Merge master into haskell-updates

2024-10-06 20:48:32 +03:00 · 2024-05-09 00:13:17 +00:00 · 2024-05-09 00:13:17 +00:00 · 74b47cf0d8
commit 74b47cf0d8
parent 7a6f77f760 5c4ae2d9ff
717 changed files with 11260 additions and 101478 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3861,6 +3861,16 @@
      fingerprint = "6E3A FA6D 915C C2A4 D26F  C53E 7BB4 BA9C 783D 2BBC";
    }];
  };
+  codebam = {
+      name = "Sean Behan";
+      email = "codebam@riseup.net";
+      matrix = "@codebam:fedora.im";
+      github = "codebam";
+      githubId = 6035884;
+      keys = [{
+        fingerprint = "42CD E212 593C F2FD C723 48A8 0F6D 5021 A87F 92BA";
+      }];
+    };
  codec = {
    email = "codec@fnord.cx";
    github = "codec";
@ -13566,6 +13576,15 @@
      fingerprint = "1248 D3E1 1D11 4A85 75C9  8934 6794 D45A 488C 2EDE";
    }];
  };
+  momeemt = {
+    name = "Mutsuha Asada";
+    email = "me@momee.mt";
+    github = "momeemt";
+    githubId = 43488453;
+    keys = [{
+      fingerprint = "D94F EA9F 5B08 F6A1 7B8F  EB8B ACB5 4F0C BC6A A7C6";
+    }];
+  };
  monaaraj = {
    name = "Mon Aaraj";
    email = "owo69uwu69@gmail.com";
@ -14111,6 +14130,16 @@
    githubId = 56316606;
    name = "Amneesh Singh";
  };
+  naxdy = {
+    name = "Naxdy";
+    email = "naxdy@naxdy.org";
+    matrix = "@naxdy:naxdy.org";
+    github = "Naxdy";
+    githubId = 4532582;
+    keys = [{
+      fingerprint = "BDEA AB07 909D B96F 4106 85F1 CC15 0758 46BC E91B";
+    }];
+  };
  nayala = {
    name = "Nia";
    matrix = "@fly:asra.gr";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -53,6 +53,10 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
 - `system.etc.overlay.enable` option was added. If enabled, `/etc` is
  mounted via an overlayfs instead of being created by a custom perl script.

+- For each supporting version of the Linux kernel firmware blobs and kernel modules
+  are compressed with zstd. For firmware blobs this means an increase of 4.4% in size, however
+  a significantly higher decompression speed.
+
 - NixOS AMIs are now uploaded regularly to a new AWS Account.
  Instructions on how to use them can be found on <https://nixos.github.io/amis>.
  We are working on integration the data into the NixOS homepage.
@ -128,6 +132,8 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi

 - [db-rest](https://github.com/derhuerst/db-rest), a wrapper around Deutsche Bahn's internal API for public transport data. Available as [services.db-rest](#opt-services.db-rest.enable).

+- [mautrix-signal](https://github.com/mautrix/signal), a Matrix-Signal puppeting bridge. Available as [services.mautrix-signal](#opt-services.mautrix-signal.enable).
+
 - [Anki Sync Server](https://docs.ankiweb.net/sync-server.html), the official sync server built into recent versions of Anki. Available as [services.anki-sync-server](#opt-services.anki-sync-server.enable).
 The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the anki-sync-server software.

@ -683,6 +689,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
  making it possible to accumulate definitions without resorting to `mkForce`,
  hence to retain the definitions not anticipating that need.

+- Lisp modules: previously deprecated interface based on `common-lisp.sh` has now been removed.
+
 - `youtrack` is bumped to 2023.3. The update is not performed automatically, it requires manual interaction. See the YouTrack section in the manual for details.

 - QtMultimedia has changed its default backend to `QT_MEDIA_BACKEND=ffmpeg` (previously `gstreamer` on Linux or `darwin` on MacOS).
--- a/nixos/lib/systemd-lib.nix
+++ b/nixos/lib/systemd-lib.nix
@ -18,6 +18,7 @@ let
    flip
    head
    isInt
+    isFloat
    isList
    isPath
    length
@ -152,7 +153,7 @@ in rec {
      "Systemd ${group} field `${name}' is outside the range [${toString min},${toString max}]";

  assertRangeOrOneOf = name: min: max: values: group: attr:
-    optional (attr ? ${name} && !((min <= attr.${name} && max >= attr.${name}) || elem attr.${name} values))
+    optional (attr ? ${name} && !(((isInt attr.${name} || isFloat attr.${name}) && min <= attr.${name} && max >= attr.${name}) || elem attr.${name} values))
      "Systemd ${group} field `${name}' is not a value in range [${toString min},${toString max}], or one of ${toString values}";

  assertMinimum = name: min: group: attr:
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -666,6 +666,7 @@
  ./services/matrix/maubot.nix
  ./services/matrix/mautrix-facebook.nix
  ./services/matrix/mautrix-meta.nix
+  ./services/matrix/mautrix-signal.nix
  ./services/matrix/mautrix-telegram.nix
  ./services/matrix/mautrix-whatsapp.nix
  ./services/matrix/mjolnir.nix
--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@ -11,7 +11,7 @@ in
    description = ''
      Periodic backups to create with Restic.
    '';
-    type = types.attrsOf (types.submodule ({ config, name, ... }: {
+    type = types.attrsOf (types.submodule ({ name, ... }: {
      options = {
        passwordFile = mkOption {
          type = types.str;
@ -206,12 +206,19 @@ in
          ];
        };

+        runCheck = mkOption {
+          type = types.bool;
+          default = (builtins.length config.services.restic.backups.${name}.checkOpts > 0);
+          defaultText = literalExpression ''builtins.length config.services.backups.${name}.checkOpts > 0'';
+          description = "Whether to run the `check` command with the provided `checkOpts` options.";
+          example = true;
+        };
+
        checkOpts = mkOption {
          type = types.listOf types.str;
          default = [ ];
          description = ''
-            A list of options for 'restic check', which is run after
-            pruning.
+            A list of options for 'restic check'.
          '';
          example = [
            "--with-cache"
@ -298,7 +305,9 @@ in
            doBackup = (backup.dynamicFilesFrom != null) || (backup.paths != null && backup.paths != []);
            pruneCmd = optionals (builtins.length backup.pruneOpts > 0) [
              (resticCmd + " forget --prune " + (concatStringsSep " " backup.pruneOpts))
-              (resticCmd + " check " + (concatStringsSep " " backup.checkOpts))
+            ];
+            checkCmd = optionals backup.runCheck [
+                (resticCmd + " check " + (concatStringsSep " " backup.checkOpts))
            ];
            # Helper functions for rclone remotes
            rcloneRemoteName = builtins.elemAt (splitString ":" backup.repository) 1;
@ -331,7 +340,7 @@ in
            serviceConfig = {
              Type = "oneshot";
              ExecStart = (optionals doBackup [ "${resticCmd} backup ${concatStringsSep " " (backup.extraBackupArgs ++ excludeFlags)} --files-from=${filesFromTmpFile}" ])
-                ++ pruneCmd;
+                ++ pruneCmd ++ checkCmd;
              User = backup.user;
              RuntimeDirectory = "restic-backups-${name}";
              CacheDirectory = "restic-backups-${name}";
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@ -167,10 +167,16 @@ let
      mv etc/udev/hwdb.bin $out
    '';

-  compressFirmware = firmware: if (config.boot.kernelPackages.kernelAtLeast "5.3" && (firmware.compressFirmware or true)) then
-    pkgs.compressFirmwareXz firmware
-  else
-    id firmware;
+  compressFirmware = firmware:
+    let
+      inherit (config.boot.kernelPackages) kernelAtLeast;
+    in
+      if ! (firmware.compressFirmware or true) then
+        firmware
+      else
+        if kernelAtLeast "5.19" then pkgs.compressFirmwareZstd firmware
+        else if kernelAtLeast "5.3" then pkgs.compressFirmwareXz firmware
+        else firmware;

  # Udev has a 512-character limit for ENV{PATH}, so create a symlink
  # tree to work around this.
--- a/nixos/modules/services/matrix/mautrix-signal.nix
+++ b/nixos/modules/services/matrix/mautrix-signal.nix
@ -0,0 +1,249 @@
+{ lib
+, config
+, pkgs
+, ...
+}:
+let
+  cfg = config.services.mautrix-signal;
+  dataDir = "/var/lib/mautrix-signal";
+  registrationFile = "${dataDir}/signal-registration.yaml";
+  settingsFile = "${dataDir}/config.yaml";
+  settingsFileUnsubstituted = settingsFormat.generate "mautrix-signal-config-unsubstituted.json" cfg.settings;
+  settingsFormat = pkgs.formats.json { };
+  appservicePort = 29328;
+
+  # to be used with a list of lib.mkIf values
+  optOneOf = lib.lists.findFirst (value: value.condition) (lib.mkIf false null);
+  mkDefaults = lib.mapAttrsRecursive (n: v: lib.mkDefault v);
+  defaultConfig = {
+    homeserver.address = "http://localhost:8448";
+    appservice = {
+      hostname = "[::]";
+      port = appservicePort;
+      database.type = "sqlite3";
+      database.uri = "file:${dataDir}/mautrix-signal.db?_txlock=immediate";
+      id = "signal";
+      bot = {
+        username = "signalbot";
+        displayname = "Signal Bridge Bot";
+      };
+      as_token = "";
+      hs_token = "";
+    };
+    bridge = {
+      username_template = "signal_{{.}}";
+      displayname_template = "{{or .ProfileName .PhoneNumber \"Unknown user\"}}";
+      double_puppet_server_map = { };
+      login_shared_secret_map = { };
+      command_prefix = "!signal";
+      permissions."*" = "relay";
+      relay.enabled = true;
+    };
+    logging = {
+      min_level = "info";
+      writers = lib.singleton {
+        type = "stdout";
+        format = "pretty-colored";
+        time_format = " ";
+      };
+    };
+  };
+
+in
+{
+  options.services.mautrix-signal = {
+    enable = lib.mkEnableOption "mautrix-signal, a Matrix-Signal puppeting bridge.";
+
+    settings = lib.mkOption {
+      apply = lib.recursiveUpdate defaultConfig;
+      type = settingsFormat.type;
+      default = defaultConfig;
+      description = ''
+        {file}`config.yaml` configuration as a Nix attribute set.
+        Configuration options should match those described in
+        [example-config.yaml](https://github.com/mautrix/signal/blob/master/example-config.yaml).
+        Secret tokens should be specified using {option}`environmentFile`
+        instead of this world-readable attribute set.
+      '';
+      example = {
+        appservice = {
+          database = {
+            type = "postgres";
+            uri = "postgresql:///mautrix_signal?host=/run/postgresql";
+          };
+          id = "signal";
+          ephemeral_events = false;
+        };
+        bridge = {
+          history_sync = {
+            request_full_sync = true;
+          };
+          private_chat_portal_meta = true;
+          mute_bridging = true;
+          encryption = {
+            allow = true;
+            default = true;
+            require = true;
+          };
+          provisioning = {
+            shared_secret = "disable";
+          };
+          permissions = {
+            "example.com" = "user";
+          };
+        };
+      };
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        File containing environment variables to be passed to the mautrix-signal service.
+        If an environment variable `MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET` is set,
+        then its value will be used in the configuration file for the option
+        `login_shared_secret_map` without leaking it to the store, using the configured
+        `homeserver.domain` as key.
+        See [here](https://github.com/mautrix/signal/blob/main/example-config.yaml)
+        for the documentation of `login_shared_secret_map`.
+      '';
+    };
+
+    serviceDependencies = lib.mkOption {
+      type = with lib.types; listOf str;
+      default = (lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)
+        ++ (lib.optional config.services.matrix-conduit.enable "conduit.service");
+      defaultText = lib.literalExpression ''
+        (optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)
+        ++ (optional config.services.matrix-conduit.enable "conduit.service")
+      '';
+      description = ''
+        List of systemd units to require and wait for when starting the application service.
+      '';
+    };
+
+    registerToSynapse = lib.mkOption {
+      type = lib.types.bool;
+      default = config.services.matrix-synapse.enable;
+      defaultText = lib.literalExpression ''
+        config.services.matrix-synapse.enable
+      '';
+      description = ''
+        Whether to add the bridge's app service registration file to
+        `services.matrix-synapse.settings.app_service_config_files`.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    users.users.mautrix-signal = {
+      isSystemUser = true;
+      group = "mautrix-signal";
+      home = dataDir;
+      description = "Mautrix-Signal bridge user";
+    };
+
+    users.groups.mautrix-signal = { };
+
+    services.matrix-synapse = lib.mkIf cfg.registerToSynapse {
+      settings.app_service_config_files = [ registrationFile ];
+    };
+    systemd.services.matrix-synapse = lib.mkIf cfg.registerToSynapse {
+      serviceConfig.SupplementaryGroups = [ "mautrix-signal" ];
+    };
+
+    # Note: this is defined here to avoid the docs depending on `config`
+    services.mautrix-signal.settings.homeserver = optOneOf (with config.services; [
+      (lib.mkIf matrix-synapse.enable (mkDefaults {
+        domain = matrix-synapse.settings.server_name;
+      }))
+      (lib.mkIf matrix-conduit.enable (mkDefaults {
+        domain = matrix-conduit.settings.global.server_name;
+        address = "http://localhost:${toString matrix-conduit.settings.global.port}";
+      }))
+    ]);
+
+    systemd.services.mautrix-signal = {
+      description = "mautrix-signal, a Matrix-Signal puppeting bridge.";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
+      after = [ "network-online.target" ] ++ cfg.serviceDependencies;
+      # ffmpeg is required for conversion of voice messages
+      path = [ pkgs.ffmpeg-headless ];
+
+      preStart = ''
+        # substitute the settings file by environment variables
+        # in this case read from EnvironmentFile
+        test -f '${settingsFile}' && rm -f '${settingsFile}'
+        old_umask=$(umask)
+        umask 0177
+        ${pkgs.envsubst}/bin/envsubst \
+          -o '${settingsFile}' \
+          -i '${settingsFileUnsubstituted}'
+        umask $old_umask
+
+        # generate the appservice's registration file if absent
+        if [ ! -f '${registrationFile}' ]; then
+          ${pkgs.mautrix-signal}/bin/mautrix-signal \
+            --generate-registration \
+            --config='${settingsFile}' \
+            --registration='${registrationFile}'
+        fi
+        chmod 640 ${registrationFile}
+
+        umask 0177
+        # 1. Overwrite registration tokens in config
+        # 2. If environment variable MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET
+        #    is set, set it as the login shared secret value for the configured
+        #    homeserver domain.
+        ${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token
+          | .[0].appservice.hs_token = .[1].hs_token
+          | .[0]
+          | if env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET then .bridge.login_shared_secret_map.[.homeserver.domain] = env.MAUTRIX_SIGNAL_BRIDGE_LOGIN_SHARED_SECRET else . end' \
+          '${settingsFile}' '${registrationFile}' > '${settingsFile}.tmp'
+        mv '${settingsFile}.tmp' '${settingsFile}'
+        umask $old_umask
+      '';
+
+      serviceConfig = {
+        User = "mautrix-signal";
+        Group = "mautrix-signal";
+        EnvironmentFile = cfg.environmentFile;
+        StateDirectory = baseNameOf dataDir;
+        WorkingDirectory = dataDir;
+        ExecStart = ''
+          ${pkgs.mautrix-signal}/bin/mautrix-signal \
+          --config='${settingsFile}' \
+          --registration='${registrationFile}'
+        '';
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        Restart = "on-failure";
+        RestartSec = "30s";
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [ "@system-service" ];
+        Type = "simple";
+        UMask = 0027;
+      };
+      restartTriggers = [ settingsFileUnsubstituted ];
+    };
+  };
+  meta.maintainers = with lib.maintainers; [ niklaskorz ];
+}
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -939,6 +939,7 @@ in {

        in {
          wantedBy = [ "multi-user.target" ];
+          wants = [ "nextcloud-update-db.service" ];
          before = [ "phpfpm-nextcloud.service" ];
          after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
          requires = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
@ -997,7 +998,7 @@ in {
          after = [ "nextcloud-setup.service" ];
          environment.NEXTCLOUD_CONFIG_DIR = "${datadir}/config";
          serviceConfig = {
-            Type = "oneshot";
+            Type = "exec";
            User = "nextcloud";
            ExecCondition = "${lib.getExe phpPackage} -f ${webroot}/occ status -e";
            ExecStart = "${lib.getExe phpPackage} -f ${webroot}/cron.php";
@ -1013,6 +1014,20 @@ in {
          };
          startAt = cfg.autoUpdateApps.startAt;
        };
+        nextcloud-update-db = {
+          after = [ "nextcloud-setup.service" ];
+          environment.NEXTCLOUD_CONFIG_DIR = "${datadir}/config";
+          script = ''
+            ${occ}/bin/nextcloud-occ db:add-missing-columns
+            ${occ}/bin/nextcloud-occ db:add-missing-indices
+            ${occ}/bin/nextcloud-occ db:add-missing-primary-keys
+          '';
+          serviceConfig = {
+            Type = "exec";
+            User = "nextcloud";
+            ExecCondition = "${lib.getExe phpPackage} -f ${webroot}/occ status -e";
+          };
+        };
      };

      services.phpfpm = {
--- a/nixos/modules/services/x11/window-managers/clfswm.nix
+++ b/nixos/modules/services/x11/window-managers/clfswm.nix
@ -10,7 +10,7 @@ in
  options = {
    services.xserver.windowManager.clfswm = {
      enable = mkEnableOption "clfswm";
-      package = mkPackageOption pkgs [ "lispPackages" "clfswm" ] { };
+      package = mkPackageOption pkgs [ "sbclPackages" "clfswm" ] { };
    };
  };

