Merge master into staging-next

2024-10-11 15:08:52 +03:00 · 2024-09-05 12:05:31 +00:00 · 2024-09-05 12:05:31 +00:00 · 37c947df6c
commit 37c947df6c
parent aef39802ee 6c4ea7a3e0
67 changed files with 4452 additions and 1159 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -21803,6 +21803,12 @@
    github = "vector1dev";
    githubId = 127302590;
  };
+  vedantmgoyal9 = {
+    name = "Vedant Mohan Goyal";
+    matrix = "@vedantmgoyal:beeper.com";
+    github = "vedantmgoyal9";
+    githubId = 83997633;
+  };
  veehaitch = {
    name = "Vincent Haupert";
    email = "mail@vincent-haupert.de";
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -35,6 +35,9 @@
  Users that want to keep PulseAudio will want to set `services.pipewire.enable = false;` and `hardware.pulseaudio.enable = true;`.
  There is currently no plan to fully deprecate and remove PulseAudio, however, PipeWire should generally be preferred for new installs.

+- Support for mounting filesystems from block devices protected with [dm-verity](https://docs.kernel.org/admin-guide/device-mapper/verity.html)
+  was added through the `boot.initrd.systemd.dmVerity` option.
+
 ## New Modules {#sec-release-24.11-new-modules}

 - [TaskChampion Sync-Server](https://github.com/GothenburgBitFactory/taskchampion-sync-server), a [Taskwariror 3](https://taskwarrior.org/docs/upgrade-3/) sync server, replacing Taskwarrior 2's sync server named [`taskserver`](https://github.com/GothenburgBitFactory/taskserver).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -363,6 +363,7 @@
  ./security/systemd-confinement.nix
  ./security/tpm2.nix
  ./security/wrappers/default.nix
+  ./services/accessibility/orca.nix
  ./services/accessibility/speechd.nix
  ./services/admin/docuum.nix
  ./services/admin/meshcentral.nix
@ -1621,6 +1622,7 @@
  ./system/boot/stage-2.nix
  ./system/boot/systemd.nix
  ./system/boot/systemd/coredump.nix
+  ./system/boot/systemd/dm-verity.nix
  ./system/boot/systemd/initrd-secrets.nix
  ./system/boot/systemd/initrd.nix
  ./system/boot/systemd/journald.nix
--- a/nixos/modules/security/auditd.nix
+++ b/nixos/modules/security/auditd.nix
@ -1,19 +1,29 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:

 {
-  options.security.auditd.enable = mkEnableOption "the Linux Audit daemon";
+  options.security.auditd.enable = lib.mkEnableOption "the Linux Audit daemon";

-  config = mkIf config.security.auditd.enable {
+  config = lib.mkIf config.security.auditd.enable {
    boot.kernelParams = [ "audit=1" ];

    environment.systemPackages = [ pkgs.audit ];

    systemd.services.auditd = {
      description = "Linux Audit daemon";
-      wantedBy = [ "basic.target" ];
-      before = [ "shutdown.target" ];
+      wantedBy = [ "sysinit.target" ];
+      after = [
+        "local-fs.target"
+        "systemd-tmpfiles-setup.service"
+      ];
+      before = [
+        "sysinit.target"
+        "shutdown.target"
+      ];
      conflicts = [ "shutdown.target" ];

      unitConfig = {
--- a/nixos/modules/services/accessibility/orca.nix
+++ b/nixos/modules/services/accessibility/orca.nix
@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.orca;
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkPackageOption
+    ;
+in
+{
+  options.services.orca = {
+    enable = mkEnableOption "Orca screen reader";
+    package = mkPackageOption pkgs "orca" { };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    services.speechd.enable = true;
+  };
+}
--- a/nixos/modules/services/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/desktop-managers/plasma6.nix
@ -245,6 +245,9 @@ in {
    xdg.portal.configPackages = mkDefault [kdePackages.xdg-desktop-portal-kde];
    services.pipewire.enable = mkDefault true;

+    # Enable screen reader by default
+    services.orca.enable = mkDefault true;
+
    services.displayManager = {
      sessionPackages = [kdePackages.plasma-workspace];
      defaultSession = mkDefault "plasma";
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@ -374,14 +374,6 @@ in {
        permissions = "u+rx,g+x,o-rwx";
      };

-      "logs-management.plugin" = {
-        source = "${cfg.package}/libexec/netdata/plugins.d/logs-management.plugin.org";
-        capabilities = "cap_dac_read_search,cap_syslog+ep";
-        owner = cfg.user;
-        group = cfg.group;
-        permissions = "u+rx,g+x,o-rwx";
-      };
-
      "slabinfo.plugin" = {
        source = "${cfg.package}/libexec/netdata/plugins.d/slabinfo.plugin.org";
        capabilities = "cap_dac_override+ep";
--- a/nixos/modules/services/security/endlessh-go.nix
+++ b/nixos/modules/services/security/endlessh-go.nix
@ -9,6 +9,8 @@ in
  options.services.endlessh-go = {
    enable = mkEnableOption "endlessh-go service";

+    package = mkPackageOption pkgs "endlessh-go" { };
+
    listenAddress = mkOption {
      type = types.str;
      default = "0.0.0.0";
@ -86,7 +88,7 @@ in
        {
          Restart = "always";
          ExecStart = with cfg; concatStringsSep " " ([
-            "${pkgs.endlessh-go}/bin/endlessh-go"
+            (lib.getExe cfg.package)
            "-logtostderr"
            "-host=${listenAddress}"
            "-port=${toString port}"
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@ -172,7 +172,6 @@ in
      ] ++ utils.removePackagesByName [
        # accessibility
        onboard
-        orca

        # theme
        sound-theme-freedesktop
@ -199,6 +198,8 @@ in
        })
      ];

+      services.orca.enable = mkDefault (notExcluded pkgs.orca);
+
      xdg.portal.configPackages = mkDefault [ pkgs.cinnamon-common ];

      # Override GSettings schemas
--- a/nixos/modules/services/x11/desktop-managers/gnome.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome.nix
@ -357,6 +357,8 @@ in
        isSystem = true;
      };

+      services.orca.enable = notExcluded pkgs.orca;
+
      fonts.packages = with pkgs; [
        cantarell-fonts
        dejavu_fonts
@ -380,7 +382,6 @@ in
            pkgs.gnome-shell-extensions
            pkgs.gnome-tour # GNOME Shell detects the .desktop file on first log-in.
            pkgs.gnome-user-docs
-            pkgs.orca
            pkgs.glib # for gsettings program
            pkgs.gnome-menus
            pkgs.gtk3.out # for gtk-launch program
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@ -175,6 +175,7 @@ in
        # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/1443
        pkgs.pantheon.mutter
      ];
+      services.orca.enable = mkDefault (notExcluded pkgs.orca);
      systemd.packages = with pkgs; [
        gnome-session
        pantheon.gala
@ -211,7 +212,6 @@ in
        adwaita-icon-theme
        gtk3.out # for gtk-launch program
        onboard
-        orca # elementary/greeter#668
        sound-theme-freedesktop
        xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
      ]) ++ (with pkgs.pantheon; [
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@ -357,6 +357,9 @@ in
        pkgs.media-player-info
      ];

+      # Enable screen reader by default
+      services.orca.enable = mkDefault true;
+
      services.displayManager.sddm = {
        theme = mkDefault "breeze";
      };
--- a/nixos/modules/system/boot/systemd/dm-verity.nix
+++ b/nixos/modules/system/boot/systemd/dm-verity.nix
@ -0,0 +1,65 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.boot.initrd.systemd.dmVerity;
+in
+{
+  options = {
+    boot.initrd.systemd.dmVerity = {
+      enable = lib.mkEnableOption "dm-verity" // {
+        description = ''
+          Mount verity-protected block devices in the initrd.
+
+          Enabling this option allows to use `systemd-veritysetup` and
+          `systemd-veritysetup-generator` in the initrd.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.enable -> config.boot.initrd.systemd.enable;
+        message = ''
+          'boot.initrd.systemd.dmVerity.enable' requires 'boot.initrd.systemd.enable' to be enabled.
+        '';
+      }
+    ];
+
+    boot.initrd = {
+      availableKernelModules = [
+        # For documentation, see https://docs.kernel.org/admin-guide/device-mapper/dm-init.html
+        "dm_mod"
+        # For documentation, see:
+        # - https://docs.kernel.org/admin-guide/device-mapper/verity.html
+        # - https://gitlab.com/cryptsetup/cryptsetup/-/wikis/DMVerity
+        "dm_verity"
+      ];
+
+      # dm-verity needs additional udev rules from LVM to work.
+      services.lvm.enable = true;
+
+      # The additional targets and store paths allow users to integrate verity-protected devices
+      # through the systemd tooling.
+      systemd = {
+        additionalUpstreamUnits = [
+          # https://github.com/systemd/systemd/blob/main/units/veritysetup-pre.target
+          "veritysetup-pre.target"
+          # https://github.com/systemd/systemd/blob/main/units/veritysetup.target
+          "veritysetup.target"
+          # https://github.com/systemd/systemd/blob/main/units/remote-veritysetup.target
+          "remote-veritysetup.target"
+        ];
+
+        storePaths = [
+          # These are the two binaries mentioned in https://github.com/systemd/systemd/blob/main/src/veritysetup/meson.build; there are no others.
+          "${config.boot.initrd.systemd.package}/lib/systemd/systemd-veritysetup"
+          "${config.boot.initrd.systemd.package}/lib/systemd/system-generators/systemd-veritysetup-generator"
+        ];
+      };
+    };
+  };
+
+  meta.maintainers = [ lib.maintainers.msanft ];
+}
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@ -218,7 +218,7 @@ in {
    };

    root = lib.mkOption {
-      type = lib.types.enum [ "fstab" "gpt-auto" ];
+      type = lib.types.nullOr (lib.types.enum [ "fstab" "gpt-auto" ]);
      default = "fstab";
      example = "gpt-auto";
      description = ''
@ -227,6 +227,9 @@ in {
        allow specifying the root file system itself this
        way. Instead, the `fstab` value is used in order to interpret
        the root file system specified with the `fileSystems` option.
+
+        If the root FS is mounted by other means, such as systemd generators other than
+        `fstab`, `gpt-auto` or a custom generator, set this to `null`.
      '';
    };

@ -398,9 +401,9 @@ in {
    ++ lib.optional (cfg.enableTpm2 && !(pkgs.stdenv.hostPlatform.isRiscV64 || pkgs.stdenv.hostPlatform.isArmv7)) "tpm-crb"
    ++ lib.optional cfg.package.withEfi "efivarfs";

