3.1";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "turbot";
    repo = "powerpipe";
    rev = "refs/tags/v${version}";
-    hash = "sha256-tvGCgpuWMCzBldgxf4caKiUe7EpraJJeOVBwNqU60oc=";
+    hash = "sha256-KJ024dIU0GmeHCFa/pbyFIA+LitaudHC+NBGg8yNWxM=";
  };

-  vendorHash = "sha256-C3memfHNSlkiwhwB5zCXCtUOII3IjFD5FHGd8uPGmpU=";
+  vendorHash = "sha256-XALFXUeWrS4nt+ONToCfYXvLWuk7ZhLWvJidnATcWtM=";
  proxyVendor = true;

  nativeBuildInputs = [
--- a/pkgs/applications/misc/sfwbar/default.nix
+++ b/pkgs/applications/misc/sfwbar/default.nix
@ -1,28 +1,31 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, gtk3
-, meson
-, ninja
-, json_c
-, pkg-config
-, gtk-layer-shell
-, libpulseaudio
-, libmpdclient
-, libxkbcommon
-, alsa-lib
-, makeWrapper
-,
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  gtk3,
+  meson,
+  ninja,
+  json_c,
+  pkg-config,
+  gtk-layer-shell,
+  libpulseaudio,
+  libmpdclient,
+  libxkbcommon,
+  alsa-lib,
+  makeWrapper,
 }:
-stdenv.mkDerivation rec {
+let
+  version = "1.0_beta14";
+in
+stdenv.mkDerivation {
  pname = "sfwbar";
-  version = "1.0_beta13";
+  inherit version;

  src = fetchFromGitHub {
    owner = "LBCrion";
-    repo = pname;
+    repo = "sfwbar";
    rev = "v${version}";
-    hash = "sha256-7oiuTEqdXDReKdakJX6+HRaSi1XovM+MkHFkaFZtq64=";
+    hash = "sha256-4brP1SXaWq/L0D87rvlrWhLU1oFPSwNNxBSzRr4jsTM=";
  };

  buildInputs = [
@ -47,12 +50,16 @@ stdenv.mkDerivation rec {
      --suffix XDG_DATA_DIRS : $out/share
  '';

-  meta = with lib; {
+  meta = {
    homepage = "https://github.com/LBCrion/sfwbar";
    description = "Flexible taskbar application for wayland compositors, designed with a stacking layout in mind";
+    changelog = "https://github.com/LBCrion/sfwbar/releases/tag/v${version}";
    mainProgram = "sfwbar";
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ NotAShelf ];
-    license = licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      luftmensch-luftmensch
+      NotAShelf
+    ];
+    license = lib.licenses.gpl3Only;
  };
 }
--- a/pkgs/by-name/sp/spacedrive/package.nix
+++ b/pkgs/by-name/sp/spacedrive/package.nix
@ -1,73 +1,136 @@
-{ lib
-, pkgs
-, stdenv
-, fetchurl
-, appimageTools
-, undmg
-, nix-update-script
+{
+  lib,
+  stdenv,
+  fetchurl,
+  undmg,
+  nix-update-script,
+  #linux required
+  autoPatchelfHook,
+  dpkg,
+  gdk-pixbuf,
+  glib,
+  gst_all_1,
+  libsoup,
+  webkitgtk_4_1,
+  xdotool,
 }:

 let
  pname = "spacedrive";
-  version = "0.2.14";
+  version = "0.3.1";