--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -17,11 +17,13 @@ let
          "ManageForeignRoutingPolicyRules"
          "ManageForeignRoutes"
          "RouteTable"
+          "IPv6PrivacyExtensions"
        ])
        (assertValueOneOf "SpeedMeter" boolValues)
        (assertInt "SpeedMeterIntervalSec")
        (assertValueOneOf "ManageForeignRoutingPolicyRules" boolValues)
        (assertValueOneOf "ManageForeignRoutes" boolValues)
+        (assertValueOneOf "IPv6PrivacyExtensions" (boolValues ++ ["prefer-public" "kernel"]))
      ];

      sectionDHCPv4 = checkUnitConfig "DHCPv4" [
--- a/nixos/tests/archi.nix
+++ b/nixos/tests/archi.nix
@ -24,7 +24,9 @@ import ./make-test-python.nix ({ lib, ... }: {
         machine.wait_for_window("Archi")

         # wait till main UI is open
-         machine.wait_for_text("Welcome to Archi")
+         # since OCR seems to be buggy wait_for_text was replaced by sleep, issue: #302965
+         # machine.wait_for_text("Welcome to Archi")
+         machine.sleep(20)

         machine.screenshot("welcome-screen")
  '';
--- a/pkgs/applications/blockchains/clboss/default.nix
+++ b/pkgs/applications/blockchains/clboss/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "clboss";
-  version = "0.13";
+  version = "0.13.1";

  src = fetchFromGitHub {
    owner = "ZmnSCPxj";
    repo = "clboss";
    rev = "v${version}";
-    hash = "sha256-NP9blymdqDXo/OtGLQg/MXK24PpPvCrzqXRdtfCvpfI=";
+    hash = "sha256-DQvcf+y73QQYQanEvbOCOgwQzvNOXS1ZY+hVvS6N+G0=";
  };

  nativeBuildInputs = [ autoconf-archive autoreconfHook pkg-config libev curlWithGnuTls sqlite ];
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchurl, appimageTools, imagemagick }:
+{ lib, fetchurl, appimageTools, makeWrapper, imagemagick }:

 let
  pname = "ledger-live-desktop";
@ -22,6 +22,10 @@ appimageTools.wrapType2 rec {
    ${imagemagick}/bin/convert ${appimageContents}/ledger-live-desktop.png -resize 512x512 ledger-live-desktop_512.png
    install -m 444 -D ledger-live-desktop_512.png $out/share/icons/hicolor/512x512/apps/ledger-live-desktop.png

+    source "${makeWrapper}/nix-support/setup-hook"
+    wrapProgram "$out/bin/${pname}" \
+       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
+
    substituteInPlace $out/share/applications/ledger-live-desktop.desktop \
      --replace 'Exec=AppRun' 'Exec=${pname}'
  '';
--- a/pkgs/applications/editors/textadept/default.nix
+++ b/pkgs/applications/editors/textadept/default.nix
@ -3,7 +3,7 @@
 , withCurses ? false, ncurses
 }:
 stdenv.mkDerivation rec {
-  version = "12.1";
+  version = "12.4";
  pname = "textadept";

  src = fetchFromGitHub {
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    owner = "orbitalquark";
    repo = "textadept";
    rev = "textadept_${version}";
-    sha256 = "sha256-ce7U/GR/4zkjnRN3fx3FLecc9vuvFqCONy275SWnpNc=";
+    sha256 = "sha256-nPgpQeBq5Stv2o0Ke4W2Ltnx6qLe5TIC5a8HSYVkmfI=";
  };

  nativeBuildInputs = [ cmake ]
--- a/pkgs/applications/editors/textadept/deps.nix
+++ b/pkgs/applications/editors/textadept/deps.nix
@ -1,8 +1,8 @@
 {
  # scintilla
-  "scintilla536.tgz" = {
-    url = "https://www.scintilla.org/scintilla536.tgz";
-    sha256 = "sha256-ib6CeKg+eBOSWq/il32quH0r1r69F7AXn+cq/dVIyyQ=";
+  "scintilla550.tgz" = {
+    url = "https://www.scintilla.org/scintilla550.tgz";
+    sha256 = "sha256-5VPpVQnwH5KqFX+gLQanEmQuE9aaEewaAqfd8ixAYjE=";
  };
  # lexilla
  "lexilla510.tgz" = {
@ -15,9 +15,9 @@
    sha256 = "sha256-l1qeLMCrhyoZA/GfmXFR20rY5EsUoO5e+1vZJtYdb24=";
  };
  # scintillua
-  "e88bbcfecae46b48b79d8156ea7129411b5c847d.zip" = {
-    url = "https://github.com/orbitalquark/scintillua/archive/e88bbcfecae46b48b79d8156ea7129411b5c847d.zip";
-    sha256 = "sha256-sWqpVtcAwysGn86XFwaEkKSPemk2247SydOQi6klFrQ=";
+  "scintillua_6.3.zip" = {
+    url = "https://github.com/orbitalquark/scintillua/archive/scintillua_6.3.zip";
+    sha256 = "sha256-SAFmu3q8T1UtVjdUcFy9NPu0DOLqewvU/Vb9b7XjgQM=";
  };
  # lua
  "lua-5.4.6.tar.gz" = {
@ -49,6 +49,11 @@
    url = "https://github.com/orbitalquark/lua-std-regex/archive/1.0.zip";
    sha256 = "sha256-W2hKHOfqYyo3qk+YvPJlzZfZ1wxZmMVphSlcaql+dOE=";
  };
+  # singleapp
+  "v3.4.0.zip" = {
+    url = "https://github.com/itay-grudev/SingleApplication/archive/refs/tags/v3.4.0.zip";
+    sha256 = "sha256-FwyzM+R9ALpGH9u2RXab4Sqi4Q+p3Qs+8EdfhjPGcXY=";
+  };
 }


--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1477,8 +1477,8 @@ let
        mktplcRef = {
          name = "elixir-ls";
          publisher = "JakeBecker";
-          version = "0.21.0";
-          hash = "sha256-enx5qlbvfn25jGkjJEB0dJ3/zGhlVC5Q3ISS1qL9+bg=";
+          version = "0.21.1";
+          hash = "sha256-z/GhynjkoEcaRp59tYr1lnM5vfV0OaDCcCpC02OdVLE=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/JakeBecker.elixir-ls/changelog";
--- a/pkgs/applications/misc/clight/clight-gui.nix
+++ b/pkgs/applications/misc/clight/clight-gui.nix
@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, qtbase
+, qtcharts
+, wrapQtAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "clight-gui";
+  version = "unstable-2023-02-21";
+
+  src = fetchFromGitHub {
+    owner = "nullobsi";
+    repo = "clight-gui";
+    rev = "29e7216bfcc68135350a695ce446134bcb0463a6";
+    hash = "sha256-U4vaMwnVDZnYLc+K3/yD81Q1vyBL8uSrrhOHbjbox5U=";
+  };
+
+  buildInputs = [ qtbase qtcharts ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook ];
+
+  sourceRoot = "${src.name}/src";
+
+  meta = with lib; {
+    description = "Qt GUI for clight";
+    homepage = "https://github.com/nullobsi/clight-gui";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nickhu ];
+    mainProgram = "clight-gui";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/misc/elogind/default.nix
+++ b/pkgs/applications/misc/elogind/default.nix
@ -12,7 +12,7 @@
 , udev
 , eudev
 , libxslt
-, python3
+, python3Packages
 , docbook5
 , docbook_xsl
 , docbook_xsl_ns
@ -47,11 +47,13 @@ stdenv.mkDerivation rec {
    gettext
    libxslt.bin # xsltproc
    docbook5 docbook_xsl docbook_xsl_ns docbook_xml_dtd_42 docbook_xml_dtd_45 # needed for docbook without Internet
-    (python3.withPackages (p: with p; [ lxml ]))  # fixes: man/meson.build:111:0: ERROR: Could not execute command "/build/source/tools/xml_helper.py".
+
+    # fixes: man/meson.build:111:0: ERROR: Could not execute command "/build/source/tools/xml_helper.py".
+    python3Packages.python
+    python3Packages.lxml
  ];

-  buildInputs =
-    if enableSystemd then [ udev ] else [ eudev ];
+  buildInputs = [ libcap ] ++ (if enableSystemd then [ udev ] else [ eudev ]);

  # Inspired by the systemd `preConfigure`.
  # Conceptually we should patch all files required during the build, but not scripts
--- a/pkgs/applications/misc/gradience/default.nix
+++ b/pkgs/applications/misc/gradience/default.nix
@ -67,6 +67,7 @@ python3Packages.buildPythonApplication rec {
    pygobject3
    svglib
    yapsy
+    packaging
  ];

  preFixup = ''
--- a/pkgs/applications/misc/oxker/default.nix
+++ b/pkgs/applications/misc/oxker/default.nix
@ -2,14 +2,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "oxker";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-pHyIL5Jmldsa0ZNMiYpBD+9zxPv8Blg23nnWD2YmHMI=";
+    sha256 = "sha256-L03r4PHCu+jsUC5vVSG77SR2ak/AsuVAhTd7P1WibAk=";
  };

-  cargoHash = "sha256-N1Cv89njL9QCIs3HclcjsqgSUSMEckis8zyVqepeW70=";
+  cargoHash = "sha256-5UxbZZdVioy1OZCbE6qESGKVnVT6TS4VHzsKlQ8XP2c=";

  meta = with lib; {
    description = "A simple tui to view & control docker containers";
--- a/pkgs/applications/misc/raider/default.nix
+++ b/pkgs/applications/misc/raider/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "raider";
-  version = "2.1.0";
+  version = "3.0.0";

  src = fetchFromGitHub {
    owner = "ADBeveridge";
    repo = "raider";
    rev = "v${version}";
-    hash = "sha256-ZR40sbEKvZxGxRaV5H9D6kBP9ZgUdc425XgIhqidWLI=";
+    hash = "sha256-zqM2B1M7E4CRupd09rvFYG7H7wBd2hTWnjN3xadS36w=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/resp-app/default.nix
+++ b/pkgs/applications/misc/resp-app/default.nix
@ -77,6 +77,7 @@ mkDerivation rec {
      --replace '/opt/resp_app' "${placeholder "out"}" \
      --replace 'target.path = $$LINUX_INSTALL_PATH' 'target.path = $$LINUX_INSTALL_PATH/bin' \
      --replace '/usr/' "$out/"
+    rm -r 3rdparty/snappy
  '';

  qmakeFlags = [
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@ -1,11 +1,11 @@
 {
  stable = {
    chromedriver = {
-      hash_darwin = "sha256-RGOChK4JhrFUgVY/5YqgE0KFLRl6a7X2llw1ZfhiPXY=";
+      hash_darwin = "sha256-4MZwD2jgjOrBTtkjxW0XH+lZfP8wj7Z6eg7LwFziCPU=";
      hash_darwin_aarch64 =
-        "sha256-K1jFXmWtXrS43UJg2mQ39Kae6tv7E9Fxm6LUWg+uwLo=";
-      hash_linux = "sha256-xwaRNh7sllyNaq8+aLAZDQ3uDg06cu3KYqc02LWPSyw=";
-      version = "124.0.6367.91";
+        "sha256-P9qi8rR8DW+WOT+ev2EgA93StnGrBiIHu2UbkEhS+0M=";
+      hash_linux = "sha256-eudgRu3OMuTBTeX8zrm6ShgmjcsNhzaBYEAP/4n1SJk=";
+      version = "124.0.6367.155";
    };
    deps = {
      gn = {
@ -15,9 +15,9 @@
        version = "2024-03-14";
      };
    };
-    hash = "sha256-+r/48dxipSAo74v1deMuKalW+Hj85hCun63ZcgLYDLk=";
-    hash_deb_amd64 = "sha256-H3bv6WiVBl4j38ROZ80+SD9UO9ok+xxcKFxDd9yjWNY=";
-    version = "124.0.6367.118";
+    hash = "sha256-Qv1xYofY4Tgj+WT1a8ehOo7R52CwZz2vCK9MDSnjmsg=";
+    hash_deb_amd64 = "sha256-lFG5l3K2Yo1BYbXS9bK+9gWx6JxFrPxpT+zI7dBXQ6E=";
+    version = "124.0.6367.155";
  };
  ungoogled-chromium = {
    deps = {
@ -28,12 +28,12 @@
        version = "2024-03-14";
      };
      ungoogled-patches = {
-        hash = "sha256-Oo3+LCQYRRLsCQRLF+2+5tw3vMt0XYHlM4jTiapp9E8=";
-        rev = "124.0.6367.118-1";
+        hash = "sha256-RS6flauUQjd+NPqUIppwlgtjOKxJa5+OTnL4aI3gRcs=";
+        rev = "124.0.6367.155-1";
      };
    };
-    hash = "sha256-+r/48dxipSAo74v1deMuKalW+Hj85hCun63ZcgLYDLk=";
-    hash_deb_amd64 = "sha256-H3bv6WiVBl4j38ROZ80+SD9UO9ok+xxcKFxDd9yjWNY=";
-    version = "124.0.6367.118";
+    hash = "sha256-Qv1xYofY4Tgj+WT1a8ehOo7R52CwZz2vCK9MDSnjmsg=";
+    hash_deb_amd64 = "sha256-lFG5l3K2Yo1BYbXS9bK+9gWx6JxFrPxpT+zI7dBXQ6E=";
+    version = "124.0.6367.155";
  };
 }
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "talosctl";
-  version = "1.7.0";
+  version = "1.7.1";

  src = fetchFromGitHub {
    owner = "siderolabs";
    repo = "talos";
    rev = "v${version}";
-    hash = "sha256-E5pu37R2y0hQezM/p6LJXZv2L6QnV89Ir2HoKaqcOqI=";
+    hash = "sha256-1UDPpavDjWoM5kSfyaT4H5y5ax/vVlfqpzN9U2sTVuk=";
  };