-    boot.kernelParams = [
-      "root=${config.boot.initrd.systemd.root}"
-    ] ++ lib.optional (config.boot.resumeDevice != "") "resume=${config.boot.resumeDevice}"
+    boot.kernelParams =
+      lib.optional (config.boot.initrd.systemd.root != null) "root=${config.boot.initrd.systemd.root}"
+      ++ lib.optional (config.boot.resumeDevice != "") "resume=${config.boot.resumeDevice}"
      # `systemd` mounts root in initrd as read-only unless "rw" is on the kernel command line.
      # For NixOS activation to succeed, we need to have root writable in initrd.
      ++ lib.optional (config.boot.initrd.systemd.root == "gpt-auto") "rw";
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -259,6 +259,7 @@ in {
  dhparams = handleTest ./dhparams.nix {};
  disable-installer-tools = handleTest ./disable-installer-tools.nix {};
  discourse = handleTest ./discourse.nix {};
+  dm-verity = runTest ./dm-verity.nix;
  dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
  dnscrypt-wrapper = runTestOn ["x86_64-linux"] ./dnscrypt-wrapper;
  dnsdist = import ./dnsdist.nix { inherit pkgs runTest; };
--- a/nixos/tests/dm-verity.nix
+++ b/nixos/tests/dm-verity.nix
@ -0,0 +1,245 @@
+# Tests a NixOS system with a read-only root filesystem that's integrity-protected
+# through DM-verity. The root filesystem is mounted read-only, and for NixOS activation
+# to succeed, an overlay `tmpfs` is mounted on top of it.
+# This test uses systemd-repart to create a bootable disk image, as it supplies handy
+# utilities for creating verity partitions, but it can also be setup manually through
+# `systemd-veritysetup`.
+
+{ lib, pkgs, ... }:
+
+let
+  imageId = "verity-root-image";
+  imageVersion = "1-rc1";
+
+  # Use a random, but fixed root hash placeholder to allow us specifying the "real" root hash
+  # after the image is first built.
+  roothashPlaceholder = "61fe0f0c98eff2a595dd2f63a5e481a0a25387261fa9e34c37e3a4910edf32b8";
+in
+{
+  name = "verity-root";
+
+  meta.maintainers = with lib.maintainers; [ msanft ];
+
+  nodes.machine =
+    {
+      lib,
+      pkgs,
+      config,
+      modulesPath,
+      ...
+    }:
+    {
+
+      imports = [ "${modulesPath}/image/repart.nix" ];
+
+      virtualisation.directBoot.enable = false;
+      virtualisation.mountHostNixStore = false;
+      virtualisation.useEFIBoot = true;
+
+      # Disable boot loaders, as a UKI is used, which contains systemd-stub.
+      # TODO(raitobezarius): revisit this when #244907 lands
+      boot.loader.grub.enable = false;
+
+      system.image.id = imageId;
+      system.image.version = imageVersion;
+
+      # systemd-veritysetup-generator takes care of setting up the root filesystem.
+      fileSystems = lib.mkForce { };
+      virtualisation.fileSystems = lib.mkForce { };
+
+      # Provides 'veritysetup' to check if the verity-protected device
+      # has been mapped correctly.
+      environment.systemPackages = with pkgs; [ cryptsetup ];
+
+      boot.initrd = {
+        kernelModules = [ "overlay" ];
+        supportedFilesystems = [ "erofs" ];
+
+        systemd = {
+          enable = true;
+          dmVerity.enable = true;
+          root = null; # systemd-veritysetup-generator takes care of mounting /
+
+          tmpfiles.settings = {
+            "10-mountpoints" =
+              let
+                conf = {
+                  mode = "0755";
+                  user = "root";
+                  group = "root";
+                };
+              in
+              {
+                "/run/etc/upper".d = conf;
+                "/run/etc/work".d = conf;
+                "/run/var/upper".d = conf;
+                "/run/var/work".d = conf;
+                "/run/tmp/upper".d = conf;
+                "/run/tmp/work".d = conf;
+              };
+          };
+
+          # We directly define the mount units here, as we need to specify dependencies very
+          # granularly, and systemd-fstab-generator doesn't give us that flexibility.
+          mounts = [
+            {
+              where = "/sysroot/etc";
+              what = "overlay";
+              type = "overlay";
+              options = "lowerdir=/sysroot${config.system.build.etc}/etc,upperdir=/run/etc/upper,workdir=/run/etc/work";
+              wantedBy = [
+                "initrd-fs.target"
+                "initrd-switch-root.target"
+                "default.target"
+              ];
+              before = [ "initrd-fs.target" ];
+              after = [ "systemd-tmpfiles-setup.service" ];
+              unitConfig.RequiresMountsFor = "/sysroot/nix/store";
+              unitConfig.DefaultDependencies = false;
+            }
+            {
+              where = "/sysroot/var";
+              what = "overlay";
+              type = "overlay";
+              options = "lowerdir=/sysroot/var,upperdir=/run/var/upper,workdir=/run/var/work";
+              wantedBy = [
+                "initrd-fs.target"
+                "initrd-switch-root.target"
+                "default.target"
+              ];
+              before = [ "initrd-fs.target" ];
+              after = [ "systemd-tmpfiles-setup.service" ];
+              unitConfig.RequiresMountsFor = "/sysroot/nix/store";
+              unitConfig.DefaultDependencies = false;
+            }
+            {
+              where = "/sysroot/tmp";
+              what = "overlay";
+              type = "overlay";
+              options = "lowerdir=/sysroot/tmp,upperdir=/run/tmp/upper,workdir=/run/tmp/work";
+              wantedBy = [
+                "initrd-fs.target"
+                "initrd-switch-root.target"
+                "default.target"
+              ];
+              before = [ "initrd-fs.target" ];
+              after = [ "systemd-tmpfiles-setup.service" ];
+              unitConfig.RequiresMountsFor = "/sysroot/nix/store";
+              unitConfig.DefaultDependencies = false;
+            }
+          ];
+        };
+      };
+
+      boot.kernelParams = [
+        "systemd.verity=yes"
+        "roothash=${roothashPlaceholder}"
+      ];
+
+      image.repart = {
+        name = imageId;
+        # OVMF does not work with the default repart sector size of 4096
+        sectorSize = 512;
+        partitions = {
+          # ESP
+          "00-esp" = {
+            contents =
+              let
+                efiArch = config.nixpkgs.hostPlatform.efiArch;
+              in
+              {
+                "/EFI/BOOT/BOOT${lib.toUpper efiArch}.EFI".source = "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
+
+                "/EFI/Linux/${config.system.boot.loader.ukiFile}".source = "${config.system.build.uki}/${config.system.boot.loader.ukiFile}";
+              };
+            repartConfig = {
+              Type = "esp";
+              Format = "vfat";
+              # Minimize = "guess" seems to not work very well for vfat
+              # partitions. It's better to set a sensible default instead. The
+              # aarch64 kernel seems to generally be a little bigger than the
+              # x86_64 kernel. To stay on the safe side, leave some more slack
+              # for every platform other than x86_64.
+              SizeMinBytes = if config.nixpkgs.hostPlatform.isx86_64 then "64M" else "96M";
+            };
+          };
+
+          # Root Partition
+          "10-root" = {
+            storePaths = [ config.system.build.toplevel ];
+            repartConfig = {
+              Type = "root";
+              Format = "erofs";
+              Label = "root";
+              Verity = "data";
+              VerityMatchKey = "root";
+              Minimize = "best";
+              # We need to ensure that mountpoints are available.
+              MakeDirectories = "/bin /boot /dev /etc /home /lib /lib64 /mnt /nix /opt /proc /root /run /srv /sys /tmp /usr /var";
+            };
+          };
+
+          # Verity hashtree for the root partition
+          "20-root-verity" = {
+            repartConfig = {
+              Type = "root-verity";
+              Label = "root-verity";
+              Verity = "hash";
+              VerityMatchKey = "root";
+              Minimize = "best";
+            };
+          };
+        };
+      };
+    };
+
+  testScript =
+    let
+      # We override the build of the image by extending it with code to replace the placeholder with the real root hash.
+      # This way, we can build the image first and then set the root hash afterwards in a single derivation.
+      buildOverride = oldAttrs: {
+        nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ pkgs.jq ];
+        postInstall = ''
+          # Replace the placeholder with the real root hash.
+          realRoothash=$(${pkgs.jq}/bin/jq -r "[.[] | select(.roothash != null)] | .[0].roothash" $out/repart-output.json)
+          sed -i "0,/${roothashPlaceholder}/ s/${roothashPlaceholder}/$realRoothash/" $out/${oldAttrs.pname}_${oldAttrs.version}.raw
+        '';
+      };
+    in
+    { nodes, ... }:
+    ''
+      import os, subprocess, tempfile
+
+      tmp_disk_image = tempfile.NamedTemporaryFile()
+
+      subprocess.run([
+        "${nodes.machine.virtualisation.qemu.package}/bin/qemu-img",
+        "create",
+        "-f",
+        "qcow2",
+        "-b",
+        "${nodes.machine.system.build.image.overrideAttrs buildOverride}/${nodes.machine.image.repart.imageFile}",
+        "-F",
+        "raw",
+        tmp_disk_image.name,
+      ])
+
+      # Set NIX_DISK_IMAGE so that the qemu script finds the right disk image.
+      os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
+
+      os_release = machine.succeed("cat /etc/os-release")
+      assert 'IMAGE_ID="${imageId}"' in os_release
+      assert 'IMAGE_VERSION="${imageVersion}"' in os_release
+
+      bootctl_status = machine.succeed("bootctl status")
+      assert "Boot Loader Specification Type #2 (.efi)" in bootctl_status
+
+      verity_status = machine.succeed("veritysetup status root")
+      assert "type:        VERITY" in verity_status
+      assert "status:      verified" in verity_status
+
+      commandline = machine.succeed("cat /proc/cmdline")
+      roothash = commandline.split("roothash=")[1].split(" ")[0]
+      assert roothash in verity_status
+    '';
+}
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@ -47,15 +47,16 @@ let
  withMTP = config.clementine.mtp or true;
  withCD = config.clementine.cd or true;
  withCloud = config.clementine.cloud or true;
-in mkDerivation {
+in
+mkDerivation {
  pname = "clementine";
-  version = "unstable-2022-04-11";
+  version = "1.4.rc2-unstable-2024-05-12";

  src = fetchFromGitHub {
    owner = "clementine-player";
    repo = "Clementine";
-    rev = "250024e117fbe5fae7c62b9c8e655d66412a6ed7";
-    sha256 = "06fcbs3wig3mh711iypyj49qm5246f7qhvgvv8brqfrd8cqyh6qf";
+    rev = "7607ddcb96e79d373c4b60d9de21f3315719c7d8";
+    sha256 = "sha256-yOG/Je6N8YEsu5AOtxOFgDl3iqb97assYMZYMSwQqqk=";
  };

  nativeBuildInputs = [
@ -117,6 +118,7 @@ in mkDerivation {
  '';

  cmakeFlags = [
+    "-DFORCE_GIT_REVISION=1.3.1"
    "-DUSE_SYSTEM_PROJECTM=ON"
    "-DSPOTIFY_BLOB=OFF"
  ];
--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , wrapQtAppsHook
 , pkg-config
@ -18,18 +19,16 @@
 , portmidi
 , qtbase
 , qtdeclarative
-, qtgraphicaleffects
 , flac
 , libopusenc
 , libopus
 , tinyxml-2
-, qtquickcontrols
-, qtquickcontrols2
-, qtscript
+, qt5compat
+, qtwayland
 , qtsvg
-, qtxmlpatterns
+, qtscxml
 , qtnetworkauth
-, qtx11extras
+, qttools
 , nixosTests
 , darwin
 }:
@ -50,31 +49,48 @@ let
  } else portaudio;
 in stdenv'.mkDerivation (finalAttrs: {
  pname = "musescore";
-  version = "4.3.2";
+  version = "4.4.0";