-  src = fetchurl {
-    aarch64-darwin = {
-      url = "https://github.com/spacedriveapp/spacedrive/releases/download/${version}/Spacedrive-darwin-aarch64.dmg";
-      hash = "sha256-G0Ey7ewZeXegiqkAXFmS0MdaYllTphp7Buqs5/4/mWY=";
-    };
-    x86_64-darwin = {
-      url = "https://github.com/spacedriveapp/spacedrive/releases/download/${version}/Spacedrive-darwin-x86_64.dmg";
-      hash = "sha256-ypUDb94RlGqJfkf4htWKZ0UrGZ0SyCZrrAqtMuxDzDI=";
-    };
-    x86_64-linux = {
-      url = "https://github.com/spacedriveapp/spacedrive/releases/download/${version}/Spacedrive-linux-x86_64.AppImage";
-      hash = "sha256-DFJ1/uJW0BwEtJZxGpnvGC7U8YmsJTUbcuWEOAP2Bno=";
-    };
-  }.${stdenv.system} or (throw "${pname}-${version}: ${stdenv.system} is unsupported.");
+  src =
+    fetchurl
+      {
+        aarch64-darwin = {
+          url = "https://github.com/spacedriveapp/spacedrive/releases/download/${version}/Spacedrive-darwin-aarch64.dmg";
+          hash = "sha256-9E7h03zJtH8b6khDcbBsB46iVWwl48s+GJuBMOmEre4=";
+        };
+        x86_64-darwin = {
+          url = "https://github.com/spacedriveapp/spacedrive/releases/download/${version}/Spacedrive-darwin-x86_64.dmg";
+          hash = "sha256-h+B7tc6jXJUFNEMhG6ZNch+grtgUeAzfa37BDoZ6M8Q=";
+        };
+        x86_64-linux = {
+          url = "https://github.com/spacedriveapp/spacedrive/releases/download/${version}/Spacedrive-linux-x86_64.deb";
+          hash = "sha256-E1mOODG4YzBc0TPZJmKgrt/c5hp5LwzLaYPl+J5dnkg=";
+        };
+      }
+      .${stdenv.system} or (throw "${pname}-${version}: ${stdenv.system} is unsupported.");

  meta = {
    description = "Open source file manager, powered by a virtual distributed filesystem";
    homepage = "https://www.spacedrive.com";
    changelog = "https://github.com/spacedriveapp/spacedrive/releases/tag/${version}";
-    platforms = [ "aarch64-darwin" "x86_64-darwin" "x86_64-linux" ];
+    platforms = [
+      "aarch64-darwin"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
    license = lib.licenses.agpl3Plus;
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with lib.maintainers; [ DataHearth heisfer mikaelfangel stepbrobd ];
+    maintainers = with lib.maintainers; [
+      DataHearth
+      heisfer
+      mikaelfangel
+      stepbrobd
+    ];
    mainProgram = "spacedrive";
  };

  passthru.updateScript = nix-update-script { };
 in
-if stdenv.isDarwin then stdenv.mkDerivation
-{
-  inherit pname version src meta passthru;
+if stdenv.isDarwin then
+  stdenv.mkDerivation {
+    inherit
+      pname
+      version
+      src
+      meta
+      passthru
+      ;

-  sourceRoot = "Spacedrive.app";
+    sourceRoot = "Spacedrive.app";

-  nativeBuildInputs = [ undmg ];
+    nativeBuildInputs = [ undmg ];

-  installPhase = ''
-    mkdir -p "$out/Applications/Spacedrive.app"
-    cp -r . "$out/Applications/Spacedrive.app"
-    mkdir -p "$out/bin"
-    ln -s "$out/Applications/Spacedrive.app/Contents/MacOS/Spacedrive" "$out/bin/spacedrive"
-  '';
-}
-else appimageTools.wrapType2 {
-  inherit pname version src meta passthru;
+    installPhase = ''
+      runHook preInstall

-  extraPkgs = pkgs: [ pkgs.libthai ];
+      mkdir -p "$out/Applications/Spacedrive.app"
+      cp -r . "$out/Applications/Spacedrive.app"
+      mkdir -p "$out/bin"
+      ln -s "$out/Applications/Spacedrive.app/Contents/MacOS/Spacedrive" "$out/bin/spacedrive"