-  vendorHash = "sha256-5vWAZsLQxPZGpTiT/OowCLNPdE5e+HrAGXpFRw6jgbU=";
+  vendorHash = "sha256-52RaQOJ2KTuc8wdk7vv5XsynKdMOwZ1LaqiPdB+jXPw=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -6,7 +6,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "flexget";
-  version = "3.11.30";
+  version = "3.11.31";
  pyproject = true;

  # Fetch from GitHub in order to use `requirements.in`
@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "Flexget";
    repo = "Flexget";
    rev = "refs/tags/v${version}";
-    hash = "sha256-msvNZ3kE48dNnhtUWLGxulb2iZ78hhyg7fVL2OSOdyY=";
+    hash = "sha256-lTAC33mw2iHY9Xj4WRgO+Fh+xfjs5vRw6xAZcEaJKhM=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/ids/suricata/default.nix
+++ b/pkgs/applications/networking/ids/suricata/default.nix
@ -49,6 +49,10 @@ stdenv.mkDerivation rec {
  ++ lib.optionals rustSupport [ rustc cargo ]
  ;

+  propagatedBuildInputs = with python.pkgs; [
+    pyyaml
+  ];
+
  buildInputs = [
    elfutils
    jansson
--- a/pkgs/applications/networking/instant-messengers/ferdium/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ferdium/default.nix
@ -6,14 +6,14 @@ let
    aarch64-linux = "arm64";
  }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  hash = {
-    amd64-linux_hash = "sha256-RH8iHqJ0Nd3wkXmv/ZGX5JeWtxyJtVLVb0tz6tnkjrw=";
-    arm64-linux_hash = "sha256-0gvkabuxRqkMeyZiOSyT6C7v767+uCrsXE8qk0y0mYM=";
+    amd64-linux_hash = "sha256-Q5fUMQQTQKgUkakmsiBFH2UwJdk/XV8wpQi6uRHi90U=";
+    arm64-linux_hash = "sha256-axFIwz1AtzxO1+XkmCflHqi/CdsmeqD6QAxepATMqm4=";
  }."${arch}-linux_hash";
 in
 mkFranzDerivation rec {
  pname = "ferdium";
  name = "Ferdium";
-  version = "6.7.2";
+  version = "6.7.3";
  src = fetchurl {
    url = "https://github.com/ferdium/ferdium-app/releases/download/v${version}/Ferdium-linux-${version}-${arch}.deb";
    inherit hash;
--- a/pkgs/applications/networking/instant-messengers/jami/config/pjsip_args_common
+++ b/pkgs/applications/networking/instant-messengers/jami/config/pjsip_args_common
@ -1,19 +0,0 @@
--disable-sound
--enable-video
--enable-ext-sound
--disable-speex-aec
--disable-g711-codec
--disable-l16-codec
--disable-gsm-codec
--disable-g722-codec
--disable-g7221-codec
--disable-speex-codec
--disable-ilbc-codec
--disable-opencore-amr
--disable-silk
--disable-sdl
--disable-ffmpeg
--disable-v4l2
--disable-openh264
--disable-resample
--disable-libwebrtc
--- a/pkgs/applications/networking/instant-messengers/jami/config/pjsip_args_linux
+++ b/pkgs/applications/networking/instant-messengers/jami/config/pjsip_args_linux
@ -1 +0,0 @@
--enable-epoll
--- a/pkgs/applications/networking/instant-messengers/jami/config/pjsip_patches
+++ b/pkgs/applications/networking/instant-messengers/jami/config/pjsip_patches
@ -1 +0,0 @@
-0009-add-config-site.patch
--- a/pkgs/applications/networking/instant-messengers/jami/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/default.nix
@ -35,6 +35,7 @@

  # for client
 , cmake
+, git
 , networkmanager # for libnm
 , python3
 , qttools # for translations
@ -61,57 +62,80 @@
 , opendht
 }:

-let
-  readLinesToList = with builtins; file: filter (s: isString s && stringLength s > 0) (split "\n" (readFile file));
-in
 stdenv.mkDerivation rec {
  pname = "jami";
-  version = "20231201.0";
+  version = "20240430.0";

  src = fetchFromGitLab {
    domain = "git.jami.net";
    owner = "savoirfairelinux";
    repo = "jami-client-qt";
    rev = "stable/${version}";
-    hash = "sha256-A38JwjqdQVy03d738p2tpTFA6EWRSPNiesS5wZfti7Y=";
+    hash = "sha256-v7558m2h3RqvLLhf3BdYO9LKCFKuMTtPIXgH6OXiiY4=";
    fetchSubmodules = true;
  };

-  pjsip-jami = pjsip.overrideAttrs (old:
-    let
-      patch-src = src + "/daemon/contrib/src/pjproject/";
-    in
-    rec {
-      version = "311bd018fc07aaf62d4c2d2494e08b5ee97e6846";
+  pjsip-jami = pjsip.overrideAttrs (old: rec {
+    version = "797f1a38cc1066acc4adc9561aa1288afabe72d5";

-      src = fetchFromGitHub {
-        owner = "savoirfairelinux";
-        repo = "pjproject";
-        rev = version;
-        hash = "sha256-pZiOSOUxAXzMY4c1/AyKcwa7nyIJC/ZVOqDg9/QO/Nk=";
-      };
+    src = fetchFromGitHub {
+      owner = "savoirfairelinux";
+      repo = "pjproject";
+      rev = version;
+      hash = "sha256-lTDbJF09R2G+EIkMj1YyKa4XokH9LlcIG+RhRJhzUes=";
+    };

-      patches = (map (x: patch-src + x) (readLinesToList ./config/pjsip_patches));
+    configureFlags = [
+      "--disable-sound"
+      "--enable-video"
+      "--enable-ext-sound"
+      "--disable-speex-aec"
+      "--disable-g711-codec"
+      "--disable-l16-codec"
+      "--disable-gsm-codec"
+      "--disable-g722-codec"
+      "--disable-g7221-codec"
+      "--disable-speex-codec"
+      "--disable-ilbc-codec"
+      "--disable-opencore-amr"
+      "--disable-silk"
+      "--disable-sdl"
+      "--disable-ffmpeg"
+      "--disable-v4l2"
+      "--disable-openh264"
+      "--disable-resample"
+      "--disable-libwebrtc"
+      "--with-gnutls=yes"
+    ]
+    ++ lib.optionals stdenv.isLinux [
+      "--enable-epoll"
+    ];

-      configureFlags = (readLinesToList ./config/pjsip_args_common)
-        ++ lib.optionals stdenv.isLinux (readLinesToList ./config/pjsip_args_linux);
-    });
+    buildInputs = old.buildInputs ++ [ gnutls ];
+  });

-  opendht-jami = opendht.override {
+  opendht-jami = (opendht.overrideAttrs {
+    src = fetchFromGitHub {
+      owner = "savoirfairelinux";
+      repo = "opendht";
+      rev = "f2cee8e9ce24746caa7dee1847829c526d340284";
+      hash = "sha256-ZnIrlybF3MCiXxxv80tRzCJ5CJ54S42prGUjq1suJNA=";
+    };
+  }).override {
    enableProxyServerAndClient = true;
    enablePushNotifications = true;
  };

  dhtnet = stdenv.mkDerivation {
    pname = "dhtnet";
-    version = "unstable-2023-11-23";
+    version = "unstable-2022-04-26";

    src = fetchFromGitLab {
      domain = "git.jami.net";
      owner = "savoirfairelinux";
      repo = "dhtnet";
-      rev = "b1bcdecbac2a41de3941ef5a34faa6fbe4472535";
-      hash = "sha256-EucSsUuHXbVqr7drrTLK0f+WZT2k9Tx/LV+IBldTQO8=";
+      rev = "d7976982d24867c6faaf8103504ec8a10d932fa0";
+      hash = "sha256-vazFDMIu/3AWeOz0LZhZD9NFO8cd5AK41zBpqpQrqnc=";
    };

    nativeBuildInputs = [
@ -130,6 +154,7 @@ stdenv.mkDerivation rec {
      opendht-jami
      openssl
      pjsip-jami
+      python3
      restinio
    ];

@ -193,6 +218,20 @@ stdenv.mkDerivation rec {
    enableParallelBuilding = true;
  };

+  qwindowkit = fetchFromGitHub {
+    owner = "stdware";
+    repo = "qwindowkit";
+    rev = "79b1f3110754f9c21af2d7dacbd07b1a9dbaf6ef";
+    hash = "sha256-iZfmv3ADVjHf47HPK/FdrfeAzrXbxbjH3H5MFVg/ZWE=";
+    fetchSubmodules = true;
+  };
+
+  postPatch = ''
+    sed -i -e '/GIT_REPOSITORY/,+1c SOURCE_DIR ''${CMAKE_CURRENT_SOURCE_DIR}/qwindowkit' extras/build/cmake/contrib_tools.cmake
+    sed -i -e 's/if(DISTRO_NEEDS_QMSETUP_PATCH)/if(TRUE)/' CMakeLists.txt
+    cp -R --no-preserve=mode,ownership ${qwindowkit} qwindowkit
+  '';
+
  preConfigure = ''
    echo 'const char VERSION_STRING[] = "${version}";' > src/app/version.h
    # Currently the daemon is still built seperately but jami expects it in CMAKE_INSTALL_PREFIX
@ -208,6 +247,7 @@ stdenv.mkDerivation rec {
    wrapQtAppsHook
    pkg-config
    cmake
+    git
    python3
    qttools
  ];
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
  pname = "signal-desktop-beta";
  dir = "Signal Beta";
-  version = "7.7.0-beta.1";
+  version = "7.9.0-beta.1";
  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
-  hash = "sha256-oswS1aRkpiTNSpQ6CqfJnoM412RRwraeht4iqq8L1Bk=";
+  hash = "sha256-NZo2H+rX7sy+aPP9Bl9EWPEROkhLXG2puUdbc0s7Nbw=";
 }
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
  pname = "signal-desktop";
  dir = "Signal";
-  version = "7.7.0";
+  version = "7.8.0";
  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-UESpbYZ4oRhhQF8GYrbKnNkqmefCfTE1jfCCK7ctIKk=";
+  hash = "sha256-gBcfe3lU2pmRHSXNNXBFU7Qv83Bf6OPv5LM/HxeLkjM=";
 }
--- a/pkgs/applications/networking/remote/freerdp/3.nix
+++ b/pkgs/applications/networking/remote/freerdp/3.nix
@ -13,7 +13,6 @@
 , glib
 , openh264
 , openssl
-, p11-kit
 , pcre2
 , pkcs11helper
 , uriparser
@ -69,13 +68,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "freerdp";
-  version = "3.4.0";
+  version = "3.5.1";

  src = fetchFromGitHub {
    owner = "FreeRDP";
    repo = "FreeRDP";
    rev = finalAttrs.version;
-    hash = "sha256-ZOYHhldTdV8DrOHoXS42NXB6JHBJMGRswgTczn1S6BE=";
+    hash = "sha256-8yWMnwJbvyUiEuX+2bEim1IeqPx20u9yvNIVe7MC/ZQ=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/remote/freerdp/default.nix
+++ b/pkgs/applications/networking/remote/freerdp/default.nix
@ -205,6 +205,7 @@ stdenv.mkDerivation rec {
      following the Microsoft Open Specifications.
    '';
    homepage = "https://www.freerdp.com/";
+    changelog = "https://github.com/FreeRDP/FreeRDP/releases/tag/${src.rev}";
    license = licenses.asl20;
    maintainers = with maintainers; [ peterhoeg lheckemann ];
    platforms = platforms.unix;
--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "seaweedfs";
-  version = "3.65";
+  version = "3.66";

  src = fetchFromGitHub {
    owner = "seaweedfs";
    repo = "seaweedfs";
    rev = version;
-    hash = "sha256-+HSdOP0ls8OKIFlI6qIsyhDY+4+//cbcEFL9w8rJ5i0=";
+    hash = "sha256-1hK7FEBfLWh1LVtuhELAvZFyMK1bpOSnBg78aIRK8LY=";
  };

-  vendorHash = "sha256-53HX4WvAQkrEa2v0PzaRwy6tMVqTB5UEWDHhDwCQk18=";
+  vendorHash = "sha256-ly1opQmYL8zRKtLTMFo5Ek9ofEtn1YwmfhVuWfACKxY=";

  subPackages = [ "weed" ];

--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@ -76,6 +76,12 @@ stdenv.mkDerivation rec {
    ./0003-remove-valgrind.patch
    # this patch makes gnucash exec the Finance::Quote wrapper directly
    ./0004-exec-fq-wrapper.patch
+    # Fix importing QIF by backporting a fix. remove on next release
+    # https://bugs.gnucash.org/show_bug.cgi?id=799262
+    (fetchpatch {
+      url = "https://github.com/Gnucash/gnucash/commit/b33b864c2fa0ba72d1940465e7fa962dd36833c9.patch";
+      hash = "sha256-A8pYW6CcNFBGC/MDijnuFJdlNAzSDS6Tcj+haCcEI/M=";
+    })
  ];

  # this needs to be an environment variable and not a cmake flag to suppress
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "snakemake";
-  version = "8.11.0";
+  version = "8.11.2";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "snakemake";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-bAzhQMGI4t/ftcZnz6h/PmlDlGgMU8vFVHb9QXED/Hw=";
+    hash = "sha256-rIA757FIIkb6h/QNzyVbIbipkZTwysNonHrPHLqFOyI=";
    # https://github.com/python-versioneer/python-versioneer/issues/217
    postFetch = ''
      sed -i "$out"/snakemake/_version.py -e 's#git_refnames = ".*"#git_refnames = " (tag: v${version})"#'
--- a/pkgs/applications/science/robotics/mujoco/default.nix
+++ b/pkgs/applications/science/robotics/mujoco/default.nix
@ -12,12 +12,12 @@
 let
  pin = {

-    # See https://github.com/google-deepmind/mujoco/blob/3.0.0/cmake/MujocoDependencies.cmake#L17-L64
+    # See https://github.com/google-deepmind/mujoco/blob/<VERSION>/cmake/MujocoDependencies.cmake#L17-L64
    abseil-cpp = fetchFromGitHub {
      owner = "abseil";
      repo = "abseil-cpp";
-      rev = "2f9e432cce407ce0ae50676696666f33a77d42ac";
-      hash = "sha256-D4E11bICKr3Z5RRah7QkfXVsXtuUg32FMmKpiOGjZDM=";
+      rev = "d7aaad83b488fd62bd51c81ecf16cd938532cc0a";
+      hash = "sha256-eA2/dZpNOlex1O5PNa3XSZhpMB3AmaIoHzVDI9TD/cg=";
    };
    benchmark = fetchFromGitHub {
      owner = "google";
@ -70,8 +70,8 @@ let
    marchingcubecpp = fetchFromGitHub {
      owner = "aparis69";
      repo = "MarchingCubeCpp";
-      rev = "5b79e5d6bded086a0abe276a4b5a69fc17ae9bf1";
-      hash = "sha256-L0DH1GJZ/3vatQAU/KZj/2xTKE6Fwcw9eQYzLdqX2N4=";
+      rev = "f03a1b3ec29b1d7d865691ca8aea4f1eb2c2873d";
+      hash = "sha256-90ei0lpJA8XuVGI0rGb3md0Qtq8/bdkU7dUCHpp88Bw=";
    };

    tmd = stdenv.mkDerivation rec {
@ -129,7 +129,7 @@ let

 in stdenv.mkDerivation rec {
  pname = "mujoco";
-  version = "3.1.4";
+  version = "3.1.5";