  src = fetchFromGitHub {
    owner = "musescore";
    repo = "MuseScore";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-QjvY8R2nq/DeFDikHn9qr4aCEwzAcogQXM5vdZqhoMM=";
+    sha256 = "sha256-oDbOaLFmSpZ7D8E7LBxUwFwiaPcucIUj3eEp6sXR5o8=";
  };
+  patches = [
+    # https://github.com/musescore/MuseScore/pull/24247
+    (fetchpatch {
+      name = "skip-downloading-harfbuzz.patch";
+      url = "https://github.com/musescore/MuseScore/commit/686ea243d58b43eb3dff7ebdabb2e09de4d212e4.patch";
+      hash = "sha256-fsb1hKFKXwBdMPh+Ek0UT3XtI8qg3ieWUQW1/XDvhmg=";
+    })
+    # https://github.com/musescore/MuseScore/pull/24261
+    (fetchpatch {
+      name = "allow-using-system-harfbuzz.patch";
+      url = "https://github.com/musescore/MuseScore/commit/696279e362afe72db5e92f8a47aa64b3a0e86a86.patch";
+      hash = "sha256-z1W2SmzUUlVL7mRR2frzUZjMEnwqkVfRVz4TufR1tDU=";
+    })
+    # https://github.com/musescore/MuseScore/pull/24326
+    (fetchpatch {
+      name = "fix-menubar-with-qt6.5+.patch";
+      url = "https://github.com/musescore/MuseScore/pull/24326/commits/b274f13311ad0b2bce339634a006ba22fbd3379e.patch";
+      hash = "sha256-ZGmjRa01CBEIxJdJYQMhdg4A9yjWdlgn0pCPmENBTq0=";
+    })
+  ];

  cmakeFlags = [
-    "-DMUSESCORE_BUILD_MODE=release"
+    "-DMUSE_APP_BUILD_MODE=release"
    # Disable the build and usage of the `/bin/crashpad_handler` utility - it's
    # not useful on NixOS, see:
    # https://github.com/musescore/MuseScore/issues/15571
-    "-DMUE_BUILD_CRASHPAD_CLIENT=OFF"
+    "-DMUSE_MODULE_DIAGNOSTICS_CRASHPAD_CLIENT=OFF"
    # Use our versions of system libraries
    "-DMUE_COMPILE_USE_SYSTEM_FREETYPE=ON"
+    "-DMUE_COMPILE_USE_SYSTEM_HARFBUZZ=ON"
    "-DMUE_COMPILE_USE_SYSTEM_TINYXML=ON"
    # Implies also -DMUE_COMPILE_USE_SYSTEM_OPUS=ON
    "-DMUE_COMPILE_USE_SYSTEM_OPUSENC=ON"
    "-DMUE_COMPILE_USE_SYSTEM_FLAC=ON"
-    # From some reason, in $src/build/cmake/SetupBuildEnvironment.cmake,
-    # upstream defaults to compiling to x86_64 only, unless this cmake flag is
-    # set
-    "-DMUE_COMPILE_BUILD_MACOS_APPLE_SILICON=ON"
    # Don't bundle qt qml files, relevant really only for darwin, but we set
    # this for all platforms anyway.
    "-DMUE_COMPILE_INSTALL_QTQML_FILES=OFF"
@ -94,6 +110,7 @@ in stdenv'.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    wrapQtAppsHook
    cmake
+    qttools
    pkg-config
    ninja
  ];
@ -114,14 +131,11 @@ in stdenv'.mkDerivation (finalAttrs: {
    tinyxml-2
    qtbase
    qtdeclarative
-    qtgraphicaleffects
-    qtquickcontrols
-    qtquickcontrols2
-    qtscript
+    qt5compat
+    qtwayland
    qtsvg
-    qtxmlpatterns
+    qtscxml
    qtnetworkauth
-    qtx11extras
  ] ++ lib.optionals stdenv.isLinux [
    alsa-lib
  ];
--- a/pkgs/applications/gis/qgis/default.nix
+++ b/pkgs/applications/gis/qgis/default.nix
@ -24,13 +24,13 @@ in symlinkJoin rec {
  pythonInputs = qgis-unwrapped.pythonBuildInputs ++ (extraPythonPackages qgis-unwrapped.py.pkgs);

  postBuild = ''
-    # unpackPhase
-
    buildPythonPath "$pythonInputs"

-    wrapProgram $out/bin/qgis \
-      --prefix PATH : $program_PATH \
-      --set PYTHONPATH $program_PYTHONPATH
+    for program in $out/bin/*; do
+      wrapProgram $program \
+        --prefix PATH : $program_PATH \
+        --set PYTHONPATH $program_PYTHONPATH
+    done
  '';

  passthru = {
--- a/pkgs/applications/gis/qgis/ltr.nix
+++ b/pkgs/applications/gis/qgis/ltr.nix
@ -24,13 +24,13 @@ in symlinkJoin rec {
  pythonInputs = qgis-ltr-unwrapped.pythonBuildInputs ++ (extraPythonPackages qgis-ltr-unwrapped.py.pkgs);

  postBuild = ''
-    # unpackPhase
-
    buildPythonPath "$pythonInputs"

-    wrapProgram $out/bin/qgis \
-      --prefix PATH : $program_PATH \
-      --set PYTHONPATH $program_PYTHONPATH
+    for program in $out/bin/*; do
+      wrapProgram $program \
+        --prefix PATH : $program_PATH \
+        --set PYTHONPATH $program_PYTHONPATH
+    done
  '';

  passthru = {
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@ -173,9 +173,11 @@ in mkDerivation rec {
    # the path at build time using GRASS_PREFIX.
    # Using wrapGAppsHook also prevents file dialogs from crashing the program
    # on non-NixOS.
-    wrapProgram $out/bin/qgis \
-      "''${gappsWrapperArgs[@]}" \
-      --prefix PATH : ${lib.makeBinPath [ grass ]}
+    for program in $out/bin/*; do
+      wrapProgram $program \
+        "''${gappsWrapperArgs[@]}" \
+        --prefix PATH : ${lib.makeBinPath [ grass ]}
+    done
  '';

  meta = with lib; {
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@ -175,9 +175,11 @@ in mkDerivation rec {
    # the path at build time using GRASS_PREFIX.
    # Using wrapGAppsHook also prevents file dialogs from crashing the program
    # on non-NixOS.
-    wrapProgram $out/bin/qgis \
-      "''${gappsWrapperArgs[@]}" \
-      --prefix PATH : ${lib.makeBinPath [ grass ]}
+    for program in $out/bin/*; do
+      wrapProgram $program \
+        "''${gappsWrapperArgs[@]}" \
+        --prefix PATH : ${lib.makeBinPath [ grass ]}
+    done
  '';

  meta = with lib; {
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -20,14 +20,14 @@
 let
  pname = "qownnotes";
  appname = "QOwnNotes";
-  version = "24.9.0";
+  version = "24.9.1";
 in
 stdenv.mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-xlGBpRiak/th/z9zKbQXpuk3py/W1ns90NjKw4w3FtI=";
+    hash = "sha256-W9w7FJ0EfwPLC9R6OnDz+yny4VSaRGdrPXvaReV9hco=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/window-managers/miriway/default.nix
+++ b/pkgs/applications/window-managers/miriway/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "miriway";
-  version = "0-unstable-2024-08-14";
+  version = "0-unstable-2024-08-31";

  src = fetchFromGitHub {
    owner = "Miriway";
    repo = "Miriway";
-    rev = "2d00e8a61cb029cec96596897a1dada8033c601a";
-    hash = "sha256-DB07IGFXLQj2LsU8iVZrSda0FS/efKUAolet8fK9Clo=";
+    rev = "2d754931f038865bd91938578b862262f0ce7c00";
+    hash = "sha256-wmtAbajZ859tvLjKuwqFUq05VGLxHNJX1XyIXM6vvgU=";
  };

  strictDeps = true;
--- a/pkgs/by-name/at/atlauncher/deps.json
+++ b/pkgs/by-name/at/atlauncher/deps.json
--- a/pkgs/by-name/at/atlauncher/package.nix
+++ b/pkgs/by-name/at/atlauncher/package.nix
@ -1,9 +1,8 @@
 {
-  copyDesktopItems,
-  fetchurl,
+  fetchFromGitHub,
+  gradle,
  jre,
  lib,
-  makeDesktopItem,
  makeWrapper,
  stdenvNoCC,

@ -24,23 +23,37 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "atlauncher";
  version = "3.4.36.10";

-  src = fetchurl {
-    url = "https://github.com/ATLauncher/ATLauncher/releases/download/v${finalAttrs.version}/ATLauncher-${finalAttrs.version}.jar";
-    hash = "sha256-JZTiYcea5ik8a4RmNLxZcuea7spGWftUGRiRW2Ive7c=";
+  src = fetchFromGitHub {
+    owner = "ATLauncher";
+    repo = "ATLauncher";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-EMV/M5W/acJaQJsi4COoRQC2YVfuJG9HGcwvGfakoNo=";
  };

-  env.ICON = fetchurl {
-    url = "https://atlauncher.com/assets/images/logo.svg";
-    hash = "sha256-XoqpsgLmkpa2SdjZvPkgg6BUJulIBIeu6mBsJJCixfo=";
-  };
-
-  dontUnpack = true;
+  postPatch = ''
+    # exclude UI tests
+    sed -i "/test {/a\    exclude '**/BasicLauncherUiTest.class'" build.gradle
+  '';

  nativeBuildInputs = [
-    copyDesktopItems
+    gradle
    makeWrapper
  ];

+  mitmCache = gradle.fetchDeps {
+    inherit (finalAttrs) pname;
+    data = ./deps.json;
+  };
+
+  doCheck = true;
+
+  gradleBuildTask = "shadowJar";
+
+  gradleFlags = [
+    "--exclude-task"
+    "createExe"
+  ];
+
  installPhase =
    let
      runtimeLibraries =
@ -59,30 +72,28 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    ''
      runHook preInstall

-      mkdir -p $out/bin $out/share/java
-      cp $src $out/share/java/ATLauncher.jar
+      mkdir -p $out/{bin,share/java}
+      cp build/libs/ATLauncher-${finalAttrs.version}.jar $out/share/java/ATLauncher.jar

-      makeWrapper ${jre}/bin/java $out/bin/atlauncher \
+      makeWrapper ${lib.getExe jre} $out/bin/atlauncher \
        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeLibraries}" \
        --add-flags "-jar $out/share/java/ATLauncher.jar" \
        --add-flags "--working-dir \"\''${XDG_DATA_HOME:-\$HOME/.local/share}/ATLauncher\"" \
        --add-flags "--no-launcher-update"