-  extraInstallCommands =
-    let
-      appimageContents = appimageTools.extractType2 { inherit pname version src; };
-    in
-    ''
-      # Install .desktop files
-      install -Dm444 ${appimageContents}/com.spacedrive.desktop -t $out/share/applications
-      install -Dm444 ${appimageContents}/spacedrive.png -t $out/share/pixmaps
-      substituteInPlace $out/share/applications/com.spacedrive.desktop \
-        --replace 'Exec=usr/bin/spacedrive' 'Exec=spacedrive'
+      runHook postInstall
    '';
-}
+  }
+
+else
+  stdenv.mkDerivation {
+    inherit
+      pname
+      version
+      src
+      meta
+      passthru
+      ;
+
+    nativeBuildInputs = [
+      autoPatchelfHook
+      dpkg
+    ];
+
+    # Depends: libc6, libxdo3, libwebkit2gtk-4.1-0, libgtk-3-0
+    # Recommends: gstreamer1.0-plugins-ugly
+    # Suggests: gstreamer1.0-plugins-bad
+    buildInputs = [
+      xdotool
+      glib
+      libsoup
+      webkitgtk_4_1
+      gdk-pixbuf
+      gst_all_1.gst-plugins-ugly
+      gst_all_1.gst-plugins-bad
+      gst_all_1.gst-plugins-base
+      gst_all_1.gstreamer
+    ];
+
+    unpackPhase = ''
+      runHook preUnpack
+
+      dpkg-deb -x $src .
+
+      runHook postUnpack
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/bin
+      cp -r usr/share $out/
+      cp -r usr/lib $out/
+      cp -r usr/bin $out/
+
+      runHook postInstall
+    '';
+  }
--- a/pkgs/by-name/sy/sysmenu/001-no-runtime-config.patch
+++ b/pkgs/by-name/sy/sysmenu/001-no-runtime-config.patch
@ -0,0 +1,13 @@
+diff --git a/src/config.hpp b/src/config.hpp
+index 6e7439b..ae01462 100644
+--- a/src/config.hpp
+++ b/src/config.hpp
+@@ -4,8 +4,6 @@
+ 	Runtime configuration can be disabled by deleting #define RUNTIME_CONFIG
+ */
+ 
+-#define RUNTIME_CONFIG
+-
+ // Current								Default
+ inline bool starthidden = false;		// false
+ inline bool searchbar = true;			// true
--- a/pkgs/by-name/sy/sysmenu/002-cflags-fix.patch
+++ b/pkgs/by-name/sy/sysmenu/002-cflags-fix.patch
@ -0,0 +1,13 @@
+diff --git a/Makefile b/Makefile
+index f0b6baf..71033a5 100644
+--- a/Makefile
+++ b/Makefile
+@@ -4,7 +4,7 @@ SRCS +=	$(wildcard src/*.cpp)
+ OBJS = $(SRCS:.cpp=.o)
+ DESTDIR = $(HOME)/.local
+ 
+-CXXFLAGS = -march=native -mtune=native -Os -s -Wall -flto=auto -fno-exceptions
+CXXFLAGS = -Os -s -Wall -flto=auto -fno-exceptions
+ CXXFLAGS += $(shell pkg-config --cflags $(PKGS))
+ LDFLAGS += $(shell pkg-config --libs $(PKGS)) -Wl,--gc-sections
+ 
--- a/pkgs/by-name/sy/sysmenu/package.nix
+++ b/pkgs/by-name/sy/sysmenu/package.nix
@ -0,0 +1,56 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  pkg-config,
+  git,
+  gtkmm4,
+  gtk4-layer-shell,
+  wrapGAppsHook4,
+  unstableGitUpdater,
+}:
+
+stdenv.mkDerivation {
+  pname = "sysmenu";
+  version = "unstable-2024-06-13";
+
+  src = fetchFromGitHub {
+    owner = "System64fumo";
+    repo = "sysmenu";
+    rev = "0b891e5d27f286b867d4a0984ee284a3456de851";
+    hash = "sha256-zI6dmS+ZqcGrG/joWouqrMNQfTRflP677kYJLJEWTBc=";
+  };
+
+  patches = [
+    ./001-no-runtime-config.patch
+    ./002-cflags-fix.patch
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    git
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    gtkmm4
+    gtk4-layer-shell
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 sysmenu $out/bin/sysmenu
+    runHook postInstall
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    description = "Simple program launcher using GTK4";
+    homepage = "https://github.com/System64fumo/sysmenu";
+    license = lib.licenses.wtfpl;
+    mainProgram = "sysmenu";
+    maintainers = with lib.maintainers; [ matteopacini ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/wl/wl-clipboard-rs/package.nix
+++ b/pkgs/by-name/wl/wl-clipboard-rs/package.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "wl-clipboard-rs";
-  version = "0.8.1";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "YaLTeR";
    repo = "wl-clipboard-rs";
    rev = "v${version}";
-    hash = "sha256-tNmpGBg21IuhKEzY15O2MKVpMB+eCjvRVwVUahADuJU=";
+    hash = "sha256-qwlR/PJivCgQTXe027zuQxq0iVJ3/BLg6LAD3w5tb9Y=";
  };