  # Bumping version? Make sure to look though the MuJoCo's commit
  # history for bumped dependency pins!
@ -137,7 +137,7 @@ in stdenv.mkDerivation rec {
    owner = "google-deepmind";
    repo = "mujoco";
    rev = "refs/tags/${version}";
-    hash = "sha256-VgD6ditMDpHki7l23Gjip2roA8Oi4MGpxl+4gSLTEFs=";
+    hash = "sha256-XKN489oexHf2/Gv0MVxXUzqyeJJTJXV99+fNi8shdsg=";
  };

  patches = [ ./mujoco-system-deps-dont-fetch.patch ];
--- a/pkgs/applications/version-management/jujutsu/default.nix
+++ b/pkgs/applications/version-management/jujutsu/default.nix
@ -19,16 +19,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "jujutsu";
-  version = "0.17.0";
+  version = "0.17.1";

  src = fetchFromGitHub {
    owner = "martinvonz";
    repo = "jj";
    rev = "v${version}";
-    hash = "sha256-9Otm4EtBhSPix/perfhxHkgVhN0i/2+3JV50ex7xAlY=";
+    hash = "sha256-3f/odQ5MgYGdPKUFqF90YGN84fXgG6BRkpN96TxJz1c=";
  };

-  cargoHash = "sha256-snaqfiTfSKWnjCCUwptAJAl+n2CBRdBSswPR/y555k0=";
+  cargoHash = "sha256-N4UUouJfhKhosMBFVM0QEUNgkh7NFryXUoPmGVXcLGQ=";

  cargoBuildFlags = [ "--bin" "jj" ]; # don't install the fake editors
  useNextest = false; # nextest is the upstream integration framework, but is problematic for test skipping
--- a/pkgs/build-support/dlang/builddubpackage/default.nix
+++ b/pkgs/build-support/dlang/builddubpackage/default.nix
@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchurl,
+  fetchgit,
  linkFarm,
  dub,
  ldc,
@ -43,11 +44,27 @@ let
      };
    };

-  lockJson = if lib.isPath dubLock then lib.importJSON dubLock else dubLock;
+  makeGitDep =
+    {
+      pname,
+      version,
+      repository,
+      sha256,
+    }:
+    {
+      inherit pname version;
+      src = fetchgit {
+        url = repository;
+        rev = version;
+        inherit sha256;
+      };
+    };

-  lockedDeps = lib.mapAttrsToList (
-    pname: { version, sha256 }: makeDubDep { inherit pname version sha256; }
-  ) lockJson.dependencies;
+  lockJson = if lib.isPath dubLock then lib.importJSON dubLock else dubLock;
+  depsRaw = lib.mapAttrsToList (pname: args: { inherit pname; } // args) lockJson.dependencies;
+
+  dubDeps = map makeDubDep (lib.filter (args: !(args ? repository)) depsRaw);
+  gitDeps = map makeGitDep (lib.filter (args: args ? repository) depsRaw);

  # a directory with multiple single element registries
  # one big directory with all .zip files leads to version parsing errors
@ -56,7 +73,7 @@ let
    map (dep: {
      name = "${dep.pname}/${dep.pname}-${dep.version}.zip";
      path = dep.src;
-    }) lockedDeps
+    }) dubDeps
  );

  combinedFlags = "--skip-registry=all --compiler=${lib.getExe compiler} ${toString dubFlags}";
@ -79,12 +96,18 @@ stdenv.mkDerivation (
        runHook preConfigure

        export DUB_HOME="$NIX_BUILD_TOP/.dub"
-        mkdir -p $DUB_HOME
+        mkdir -p "$DUB_HOME"

-        # register dependencies
+        # register dub dependencies
        ${lib.concatMapStringsSep "\n" (dep: ''
          dub fetch ${dep.pname}@${dep.version} --cache=user --skip-registry=standard --registry=file://${dubRegistryBase}/${dep.pname}
-        '') lockedDeps}
+        '') dubDeps}
+
+        # register git dependencies
+        ${lib.concatMapStringsSep "\n" (dep: ''
+          mkdir -p "$DUB_HOME/packages/${dep.pname}/${dep.version}"
+          cp -r --no-preserve=all ${dep.src} "$DUB_HOME/packages/${dep.pname}/${dep.version}/${dep.pname}"
+        '') gitDeps}

        runHook postConfigure
      '';
--- a/pkgs/build-support/dlang/dub-to-nix/default.nix
+++ b/pkgs/build-support/dlang/dub-to-nix/default.nix
@ -4,8 +4,15 @@
  makeWrapper,
  python3,
  nix,
+  nix-prefetch-git,
 }:

+let
+  binPath = lib.makeBinPath [
+    nix
+    nix-prefetch-git
+  ];
+in
 runCommand "dub-to-nix"
  {
    nativeBuildInputs = [ makeWrapper ];
@ -15,5 +22,5 @@ runCommand "dub-to-nix"
    install -Dm755 ${./dub-to-nix.py} "$out/bin/dub-to-nix"
    patchShebangs "$out/bin/dub-to-nix"
    wrapProgram "$out/bin/dub-to-nix" \
-        --prefix PATH : ${lib.makeBinPath [ nix ]}
+        --prefix PATH : ${binPath}
  ''
--- a/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
+++ b/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
@ -4,10 +4,13 @@ import sys
 import json
 import os
 import subprocess
+import string
+

 def eprint(text: str):
    print(text, file=sys.stderr)

+
 if not os.path.exists("dub.selections.json"):
    eprint("The file `dub.selections.json` does not exist in the current working directory")
    eprint("run `dub upgrade --annotate` to generate it")
@ -16,24 +19,53 @@ if not os.path.exists("dub.selections.json"):
 with open("dub.selections.json") as f:
    selectionsJson = json.load(f)

-versionDict: dict[str, str] = selectionsJson["versions"]
+depsDict: dict = selectionsJson["versions"]

-for pname in versionDict:
-    version = versionDict[pname]
+# For each dependency expand non-expanded version into a dict with a "version" key
+depsDict = {pname: (versionOrDepDict if isinstance(versionOrDepDict, dict) else {"version": versionOrDepDict}) for (pname, versionOrDepDict) in depsDict.items()}
+
+# Don't process path-type selections
+depsDict = {pname: depDict for (pname, depDict) in depsDict.items() if "path" not in depDict}
+
+# Pre-validate selections before trying to fetch
+for pname in depsDict:
+    depDict = depsDict[pname]
+    version = depDict["version"]
    if version.startswith("~"):
-        eprint(f'Package "{pname}" has a branch-type version "{version}", which doesn\'t point to a fixed version')
-        eprint("You can resolve it by manually changing the required version to a fixed one inside `dub.selections.json`")
-        eprint("When packaging, you might need to create a patch for `dub.sdl` or `dub.json` to accept the changed version")
+        eprint(f'Expected version of "{pname}" to be non-branch type')
+        eprint(f'Found: "{version}"')
+        eprint("Please specify a non-branch version inside `dub.selections.json`")
+        eprint("When packaging, you might also need to patch the version value in the appropriate places (`dub.selections.json`, dub.sdl`, `dub.json`)")
        sys.exit(1)
+    if "repository" in depDict:
+        repository = depDict["repository"]
+        if not repository.startswith("git+"):
+            eprint(f'Expected repository field of "{pname}" to begin with "git+"')
+            eprint(f'Found: "{repository}"')
+            sys.exit(1)
+        if (len(version) < 7 or len(version) > 40 or not all(c in string.hexdigits for c in version)):
+            eprint(f'Expected version field of "{pname}" to begin be a valid git revision')
+            eprint(f'Found: "{version}"')
+            sys.exit(1)

-lockedDependenciesDict: dict[str, dict[str, str]] = {}
+lockedDepsDict: dict[str, dict[str, str]] = {}

-for pname in versionDict:
-    version = versionDict[pname]
-    eprint(f"Fetching {pname}@{version}")
-    url = f"https://code.dlang.org/packages/{pname}/{version}.zip"
-    command = ["nix-prefetch-url", "--type", "sha256", url]
-    sha256 = subprocess.run(command, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL).stdout.rstrip()
-    lockedDependenciesDict[pname] = {"version": version, "sha256": sha256}
+for pname in depsDict:
+    depDict = depsDict[pname]
+    version = depDict["version"]
+    if "repository" in depDict:
+        repository = depDict["repository"]
+        strippedRepo = repository[4:]
+        eprint(f"Fetching {pname}@{version} ({strippedRepo})")
+        command = ["nix-prefetch-git", strippedRepo, version]
+        rawRes = subprocess.run(command, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL).stdout
+        sha256 = json.loads(rawRes)["sha256"]
+        lockedDepsDict[pname] = {"version": version, "repository": repository, "sha256": sha256}
+    else:
+        eprint(f"Fetching {pname}@{version}")
+        url = f"https://code.dlang.org/packages/{pname}/{version}.zip"
+        command = ["nix-prefetch-url", "--type", "sha256", url]
+        sha256 = subprocess.run(command, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL).stdout.rstrip()
+        lockedDepsDict[pname] = {"version": version, "sha256": sha256}

-print(json.dumps({"dependencies": lockedDependenciesDict}, indent=2))
+print(json.dumps({"dependencies": lockedDepsDict}, indent=2))
--- a/pkgs/build-support/kernel/compress-firmware-xz.nix
+++ b/pkgs/build-support/kernel/compress-firmware-xz.nix
@ -1,29 +0,0 @@
-{ runCommand, lib }:
-
-firmware:
-
-let
-  args = {
-    allowedRequisites = [];
-  } // lib.optionalAttrs (firmware ? meta) { inherit (firmware) meta; };
-in
-
-runCommand "${firmware.name}-xz" args ''
-  mkdir -p $out/lib
-  (cd ${firmware} && find lib/firmware -type d -print0) |
-      (cd $out && xargs -0 mkdir -v --)
-  (cd ${firmware} && find lib/firmware -type f -print0) |
-      (cd $out && xargs -0rtP "$NIX_BUILD_CORES" -n1 \
-          sh -c 'xz -9c -T1 -C crc32 --lzma2=dict=2MiB "${firmware}/$1" > "$1.xz"' --)
-  (cd ${firmware} && find lib/firmware -type l) | while read link; do
-      target="$(readlink "${firmware}/$link")"
-      if [ -f "${firmware}/$link" ]; then
-        ln -vs -- "''${target/^${firmware}/$out}.xz" "$out/$link.xz"
-      else
-        ln -vs -- "''${target/^${firmware}/$out}" "$out/$link"
-      fi
-  done
-
-  echo "Checking for broken symlinks:"
-  find -L $out -type l -print -execdir false -- '{}' '+'
-''
--- a/pkgs/build-support/kernel/compress-firmware.nix
+++ b/pkgs/build-support/kernel/compress-firmware.nix
@ -0,0 +1,43 @@
+{ runCommand, lib, type ? "zstd", zstd }:
+
+firmware:
+
+let
+  compressor = {
+    xz = {
+      ext = "xz";
+      nativeBuildInputs = [ ];
+      cmd = file: target: ''xz -9c -T1 -C crc32 --lzma2=dict=2MiB "${file}" > "${target}"'';
+    };
+    zstd = {
+      ext = "zst";
+      nativeBuildInputs = [ zstd ];
+      cmd = file: target: ''zstd -T1 -19 --long --check -f "${file}" -o "${target}"'';
+    };
+  }.${type} or (throw "Unsupported compressor type for firmware.");
+
+  args = {
+    allowedRequisites = [];
+    inherit (compressor) nativeBuildInputs;
+  } // lib.optionalAttrs (firmware ? meta) { inherit (firmware) meta; };
+in
+
+runCommand "${firmware.name}-${type}" args ''
+  mkdir -p $out/lib
+  (cd ${firmware} && find lib/firmware -type d -print0) |
+      (cd $out && xargs -0 mkdir -v --)
+  (cd ${firmware} && find lib/firmware -type f -print0) |
+      (cd $out && xargs -0rtP "$NIX_BUILD_CORES" -n1 \
+          sh -c '${compressor.cmd "${firmware}/$1" "$1.${compressor.ext}"}' --)
+  (cd ${firmware} && find lib/firmware -type l) | while read link; do
+      target="$(readlink "${firmware}/$link")"
+      if [ -f "${firmware}/$link" ]; then
+        ln -vs -- "''${target/^${firmware}/$out}.${compressor.ext}" "$out/$link.${compressor.ext}"
+      else
+        ln -vs -- "''${target/^${firmware}/$out}" "$out/$link"
+      fi
+  done
+
+  echo "Checking for broken symlinks:"
+  find -L $out -type l -print -execdir false -- '{}' '+'
+''
--- a/pkgs/build-support/kernel/modules-closure.sh
+++ b/pkgs/build-support/kernel/modules-closure.sh
@ -80,7 +80,7 @@ for module in $(< ~-/closure); do
    # of its output.
    modinfo -b $kernel --set-version "$version" -F firmware $module | grep -v '^name:' | while read -r i; do
        echo "firmware for $module: $i"
-        for name in "$i" "$i.xz" ""; do
+        for name in "$i" "$i.xz" "$i.zst" ""; do
            [ -z "$name" ] && echo "WARNING: missing firmware $i for module $module"
            if cp -v --parents --no-preserve=mode lib/firmware/$name "$out" 2>/dev/null; then
                break
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@ -40,10 +40,14 @@ rec {
        ${pkgs.stdenv.cc.libc}/lib/libc.so.* \
        ${pkgs.stdenv.cc.libc}/lib/libm.so.* \
        ${pkgs.stdenv.cc.libc}/lib/libresolv.so.* \
+        ${pkgs.stdenv.cc.libc}/lib/libpthread.so.* \
+        ${pkgs.zstd.out}/lib/libzstd.so.* \
+        ${pkgs.xz.out}/lib/liblzma.so.* \
        $out/lib

      # Copy BusyBox.
      cp -pd ${pkgs.busybox}/bin/* $out/bin
+      cp -pd ${pkgs.kmod}/bin/* $out/bin

      # Run patchelf to make the programs refer to the copied libraries.
      for i in $out/bin/* $out/lib/*; do if ! test -L $i; then nuke-refs $i; fi; done
@ -54,6 +58,11 @@ rec {
              patchelf --set-interpreter $out/lib/ld-*.so.? --set-rpath $out/lib $i || true
          fi
      done
+
+      find $out/lib -type f \! -name 'ld*.so.?' | while read i; do
+        echo "patching $i..."
+        patchelf --set-rpath $out/lib $i
+      done
    ''; # */


--- a/pkgs/by-name/ad/adbtuifm/package.nix
+++ b/pkgs/by-name/ad/adbtuifm/package.nix
@ -16,7 +16,7 @@ buildGoModule rec {
  meta = with lib; {
    description = "A TUI-based file manager for the Android Debug Bridge";
    homepage = "https://github.com/darkhz/adbtuifm";
-    changelog = "https:/github.com/darkhz/adbtuifm/releases/tag/v${version}";
+    changelog = "https://github.com/darkhz/adbtuifm/releases/tag/v${version}";
    license = with licenses; [mit];
    maintainers = with maintainers; [daru-san];
    mainProgram = "adbtuifm";
--- a/pkgs/by-name/at/atac/package.nix
+++ b/pkgs/by-name/at/atac/package.nix
@ -29,6 +29,7 @@ rustPlatform.buildRustPackage rec {
      oniguruma
    ]
    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.AppKit
      darwin.apple_sdk.frameworks.Security
      darwin.apple_sdk.frameworks.SystemConfiguration
    ];
--- a/pkgs/by-name/ca/cargo-shear/package.nix
+++ b/pkgs/by-name/ca/cargo-shear/package.nix
@ -1,24 +1,38 @@
-{ fetchFromGitHub, lib, rustPlatform }:
-
-rustPlatform.buildRustPackage rec {
-  pname = "cargo-shear";
+{
+  fetchFromGitHub,
+  lib,
+  rustPlatform,
+  testers,
+  cargo-shear,
+}:
+let
  version = "0.0.25";
+in
+rustPlatform.buildRustPackage {
+  pname = "cargo-shear";
+  inherit version;

  src = fetchFromGitHub {
    owner = "Boshen";
    repo = "cargo-shear";
    rev = "v${version}";
-    sha256 = "sha256-4NnCUe4DrnSeveicxvvDF49hrc4NdRx/N10PH7Q0k8k=";
+    hash = "sha256-4NnCUe4DrnSeveicxvvDF49hrc4NdRx/N10PH7Q0k8k=";
  };

  cargoHash = "sha256-gHXJz3Xw9vC04q001kd6AgEKKaRtAK3oGMn7JJh+Neo=";