-      mkdir -p $out/share/icons/hicolor/scalable/apps
-      cp $ICON $out/share/icons/hicolor/scalable/apps/atlauncher.svg
-
      runHook postInstall
    '';

-  desktopItems = [
-    (makeDesktopItem {
-      categories = [ "Game" ];
-      desktopName = "ATLauncher";
-      exec = "atlauncher";
-      icon = "atlauncher";
-      name = "atlauncher";
-    })
-  ];
+  postInstall =
+    let
+      packagingDir = "${finalAttrs.src}/packaging/linux/_common";
+    in
+    ''
+      install -D -m444 ${packagingDir}/atlauncher.desktop -t $out/share/applications
+      install -D -m444 ${packagingDir}/atlauncher.metainfo.xml -t $out/share/metainfo
+      install -D -m444 ${packagingDir}/atlauncher.png -t $out/share/pixmaps
+      install -D -m444 ${packagingDir}/atlauncher.svg -t $out/share/icons/hicolor/scalable/apps
+    '';

  meta = {
    changelog = "https://github.com/ATLauncher/ATLauncher/blob/v${finalAttrs.version}/CHANGELOG.md";
@ -93,6 +104,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    mainProgram = "atlauncher";
    maintainers = with lib.maintainers; [ getpsyched ];
    platforms = lib.platforms.all;
-    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryBytecode # mitm cache
+    ];
  };
 })
--- a/pkgs/by-name/au/audiobookshelf/source.json
+++ b/pkgs/by-name/au/audiobookshelf/source.json
@ -1,9 +1,9 @@
 {
  "owner": "advplyr",
  "repo": "audiobookshelf",
-  "rev": "48f232790a5026ac886564ef57660a338a168187",
-  "hash": "sha256-2/lUByeWMZlxk7i+mvzBuxlxD97C+JEtmf/ajht5AOs=",
-  "version": "2.13.2",
-  "depsHash": "sha256-kU5Nrhy6AePwD2/kmvTXvrvGUH8uz3qm3ZvD3kC9EmE=",
-  "clientDepsHash": "sha256-1haujBoC9KyusE52HeepOcvmb6v7EG5XWD4dq1wPfe4="
+  "rev": "24923c0009446e2db26ec366b25dd38deb2e2573",
+  "hash": "sha256-afNz4dTEr/6STn6cqSHxugn5ofa0jY4HvUnckJabxdo=",
+  "version": "2.13.3",
+  "depsHash": "sha256-fRz4qUxd8lZODQikP011FtvyFCz4fehESUfBmSBLwtA=",
+  "clientDepsHash": "sha256-VGbwiCuDjA1rtUpLw7gO+Xb5/D09evf/Jrb93H0QCH8="
 }
--- a/pkgs/by-name/ba/basedpyright/package.nix
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@ -11,13 +11,13 @@
 }:

 let
-  version = "1.17.1";
+  version = "1.17.2";

  src = fetchFromGitHub {
    owner = "detachhead";
    repo = "basedpyright";
    rev = "refs/tags/v${version}";
-    hash = "sha256-mFY0GvVGiozxd04ktSoqcezBwXkOAeIWTgNnv1zB74A=";
+    hash = "sha256-6pksb2drjiZo1Hp6P/G06LAj3nW5WXJbVNGt5897jAA=";
  };

  patchedPackageJSON = runCommand "package.json" { } ''
@ -47,7 +47,7 @@ let
    pname = "pyright-internal";
    inherit version src;
    sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-IJMK/YhTldOr3Gh4ewlVLUSt3PlhIjilxB7QBJpdu80=";
+    npmDepsHash = "sha256-w6SurZ4EG2QW7paZsWxu0gNXMXxnzQygClOUdLeBKdw=";
    dontNpmBuild = true;
    # Uncomment this flag when using unreleased peer dependencies
    # npmFlags = [ "--legacy-peer-deps" ];
@ -94,7 +94,7 @@ buildNpmPackage rec {
  inherit version src;

  sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-TmJrh/Pya7jXhMQyCz6wwCCP0gzTTKFNUKF+vBq22U0=";
+  npmDepsHash = "sha256-y7arZsXjJ0LdWpXdSZjc7EBJPN/oWAje4uQDEhkRbDM=";

  postPatch = ''
    chmod +w ../../
--- a/pkgs/by-name/de/dep-scan/package.nix
+++ b/pkgs/by-name/de/dep-scan/package.nix
@ -4,16 +4,28 @@
  python3,
 }:

+let
+  appthreat-vulnerability-db = (
+    python3.pkgs.appthreat-vulnerability-db.overrideAttrs (oldAttrs: rec {
+      version = "5.7.3";
+      src = oldAttrs.src.override {
+        rev = "refs/tags/v${version}";
+        hash = "sha256-MrlgBUx3T2G46Pnah3obe5b4yKDzsAFVC/B7AHM0kZY=";
+      };
+    })
+  );
+
+in
 python3.pkgs.buildPythonApplication rec {
  pname = "dep-scan";
-  version = "5.3.4";
+  version = "5.4.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "owasp-dep-scan";
    repo = "dep-scan";
    rev = "refs/tags/v${version}";
-    hash = "sha256-5iMhl3Wcxwgq4Wr0TUcAuRnb2+y8DHBugnnkpcZfSAM=";
+    hash = "sha256-m0vDsCetOSfScu1eprrGaDJ1VuXxuNFBitK8N5GtfSQ=";
  };

  build-system = with python3.pkgs; [ setuptools ];
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@ -17,16 +17,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "eza";
-  version = "0.19.1";
+  version = "0.19.2";

  src = fetchFromGitHub {
    owner = "eza-community";
    repo = "eza";
    rev = "v${version}";
-    hash = "sha256-VV8tqVJq+bsgfdNSxSzo1vqYtYT37D2pBX4HydY6cKs=";
+    hash = "sha256-sTGU1Voa+mMBRIHVVUF79BwvxQfjA4XknhhhT5sk5xE=";
  };

-  cargoHash = "sha256-SUvQxW3STsP1VrPJKK2NYbApuoGfbmfUiywZILvcvj4=";
+  cargoHash = "sha256-DSZ+1Svb22RlNzx74Kpj+oWrK60s4nGfpzzodDRL/Ko=";

  nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
  buildInputs = [ zlib ]
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@ -11,13 +11,13 @@
 }:
 let
  pname = "feishin";
-  version = "0.8.0";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "jeffvli";
    repo = "feishin";
    rev = "v${version}";
-    hash = "sha256-KaZA7ZAeN6f1PWMeUl0Z4Xl/S/uD2vLPHM5uM+dIbko=";
+    hash = "sha256-9ExTxVptPEZ+E1Tr7vS3JCfH8RoRDfZ0daA1AHWuuas=";
  };

  electron = electron_31;
@ -26,7 +26,7 @@ buildNpmPackage {
  inherit pname version;

  inherit src;
-  npmDepsHash = "sha256-1BG4U6x+e204KdrIh0S/rrdj/3wh2iuuWQgFXLjO3iw=";
+  npmDepsHash = "sha256-7CsbhwdNGkeNTNYrpMfOiQDU5lo23723F4zmM6QyFdA=";

  npmFlags = [ "--legacy-peer-deps" ];
  makeCacheWritable = true;
@ -60,7 +60,7 @@ buildNpmPackage {
        inherit version;

        src = "${src}/release/app";
-        npmDepsHash = "sha256-//K8jiO3nEHs08l9eMDW2HnZBeBgxBMai2omoCI7wQw=";
+        npmDepsHash = "sha256-2LsciXkFSCxFghiMRM7NoCv+7k9MC9W0xPtMsddZCZk=";

        npmFlags = [ "--ignore-scripts" ];
        dontNpmBuild = true;
--- a/pkgs/by-name/fi/filesender/package.nix
+++ b/pkgs/by-name/fi/filesender/package.nix
@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "filesender";
-  version = "2.48";
+  version = "2.49";

  src = fetchFromGitHub {
    owner = "filesender";
    repo = "filesender";
    rev = "filesender-${finalAttrs.version}";
-    hash = "sha256-lXA9XZ5gbfut2EQ5bF2w8rhAEM++8rQseWviKwfRWGk=";
+    hash = "sha256-GNhborbwV9G2x7pLDyxGVCtTf4AIaMYQGAKNJPzedzo=";
  };

  patches = [
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@ -236,6 +236,7 @@ let
        mv "$icon_file" "$logo_output_path/google-$appname.png"
      done

+      # "--simulate-outdated-no-au" disables auto updates and browser outdated popup
      makeWrapper "$out/share/google/$appname/google-$appname" "$exe" \
        --prefix LD_LIBRARY_PATH : "$rpath" \
        --prefix PATH            : "$binpath" \
@ -243,13 +244,8 @@ let
        --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addDriverRunpath.driverLink}/share" \
        --set CHROME_WRAPPER  "google-chrome-$dist" \
        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
-        --add-flags ${
-          lib.concatStringsSep " " [
-            (lib.escapeShellArg commandLineArgs)
-            # Disables auto updates and browser outdated popup
-            "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'"
-          ]
-        }
+        --add-flags "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" \
+        --add-flags ${lib.escapeShellArg commandLineArgs}

      for elf in $out/share/google/$appname/{chrome,chrome-sandbox,chrome_crashpad_handler}; do
        patchelf --set-rpath $rpath $elf
@ -288,15 +284,11 @@ let
      cp -r *.app $out/Applications

      mkdir -p $out/bin
-      makeWrapper $out/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome $out/bin/google-chrome-stable \
-        --add-flags ${
-          lib.concatStringsSep " " [
-            (lib.escapeShellArg commandLineArgs)
-            # Disables auto updates and browser outdated popup
-            "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'"
-          ]
-        }

+      # "--simulate-outdated-no-au" disables auto updates and browser outdated popup
+      makeWrapper $out/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome $out/bin/google-chrome-stable \
+        --add-flags "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" \
+        --add-flags ${lib.escapeShellArg commandLineArgs}
      runHook postInstall
    '';
  });
--- a/pkgs/by-name/mi/micro/package.nix
+++ b/pkgs/by-name/mi/micro/package.nix
@ -1,26 +1,14 @@
 {
  lib,
-  stdenv,
  buildGoModule,
+  callPackage,
  fetchFromGitHub,
  installShellFiles,
-  callPackage,
-  wl-clipboard,
-  xclip,
-  makeWrapper,
-  # Boolean flags
-  withXclip ? stdenv.isLinux,
-  withWlClipboard ?
-    if withWlclip != null then
-      lib.warn ''
-        withWlclip is deprecated and will be removed;
-        use withWlClipboard instead.
-      '' withWlclip
-    else
-      stdenv.isLinux,
+  stdenv,
  # Deprecated options
-  # Remove them before or right after next version update from Nixpkgs or this
-  # package itself
+  # Remove them as soon as possible
+  withXclip ? null,
+  withWlClipboard ? null,
  withWlclip ? null,
 }:

@ -38,10 +26,7 @@ let

    vendorHash = "sha256-ePhObvm3m/nT+7IyT0W6K+y+9UNkfd2kYjle2ffAd9Y=";

-    nativeBuildInputs = [
-      installShellFiles
-      makeWrapper
-    ];
+    nativeBuildInputs = [ installShellFiles ];

    outputs = [
      "out"
@ -73,22 +58,12 @@ let
      install -Dm644 assets/micro-logo-mark.svg $out/share/icons/hicolor/scalable/apps/micro.svg
    '';

-    postFixup =
-      let
-        clipboardPackages =
-          lib.optionals withXclip [ xclip ]
-          ++ lib.optionals withWlClipboard [ wl-clipboard ];
-      in
-      lib.optionalString (withXclip || withWlClipboard) ''
-        wrapProgram "$out/bin/micro" \
-                  --prefix PATH : "${lib.makeBinPath clipboardPackages}"
-      '';
-
    passthru = {
      tests = lib.packagesFromDirectoryRecursive {
        inherit callPackage;
        directory = ./tests;
      };
+      wrapper = callPackage ./wrapper.nix { micro = self; };
    };

    meta = {
@ -114,4 +89,11 @@ let
    };
  };
 in
-self
+lib.warnIf (withXclip != null || withWlClipboard != null || withWlclip != null) ''
+  The options `withXclip`, `withWlClipboard`, `withWlclip` were removed. If
+  you are seeking for clipboard support, please consider the following
+  packages:
+  - `micro-with-wl-clipboard`
+  - `micro-with-xclip`
+  - `micro-full`
+'' self
--- a/pkgs/by-name/mi/micro/wrapper.nix
+++ b/pkgs/by-name/mi/micro/wrapper.nix
@ -0,0 +1,33 @@
+{
+  lib,
+  micro,
+  makeWrapper,
+  symlinkJoin,
+  # configurable options
+  extraPackages ? [ ],
+}:
+
+symlinkJoin {
+  name = "micro-wrapped-${micro.version}";
+  inherit (micro) pname version outputs;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  paths = [ micro ];
+
+  postBuild = ''
+    ${lib.concatMapStringsSep "\n" (
+      output: "ln --verbose --symbolic --no-target-directory ${micro.${output}} \$${output}"
+    ) (lib.remove "out" micro.outputs)}
+
+    pushd $out/bin
+    for f in *; do
+      rm $f
+      makeWrapper ${micro}/bin/$f $f \
+        --prefix PATH ":" "${lib.makeBinPath extraPackages}"
+    done
+    popd
+  '';
+
+  meta = micro.meta;
+}
--- a/pkgs/by-name/mi/mistral-rs/Cargo.lock
+++ b/pkgs/by-name/mi/mistral-rs/Cargo.lock
--- a/pkgs/by-name/mi/mistral-rs/package.nix
+++ b/pkgs/by-name/mi/mistral-rs/package.nix
@ -19,6 +19,7 @@

  testers,
  mistral-rs,
+  nix-update-script,

  cudaPackages,
  cudaCapability ? null,
@ -56,7 +57,6 @@ let
      cudaCapability;
  cudaCapability' = lib.toInt (cudaPackages.cudaFlags.dropDot cudaCapabilityString);

-  # TODO Should we assert mklAccel -> stdenv.isLinux && stdenv.isx86_64 ?
  mklSupport =
    assert accelIsValid;
    (acceleration == "mkl");
@ -80,27 +80,23 @@ in

 rustPlatform.buildRustPackage rec {
  pname = "mistral-rs";
-  version = "0.1.18";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "EricLBuehler";
    repo = "mistral.rs";
    rev = "refs/tags/v${version}";
-    hash = "sha256-lMDFWNv9b0UfckqLmyWRVwnqmGe6nxYsUHzoi2+oG84=";
+    hash = "sha256-3o7Esn+hEXKOoHX6JeXu/sgkWeL6tLCoH+Ep81/LoeU=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "candle-core-0.6.0" = "sha256-DxGBWf2H7MamrbboTJ4zHy1HeE8ZVT7QvE3sTYrRxBc=";
-      "range-checked-0.1.0" = "sha256-S+zcF13TjwQPFWZLIbUDkvEeaYdaxCOtDLtI+JRvum8=";
+      "bindgen_cuda-0.1.6" = "sha256-OWGcQxT+x5HyIFskNVWpPr6Qfkh6Mv/g4PVSm5oA27g=";
+      "candle-core-0.6.0" = "sha256-8UBDQfbVR4gsZRRCy899DA27saiC85+FRm6L4YBX2oA=";
    };
  };

-  postPatch = ''
-    ln -s ${./Cargo.lock} Cargo.lock
-  '';
-
  nativeBuildInputs = [
    pkg-config
    python3
@ -112,6 +108,7 @@ rustPlatform.buildRustPackage rec {
      openssl
    ]
    ++ lib.optionals cudaSupport [
+      cudaPackages.cuda_cudart
      cudaPackages.cuda_nvrtc
      cudaPackages.libcublas
      cudaPackages.libcurand
@ -120,7 +117,13 @@ rustPlatform.buildRustPackage rec {
    ++ lib.optionals stdenv.isDarwin darwinBuildInputs;

  cargoBuildFlags =
-    lib.optionals cudaSupport [ "--features=cuda" ]
+    [
+      # This disables the plotly crate which fails to build because of the kaleido feature requiring
+      # network access at build-time.
+      # See https://github.com/NixOS/nixpkgs/pull/323788#issuecomment-2206085825
+      "--no-default-features"
+    ]
+    ++ lib.optionals cudaSupport [ "--features=cuda" ]
    ++ lib.optionals mklSupport [ "--features=mkl" ]
    ++ lib.optionals (stdenv.isDarwin && metalSupport) [ "--features=metal" ];

@ -129,7 +132,7 @@ rustPlatform.buildRustPackage rec {
      SWAGGER_UI_DOWNLOAD_URL =
        let
          # When updating:
-          # - Look for the version of `utopia-swagger-ui` at:
+          # - Look for the version of `utoipa-swagger-ui` at:
          #   https://github.com/EricLBuehler/mistral.rs/blob/v<MISTRAL-RS-VERSION>/mistralrs-server/Cargo.toml
          # - Look at the corresponding version of `swagger-ui` at:
          #   https://github.com/juhaku/utoipa/blob/utoipa-swagger-ui-<UTOPIA-SWAGGER-UI-VERSION>/utoipa-swagger-ui/build.rs#L21-L22
@ -166,20 +169,29 @@ rustPlatform.buildRustPackage rec {
  checkFlags = [
    "--skip=gguf::gguf_tokenizer::tests::test_decode_gpt2"
    "--skip=gguf::gguf_tokenizer::tests::test_decode_llama"
+    "--skip=gguf::gguf_tokenizer::tests::test_encode_decode_gpt2"
+    "--skip=gguf::gguf_tokenizer::tests::test_encode_decode_llama"
    "--skip=gguf::gguf_tokenizer::tests::test_encode_gpt2"
    "--skip=gguf::gguf_tokenizer::tests::test_encode_llama"
    "--skip=sampler::tests::test_argmax"
    "--skip=sampler::tests::test_gumbel_speculative"
+    "--skip=util::tests::test_parse_image_url"
  ];

  passthru = {
    tests = {
      version = testers.testVersion { package = mistral-rs; };

-      withMkl = mistral-rs.override { acceleration = "mkl"; };
-      withCuda = mistral-rs.override { acceleration = "cuda"; };
-      withMetal = mistral-rs.override { acceleration = "metal"; };
+      # TODO: uncomment when mkl support will be fixed
+      withMkl = lib.optionalAttrs (stdenv.hostPlatform == "x86_64-linux") (
+        mistral-rs.override { acceleration = "mkl"; }
+      );
+      withCuda = lib.optionalAttrs stdenv.isLinux (mistral-rs.override { acceleration = "cuda"; });
+      withMetal = lib.optionalAttrs (stdenv.hostPlatform == "aarch64-darwin") (
+        mistral-rs.override { acceleration = "metal"; }
+      );
    };
+    updateScript = nix-update-script { };
  };

  meta = {
@ -194,6 +206,8 @@ rustPlatform.buildRustPackage rec {
        lib.platforms.linux
      else if metalSupport then
        [ "aarch64-darwin" ]
+      else if mklSupport then
+        [ "x86_64-linux" ]
      else
        lib.platforms.unix;
    broken = mklSupport;
--- a/pkgs/by-name/ne/netscanner/package.nix
+++ b/pkgs/by-name/ne/netscanner/package.nix
@ -6,7 +6,7 @@
 }:
 let
  pname = "netscanner";
-  version = "0.5.2";
+  version = "0.5.3";
 in
 rustPlatform.buildRustPackage {
  inherit pname version;
@ -17,10 +17,10 @@ rustPlatform.buildRustPackage {
    owner = "Chleba";
    repo = "netscanner";
    rev = "refs/tags/v${version}";
-    hash = "sha256-gVwI5dGQqSQf2wR7oKMTRIqseUbAEDTTuQ51S6dvEFw=";
+    hash = "sha256-rqUGi7UF9y3VZ0KoctCesQVgJbR1WfqhFA6aYFFimNk=";
  };

-  cargoHash = "sha256-30VSeBbaVWVEO14eUx28HSymfkCxH0IZmEN4cnJ9wIk=";
+  cargoHash = "sha256-VP6L3lXDXadimSWC2L4yfzTRfTcUilJtZ7TeHARAKAY=";

  postFixup = ''
    wrapProgram $out/bin/netscanner \
--- a/pkgs/by-name/pl/plasmusic-toolbar/package.nix
+++ b/pkgs/by-name/pl/plasmusic-toolbar/package.nix
@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "plasmusic-toolbar";
-  version = "1.5.0";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "ccatterina";
    repo = "plasmusic-toolbar";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-22eSrvigJHmwVB396APkDtiJjavpijUMuZ4mqQGVwf4=";
+    hash = "sha256-tZ2xcoGZp2GWoKd4XjO2K4he3tKBHgxi0PdqY+5ULn0=";
  };

  installPhase = ''
--- a/pkgs/by-name/sc/scrutiny-collector/package.nix
+++ b/pkgs/by-name/sc/scrutiny-collector/package.nix
@ -24,7 +24,7 @@ buildGoModule rec {

  vendorHash = "sha256-SiQw6pq0Fyy8Ia39S/Vgp9Mlfog2drtVn43g+GXiQuI=";

-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];

  CGO_ENABLED = 0;