-  cargoHash = "sha256-0Ix+fF1QO1KU8FIOb8EV4iYXe4S69sZOxCdxYccL8m0=";
+  cargoHash = "sha256-C3vhZq5IHtbfg2mYYdQRqaLSA0iSER8zRaKi72FCd+E=";

  cargoBuildFlags = [
    "--package=wl-clipboard-rs"
--- a/pkgs/data/documentation/man-pages/default.nix
+++ b/pkgs/data/documentation/man-pages/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "man-pages";
-  version = "6.8";
+  version = "6.9";

  src = fetchurl {
    url = "mirror://kernel/linux/docs/man-pages/${pname}-${version}.tar.xz";
-    hash = "sha256-ucawpCD4ORSL4EsvwTqFaSMTco1U1HxpyKE4N5Zl0iY=";
+    hash = "sha256-0Uyv9UzGYvNLG3C89i1OJ+TC/SYGcqNbbnSvcbP3H4g=";
  };

  makeFlags = [
--- a/pkgs/development/compilers/llvm/12/default.nix
+++ b/pkgs/development/compilers/llvm/12/default.nix
@ -1,7 +1,7 @@
-{ lowPrio, newScope, pkgs, lib, stdenv, cmake
+{ lowPrio, newScope, pkgs, lib, stdenv
 , preLibcCrossHeaders
-, substitute, substituteAll, fetchFromGitHub, fetchpatch
-, libxml2, python3, isl, fetchurl, overrideCC, wrapCCWith, wrapBintoolsWith
+, substitute, substituteAll, fetchFromGitHub, fetchpatch, fetchurl
+, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 , targetLlvm
@ -17,6 +17,10 @@
    then null
    else pkgs.bintools
 , darwin
+# Allows passthrough to packages via newScope. This makes it possible to
+# do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
+# an llvmPackages whose packages are overridden in an internally consistent way.
+, ...
 }@args:

 let
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@ -1,7 +1,7 @@
-{ lowPrio, newScope, pkgs, lib, stdenv, cmake
+{ lowPrio, newScope, pkgs, lib, stdenv
 , preLibcCrossHeaders
-, fetchpatch
-, libxml2, python3, isl, fetchFromGitHub, substitute, substituteAll, overrideCC, wrapCCWith, wrapBintoolsWith
+, substitute, substituteAll, fetchFromGitHub, fetchpatch
+, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 , targetLlvm
@ -40,7 +40,10 @@
 # to you to make sure that the LLVM repo given matches the release configuration
 # specified.
 , monorepoSrc ? null
-
+# Allows passthrough to packages via newScope. This makes it possible to
+# do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
+# an llvmPackages whose packages are overridden in an internally consistent way.
+, ...
 }@args:

 assert
--- a/pkgs/development/compilers/llvm/14/default.nix
+++ b/pkgs/development/compilers/llvm/14/default.nix
@ -1,6 +1,7 @@
-{ lowPrio, newScope, pkgs, lib, stdenv, cmake
+{ lowPrio, newScope, pkgs, lib, stdenv
 , preLibcCrossHeaders
-, libxml2, python3, fetchFromGitHub, substitute, substituteAll, fetchpatch, overrideCC, wrapCCWith, wrapBintoolsWith
+, substitute, substituteAll, fetchFromGitHub, fetchpatch
+, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 , targetLlvm
@ -39,6 +40,10 @@
 # to you to make sure that the LLVM repo given matches the release configuration
 # specified.
 , monorepoSrc ? null
+# Allows passthrough to packages via newScope. This makes it possible to
+# do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
+# an llvmPackages whose packages are overridden in an internally consistent way.
+, ...
 }@args:

 assert
--- a/pkgs/development/compilers/llvm/15/default.nix
+++ b/pkgs/development/compilers/llvm/15/default.nix
@ -1,6 +1,7 @@
-{ lowPrio, newScope, pkgs, lib, stdenv, cmake, ninja
+{ lowPrio, newScope, pkgs, lib, stdenv
 , preLibcCrossHeaders
-, libxml2, python3, fetchFromGitHub, fetchpatch, substitute, substituteAll, overrideCC, wrapCCWith, wrapBintoolsWith
+, substitute, substituteAll, fetchFromGitHub, fetchpatch
+, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 , targetLlvm
@ -39,6 +40,10 @@
 # to you to make sure that the LLVM repo given matches the release configuration
 # specified.
 , monorepoSrc ? null
+# Allows passthrough to packages via newScope. This makes it possible to
+# do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
+# an llvmPackages whose packages are overridden in an internally consistent way.
+, ...
 }@args:

 assert
--- a/pkgs/development/compilers/llvm/16/default.nix
+++ b/pkgs/development/compilers/llvm/16/default.nix
@ -1,6 +1,7 @@
-{ lowPrio, newScope, pkgs, lib, stdenv, cmake, ninja
+{ lowPrio, newScope, pkgs, lib, stdenv
 , preLibcCrossHeaders
-, libxml2, python3, fetchFromGitHub, substituteAll, overrideCC, wrapCCWith, wrapBintoolsWith
+, substitute, substituteAll, fetchFromGitHub
+, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 , targetLlvm
@ -39,6 +40,10 @@
 # to you to make sure that the LLVM repo given matches the release configuration
 # specified.
 , monorepoSrc ? null
+# Allows passthrough to packages via newScope. This makes it possible to
+# do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
+# an llvmPackages whose packages are overridden in an internally consistent way.
+, ...
 }@args:

 assert
--- a/pkgs/development/compilers/llvm/17/default.nix
+++ b/pkgs/development/compilers/llvm/17/default.nix
@ -1,6 +1,7 @@
-{ lowPrio, newScope, pkgs, lib, stdenv, cmake, ninja
+{ lowPrio, newScope, pkgs, lib, stdenv
 , preLibcCrossHeaders
-, libxml2, python3, fetchFromGitHub, fetchpatch, substituteAll, overrideCC, wrapCCWith, wrapBintoolsWith
+, substitute, substituteAll, fetchFromGitHub, fetchpatch
+, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 , targetLlvm
@ -39,6 +40,10 @@
 # to you to make sure that the LLVM repo given matches the release configuration
 # specified.
 , monorepoSrc ? null
+# Allows passthrough to packages via newScope. This makes it possible to
+# do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
+# an llvmPackages whose packages are overridden in an internally consistent way.
+, ...
 }@args:

 assert
--- a/pkgs/development/compilers/llvm/18/default.nix
+++ b/pkgs/development/compilers/llvm/18/default.nix
@ -1,6 +1,7 @@
-{ lowPrio, newScope, pkgs, lib, stdenv, cmake, ninja
+{ lowPrio, newScope, pkgs, lib, stdenv
 , preLibcCrossHeaders
-, libxml2, python3, fetchFromGitHub, substituteAll, overrideCC, wrapCCWith, wrapBintoolsWith
+, substitute, substituteAll, fetchFromGitHub
+, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 , targetLlvm
@ -39,6 +40,10 @@
 # to you to make sure that the LLVM repo given matches the release configuration
 # specified.
 , monorepoSrc ? null
+# Allows passthrough to packages via newScope. This makes it possible to
+# do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
+# an llvmPackages whose packages are overridden in an internally consistent way.
+, ...
 }@args:

 assert
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@ -1,6 +1,7 @@
-{ lowPrio, newScope, pkgs, lib, stdenv, cmake, ninja
+{ lowPrio, newScope, pkgs, lib, stdenv
 , preLibcCrossHeaders
-, libxml2, python3, fetchFromGitHub, substituteAll, overrideCC, wrapCCWith, wrapBintoolsWith
+, substitute, substituteAll, fetchFromGitHub, fetchpatch
+, overrideCC, wrapCCWith, wrapBintoolsWith
 , buildLlvmTools # tools, but from the previous stage, for cross
 , targetLlvmLibraries # libraries, but from the next stage, for cross
 , targetLlvm
@ -44,6 +45,10 @@
 # to you to make sure that the LLVM repo given matches the release configuration
 # specified.
 , monorepoSrc ? null
+# Allows passthrough to packages via newScope. This makes it possible to
+# do `(llvmPackages.override { <someLlvmDependency> = bar; }).clang` and get
+# an llvmPackages whose packages are overridden in an internally consistent way.
+, ...
 }@args:

 assert
--- a/pkgs/development/haskell-modules/configuration-ghc-9.8.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-9.8.x.nix
@ -132,8 +132,10 @@ self: super: {
  hip = appendConfigureFlag "--ghc-options=-fsimpl-tick-factor=200" super.hip;