-  meta = with lib; {
+  # https://github.com/Boshen/cargo-shear/blob/a0535415a3ea94c86642f39f343f91af5cdc3829/src/lib.rs#L20-L23
+  SHEAR_VERSION = version;
+  passthru.tests.version = testers.testVersion {
+    package = cargo-shear;
+  };
+
+  meta = {
    description = "Detect and remove unused dependencies from Cargo.toml";
    mainProgram = "cargo-shear";
    homepage = "https://github.com/Boshen/cargo-shear";
-    changelog = "https://github.com/Boshen/cargo-shear/blob/${src.rev}/CHANGELOG.md";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ uncenter ];
+    changelog = "https://github.com/Boshen/cargo-shear/blob/v${version}/CHANGELOG.md";
+    license = [ lib.licenses.mit ];
+    maintainers = with lib.maintainers; [ uncenter ];
  };
 }
--- a/pkgs/by-name/di/dim/package.nix
+++ b/pkgs/by-name/di/dim/package.nix
@ -11,6 +11,7 @@
  sqlite,
  libvaSupport ? stdenv.hostPlatform.isLinux,
  libva,
+  fetchpatch,
 }:
 rustPlatform.buildRustPackage rec {
  pname = "dim";
@ -45,6 +46,14 @@ rustPlatform.buildRustPackage rec {
    # (ffmpeg) binaries in the same directory as the binary. Patch it to use
    # the working dir and PATH instead.
    ./relative-paths.diff
+
+    # Upstream has some unused imports that prevent things from compiling...
+    # Remove for next release.
+    (fetchpatch {
+      name = "remove-unused-imports.patch";
+      url = "https://github.com/Dusk-Labs/dim/commit/f62de1d38e6e52f27b1176f0dabbbc51622274cb.patch";
+      hash = "sha256-Gk+RHWtCKN7McfFB3siIOOhwi3+k17MCQr4Ya4RCKjc=";
+    })
  ];

  postConfigure = ''
--- a/pkgs/applications/audio/furnace/default.nix
+++ b/pkgs/applications/audio/furnace/default.nix
@ -8,6 +8,7 @@
 , makeWrapper
 , fftw
 , fmt_8
+, freetype
 , libsndfile
 , libX11
 , rtmidi
@ -16,7 +17,7 @@
 , withJACK ? stdenv.hostPlatform.isUnix
 , libjack2
 , withGUI ? true
-, Cocoa
+, darwin
 , portaudio
 , alsa-lib
 # Enable GL/GLES rendering
@ -25,23 +26,23 @@
 , preferGLES ? stdenv.hostPlatform.isAarch
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "furnace";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitHub {
    owner = "tildearrow";
    repo = "furnace";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-Pv9Sx+bdoy8uV5o9i1rUSuokwQVA8EPYFkZXM8Fynmk=";
+    hash = "sha256-z0WvJvkry/9T4Fgp2fX83CxPpDBoOPNVtyX2OUk26FI=";
  };

  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
    # To offer scaling detection on X11, furnace checks if libX11.so is available via dlopen and uses some of its functions
    # But it's being linked against a versioned libX11.so.VERSION via SDL, so the unversioned one is not on the rpath
    substituteInPlace src/gui/scaling.cpp \
-      --replace 'libX11.so' '${lib.getLib libX11}/lib/libX11.so'
+      --replace-fail 'libX11.so' '${lib.getLib libX11}/lib/libX11.so'
  '';

  nativeBuildInputs = [
@ -54,6 +55,7 @@ stdenv.mkDerivation rec {
  buildInputs = [
    fftw
    fmt_8
+    freetype
    libsndfile
    rtmidi
    SDL2
@ -64,26 +66,30 @@ stdenv.mkDerivation rec {
  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
    # portaudio pkg-config is pulling this in as a link dependency, not set in propagatedBuildInputs
    alsa-lib
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [
    Cocoa
-  ];
+  ]);

  cmakeFlags = [
-    "-DBUILD_GUI=${if withGUI then "ON" else "OFF"}"
-    "-DSYSTEM_FFTW=ON"
-    "-DSYSTEM_FMT=ON"
-    "-DSYSTEM_LIBSNDFILE=ON"
-    "-DSYSTEM_RTMIDI=ON"
-    "-DSYSTEM_SDL2=ON"
-    "-DSYSTEM_ZLIB=ON"
-    "-DSYSTEM_PORTAUDIO=ON"
-    "-DWITH_JACK=${if withJACK then "ON" else "OFF"}"
-    "-DWITH_PORTAUDIO=ON"
-    "-DWITH_RENDER_SDL=ON"
-    "-DWITH_RENDER_OPENGL=${lib.boolToString withGL}"
-    "-DWARNINGS_ARE_ERRORS=ON"
-  ] ++ lib.optionals withGL [
-    "-DUSE_GLES=${lib.boolToString preferGLES}"
+    (lib.cmakeBool "BUILD_GUI" withGUI)
+    (lib.cmakeBool "SYSTEM_FFTW" true)
+    (lib.cmakeBool "SYSTEM_FMT" true)
+    (lib.cmakeBool "SYSTEM_LIBSNDFILE" true)
+    (lib.cmakeBool "SYSTEM_RTMIDI" true)
+    (lib.cmakeBool "SYSTEM_SDL2" true)
+    (lib.cmakeBool "SYSTEM_ZLIB" true)
+    (lib.cmakeBool "USE_FREETYPE" true)
+    (lib.cmakeBool "SYSTEM_FREETYPE" true)
+    (lib.cmakeBool "WITH_JACK" withJACK)
+    (lib.cmakeBool "WITH_PORTAUDIO" true)
+    (lib.cmakeBool "SYSTEM_PORTAUDIO" true)
+    (lib.cmakeBool "WITH_RENDER_SDL" true)
+    (lib.cmakeBool "WITH_RENDER_OPENGL" withGL)
+    (lib.cmakeBool "USE_GLES" (withGL && preferGLES))
+    (lib.cmakeBool "WITH_RENDER_METAL" false) # fails to build
+    (lib.cmakeBool "WITH_RENDER_OPENGL1" (withGL && !preferGLES))
+    (lib.cmakeBool "WARNINGS_ARE_ERRORS" true)
+    (lib.cmakeBool "FORCE_APPLE_BIN" true)
  ];

  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
@ -109,13 +115,13 @@ stdenv.mkDerivation rec {
    };
  };

-  meta = with lib; {
+  meta = {
    description = "Multi-system chiptune tracker compatible with DefleMask modules";
    homepage = "https://github.com/tildearrow/furnace";
-    changelog = "https://github.com/tildearrow/furnace/releases/tag/v${version}";
-    license = with licenses; [ gpl2Plus ];
-    maintainers = with maintainers; [ OPNA2608 ];
-    platforms = platforms.all;
+    changelog = "https://github.com/tildearrow/furnace/releases/tag/v${finalAttrs.version}";
+    license = with lib.licenses; [ gpl2Plus ];
+    maintainers = with lib.maintainers; [ OPNA2608 ];
+    platforms = lib.platforms.all;
    mainProgram = "furnace";
  };
-}
+})
--- a/pkgs/applications/audio/furnace/update.sh
+++ b/pkgs/applications/audio/furnace/update.sh
--- a/pkgs/by-name/ga/gamescope/package.nix
+++ b/pkgs/by-name/ga/gamescope/package.nix
@ -44,14 +44,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gamescope";
-  version = "3.14.11";
+  version = "3.14.13";

  src = fetchFromGitHub {
    owner = "ValveSoftware";
    repo = "gamescope";
    rev = "refs/tags/${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-Ex4uJ50EiX9ZVzmndygxET0wZmPtPB4Ditjq5bdhKTQ=";
+    hash = "sha256-oBOD4kGrZaiAoK1vmr9FB9igMnraNpm0+mHqezHwC78=";
  };

  patches = [
--- a/pkgs/by-name/gi/githooks/package.nix
+++ b/pkgs/by-name/gi/githooks/package.nix
@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
  pname = "githooks";
-  version = "3.0.1";
+  version = "3.0.2";

  src = fetchFromGitHub {
    owner = "gabyx";
    repo = "githooks";
    rev = "v${version}";
-    hash = "sha256-qv0nl3EEYVo/s79r+yK3ZQCGPXM2bzGdWatPY24aOZg=";
+    hash = "sha256-gTvbvW+AFyZUBt7gSKJGc9lrl7CAy+cOElcADlIvuRk=";
  };

  modRoot = "./githooks";
--- a/pkgs/by-name/hi/hieroglyphic/package.nix
+++ b/pkgs/by-name/hi/hieroglyphic/package.nix
@ -13,8 +13,13 @@
  glib,
  gtk4,
  libadwaita,
+  darwin,
+  gettext,
 }:

+let
+  inherit (darwin.apple_sdk.frameworks) CoreFoundation Foundation;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "hieroglyphic";
  version = "1.0.1";
@ -44,11 +49,19 @@ stdenv.mkDerivation (finalAttrs: {
    desktop-file-utils
  ];

-  buildInputs = [
-    glib
-    gtk4
-    libadwaita
-  ];
+  buildInputs =
+    [
+      glib
+      gtk4
+      libadwaita
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      CoreFoundation
+      Foundation
+    ];
+
+  # needed for darwin
+  env.GETTEXT_DIR = "${gettext}";

  meta = {
    changelog = "https://github.com/FineFindus/Hieroglyphic/releases/tag/v${finalAttrs.version}";
--- a/pkgs/by-name/ki/kittysay/package.nix
+++ b/pkgs/by-name/ki/kittysay/package.nix
@ -3,7 +3,7 @@
  rustPlatform,
  fetchFromGitHub,
 }: let
-  version = "0.5.0";
+  version = "0.6.0";
 in
  rustPlatform.buildRustPackage {
    pname = "kittysay";
@ -13,10 +13,10 @@ in
      owner = "uncenter";
      repo = "kittysay";
      rev = "v${version}";
-      sha256 = "sha256-eOcHrEvU3nBKFokwE8CyDOUYoBA1+gBlnl7VRUuoFfE=";
+      sha256 = "sha256-dJpbRPrpilaOFVPjAESk4DyZtH/hJm16p6pMRqrzOk4=";
    };

-    cargoHash = "sha256-dVgPp5jY3ii8mO/HLTDESQzQyZXzqut8Bjm2KfWD0+U=";
+    cargoHash = "sha256-r1xdMczqVyX7ZPjkyDdgVW3BFOeKOw1Dp6mGHb2XzrM=";

    meta = {
      description = "Cowsay, but with a cute kitty :3";
--- a/pkgs/by-name/ma/makima/package.nix
+++ b/pkgs/by-name/ma/makima/package.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec{
  pname = "makima";
-  version = "0.6.5";
+  version = "0.6.6";

  src = fetchFromGitHub {
    owner = "cyber-sushi";
    repo = "makima";
    rev = "v${version}";
-    hash = "sha256-Zhr8j1JWxjwUZ3fjXKUEaKp3T6/dekeAxUDys6eniMQ=";
+    hash = "sha256-Orl79ETROaQzAraGGgYQSSreASanYQHkpEetIR8kJmo=";
  };

-  cargoHash = "sha256-LdgS833MKJOEnUmfvnH/sWG9RrRMNwbe5gAgXTUYzh8=";
+  cargoHash = "sha256-npnAbzy2EN3tK1/pSJnnucMj5lLn30lrgKtcPDl0HQQ=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ udev ];
--- a/pkgs/by-name/me/mealie/package.nix
+++ b/pkgs/by-name/me/mealie/package.nix
@ -112,7 +112,7 @@ in pythonpkgs.buildPythonPackage rec {

  postPatch = ''
    substituteInPlace mealie/__init__.py \
-      --replace-fail '__version__ = ' '__version__ = "${version}" #'
+      --replace-fail '__version__ = ' '__version__ = "v${version}" #'
  '';

  postInstall = let
--- a/pkgs/by-name/op/openrocket/package.nix
+++ b/pkgs/by-name/op/openrocket/package.nix
@ -60,7 +60,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  meta = {
    changelog = "https://github.com/openrocket/openrocket/releases/tag/${finalAttrs.src.rev}";
    description = "Model-rocketry aerodynamics and trajectory simulation software";
-    homepage = "openrocket.info";
+    homepage = "https://openrocket.info";
    license = lib.licenses.gpl3Plus;
    mainProgram = "openrocket";
    maintainers = with lib.maintainers; [ tomasajt ];
--- a/pkgs/by-name/pa/paperless-asn-qr-codes/package.nix
+++ b/pkgs/by-name/pa/paperless-asn-qr-codes/package.nix
@ -0,0 +1,42 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "paperless-asn-qr-codes";
+  version = "0.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "entropia";
+    repo = "paperless-asn-qr-codes";
+    rev = "v${version}";
+    hash = "sha256-/xCU6xDrmhkua4Iw/BCzhOuqO5GT/0rTJ+Y59wuMz6E=";
+  };
+
+  prePatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "\"argparse\"," ""
+  '';
+
+  nativeBuildInputs = [
+    python3.pkgs.hatch-vcs
+    python3.pkgs.hatchling
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    reportlab
+    reportlab-qrcode
+  ];
+
+  pythonImportsCheck = [ "paperless_asn_qr_codes" ];
+
+  meta = with lib; {
+    description = "Command line utility for generating ASN labels for paperless with both a human-readable representation, as well as a QR code for machine consumption";
+    homepage = "https://github.com/entropia/paperless-asn-qr-codes";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ xanderio ];
+    mainProgram = "paperless-asn-qr-codes";
+  };
+}
--- a/pkgs/by-name/ra/ratslap/package.nix
+++ b/pkgs/by-name/ra/ratslap/package.nix
@ -7,15 +7,15 @@
 , git
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "ratslap";
  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "krayon";
    repo = "ratslap";
-    rev = version;
-    sha256 = "sha256-PO/79tTiO4TBtojrEtkSf5W6zuG+Ml2iJGAtYHDwHEY=";
+    rev = finalAttrs.version;
+    hash = "sha256-PO/79tTiO4TBtojrEtkSf5W6zuG+Ml2iJGAtYHDwHEY=";
    leaveDotGit = true;
  };

@ -33,9 +33,9 @@ stdenv.mkDerivation rec {
    makeFlagsArray+=(
      "-W gitup"
      "VDIRTY="
-      "MAJVER=${version}"
+      "MAJVER=${finalAttrs.version}"
      "APPBRANCH=main"
-      "BINNAME=${pname}"
+      "BINNAME=ratslap"
      "MARKDOWN_GEN="
      "BUILD_DATE=$(git show -s --date=format:'%Y-%m-%d %H:%M:%S%z' --format=%cd)"
      "BUILD_MONTH=$(git show -s --date=format:'%B' --format=%cd)"
@ -49,8 +49,8 @@ stdenv.mkDerivation rec {
    mkdir -p $out/bin
    cp ratslap $out/bin