--- a/pkgs/development/compilers/gcc-arm-embedded/13/default.nix
+++ b/pkgs/development/compilers/gcc-arm-embedded/13/default.nix
@ -9,7 +9,7 @@

 stdenv.mkDerivation rec {
  pname = "gcc-arm-embedded";
-  version = "13.2.rel1";
+  version = "13.3.rel1";

  platform = {
    aarch64-darwin = "darwin-arm64";
@ -20,11 +20,12 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://developer.arm.com/-/media/Files/downloads/gnu/${version}/binrel/arm-gnu-toolchain-${version}-${platform}-arm-none-eabi.tar.xz";
+    # hashes obtained from location ${url}.sha256asc
    sha256 = {
-      aarch64-darwin = "39c44f8af42695b7b871df42e346c09fee670ea8dfc11f17083e296ea2b0d279";
-      aarch64-linux  = "8fd8b4a0a8d44ab2e195ccfbeef42223dfb3ede29d80f14dcf2183c34b8d199a";
-      x86_64-darwin  = "075faa4f3e8eb45e59144858202351a28706f54a6ec17eedd88c9fb9412372cc";
-      x86_64-linux   = "6cd1bbc1d9ae57312bcd169ae283153a9572bd6a8e4eeae2fedfbc33b115fdbb";
+      aarch64-darwin = "fb6921db95d345dc7e5e487dd43b745e3a5b4d5c0c7ca4f707347148760317b4";
+      aarch64-linux  = "c8824bffd057afce2259f7618254e840715f33523a3d4e4294f471208f976764";
+      x86_64-darwin  = "1ab00742d1ed0926e6f227df39d767f8efab46f5250505c29cb81f548222d794";
+      x86_64-linux   = "95c011cee430e64dd6087c75c800f04b9c49832cc1000127a92a97f9c8d83af4";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

--- a/pkgs/development/libraries/LAStools/default.nix
+++ b/pkgs/development/libraries/LAStools/default.nix
@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    description = "Software for rapid LiDAR processing";
    homepage = "http://lastools.org/";
    license = licenses.unfree;
-    maintainers = with maintainers; [ stephenwithph ];
+    maintainers = with maintainers; teams.geospatial.members ++ [ stephenwithph ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/libLAS/default.nix
+++ b/pkgs/development/libraries/libLAS/default.nix
@ -49,11 +49,11 @@ stdenv.mkDerivation rec {
    install_name_tool -change "@rpath/liblas.3.dylib" "$out/lib/liblas.3.dylib" $out/lib/liblas_c.dylib
  '';

-  meta = {
+  meta = with lib; {
    description = "LAS 1.0/1.1/1.2 ASPRS LiDAR data translation toolset";
    homepage = "https://liblas.org";
-    license = lib.licenses.bsd3;
-    platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.michelk ];
+    license = licenses.bsd3;
+    platforms = platforms.unix;
+    maintainers = with maintainers; teams.geospatial.members ++ [ lib.maintainers.michelk ];
  };
 }
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "adafruit-platformdetect";
-  version = "3.73.0";
+  version = "3.74.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -16,7 +16,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "adafruit_platformdetect";
    inherit version;
-    hash = "sha256-IwkJityP+Hs9mkpdOu6+P3t/VasOE9Get1/6hl82+rg=";
+    hash = "sha256-rVmtqpVjQgovAsVCu3+hgglga9LJPGT8zzlhySmpba8=";
  };

  build-system = [ setuptools-scm ];
--- a/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
+++ b/pkgs/development/python-modules/appthreat-vulnerability-db/default.nix
@ -21,7 +21,7 @@

 buildPythonPackage rec {
  pname = "appthreat-vulnerability-db";
-  version = "6.0.8";
+  version = "6.0.14";
  pyproject = true;

  disabled = pythonOlder "3.10";
@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "AppThreat";
    repo = "vulnerability-db";
    rev = "refs/tags/v${version}";
-    hash = "sha256-lgt609UDuHTGQTTrpvxNvgUk6GU+TYqwc19dzatI4Io=";
+    hash = "sha256-Xm/2AHV4r6SmKK1wZS20xh9xRO3zhdEB/hpRT1o3z2Q=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/awkward/default.nix
+++ b/pkgs/development/python-modules/awkward/default.nix
@ -86,6 +86,12 @@ buildPythonPackage rec {
    # Disable tests dependending on jax on darwin
  ] ++ lib.optionals stdenv.isDarwin [ "tests/test_2603_custom_behaviors_with_jax.py" ];

+  disabledTests = [
+    # AssertionError: Regex pattern did not match.
+    "test_serialise_with_nonserialisable_attrs"
+    "test_serialise_with_nonserialisable_attrs"
+  ];
+
  meta = {
    description = "Manipulate JSON-like data with NumPy-like idioms";
    homepage = "https://github.com/scikit-hep/awkward";
--- a/pkgs/development/python-modules/lxml-html-clean/default.nix
+++ b/pkgs/development/python-modules/lxml-html-clean/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "lxml-html-clean";
-  version = "0.2.0";
+  version = "0.2.2";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "fedora-python";
    repo = "lxml_html_clean";
    rev = "refs/tags/${version}";
-    hash = "sha256-3ifuEgjCLDj0dBh9AbjAT/hNFGfINbvyjgRuxIRuarw=";
+    hash = "sha256-DiHbO2m/JckdXFMU7/LAW2hkyskqWtrQ93sgsVcdDSo=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
+++ b/pkgs/development/tools/rust/cargo-llvm-cov/default.nix
@ -26,7 +26,7 @@

 let
  pname = "cargo-llvm-cov";
-  version = "0.6.11";
+  version = "0.6.12";

  owner = "taiki-e";
  homepage = "https://github.com/${owner}/${pname}";
@ -37,7 +37,7 @@ let
  cargoLock = fetchurl {
    name = "Cargo.lock";
    url = "https://crates.io/api/v1/crates/${pname}/${version}/download";
-    sha256 = "sha256-/PwzG+Erz1aMDg50glZBP7mNHzuvvn2Dn+dicMG2ouo=";
+    sha256 = "sha256-QMO5J5c8MQr84w6X74oQrHV99cjSUVfpC8Ub1csQ0gI=";
    downloadToTemp = true;
    postFetch = ''
      tar xzf $downloadedFile ${pname}-${version}/Cargo.lock
@ -55,7 +55,7 @@ rustPlatform.buildRustPackage {
    inherit owner;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-1HZNYC7bMG7olnZH4oOC/fXOAF9qt7MYhlQbaOKDmvg=";
+    sha256 = "sha256-BlXgbCWjGya/I94nqfjBqQPSWnVhyhNn0oSRL9xiS6k=";
  };

  # Upstream doesn't include the lockfile so we need to add it back
@ -63,7 +63,7 @@ rustPlatform.buildRustPackage {
    cp ${cargoLock} source/Cargo.lock
  '';

-  cargoHash = "sha256-sN3vNZgi45pcDXI8kQ0L/r6HCDGs8l2VMwI+LHjwZ6Q=";
+  cargoHash = "sha256-nabO19JePQRuhxsbm5wVIU4+5si6p0VgqR2QLmLeivU=";

  # `cargo-llvm-cov` reads these environment variables to find these binaries,
  # which are needed to run the tests
--- a/pkgs/development/tools/rust/cargo-llvm-lines/default.nix
+++ b/pkgs/development/tools/rust/cargo-llvm-lines/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-llvm-lines";
-  version = "0.4.39";
+  version = "0.4.40";

  src = fetchFromGitHub {
    owner = "dtolnay";
    repo = pname;
    rev = version;
-    hash = "sha256-iy8bZvF3JYnlABzhmsrzo89pmKAWQYVNSZ9HoplpWiY=";
+    hash = "sha256-FyPq2+Smx4ZbJG13TKUHlyAANU4JbpAAUxisH9c4Aq8=";
  };

-  cargoHash = "sha256-vFj7U+30dcLkFJ1eet6lykTcJHzKWOSzAqPqKJrp6Gg=";
+  cargoHash = "sha256-AH27+WrWguFpZFIq3N8Wb1Nlwbof6tgX0W4AtwMtoVw=";

  meta = with lib; {
    description = "Count the number of lines of LLVM IR across all instantiations of a generic function";
--- a/pkgs/development/tools/rust/cargo-nextest/default.nix
+++ b/pkgs/development/tools/rust/cargo-nextest/default.nix
@ -1,31 +1,22 @@
-{ lib, rustPlatform, fetchFromGitHub, stdenv, darwin }:
+{ lib, rustPlatform, fetchFromGitHub, nix-update-script }:

 rustPlatform.buildRustPackage rec {
  pname = "cargo-nextest";
-  version = "0.9.72";
+  version = "0.9.77";

  src = fetchFromGitHub {
    owner = "nextest-rs";
    repo = "nextest";
    rev = "cargo-nextest-${version}";
-    hash = "sha256-FQM1SVzGgmu6HHijP9kKEJPhhzSLs/jo36b4qnx0lb4=";
+    hash = "sha256-4wqWCa3HHctKSaSYiiLBa9PM6cWyr0H7blI9BWGLTuI=";
  };

-  cargoHash = "sha256-2ttG9lPIkLRzDPcDNZjROOIIDhcEHfBvs/DTniZtQUY=";
-
-  buildInputs = lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.SystemConfiguration
-  ];
+  cargoHash = "sha256-9XOkXK5sH+Qo8omS8V8FMgnh+oqLZL4paqoL9UOPevA=";

  cargoBuildFlags = [ "-p" "cargo-nextest" ];
  cargoTestFlags = [ "-p" "cargo-nextest" ];

-  # TODO: investigate some more why these tests fail in nix
-  checkFlags = [
-    "--skip=tests_integration::test_list"
-    "--skip=tests_integration::test_relocated_run"
-    "--skip=tests_integration::test_run"
-  ];
+  passthru.updateScript = nix-update-script { };

  meta = with lib; {
    description = "Next-generation test runner for Rust projects";
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@ -142,6 +142,7 @@ stdenv.mkDerivation (finalAttrs: {
      done

      install -Dm755 ../../tools/prlfsmountd.sh $out/sbin/prlfsmountd
+      install -Dm755 ../../tools/prlbinfmtconfig.sh $out/sbin/prlbinfmtconfig
      for f in $out/bin/* $out/sbin/*; do
        wrapProgram $f \
          --prefix LD_LIBRARY_PATH ':' "${libPath}" \
--- a/pkgs/os-specific/linux/zfs/2_2.nix
+++ b/pkgs/os-specific/linux/zfs/2_2.nix
@ -14,10 +14,10 @@ callPackage ./generic.nix args {
  # this attribute is the correct one for this package.
  kernelModuleAttribute = "zfs_2_2";
  # check the release notes for compatible kernels
-  kernelCompatible = kernel: kernel.kernelOlder "6.10";
+  kernelCompatible = kernel: kernel.kernelOlder "6.11";

  # this package should point to the latest release.
-  version = "2.2.5";
+  version = "2.2.6";

  tests = [
    nixosTests.zfs.installer
@ -26,5 +26,5 @@ callPackage ./generic.nix args {

  maintainers = with lib.maintainers; [ adamcstephens amarshall ];

-  hash = "sha256-BkwcNPk+jX8CXp5xEVrg4THof7o/5j8RY2SY6+IPNTg=";
+  hash = "sha256-wkgoYg6uQOHVq8a9sJXzO/QXJ6q28l7JXWkC+BFvOb0=";
 }
--- a/pkgs/os-specific/linux/zfs/generic.nix
+++ b/pkgs/os-specific/linux/zfs/generic.nix
@ -184,6 +184,7 @@ let