  # Fix build with text-2.x.
-  libmpd = appendPatch (pkgs.fetchpatch
-      { url = "https://github.com/vimus/libmpd-haskell/pull/138.patch";
+  libmpd = appendPatch
+    (pkgs.fetchpatch {
+        name = "138.patch"; # https://github.com/vimus/libmpd-haskell/pull/138
+        url = "https://github.com/vimus/libmpd-haskell/compare/95d3b3bab5858d6d1f0e079d0ab7c2d182336acb...f1cbf247261641565a3937b90721f7955d254c5e.patch";
        sha256 = "Q4fA2J/Tq+WernBo+UIMdj604ILOMlIYkG4Pr046DfM=";
      })
    super.libmpd;
--- a/pkgs/development/libraries/libdeltachat/Cargo.lock
+++ b/pkgs/development/libraries/libdeltachat/Cargo.lock
--- a/pkgs/development/libraries/libdeltachat/default.nix
+++ b/pkgs/development/libraries/libdeltachat/default.nix
@ -31,13 +31,13 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "libdeltachat";
-  version = "1.136.3";
+  version = "1.140.2";

  src = fetchFromGitHub {
    owner = "deltachat";
    repo = "deltachat-core-rust";
    rev = "v${version}";
-    hash = "sha256-/ZWpPpxnOCLGswrfbEPvfUn1LpdBQeR5LecRAB0PEhI=";
+    hash = "sha256-BSbvgKiI89B+nxp5McBKTJAwgePt27C1QvSQLhTL7pQ=";
  };

  patches = [
--- a/pkgs/development/libraries/libdeltachat/no-static-lib.patch
+++ b/pkgs/development/libraries/libdeltachat/no-static-lib.patch
@ -1,33 +1,33 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 44ca43e7..8b6960dd 100644
+index 5587e391..a18092f5 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -14,7 +14,6 @@ find_program(CARGO cargo)
+@@ -20,7 +20,6 @@ endif()
 
 add_custom_command(
 	OUTPUT
-	"target/release/libdeltachat.a"
- 	"target/release/libdeltachat.${DYNAMIC_EXT}"
- 	"target/release/pkgconfig/deltachat.pc"
+-	"${CMAKE_BINARY_DIR}/target/release/libdeltachat.a"
+ 	"${CMAKE_BINARY_DIR}/target/release/libdeltachat.${DYNAMIC_EXT}"
+ 	"${CMAKE_BINARY_DIR}/target/release/pkgconfig/deltachat.pc"
         COMMAND
-@@ -39,12 +38,10 @@ add_custom_target(
+@@ -35,12 +34,10 @@ add_custom_target(
 	lib_deltachat
 	ALL
 	DEPENDS
-	"target/release/libdeltachat.a"
- 	"target/release/libdeltachat.${DYNAMIC_EXT}"
- 	"target/release/pkgconfig/deltachat.pc"
+-	"${CMAKE_BINARY_DIR}/target/release/libdeltachat.a"
+ 	"${CMAKE_BINARY_DIR}/target/release/libdeltachat.${DYNAMIC_EXT}"
+ 	"${CMAKE_BINARY_DIR}/target/release/pkgconfig/deltachat.pc"
 )
 
 install(FILES "deltachat-ffi/deltachat.h" DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
-install(FILES "target/release/libdeltachat.a" DESTINATION ${CMAKE_INSTALL_LIBDIR})
- install(FILES "target/release/libdeltachat.${DYNAMIC_EXT}" DESTINATION ${CMAKE_INSTALL_LIBDIR})
- install(FILES "target/release/pkgconfig/deltachat.pc" DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig)
+-install(FILES "${CMAKE_BINARY_DIR}/target/${ARCH_DIR}/release/libdeltachat.a" DESTINATION ${CMAKE_INSTALL_LIBDIR})
+ install(FILES "${CMAKE_BINARY_DIR}/target/${ARCH_DIR}/release/libdeltachat.${DYNAMIC_EXT}" DESTINATION ${CMAKE_INSTALL_LIBDIR})
+ install(FILES "${CMAKE_BINARY_DIR}/target/${ARCH_DIR}/release/pkgconfig/deltachat.pc" DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig)
 diff --git a/deltachat-ffi/Cargo.toml b/deltachat-ffi/Cargo.toml
-index de0fbafe..120efec9 100644
+index d66cb00f..48347a48 100644
 --- a/deltachat-ffi/Cargo.toml
 +++ b/deltachat-ffi/Cargo.toml
-@@ -12,7 +12,7 @@ categories = ["cryptography", "std", "email"]
+@@ -11,7 +11,7 @@ categories = ["cryptography", "std", "email"]
 