-    mv manpage.1 ${pname}.1
-    installManPage ${pname}.1
+    mv manpage.1 ratslap.1
+    installManPage ratslap.1

    runHook postInstall
  '';
@ -62,9 +62,9 @@ stdenv.mkDerivation rec {
      all buttons and configuring modes, DPI settings and the LED.
    '';
    homepage = "https://github.com/krayon/ratslap";
-    changelog = "https://github.com/krayon/ratslap/releases/tag/${version}";
+    changelog = "https://github.com/krayon/ratslap/releases/tag/${finalAttrs.version}";
    license = licenses.gpl2Only;
    maintainers = with maintainers; [ zebreus ];
-    platforms = platforms.all;
+    platforms = platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/rc/rclip/package.nix
+++ b/pkgs/by-name/rc/rclip/package.nix
@ -4,14 +4,14 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "rclip";
-  version = "1.8.8";
+  version = "1.8.10";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "yurijmikhalevich";
    repo = "rclip";
-    rev = "v${version}";
-    hash = "sha256-XhAeOeMNUE5MMayWlERhTMmkEnA0EpcB6ln1txGTTDE=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-wjwi6GBblv8Z3SA1bMrtPz3KVF8Zw5595Hqyp8FPgcg=";
  };

  nativeBuildInputs = with python3Packages; [
--- a/pkgs/by-name/re/regina/package.nix
+++ b/pkgs/by-name/re/regina/package.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "regina-rexx";
-  version = "3.9.5";
+  version = "3.9.6";

  src = fetchurl {
    url = "mirror://sourceforge/regina-rexx/regina-rexx/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-COmpBhvuADjPtFRG3iB2b/2uUO6jf2ZCRG7E5zoqvFE=";
+    hash = "sha256-7ZjHp/HVpBSLAv7xsWruSmpthljQGoDPXFAwFe8Br6U=";
  };