      # Add Bash completions.
      install -v -m444 -D -t $out/share/bash-completion/completions contrib/bash_completion.d/zfs
+    '' + optionalString (lib.versionOlder version "2.2.6") ''
      (cd $out/share/bash-completion/completions; ln -s zfs zpool)
    '';

--- a/pkgs/os-specific/linux/zfs/unstable.nix
+++ b/pkgs/os-specific/linux/zfs/unstable.nix
@ -20,12 +20,12 @@ callPackage ./generic.nix args {
  # IMPORTANT: Always use a tagged release candidate or commits from the
  # zfs-<version>-staging branch, because this is tested by the OpenZFS
  # maintainers.
-  version = "2.2.5";
+  version = "2.2.6";
  # rev = "";

  tests = [
    nixosTests.zfs.unstable
  ];

-  hash = "sha256-BkwcNPk+jX8CXp5xEVrg4THof7o/5j8RY2SY6+IPNTg=";
+  hash = "sha256-wkgoYg6uQOHVq8a9sJXzO/QXJ6q28l7JXWkC+BFvOb0=";
 }
--- a/pkgs/servers/home-assistant/custom-components/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/default.nix
@ -22,6 +22,8 @@

  frigate = callPackage ./frigate {};

+  garmin_connect = callPackage ./garmin_connect {};
+
  govee-lan = callPackage ./govee-lan {};

  gpio = callPackage ./gpio {};
--- a/pkgs/servers/home-assistant/custom-components/garmin_connect/default.nix
+++ b/pkgs/servers/home-assistant/custom-components/garmin_connect/default.nix
@ -0,0 +1,35 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+  garminconnect,
+  tzlocal,
+}:
+
+buildHomeAssistantComponent {
+  owner = "cyberjunky";
+  domain = "garmin_connect";
+  version = "unstable-2024-08-31";
+
+  src = fetchFromGitHub {
+    owner = "cyberjunky";
+    repo = "home-assistant-garmin_connect";
+    rev = "d42edcabc67ba6a7f960e849c8aaec1aabef87c0";
+    hash = "sha256-KqbP6TpH9B0/AjtsW5TcWSNgUhND+w8rO6X8fHqtsDI=";
+  };
+
+  propagatedBuildInputs = [
+    garminconnect
+    tzlocal
+  ];
+
+  meta = with lib; {
+    description = "The Garmin Connect integration allows you to expose data from Garmin Connect to Home Assistant";
+    homepage = "https://github.com/cyberjunky/home-assistant-garmin_connect";
+    maintainers = with maintainers; [
+      matthiasbeyer
+      dmadisetti
+    ];
+    license = licenses.mit;
+  };
+}
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/default.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/default.nix
@ -1,9 +1,10 @@
-{ callPackage
+{
+  lib,
+  pkgs,
+  callPackage,
 }:

 {
-  android-tv-card = callPackage ./android-tv-card { };
-
  apexcharts-card = callPackage ./apexcharts-card { };

  atomic-calendar-revive = callPackage ./atomic-calendar-revive { };
@ -32,7 +33,14 @@

  template-entity-row = callPackage ./template-entity-row { };

+  universal-remote-card = callPackage ./universal-remote-card { };
+
  valetudo-map-card = callPackage ./valetudo-map-card { };

  zigbee2mqtt-networkmap = callPackage ./zigbee2mqtt-networkmap { };
 }
+// lib.optionalAttrs pkgs.config.allowAliases {
+  android-tv-card =
+    lib.warn "`home-assistant-custom-lovelace-modules.android-tv-card` has been renamed to `universal-remote-card`"
+    pkgs.home-assistant-custom-lovelace-modules.universal-remote-card;
+}
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/default.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/default.nix
@ -4,33 +4,33 @@
 }:

 buildNpmPackage rec {
-  pname = "android-tv-card";
-  version = "3.9.4";
+  pname = "universal-remote-card";
+  version = "4.0.0";

  src = fetchFromGitHub {
    owner = "Nerwyn";
    repo = "android-tv-card";
    rev = version;
-    hash = "sha256-I50WNH/OL7O6YrZ0yf+uPJc05STJrjP8DS/wfaSBTHU=";
+    hash = "sha256-vQfXsEMYPga816X8eGYdjgpou38KfMtLcKjIGkT25xU=";
  };

  patches = [ ./dont-call-git.patch ];

-  npmDepsHash = "sha256-cuc7+QziclvJWp7MncLjkzfub5UbWYPVoUC/DZfs38g=";
+  npmDepsHash = "sha256-lFpgO/5JEmnl1wXLuy/OqncxPSx96BTydbprGEN+feM=";

  installPhase = ''
    runHook preInstall

    mkdir $out
-    cp dist/android-tv-card.min.js $out
+    cp dist/universal-remote-card.min.js $out

    runHook postInstall
  '';

-  passthru.entrypoint = "android-tv-card.min.js";
+  passthru.entrypoint = "universal-remote-card.min.js";

  meta = with lib; {
-    description = "Universal Customizable TV Remote Card, with HA actions, super configurable touchpad, slider, haptics, and keyboard";
+    description = "Completely customizable universal remote card for Home Assistant. Supports multiple platforms out of the box";
    homepage = "https://github.com/Nerwyn/android-tv-card";
    license = licenses.asl20;
    maintainers = with maintainers; [ k900 ];
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/dont-call-git.patch
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/dont-call-git.patch
--- a/pkgs/servers/monitoring/grafana-image-renderer/default.nix
+++ b/pkgs/servers/monitoring/grafana-image-renderer/default.nix
@ -7,18 +7,18 @@

 mkYarnPackage rec {
  pname = "grafana-image-renderer";
-  version = "3.11.3";
+  version = "3.11.4";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "grafana-image-renderer";
    rev = "v${version}";
-    hash = "sha256-a++aQt2y7+Nrvjka9XV7j8YwmppWFnUffFO4XEiZVvo=";
+    hash = "sha256-ob+YSHuu8vnj3TeAeXa9vTaRJouWpgsdq0gvdKV3BnA=";
  };

  offlineCache = fetchYarnDeps {
    yarnLock = src + "/yarn.lock";
-    hash = "sha256-rW9mxrM4aHKGojyRbsxQe3ZZJQ8I42PJ0MplkVu3qyA=";
+    hash = "sha256-ZrP3cLGyA8I1EhYrQPkqUwUk52FvVxR8Wg4OGllNRmg=";
  };

  packageJSON = ./package.json;
--- a/pkgs/servers/monitoring/grafana-image-renderer/package.json
+++ b/pkgs/servers/monitoring/grafana-image-renderer/package.json
@ -28,7 +28,7 @@
    "@grpc/grpc-js": "^1.8.22",
    "@grpc/proto-loader": "^0.7.2",
    "@hapi/boom": "^10.0.0",
-    "@puppeteer/browsers": "^1.6.0",
+    "@puppeteer/browsers": "^2.3.1",
    "chokidar": "^3.5.2",
    "dompurify": "^2.4.0",
    "express": "^4.19.2",
@ -40,10 +40,10 @@
    "morgan": "^1.9.0",
    "multer": "^1.4.5-lts.1",
    "on-finished": "^2.3.0",
-    "poolpeteer": "^0.23.0",
+    "poolpeteer": "^0.24.0",
    "prom-client": "^14.1.0",
-    "puppeteer": "^21.0.3",
-    "puppeteer-cluster": "^0.23.0",
+    "puppeteer": "^22.8.2",
+    "puppeteer-cluster": "^0.24.0",
    "unique-filename": "^2.0.1",
    "winston": "^3.8.2"
  },
@ -59,7 +59,7 @@
    "@types/supertest": "^2.0.15",
    "@typescript-eslint/eslint-plugin": "5.37.0",
    "@typescript-eslint/parser": "5.37.0",
-    "axios": "1.6.7",
+    "axios": "1.7.4",
    "cross-env": "7.0.3",
    "eslint": "8.23.1",
    "fast-png": "^6.2.0",
--- a/pkgs/tools/security/nuclei/default.nix
+++ b/pkgs/tools/security/nuclei/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "nuclei";
-  version = "3.3.1";
+  version = "3.3.2";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "nuclei";
    rev = "refs/tags/v${version}";
-    hash = "sha256-pUctan5p3jxrj2/98nzibZQAL2EK8R5jnD/hjVgxSzQ=";
+    hash = "sha256-CBZeo2k9ZA41NotA6XIhkIQkEDvcbSIBCnPSOYXlLDQ=";
  };

-  vendorHash = "sha256-sJkkgh7F5Hgj9K6m7OTQbamkcS3uS78jK9HdLYeypIU=";
+  vendorHash = "sha256-ewjJ89tCeedlTGngB7yU8JbfoTnPUw5Pg2iMwjg1SgU=";

  subPackages = [ "cmd/nuclei/" ];

--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@ -20,7 +20,7 @@
 }:

 stdenv.mkDerivation rec {
-  version = "1.46.1";
+  version = "1.47.0";
  pname = "netdata";

  src = fetchFromGitHub {
@ -28,9 +28,9 @@ stdenv.mkDerivation rec {
    repo = "netdata";
    rev = "v${version}";
    hash = if withCloudUi
-      then "sha256-tFjczhJ7bIEUDZx3MxYBu4tGkJhoQn5V79D4sLV2o8U="
+      then "sha256-eMapy4HQaEblDfZt2uVSfBWRlkstX7TxZDBgSv5bW/I="
      # we delete the v2 GUI after fetching
-      else "sha256-uW3jRiJjFIFSfmmavM3KVF985F8nMKa+lQAgNBZvKyE=";
+      else "sha256-Gx7u3Owh/fVAnSw91xfdcmyx4m+bvQAvDaUxzXQ36/0=";
    fetchSubmodules = true;

    # Remove v2 dashboard distributed under NCUL1. Make sure an empty
@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake pkg-config makeWrapper go ninja ]
    ++ lib.optionals withCups [ cups.dev ];
  # bash is only used to rewrite shebangs
-  buildInputs = [ bash curl jemalloc json_c libuv zlib libyaml ]
+  buildInputs = [ bash curl jemalloc json_c libuv zlib libyaml lm_sensors ]
    ++ lib.optionals stdenv.isDarwin [ CoreFoundation IOKit libossp_uuid ]
    ++ lib.optionals (!stdenv.isDarwin) [ libcap libuuid ]
    ++ lib.optionals withCups [ cups ]
@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
    ./dashboard-v2-removal.patch
  ];