 [lib]
 name = "deltachat"
--- a/pkgs/development/libraries/xgboost/default.nix
+++ b/pkgs/development/libraries/xgboost/default.nix
@ -59,9 +59,9 @@ effectiveStdenv.mkDerivation rec {
  };

  patches = lib.optionals (cudaSupport && cudaPackages.cudaMajorMinorVersion == "12.4") [
-    (fetchpatch {
+    (fetchpatch { # https://github.com/dmlc/xgboost/pull/10123
      name = "Fix compilation with the ctk 12.4.";
-      url = "https://github.com/dmlc/xgboost/pull/10123.patch";
+      url = "https://github.com/dmlc/xgboost/commit/c760f85db0bc7bd6379901fbfb67ceccc2b37700.patch";
      hash = "sha256-iP9mll9pg8T2ztCR7dBPnLP17/x3ImJFrr5G3e2dqHo=";
    })
  ];
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.106";
+  version = "9.2.107";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "ailment";
    rev = "refs/tags/v${version}";
-    hash = "sha256-f1F1mPqrZJvXPmziyRIoPj7lIAfSWzpSpLtVs1RjzhI=";
+    hash = "sha256-yEwSHmAxbbdLVFatG4pKJokatCkO4RCZUMVAoBSOwTI=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -37,7 +37,7 @@

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.106";
+  version = "9.2.107";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -46,7 +46,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "angr";
    rev = "refs/tags/v${version}";
-    hash = "sha256-TM6Jvb260lQWDrqYASdpRqgS9PmkmPUBcncDtTwWKAU=";
+    hash = "sha256-f4RiLXEp4q3V2SiX6OSLHbAVCaZ5GLOvqm1qmBAYIZ8=";
  };

  pythonRelaxDeps = [ "capstone" ];
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.106";
+  version = "9.2.107";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "archinfo";
    rev = "refs/tags/v${version}";
-    hash = "sha256-tjM0+R7m9jlhf/cXptjOoyV7o+9xU889wTwOBcFjNSQ=";
+    hash = "sha256-D29ddBceo4Bz3KUiQckdbV0e9uPXEOAAIHZrSpqw3BE=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@ -10,6 +10,7 @@
  fastapi,
  fetchFromGitHub,
  grpcio,
+  httpx,
  hypothesis,
  importlib-resources,
  kubernetes,
@ -50,7 +51,7 @@

 buildPythonPackage rec {
  pname = "chromadb";
-  version = "0.5.0";
+  version = "0.5.3";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -59,13 +60,13 @@ buildPythonPackage rec {
    owner = "chroma-core";
    repo = "chroma";
    rev = "refs/tags/${version}";
-    hash = "sha256-gM+fexjwifF3evR8jZvMbIDz655RFKPUizrsB2q5tbw=";
+    hash = "sha256-czDL2b+Jj7mrYZCTfnaZArkOHBaWyTV0BTE2wvykHps=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-zyiFv/gswGupm7Y8BhviklqJzM914v0QyUsRwbGKZ48=";
+    hash = "sha256-eTVT1yowuDsajjceWojdUdX466FKneUt1i5QipBFdp4=";
  };

  pythonRelaxDeps = [ "orjson" ];
@ -92,6 +93,7 @@ buildPythonPackage rec {
    chroma-hnswlib
    fastapi
    grpcio
+    httpx
    importlib-resources
    kubernetes
    mmh3
@ -143,12 +145,13 @@ buildPythonPackage rec {

  disabledTestPaths = [
    # Tests require network access
-    "chromadb/test/property/test_cross_version_persist.py"
    "chromadb/test/auth/test_simple_rbac_authz.py"
+    "chromadb/test/db/test_system.py"
    "chromadb/test/ef/test_default_ef.py"
-    "chromadb/test/test_api.py"
    "chromadb/test/property/"
+    "chromadb/test/property/test_cross_version_persist.py"
    "chromadb/test/stress/"
+    "chromadb/test/test_api.py"
  ];

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.2.106";
+  version = "9.2.107";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "claripy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-y3r0/FU8GcVMv+wnccCB/SUBS+TC22S3qp4Awbhoung=";
+    hash = "sha256-89wh/SuwxOuORk3S42VA/cJh1GACFWB4ceUxp2OszQM=";
  };

  # z3 does not provide a dist-info, so python-runtime-deps-check will fail
--- a/Show More
+++ b/Show More