  buildInputs = [ ncurses ];
--- a/pkgs/by-name/re/retrospy/deps.nix
+++ b/pkgs/by-name/re/retrospy/deps.nix
@ -0,0 +1,154 @@
+# This file was automatically generated by passthru.fetch-deps.
+# Please dont edit it manually, your changes might get overwritten!
+
+{ fetchNuGet }: [
+  (fetchNuGet { pname = "Avalonia"; version = "11.0.0"; sha256 = "0wfbwrr8p5hg9f809d44gh2zfkfwnwayfw84vs33hh7ms0r380gd"; })
+  (fetchNuGet { pname = "Avalonia.Angle.Windows.Natives"; version = "2.1.0.2023020321"; sha256 = "1az4s1g22ipak9a3xfh55z2h3rm6lpqh7svbpw6ag4ysrgsjjsjd"; })
+  (fetchNuGet { pname = "Avalonia.BuildServices"; version = "0.0.28"; sha256 = "0d9hyc1zmyvzlb320arwrv12ncp45llq98hibv711b7ibm11dm7c"; })
+  (fetchNuGet { pname = "Avalonia.Controls.ColorPicker"; version = "11.0.0"; sha256 = "06wgzhxkivlaxkn8p61wainsprml2g1q4jmvy9fpn64qnfywjdn7"; })
+  (fetchNuGet { pname = "Avalonia.Controls.DataGrid"; version = "11.0.0"; sha256 = "0qlcdx4w1pcljgs7sfbn5xmmnqwp2m0fqyswrgz6c8cvjzcfsjsj"; })
+  (fetchNuGet { pname = "Avalonia.Desktop"; version = "11.0.0"; sha256 = "08y31b357fax7c1ggwhjsfwgaj6zkm2abhpc6amlmk6ci4zn12lf"; })
+  (fetchNuGet { pname = "Avalonia.Diagnostics"; version = "11.0.0"; sha256 = "134xl19rfswnz75a1mhil9yqy8haqa788rmd1p1kk6ibjbhb3np9"; })
+  (fetchNuGet { pname = "Avalonia.FreeDesktop"; version = "11.0.0"; sha256 = "042s8lc83lw6ygcsiza14wlsc09rgzw3ch2qaxkhlp73bh736ps3"; })
+  (fetchNuGet { pname = "Avalonia.Native"; version = "11.0.0"; sha256 = "1j7wpv81wqwh6zhfzc1f36vb5dp6s2ig45v8km9sp0q6f66zkrsh"; })
+  (fetchNuGet { pname = "Avalonia.ReactiveUI"; version = "11.0.0"; sha256 = "1fhp6f2aj2bmzlcj0s5r9i9rcxwakdg9gvjqvdqaq8s98d0s06qh"; })
+  (fetchNuGet { pname = "Avalonia.Remote.Protocol"; version = "11.0.0"; sha256 = "1b5031k8slwiz7bncih67fjl6ny234yd4skqxk611l9zp5snjic2"; })
+  (fetchNuGet { pname = "Avalonia.Skia"; version = "11.0.0"; sha256 = "1ra1kd0kkblppr5zy7rzdbwllggrzvp9lkxblf9mg3y8rnp6fk83"; })
+  (fetchNuGet { pname = "Avalonia.Themes.Fluent"; version = "11.0.0"; sha256 = "0v1pnk3hjclr2yqxmff8w6mlgmjch5gfb6yb8h0z1a5m5j6y31qv"; })
+  (fetchNuGet { pname = "Avalonia.Themes.Simple"; version = "11.0.0"; sha256 = "1qw76n78c14xl419yzabahbsrgymm850ql05gd4fh5naq2brksdm"; })
+  (fetchNuGet { pname = "Avalonia.Win32"; version = "11.0.0"; sha256 = "1djp4m5yin4i2f9sjv4v3syv02fllwbfinzm9h0hm2abc2ccvrm3"; })
+  (fetchNuGet { pname = "Avalonia.X11"; version = "11.0.0"; sha256 = "1gd4zrjyw3hg3d48ivhxp0ca7ma13dnpr8y1wc7d51ddlrj3c86g"; })
+  (fetchNuGet { pname = "ColorTextBlock.Avalonia"; version = "11.0.0-d1"; sha256 = "1vf5fp11zx21bsakbpf12j6mchafh749cs03w9cifb6ci98jchgh"; })
+  (fetchNuGet { pname = "Desktop.Robot"; version = "1.5.0"; sha256 = "1y78cpv97cwk4xas0rcpr2wwyags424f3in63kzj8w80d9gradr1"; })
+  (fetchNuGet { pname = "DialogHost.Avalonia"; version = "0.7.5"; sha256 = "1wkvqrzvhjhhg128gfr57fcm2xvs9yvix405nm7v06kn6xr12d73"; })
+  (fetchNuGet { pname = "DynamicData"; version = "7.9.5"; sha256 = "1m9qx8g6na5ka6kd9vhg8gjmxrnkzb6v5cl5yqp1kdjsw4rcwy6x"; })
+  (fetchNuGet { pname = "HarfBuzzSharp"; version = "2.8.2.3"; sha256 = "115aybicqs9ijjlcv6k6r5v0agkjm1bm1nkd0rj3jglv8s0xvmp2"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Linux"; version = "2.8.2.3"; sha256 = "1f18ahwkaginrg0vwsi6s56lvnqvvxv7pzklfs5lnknasxy1a76z"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.macOS"; version = "2.8.2.3"; sha256 = "052d8frpkj4ijs6fm6xp55xbv95b1s9biqwa0w8zp3rgm88m9236"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.WebAssembly"; version = "2.8.2.3"; sha256 = "043hv36bg5240znbm8x5la7py17m4jfzy57q3ka32f6zjld83j36"; })
+  (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Win32"; version = "2.8.2.3"; sha256 = "08khd2jqm8sw58ljz5srangzfm2sz3gd2q1jzc5fr80lj8rv6r74"; })
+  (fetchNuGet { pname = "LibUsbDotNet"; version = "3.0.102-alpha"; sha256 = "05hz68aj5z76lgxz87r26314xw1a37s9wjy6gmvwwa77kg6av4d0"; })
+  (fetchNuGet { pname = "Markdown.Avalonia.Tight"; version = "11.0.0-d1"; sha256 = "0ks9k3wqwvdssiwbcjc4gnrfn1r8x2dbp9amraxkmws5a7vbjdyk"; })
+  (fetchNuGet { pname = "MessageBox.Avalonia"; version = "3.0.0"; sha256 = "1hyfhbayyi8dqsy9fnp09qh92qdil9wsjy97pdfp2mywgr121q50"; })
+  (fetchNuGet { pname = "MicroCom.Runtime"; version = "0.11.0"; sha256 = "0p9c3m0zk59x9dcqw077hzd2yk60myisbacvm36mnwpcjwzjkp2m"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.0.0"; sha256 = "0bbl0jpqywqmzz2gagld1p2gvdfldjfjmm25hil9wj2nq1zc4di8"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "3.8.0"; sha256 = "12n7rvr39bzkf2maw7zplw8rwpxpxss4ich3bb2pw770rx4nyvyw"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "3.8.0"; sha256 = "1kmry65csvfn72zzc16vj1nfbfwam28wcmlrk3m5rzb8ydbzgylb"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp.Scripting"; version = "3.8.0"; sha256 = "0w0yx0lpg54iw5jazqk46h48gx43ij32gwac8iywdj6kxfxm03vw"; })
+  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Scripting.Common"; version = "3.8.0"; sha256 = "0hjgxcsj5zy27lqk0986m59n5dbplx2vjjla2lsvg4bwg8qa7bpk"; })
+  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.3.0"; sha256 = "0gw297dgkh0al1zxvgvncqs0j15lsna9l1wpqas4rflmys440xvb"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.1.2"; sha256 = "1507hnpr9my3z4w1r6xk5n0s1j3y6a2c2cnynj76za7cphxi1141"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
+  (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "6.0.0"; sha256 = "0c6pcj088g1yd1vs529q3ybgsd2vjlk5y1ic6dkmbhvrp5jibl9p"; })
+  (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "7.0.0"; sha256 = "1bh77misznh19m1swqm3dsbji499b8xh9gk6w74sgbkarf6ni8lb"; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.3"; sha256 = "0xrwysmrn4midrjal8g2hr1bbg38iyisl0svamb11arqws4w2bw7"; })
+  (fetchNuGet { pname = "NodaTime"; version = "3.1.9"; sha256 = "10vyhv24awjqxjhyq6sw0gbbim8wddj1hnsv9l7mjv2vmg71qz1w"; })
+  (fetchNuGet { pname = "PolySharp"; version = "1.10.0"; sha256 = "06qici3hhk6a0jmy0nyvspcnmhbapnic6iin3i28pkdvrii02hnz"; })
+  (fetchNuGet { pname = "ReactiveUI"; version = "18.3.1"; sha256 = "1lxkc8yk9glj0w9n5vry2dnwwvh8152ad2c5bivk8aciq64zidyn"; })
+  (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; sha256 = "0bv5qgm6vr47ynxqbnkc7i797fdi8gbjjxii173syrx14nmrkwg0"; })
+  (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.3.0"; sha256 = "1daqf33hssad94lamzg01y49xwndy2q97i2lrb7mgn28656qia1x"; })
+  (fetchNuGet { pname = "runtime.any.System.IO"; version = "4.3.0"; sha256 = "0l8xz8zn46w4d10bcn3l4yyn4vhb3lrj2zw8llvz7jk14k4zps5x"; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection"; version = "4.3.0"; sha256 = "02c9h3y35pylc0zfq3wcsvc5nqci95nrkq0mszifc0sjx7xrzkly"; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection.Extensions"; version = "4.3.0"; sha256 = "0zyri97dfc5vyaz9ba65hjj1zbcrzaffhsdlpxc9bh09wy22fq33"; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection.Primitives"; version = "4.3.0"; sha256 = "0x1mm8c6iy8rlxm8w9vqw7gb7s1ljadrn049fmf70cyh42vdfhrf"; })
+  (fetchNuGet { pname = "runtime.any.System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "03kickal0iiby82wa5flar18kyv82s9s6d4xhk5h4bi5kfcyfjzl"; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime"; version = "4.3.0"; sha256 = "1cqh1sv3h5j7ixyb7axxbdkqx6cxy00p4np4j91kpm492rf4s25b"; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime.Handles"; version = "4.3.0"; sha256 = "0bh5bi25nk9w9xi8z23ws45q5yia6k7dg3i4axhfqlnj145l011x"; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "0c3g3g3jmhlhw4klrc86ka9fjbl7i59ds1fadsb2l8nqf8z3kb19"; })
+  (fetchNuGet { pname = "runtime.any.System.Text.Encoding"; version = "4.3.0"; sha256 = "0aqqi1v4wx51h51mk956y783wzags13wa7mgqyclacmsmpv02ps3"; })
+  (fetchNuGet { pname = "runtime.any.System.Threading.Tasks"; version = "4.3.0"; sha256 = "03mnvkhskbzxddz4hm113zsch1jyzh2cs450dk3rgfjp8crlw1va"; })
+  (fetchNuGet { pname = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "16rnxzpk5dpbbl1x354yrlsbvwylrq456xzpsha1n9y3glnhyx9d"; })
+  (fetchNuGet { pname = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0hkg03sgm2wyq8nqk6dbm9jh5vcq57ry42lkqdmfklrw89lsmr59"; })
+  (fetchNuGet { pname = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0c2p354hjx58xhhz7wv6div8xpi90sc6ibdm40qin21bvi7ymcaa"; })
+  (fetchNuGet { pname = "runtime.linux-arm.runtime.native.System.IO.Ports"; version = "7.0.0"; sha256 = "1q38c2fq6c464h1hs3g6528m0m8c3a5a08vsg59mzmm42r0ayh4k"; })
+  (fetchNuGet { pname = "runtime.linux-arm.runtime.native.System.IO.Ports"; version = "8.0.0-preview.6.23329.7"; sha256 = "0gvrha8fp26hnzxqw99r50ki3mjnpjr6iaa483b4lahpljk06ijb"; })
+  (fetchNuGet { pname = "runtime.linux-arm64.runtime.native.System.IO.Ports"; version = "7.0.0"; sha256 = "1z35v6bwwl8lv7yz37xj99gablhs9sr5y0r3zb57qmjx4psvix3f"; })
+  (fetchNuGet { pname = "runtime.linux-arm64.runtime.native.System.IO.Ports"; version = "8.0.0-preview.6.23329.7"; sha256 = "1flvgvbpk7iqsi3cr23bjm9kdj63rmb97bn1hxzcia8iyybdzcnj"; })
+  (fetchNuGet { pname = "runtime.linux-x64.runtime.native.System.IO.Ports"; version = "7.0.0"; sha256 = "1gfzdz42rsv5gp1p4w5ygkw43gm101q444a3jzgsspp2jk50hdj7"; })
+  (fetchNuGet { pname = "runtime.linux-x64.runtime.native.System.IO.Ports"; version = "8.0.0-preview.6.23329.7"; sha256 = "17fw28ymsdbwpimmvh3nx2shc2khqm8gypg5q1s90kvyzb5ivzpg"; })
+  (fetchNuGet { pname = "runtime.native.System"; version = "4.3.0"; sha256 = "15hgf6zaq9b8br2wi1i3x0zvmk410nlmsmva9p0bbg73v6hml5k4"; })
+  (fetchNuGet { pname = "runtime.native.System.IO.Ports"; version = "7.0.0"; sha256 = "0l52l3kkl4rg9wg25lacb8khywmclcyq230mss0aqsyjqlyxv9l8"; })
+  (fetchNuGet { pname = "runtime.native.System.IO.Ports"; version = "8.0.0-preview.6.23329.7"; sha256 = "0gigh53b9ddkycvhm8vg5gz53wq02qzb7kivwh69vh2454f1qap7"; })
+  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "18pzfdlwsg2nb1jjjjzyb5qlgy6xjxzmhnfaijq5s2jw3cm3ab97"; })
+  (fetchNuGet { pname = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0qyynf9nz5i7pc26cwhgi8j62ps27sqmf78ijcfgzab50z9g8ay3"; })
+  (fetchNuGet { pname = "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1klrs545awhayryma6l7g2pvnp9xy4z0r1i40r80zb45q3i9nbyf"; })
+  (fetchNuGet { pname = "runtime.osx-arm64.runtime.native.System.IO.Ports"; version = "7.0.0"; sha256 = "03fjxh2lcrkgbr63zdk3sal99rrr60z9rgwa58pz4a2y78zy5h53"; })
+  (fetchNuGet { pname = "runtime.osx-arm64.runtime.native.System.IO.Ports"; version = "8.0.0-preview.6.23329.7"; sha256 = "0zphic782inl2mc6ijv7m4003pdlrk3rb7xdkcavxb5gy00lgc7n"; })
+  (fetchNuGet { pname = "runtime.osx-x64.runtime.native.System.IO.Ports"; version = "7.0.0"; sha256 = "0y3rj0dv8l4fsw4w149q94zbqz4wm28ix5cvbhs8da3r92nqy9dj"; })
+  (fetchNuGet { pname = "runtime.osx-x64.runtime.native.System.IO.Ports"; version = "8.0.0-preview.6.23329.7"; sha256 = "0rnx41sgf690wx02z3i6bxgiw43khx5xq7f27arp53v7m0d11xny"; })
+  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0zcxjv5pckplvkg0r6mw3asggm7aqzbdjimhvsasb0cgm59x09l3"; })
+  (fetchNuGet { pname = "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0vhynn79ih7hw7cwjazn87rm9z9fj0rvxgzlab36jybgcpcgphsn"; })
+  (fetchNuGet { pname = "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "160p68l2c7cqmyqjwxydcvgw7lvl1cr0znkw8fp24d1by9mqc8p3"; })
+  (fetchNuGet { pname = "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "15zrc8fgd8zx28hdghcj5f5i34wf3l6bq5177075m2bc2j34jrqy"; })
+  (fetchNuGet { pname = "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1p4dgxax6p7rlgj4q73k73rslcnz4wdcv8q2flg1s8ygwcm58ld5"; })
+  (fetchNuGet { pname = "runtime.unix.System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "1lps7fbnw34bnh3lm31gs5c0g0dh7548wfmb8zz62v0zqz71msj5"; })
+  (fetchNuGet { pname = "runtime.unix.System.Private.Uri"; version = "4.3.0"; sha256 = "1jx02q6kiwlvfksq1q9qr17fj78y5v6mwsszav4qcz9z25d5g6vk"; })
+  (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "0pnxxmm8whx38dp6yvwgmh22smknxmqs5n513fc7m4wxvs1bvi4p"; })
+  (fetchNuGet { pname = "SharpGen.Runtime"; version = "2.0.0-beta.13"; sha256 = "1250z6sa9ghf84czlkzvaysb29c0n229z1f0vh5qls89akrkl7h8"; })
+  (fetchNuGet { pname = "SharpGen.Runtime.COM"; version = "2.0.0-beta.13"; sha256 = "1lmv3jp2g7mgy9j23pd3j0wr3p89qiq8v6c6qxqf688izyni1166"; })
+  (fetchNuGet { pname = "SixLabors.ImageSharp"; version = "3.0.1"; sha256 = "12ypfknphk30szsymmn1378vlp4jmlcvsz88flfxyhwgxrir0453"; })
+  (fetchNuGet { pname = "SkiaSharp"; version = "2.88.3"; sha256 = "1yq694myq2rhfp2hwwpyzcg1pzpxcp7j72wib8p9pw9dfj7008sv"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Linux"; version = "2.88.3"; sha256 = "0dajvr60nwvnv7s6kcqgw1w97zxdpz1c5lb7kcq7r0hi0l05ck3q"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.macOS"; version = "2.88.3"; sha256 = "191ajgi6fnfqcvqvkayjsxasiz6l0bv3pps8vv9abbyc4b12qvph"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.WebAssembly"; version = "2.88.3"; sha256 = "1w5njksq3amrrp7fqxw89nv6ar2kgc5yx092i4rxv7hrjbd1aagx"; })
+  (fetchNuGet { pname = "SkiaSharp.NativeAssets.Win32"; version = "2.88.3"; sha256 = "03wwfbarsxjnk70qhqyd1dw65098dncqk2m0vksx92j70i7lry6q"; })
+  (fetchNuGet { pname = "Splat"; version = "14.4.1"; sha256 = "03ycyjn2ii44npi015p4rk344xnjgdzz02cf63cmhx2ab8hv6p4b"; })
+  (fetchNuGet { pname = "SSH.NET"; version = "2020.0.2"; sha256 = "18mq7jjdbzc7qcsh5wg2j0gd39qbnrxkn811cy8wrdvki0pfi0sm"; })
+  (fetchNuGet { pname = "SshNet.Security.Cryptography"; version = "1.3.0"; sha256 = "1y9r9c2dn81l1l4nn976fwf0by83qbvb0sp1hw7m19pqz7pmaflh"; })
+  (fetchNuGet { pname = "System.CodeDom"; version = "7.0.0"; sha256 = "08a2k2v7kdx8wmzl4xcpfj749yy476ggqsy4cps4iyqqszgyv0zc"; })
+  (fetchNuGet { pname = "System.CodeDom"; version = "8.0.0-preview.6.23329.7"; sha256 = "1wbh229qyhrhcwihpkh99kzcfmn7f13s8l94gbw3hm4d24kqks7b"; })
+  (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
+  (fetchNuGet { pname = "System.Collections.Immutable"; version = "5.0.0"; sha256 = "1kvcllagxz2q92g81zkz81djkn2lid25ayjfgjalncyc68i15p0r"; })
+  (fetchNuGet { pname = "System.ComponentModel.Annotations"; version = "4.5.0"; sha256 = "1jj6f6g87k0iwsgmg3xmnn67a14mq88np0l1ys5zkxhkvbc8976p"; })
+  (fetchNuGet { pname = "System.Configuration.ConfigurationManager"; version = "7.0.0"; sha256 = "149d9kmakzkbw69cip1ny0wjlgcvnhrr7vz5pavpsip36k2mw02a"; })
+  (fetchNuGet { pname = "System.Configuration.ConfigurationManager"; version = "8.0.0-preview.6.23329.7"; sha256 = "1jj4yizbcj54m0qhj18il5b2r2cw4njl5z46v0121qvsxsgllc8k"; })
+  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y"; })
+  (fetchNuGet { pname = "System.Diagnostics.EventLog"; version = "7.0.0"; sha256 = "16p8z975dnzmncfifa9gw9n3k9ycpr2qvz7lglpghsvx0fava8k9"; })
+  (fetchNuGet { pname = "System.Diagnostics.EventLog"; version = "8.0.0-preview.6.23329.7"; sha256 = "0c1m9c6fq4mqxv8mnwzmhpv5321lrgnn3sikis9l2072cm5lzcnm"; })
+  (fetchNuGet { pname = "System.Drawing.Common"; version = "6.0.0"; sha256 = "02n8rzm58dac2np8b3xw8ychbvylja4nh6938l5k2fhyn40imlgz"; })
+  (fetchNuGet { pname = "System.Drawing.Common"; version = "7.0.0"; sha256 = "0jwyv5zjxzr4bm4vhmz394gsxqa02q6pxdqd2hwy1f116f0l30dp"; })
+  (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.3.0"; sha256 = "1d951hrvrpndk7insiag80qxjbf2y0y39y8h5hnq9612ws661glk"; })
+  (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
+  (fetchNuGet { pname = "System.IO"; version = "4.3.0"; sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"; })
+  (fetchNuGet { pname = "System.IO.Pipelines"; version = "6.0.0"; sha256 = "08211lvckdsdbd67xz4f6cyk76cli565j0dby1grlc4k9bhwby65"; })
+  (fetchNuGet { pname = "System.IO.Ports"; version = "7.0.0"; sha256 = "0nk5r3vair9kvbgcrp8zbc60x2yr464cnm6gjsz6wj1pm5b51gvp"; })
+  (fetchNuGet { pname = "System.IO.Ports"; version = "8.0.0-preview.6.23329.7"; sha256 = "0mc02ngqdbgazg7kw82g68kpbm5f7pdyjbfssjj30281116plyqq"; })
+  (fetchNuGet { pname = "System.Linq"; version = "4.3.0"; sha256 = "1w0gmba695rbr80l1k2h4mrwzbzsyfl2z4klmpbsvsg5pm4a56s7"; })
+  (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.3.0"; sha256 = "0ky2nrcvh70rqq88m9a5yqabsl4fyd17bpr63iy2mbivjs2nyypv"; })
+  (fetchNuGet { pname = "System.Management"; version = "7.0.2"; sha256 = "0mjdkzl459hnz0qg4m0xp2kwizsqgdc9vc3xk7y7cv0znhhbb7bc"; })
+  (fetchNuGet { pname = "System.Management"; version = "8.0.0-preview.6.23329.7"; sha256 = "1f7apr1yq5jpr9alq03g90mj8wg9s30vxd8hp6irnf3pk9sgk5ys"; })
+  (fetchNuGet { pname = "System.Memory"; version = "4.5.4"; sha256 = "14gbbs22mcxwggn0fcfs1b062521azb9fbb7c113x0mq6dzq9h6y"; })
+  (fetchNuGet { pname = "System.Numerics.Vectors"; version = "4.5.0"; sha256 = "1kzrj37yzawf1b19jq0253rcs8hsq1l2q8g69d7ipnhzb0h97m59"; })
+  (fetchNuGet { pname = "System.ObjectModel"; version = "4.3.0"; sha256 = "191p63zy5rpqx7dnrb3h7prvgixmk168fhvvkkvhlazncf8r3nc2"; })
+  (fetchNuGet { pname = "System.Private.Uri"; version = "4.3.0"; sha256 = "04r1lkdnsznin0fj4ya1zikxiqr0h6r6a1ww2dsm60gqhdrf0mvx"; })
+  (fetchNuGet { pname = "System.Reactive"; version = "6.0.0"; sha256 = "1mkvx1fwychpczksy6svfmniqhbm3xqblxqik6178l12xgq7aw45"; })
+  (fetchNuGet { pname = "System.Reflection"; version = "4.3.0"; sha256 = "0xl55k0mw8cd8ra6dxzh974nxif58s3k1rjv1vbd7gjbjr39j11m"; })
+  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.3.0"; sha256 = "11f8y3qfysfcrscjpjym9msk7lsfxkk4fmz9qq95kn3jd0769f74"; })
+  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.3.0"; sha256 = "0w1n67glpv8241vnpz1kl14sy7zlnw414aqwj4hcx5nd86f6994q"; })
+  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.3.0"; sha256 = "0ql7lcakycrvzgi9kxz1b3lljd990az1x6c4jsiwcacrvimpib5c"; })
+  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.3.0"; sha256 = "02bly8bdc98gs22lqsfx9xicblszr2yan7v2mmw3g7hy6miq5hwq"; })
+  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "5.0.0"; sha256 = "17qsl5nanlqk9iz0l5wijdn6ka632fs1m1fvx18dfgswm258r3ss"; })
+  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.3.0"; sha256 = "04xqa33bld78yv5r93a8n76shvc8wwcdgr1qvvjh959g3rc31276"; })
+  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.3.0"; sha256 = "0y2ssg08d817p0vdag98vn238gyrrynjdj4181hdg780sif3ykp1"; })
+  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "0sjqlzsryb0mg4y4xzf35xi523s4is4hz9q4qgdvlvgivl7qxn49"; })
+  (fetchNuGet { pname = "System.Runtime"; version = "4.3.0"; sha256 = "066ixvgbf2c929kgknshcxqj6539ax7b9m570cp8n179cpfkapz7"; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.7.1"; sha256 = "119br3pd85lq8zcgh4f60jzmv1g976q1kdgi3hvqdlhfbw6siz2j"; })
+  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.3.0"; sha256 = "1ykp3dnhwvm48nap8q23893hagf665k0kn3cbgsqpwzbijdcgc60"; })
+  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; sha256 = "0sw2gfj2xr7sw9qjn0j3l9yw07x73lcs97p8xfc9w1x9h5g5m7i8"; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "00hywrn4g7hva1b2qri2s6rabzwgxnbpw9zfxmz28z09cpwwgh7j"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.ProtectedData"; version = "7.0.0"; sha256 = "15s9s6hsj9bz0nzw41mxbqdjgjd71w2djqbv0aj413gfi9amybk9"; })
+  (fetchNuGet { pname = "System.Security.Cryptography.ProtectedData"; version = "8.0.0-preview.6.23329.7"; sha256 = "1xs1fmz30gr0g5c2m0xy1dx5rlfsfapyj8l6v7a9c312bd02m4id"; })
+  (fetchNuGet { pname = "System.Security.Permissions"; version = "7.0.0"; sha256 = "0wkm6bj4abknzj41ygkziifx8mzhj4bix92wjvj6lihaw1gniq8c"; })
+  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
+  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "4.5.1"; sha256 = "1z21qyfs6sg76rp68qdx0c9iy57naan89pg7p6i3qpj8kyzn921w"; })
+  (fetchNuGet { pname = "System.Threading"; version = "4.3.0"; sha256 = "0rw9wfamvhayp5zh3j7p1yfmx9b5khbf4q50d8k5rk993rskfd34"; })
+  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.3.0"; sha256 = "134z3v9abw3a6jsw17xl3f6hqjpak5l682k2vz39spj4kmydg6k7"; })
+  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.4"; sha256 = "0y6ncasgfcgnjrhynaf0lwpkpkmv4a07sswwkwbwb5h7riisj153"; })
+  (fetchNuGet { pname = "System.Windows.Extensions"; version = "7.0.0"; sha256 = "11r9f0v7qp365bdpq5ax023yra4qvygljz18dlqs650d44iay669"; })
+  (fetchNuGet { pname = "Tmds.DBus.Protocol"; version = "0.15.0"; sha256 = "0d99kcs7r9cp6gpyc7z230czkkyx4164x86dhy0mca73f2ykc2g2"; })
+  (fetchNuGet { pname = "Vortice.DirectInput"; version = "3.2.0"; sha256 = "0ig60651kvynw6x3f70y3c95n581shr1k75b407p1n9mr8qnzfsy"; })
+  (fetchNuGet { pname = "Vortice.DirectX"; version = "3.2.0"; sha256 = "15wlzag7p8kvrjzjpndaa1pb9acpvylnxz8vb3rx2d3q62k9k2hw"; })
+  (fetchNuGet { pname = "Vortice.Mathematics"; version = "1.5.2"; sha256 = "04s282b07fz1h1d6rw1iiqcsfpj415fin5q5cxmq2bg7a930rfjz"; })
+  (fetchNuGet { pname = "Vortice.XInput"; version = "3.2.0"; sha256 = "00bkrsml45rzy1yvxfrykdgmg9g74ac3a2xb0251205mziwa0m3x"; })
+]
--- a/pkgs/by-name/re/retrospy/package.nix
+++ b/pkgs/by-name/re/retrospy/package.nix
@ -0,0 +1,86 @@
+{ buildDotnetModule
+, fetchFromGitHub
+, dotnetCorePackages
+, copyDesktopItems
+, makeDesktopItem
+, lib
+, fontconfig
+, libX11
+, libXcursor
+, libICE
+, libSM
+}:
+let
+  version = "6.4.8";
+
+  executables = [
+    "RetroSpy"
+    "GBPemu"
+    "GBPUpdater"
+    "UsbUpdater"
+  ];
+in
+buildDotnetModule {
+  pname = "retrospy";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "retrospy";
+    repo = "RetroSpy";
+    rev = "v${version}";
+    hash = "sha256-0rdLdud78gnBX8CIdG81caJ1IRoIjGzb7coP4huEPDA=";
+  };
+
+  nativeBuildInputs = [
+    copyDesktopItems
+  ];
+
+  runtimeDeps = [
+    fontconfig
+    libX11
+    libICE
+    libXcursor
+    libSM
+  ];
+
+  projectFile = [
+    "RetroSpyX/RetroSpyX.csproj"
+    "GBPemuX/GBPemuX.csproj"
+    "GBPUpdaterX2/GBPUpdaterX2.csproj"
+    "UsbUpdaterX2/UsbUpdaterX2.csproj"
+  ];
+
+  dotnet-sdk = dotnetCorePackages.sdk_7_0;
+  dotnet-runtime = dotnetCorePackages.aspnetcore_7_0;
+
+  nugetDeps = ./deps.nix;
+
+  inherit executables;
+
+  postInstall = ''
+    mkdir -p $out/share/retrospy
+    ${builtins.concatStringsSep "\n" (map (e: "cp ./${e}.ico $out/share/retrospy/${e}.ico") executables)}
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  desktopItems = map
+    (e: (makeDesktopItem {
+      name = e;
+      exec = e;
+      icon = "${placeholder "out"}/share/retrospy/${e}.ico";
+      desktopName = "${e}";
+      categories = [ "Utility" ];
+      startupWMClass = e;
+    }))
+    executables;
+
+  meta = {
+    description = "Live controller viewer for Nintendo consoles as well as many other retro consoles and computers";
+    homepage = "https://retro-spy.com/";
+    license = lib.licenses.gpl3;
+    maintainers = [ lib.maintainers.naxdy ];
+    platforms = lib.platforms.linux;
+  };
+}
+
--- a/pkgs/by-name/re/retrospy/update.sh
+++ b/pkgs/by-name/re/retrospy/update.sh
@ -0,0 +1,17 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts
+# shellcheck shell=bash
+set -euo pipefail
+
+new_version="$(curl -s "https://api.github.com/repos/retrospy/RetroSpy/releases?per_page=1" | jq -r '.[0].tag_name')"
+new_version=${new_version#v}
+old_version=$(nix-instantiate --eval -A retrospy.version | jq -e -r)
+
+if [[ "$new_version" == "$old_version" ]]; then
+    echo "Up to date"
+    exit 0
+fi
+
+update-source-version retrospy "$new_version"
+
+eval "$(nix-build . -A retrospy.fetch-deps --no-out-link)"
--- a/pkgs/tools/system/s0ix-selftest-tool/default.nix
+++ b/pkgs/tools/system/s0ix-selftest-tool/default.nix
@ -1,6 +1,5 @@
 {
  acpica-tools,
-  bash,
  bc,
  coreutils,
  fetchFromGitHub,
@ -11,71 +10,65 @@
  lib,
  pciutils,
  powertop,
-  resholve,
+  makeWrapper,
+  stdenv,
+  unstableGitUpdater,
  util-linux,
  xorg,
  xxd,
 }:
-resholve.mkDerivation {
+
+let
+  deps = [
+    acpica-tools
+    bc
+    coreutils
+    gawk
+    gnugrep
+    gnused
+    linuxPackages.turbostat
+    pciutils
+    powertop
+    util-linux
+    xorg.xset
+    xxd
+  ];
+in
+stdenv.mkDerivation {
  pname = "s0ix-selftest-tool";
-  version = "unstable-2022-11-04";
+  version = "0-unstable-2024-02-07";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "S0ixSelftestTool";
-    rev = "1b6db3c3470a3a74b052cb728a544199661d18ec";
-    hash = "sha256-w97jfdppW8kC8K8XvBntmkfntIctXDQCWmvug+H1hKA=";
+    rev = "c12ae3ea611812547e09bb755dd015dd969b664c";
+    hash = "sha256-9O72TxlLrkQbt80izWdbLQt9OW/4Aq1p4RuQoD2yQ5E=";
  };