-  # Guard against unused buld-time development inputs in closure. Without
+  # Guard against unused build-time development inputs in closure. Without
  # the ./skip-CONFIGURE_COMMAND.patch patch the closure retains inputs up
  # to bootstrap tools:
  #   https://github.com/NixOS/nixpkgs/pull/175719
@ -94,8 +94,6 @@ stdenv.mkDerivation rec {
       $out/libexec/netdata/plugins.d/slabinfo.plugin.org
    mv $out/libexec/netdata/plugins.d/debugfs.plugin \
       $out/libexec/netdata/plugins.d/debugfs.plugin.org
-    mv $out/libexec/netdata/plugins.d/logs-management.plugin \
-       $out/libexec/netdata/plugins.d/logs-management.plugin.org
    ${lib.optionalString withSystemdJournal ''
      mv $out/libexec/netdata/plugins.d/systemd-journal.plugin \
         $out/libexec/netdata/plugins.d/systemd-journal.plugin.org
@ -115,30 +113,31 @@ stdenv.mkDerivation rec {
  '';

  preConfigure = lib.optionalString (!stdenv.isDarwin) ''
-    substituteInPlace src/collectors/python.d.plugin/python_modules/third_party/lm_sensors.py \
-      --replace-fail 'ctypes.util.find_library("sensors")' '"${lm_sensors.out}/lib/libsensors${stdenv.hostPlatform.extensions.sharedLibrary}"'
-  '' + ''
    export GOCACHE=$TMPDIR/go-cache
    export GOPATH=$TMPDIR/go
-    export GOPROXY=file://${passthru.netdata-go-modules}
    export GOSUMDB=off

+    substituteInPlace packaging/cmake/Modules/NetdataGoTools.cmake \
+      --replace-fail \
+        'GOPROXY=https://proxy.golang.org' \
+        'GOPROXY=file://${passthru.netdata-go-modules}'
+
    # Prevent the path to be caught into the Nix store path.
    substituteInPlace CMakeLists.txt \
-      --replace-fail 'set(CACHE_DIR "''${CMAKE_INSTALL_PREFIX}/var/cache/netdata")' 'set(CACHE_DIR "/var/cache/netdata")' \
-      --replace-fail 'set(CONFIG_DIR "''${CMAKE_INSTALL_PREFIX}/etc/netdata")' 'set(CONFIG_DIR "/etc/netdata")' \
-      --replace-fail 'set(LIBCONFIG_DIR "''${CMAKE_INSTALL_PREFIX}/usr/lib/netdata/conf.d")' 'set(LIBCONFIG_DIR "${placeholder "out"}/share/netdata/conf.d")' \
-      --replace-fail 'set(LOG_DIR "''${CMAKE_INSTALL_PREFIX}/var/log/netdata")' 'set(LOG_DIR "/var/log/netdata")' \
-      --replace-fail 'set(PLUGINS_DIR "''${CMAKE_INSTALL_PREFIX}/usr/libexec/netdata/plugins.d")' 'set(PLUGINS_DIR "${placeholder "out"}/libexec/netdata/plugins.d")' \
-      --replace-fail 'set(VARLIB_DIR "''${CMAKE_INSTALL_PREFIX}/var/lib/netdata")' 'set(VARLIB_DIR "/var/lib/netdata")' \
-      --replace-fail 'set(pkglibexecdir_POST "''${CMAKE_INSTALL_PREFIX}/usr/libexec/netdata")' 'set(pkglibexecdir_POST "${placeholder "out"}/libexec/netdata")' \
-      --replace-fail 'set(localstatedir_POST "''${CMAKE_INSTALL_PREFIX}/var")' 'set(localstatedir_POST "/var")' \
-      --replace-fail 'set(sbindir_POST "''${CMAKE_INSTALL_PREFIX}/usr/sbin")' 'set(sbindir_POST "${placeholder "out"}/bin")' \
-      --replace-fail 'set(configdir_POST "''${CMAKE_INSTALL_PREFIX}/etc/netdata")' 'set(configdir_POST "/etc/netdata")' \
-      --replace-fail 'set(libconfigdir_POST "''${CMAKE_INSTALL_PREFIX}/usr/lib/netdata/conf.d")' 'set(libconfigdir_POST "${placeholder "out"}/share/netdata/conf.d")' \
-      --replace-fail 'set(cachedir_POST "''${CMAKE_INSTALL_PREFIX}/var/cache/netdata")' 'set(libconfigdir_POST "/var/cache/netdata")' \
-      --replace-fail 'set(registrydir_POST "''${CMAKE_INSTALL_PREFIX}/var/lib/netdata/registry")' 'set(registrydir_POST "/var/lib/netdata/registry")' \
-      --replace-fail 'set(varlibdir_POST "''${CMAKE_INSTALL_PREFIX}/var/lib/netdata")' 'set(varlibdir_POST "/var/lib/netdata")'
+      --replace-fail 'set(CACHE_DIR "''${NETDATA_RUNTIME_PREFIX}/var/cache/netdata")' 'set(CACHE_DIR "/var/cache/netdata")' \
+      --replace-fail 'set(CONFIG_DIR "''${NETDATA_RUNTIME_PREFIX}/etc/netdata")' 'set(CONFIG_DIR "/etc/netdata")' \
+      --replace-fail 'set(LIBCONFIG_DIR "''${NETDATA_RUNTIME_PREFIX}/usr/lib/netdata/conf.d")' 'set(LIBCONFIG_DIR "${placeholder "out"}/share/netdata/conf.d")' \
+      --replace-fail 'set(LOG_DIR "''${NETDATA_RUNTIME_PREFIX}/var/log/netdata")' 'set(LOG_DIR "/var/log/netdata")' \
+      --replace-fail 'set(PLUGINS_DIR "''${NETDATA_RUNTIME_PREFIX}/usr/libexec/netdata/plugins.d")' 'set(PLUGINS_DIR "${placeholder "out"}/libexec/netdata/plugins.d")' \
+      --replace-fail 'set(VARLIB_DIR "''${NETDATA_RUNTIME_PREFIX}/var/lib/netdata")' 'set(VARLIB_DIR "/var/lib/netdata")' \
+      --replace-fail 'set(pkglibexecdir_POST "''${NETDATA_RUNTIME_PREFIX}/usr/libexec/netdata")' 'set(pkglibexecdir_POST "${placeholder "out"}/libexec/netdata")' \
+      --replace-fail 'set(localstatedir_POST "''${NETDATA_RUNTIME_PREFIX}/var")' 'set(localstatedir_POST "/var")' \
+      --replace-fail 'set(sbindir_POST "''${NETDATA_RUNTIME_PREFIX}/''${BINDIR}")' 'set(sbindir_POST "${placeholder "out"}/bin")' \
+      --replace-fail 'set(configdir_POST "''${NETDATA_RUNTIME_PREFIX}/etc/netdata")' 'set(configdir_POST "/etc/netdata")' \
+      --replace-fail 'set(libconfigdir_POST "''${NETDATA_RUNTIME_PREFIX}/usr/lib/netdata/conf.d")' 'set(libconfigdir_POST "${placeholder "out"}/share/netdata/conf.d")' \
+      --replace-fail 'set(cachedir_POST "''${NETDATA_RUNTIME_PREFIX}/var/cache/netdata")' 'set(libconfigdir_POST "/var/cache/netdata")' \
+      --replace-fail 'set(registrydir_POST "''${NETDATA_RUNTIME_PREFIX}/var/lib/netdata/registry")' 'set(registrydir_POST "/var/lib/netdata/registry")' \
+      --replace-fail 'set(varlibdir_POST "''${NETDATA_RUNTIME_PREFIX}/var/lib/netdata")' 'set(varlibdir_POST "/var/lib/netdata")'
  '';

  cmakeFlags = [
@ -179,9 +178,9 @@ stdenv.mkDerivation rec {
      pname = "netdata-go-plugins";
      inherit version src;

-      sourceRoot = "${src.name}/src/go/collectors/go.d.plugin";
+      sourceRoot = "${src.name}/src/go/plugin/go.d";

-      vendorHash = "sha256-fK6pboXgJom77iakb+CJvNuweQjLIrpS7suWRNY/KM4=";
+      vendorHash = "sha256-NZ1tg+lvXNgypqmjjb5f7dHH6DIA9VOa4PMM4eq11n0=";
      doCheck = false;
      proxyVendor = true;

--- a/pkgs/tools/system/netdata/ndsudo-fix-path.patch
+++ b/pkgs/tools/system/netdata/ndsudo-fix-path.patch
@ -2,7 +2,7 @@
 #     https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93

 diff --git a/src/collectors/plugins.d/ndsudo.c b/src/collectors/plugins.d/ndsudo.c
-index 8b4d76f46..68fa52d38 100644
+index d53ca9f28..b42a121bf 100644
 --- a/src/collectors/plugins.d/ndsudo.c
 +++ b/src/collectors/plugins.d/ndsudo.c
@@ -357,9 +357,6 @@ int main(int argc, char *argv[]) {
@ -12,5 +12,6 @@ index 8b4d76f46..68fa52d38 100644
 -    char new_path[] = "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin";
 -    putenv(new_path);
 -
-     bool found = false;
-     char filename[FILENAME_MAX];
+     setuid(0);
+     setgid(0);
+     setegid(0);
--- a/pkgs/tools/text/runiq/Cargo.lock
+++ b/pkgs/tools/text/runiq/Cargo.lock
--- a/pkgs/tools/text/runiq/default.nix
+++ b/pkgs/tools/text/runiq/default.nix
@ -1,15 +1,21 @@
-{ lib, rustPlatform, fetchCrate, stdenv, darwin }:
+{ lib, rustPlatform, fetchFromGitHub, stdenv, darwin }:

 rustPlatform.buildRustPackage rec {
  pname = "runiq";
-  version = "2.0.0";
+  version = "2.0.0-unstable-2024-08-19";

-  src = fetchCrate {
-    inherit pname version;
-    hash = "sha256-qcgPuJOpK2fCsHAgzoIKF7upb9B3ySIZkpu9xf4JnCc=";
+  src = fetchFromGitHub {
+    owner = "whitfin";
+    repo = "runiq";
+    rev = "a642926f6ec09d4faeebebb563d4aed89e0d36fb";
+    hash = "sha256-DWP0kbTjXlyUI/+bHgom9/XJ2XW/BJEU4xvIisPVug0=";
  };

-  cargoHash = "sha256-WSMV0GNKNckN9uSPN647iDloGkNtaKcrZbeyglUappc=";
+  cargoLock.lockFile = ./Cargo.lock;
+
+  postPatch = ''
+    ln -s ${./Cargo.lock} Cargo.lock
+  '';

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.Security
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -25093,6 +25093,25 @@ with pkgs;

  meteor = callPackage ../servers/meteor { };

+  micro-full = micro.wrapper.override {
+    extraPackages = [
+      wl-clipboard
+      xclip
+    ];
+  };
+
+  micro-with-wl-clipboard = micro.wrapper.override {
+    extraPackages = [
+      wl-clipboard
+    ];
+  };
+
+  micro-with-xclip = micro.wrapper.override {
+    extraPackages = [
+      xclip
+    ];
+  };
+
  micronaut = callPackage ../development/tools/micronaut { };

  minio = callPackage ../servers/minio { };
@ -31993,7 +32012,7 @@ with pkgs;
    autoreconfHook = buildPackages.autoreconfHook269;
  };

-  musescore = libsForQt5.callPackage ../applications/audio/musescore { };
+  musescore = qt6.callPackage ../applications/audio/musescore { };

  music-player = callPackage ../applications/audio/music-player { };