  # don't use the bundled turbostat binary
  postPatch = ''
    substituteInPlace s0ix-selftest-tool.sh --replace '"$DIR"/turbostat' 'turbostat'
-    substituteInPlace s0ix-selftest-tool.sh --replace 'sudo ' ""
-
  '';

+  nativeBuildInputs = [ makeWrapper ];
  dontConfigure = true;
  dontBuild = true;

  installPhase = ''
    runHook preInstall
    install -Dm555 s0ix-selftest-tool.sh "$out/bin/s0ix-selftest-tool"
+    wrapProgram "$out/bin/s0ix-selftest-tool" --prefix PATH : ${lib.escapeShellArg deps}
    runHook postInstall
  '';

-  solutions = {
-    default = {
-      scripts = ["bin/s0ix-selftest-tool"];
-      interpreter = lib.getExe bash;
-      inputs = [
-        acpica-tools
-        bc
-        coreutils
-        gawk
-        gnugrep
-        gnused
-        linuxPackages.turbostat
-        pciutils
-        powertop
-        util-linux
-        xorg.xset
-        xxd
-      ];
-      execer = [
-        "cannot:${util-linux}/bin/dmesg"
-        "cannot:${powertop}/bin/powertop"
-        "cannot:${util-linux}/bin/rtcwake"
-        "cannot:${linuxPackages.turbostat}/bin/turbostat"
-      ];
-    };
-  };
+  passthru.updateScript = unstableGitUpdater { };

  meta = with lib; {
    homepage = "https://github.com/intel/S0ixSelftestTool";
    description = "A tool for testing the S2idle path CPU Package C-state and S0ix failures";
    license = licenses.gpl2Only;
    platforms = platforms.linux;
-    maintainers = with maintainers; [adamcstephens];
+    maintainers = with maintainers; [ adamcstephens ];
    mainProgram = "s0ix-selftest-tool";
  };
 }
--- a/pkgs/by-name/si/simdutf/package.nix
+++ b/pkgs/by-name/si/simdutf/package.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "simdutf";
-  version = "5.2.6";
+  version = "5.2.8";

  src = fetchFromGitHub {
    owner = "simdutf";
    repo = "simdutf";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-fbDQPHoGqbojvhsMOrg/gMMQJ8bODV/P53F05yIHcTQ=";
+    hash = "sha256-EFyKefq03fpkrKQoSgfvWAjMwwB5UubQouZZU9Obn3k=";
  };

  # Fix build on darwin
--- a/pkgs/by-name/sk/sketchybar-app-font/package.nix
+++ b/pkgs/by-name/sk/sketchybar-app-font/package.nix
@ -18,7 +18,7 @@ lib.checkListOfEnum "sketchybar-app-font: artifacts" artifacts artifactList
  in
  {
    pname = "sketchybar-app-font";
-    version = "2.0.17";
+    version = "2.0.18";

    srcs = selectedSources;

@ -52,15 +52,15 @@ lib.checkListOfEnum "sketchybar-app-font: artifacts" artifacts artifactList
      sources = {
        font = fetchurl {
          url = "https://github.com/kvndrsslr/sketchybar-app-font/releases/download/v${finalAttrs.version}/sketchybar-app-font.ttf";
-          hash = "sha256-iVSWFqhzf0ZxfQODAf+uvGIiWMjWbir6ZWurlx3n6/w=";
+          hash = "sha256-ajwyBUfgvIUcac8gdFUnzGJCXsUcOJnscIdtrxo7ZqY=";
        };
        lua = fetchurl {
          url = "https://github.com/kvndrsslr/sketchybar-app-font/releases/download/v${finalAttrs.version}/icon_map.lua";
-          hash = "sha256-/N16zLflQ2sONBFOZiIdC8KR1rd5pZvXftiXjXJvTVA=";
+          hash = "sha256-jxIBLE1UDD1S8nu4b9y7AUYb0XHH/3iknhmBloi1Qrs=";
        };
        shell = fetchurl {
          url = "https://github.com/kvndrsslr/sketchybar-app-font/releases/download/v${finalAttrs.version}/icon_map.sh";
-          hash = "sha256-nPBiNz+3oHwiertjMJ6YW6g6WZglGjassUGrsQVvnRM=";
+          hash = "sha256-I0t9KbC3Cs73021z9lm7TZUhmwdIaIgPVuLe8IjwkCU=";
        };
      };

--- a/pkgs/by-name/sp/spectral-language-server/package.json
+++ b/pkgs/by-name/sp/spectral-language-server/package.json
@ -0,0 +1,159 @@
+{
+  "activationEvents": [
+    "onStartupFinished"
+  ],
+  "author": "Stoplight <support@stoplight.io>",
+  "bugs": {
+    "url": "https://github.com/stoplightio/vscode-spectral/issues"
+  },
+  "categories": [
+    "Linters"
+  ],
+  "contributes": {
+    "configuration": {
+      "properties": {
+        "spectral.enable": {
+          "default": true,
+          "description": "Controls whether or not Spectral is enabled.",
+          "scope": "resource",
+          "type": "boolean"
+        },
+        "spectral.rulesetFile": {
+          "description": "Location of the ruleset file to use when validating. If omitted, the default is a .spectral.yml/.spectral.json in the same folder as the document being validated. Paths are relative to the workspace. This can also be a remote HTTP url.",
+          "scope": "resource",
+          "type": "string"
+        },
+        "spectral.run": {
+          "default": "onType",
+          "description": "Run the linter on save (onSave) or as you type (onType).",
+          "enum": [
+            "onSave",
+            "onType"
+          ],
+          "scope": "resource",
+          "type": "string"
+        },
+        "spectral.trace.server": {
+          "default": "off",
+          "description": "Traces the communication between VS Code and the language server.",
+          "enum": [
+            "off",
+            "messages",
+            "verbose"
+          ],
+          "scope": "window",
+          "type": "string"
+        },
+        "spectral.validateFiles": {
+          "description": "An array of file globs (e.g., `**/*.yaml`) in minimatch glob format which should be validated by Spectral. If language identifiers are also specified, the file must match both in order to be validated. You can also use negative file globs (e.g., `!**/package.json`) here to exclude files.",
+          "items": {
+            "type": "string"
+          },
+          "scope": "resource",
+          "type": "array"
+        },
+        "spectral.validateLanguages": {
+          "default": [
+            "json",
+            "yaml"
+          ],
+          "description": "An array of language IDs which should be validated by Spectral. If file globs are also specified, the file must match both in order to be validated.",
+          "items": {
+            "type": "string"
+          },
+          "scope": "resource",
+          "type": "array"
+        }
+      },
+      "title": "Spectral",
+      "type": "object"
+    },
+    "commands": [
+      {
+        "title": "Show Output Channel",
+        "category": "Spectral",
+        "command": "spectral.showOutputChannel"
+      }
+    ]
+  },
+  "description": "JSON/YAML linter with OpenAPI and custom ruleset support.",
+  "devDependencies": {
+    "@types/chai": "^4.3.1",
+    "@types/chai-jest-snapshot": "^1.3.6",
+    "@types/glob": "^7.2.0",
+    "@types/mocha": "^9.1.0",
+    "@types/node": "^18.11.18",
+    "@types/vscode": "^1.48.0",
+    "@typescript-eslint/eslint-plugin": "^4.33.0",
+    "@typescript-eslint/parser": "^4.1.0",
+    "chai": "^4.2.0",
+    "chai-jest-snapshot": "^2.0.0",
+    "copyfiles": "^2.4.1",
+    "cross-env": "^7.0.3",
+    "eslint": "^7.8.1",
+    "eslint-config-google": "^0.14.0",
+    "glob": "^8.0.3",
+    "http-test-servers": "^2.0.0",
+    "merge-options": "^3.0.0",
+    "mocha": "^8.1.3",
+    "rimraf": "^3.0.2",
+    "semver": "^7.3.2",
+    "shelljs": "^0.8.5",
+    "ts-loader": "^9.2.8",
+    "ts-node": "^8.10.2",
+    "typescript": "beta",
+    "vsce": "^1.103.1",
+    "vscode-test": "^1.5.0",
+    "webpack": "^5.72.0",
+    "webpack-cli": "^4.9.2"
+  },
+  "displayName": "Spectral",
+  "engines": {
+    "vscode": "^1.48.0",
+    "node": "^12.20 || >= 14.13"
+  },
+  "homepage": "https://github.com/stoplightio/vscode-spectral",
+  "icon": "icon.png",
+  "keywords": [
+    "linter",
+    "validator",
+    "OpenAPI",
+    "Swagger",
+    "API",
+    "style guide",
+    "API description",
+    "API specification",
+    "OAS",
+    "OAS2",
+    "OAS3",
+    "AsyncAPI",
+    "json",
+    "yaml"
+  ],
+  "license": "Apache-2.0",
+  "main": "./client/index.js",
+  "name": "spectral",
+  "private": true,
+  "publisher": "stoplight",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/stoplightio/vscode-spectral"
+  },
+  "scripts": {
+    "clean": "rimraf dist && rimraf \"{server,client}/dist\"",
+    "lint": "eslint --ext .ts,.js .",
+    "test": "mocha -r ts-node/register \"./+(client|server)/__tests__/unit/**/*.test.ts\"",
+    "test:e2e": "cross-env CI=true CHAI_JEST_SNAPSHOT_UPDATE_ALL=false ts-node ./client/src/__tests__/e2e/index.ts"
+  },
+  "version": "1.1.2",
+  "workspaces": {
+    "packages": [
+      "client",
+      "server"
+    ],
+    "nohoist": [
+      "client/**",
+      "server/**"
+    ]
+  }
+}
--- a/pkgs/by-name/sp/spectral-language-server/package.nix
+++ b/pkgs/by-name/sp/spectral-language-server/package.nix
@ -0,0 +1,109 @@
+{ lib
+, buildNpmPackage
+, mkYarnPackage
+, fetchYarnDeps
+, fetchFromGitHub
+, typescript
+, jq
+, fetchpatch
+}:
+let
+  # Instead of the build script that spectral-language-server provides (ref: https://github.com/luizcorreia/spectral-language-server/blob/master/script/vscode-spectral-build.sh), we build vscode-spectral manually.
+  # This is because the script must go through the network and will not work under the Nix sandbox environment.
+  vscodeSpectral = mkYarnPackage rec {
+    pname = "vscode-spectral";
+    version = "1.1.2";
+
+    src = fetchFromGitHub {
+      owner = "stoplightio";
+      repo = "vscode-spectral";
+      rev = "v${version}";
+      hash = "sha256-TWy+bC6qhTKDY874ORTBbvCIH8ycpmBiU8GLYxBIiAs=";
+    };
+
+    packageJSON = ./package.json;
+
+    offlineCache = fetchYarnDeps {
+      yarnLock = src + "/yarn.lock";
+      hash = "sha256-am27A9VyFoXuOlgG9mnvNqV3Q7Bi7GJzDqqVFGDVWIA=";
+    };
+
+    nativeBuildInputs = [ typescript jq ];
+
+    postPatch = ''
+      cp server/tsconfig.json server/tsconfig.json.bak
+      jq '.compilerOptions += {"module": "NodeNext", "moduleResolution": "NodeNext"}' server/tsconfig.json.bak > server/tsconfig.json
+    '';
+
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+      # FIXME: vscode-spactral depends on @rollup/pluginutils, but it may have a bug that doesn't provide the type definitions for NodeNext module resolution. (ref: https://github.com/rollup/plugins/issues/1192)
+      # tsc detects some type errors in the code. However we ignore this because it's not a problem for the final build if server/dist is generated.
+      tsc -p server || true
+      test -d server/dist
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out
+      cp -R server/dist $out
+      runHook postInstall
+    '';
+
+    doDist = false;
+
+    meta = with lib; {
+      homepage = "https://github.com/stoplightio/vscode-spectral";
+      description = "VS Code extension bringing the awesome Spectral JSON/YAML linter with OpenAPI/AsyncAPI support";
+      license = licenses.asl20;
+    };
+  };
+in
+buildNpmPackage rec {
+  pname = "spectral-language-server";
+  version = "1.0.8-unstable-2023-06-06";
+
+  src = fetchFromGitHub {
+    owner = "luizcorreia";
+    repo = "spectral-language-server";
+    rev = "c9a7752b08e6bba937ef4f5435902afd41b6957f";
+    hash = "sha256-VD2aAzlCnJ6mxPUSbNRfMOlslM8kLPqrAI2ah6sX9cU=";
+  };
+
+  npmDepsHash = "sha256-ixAXy/rRkyWL3jdAkrXJh1qhWcKIkr5nH/Bhu2JV6k8=";
+
+  patches = [
+    # https://github.com/luizcorreia/spectral-language-server/pull/15
+    (fetchpatch {
+      name = "fix-package-lock.patch";
+      url = "https://github.com/luizcorreia/spectral-language-server/commit/909704850dd10e7b328fc7d15f8b07cdef88899d.patch";
+      hash = "sha256-+mN93xP4HCll4dTcnh2W/m9k3XovvgnB6AOmuJpZUZ0=";
+    })
+  ];
+
+  dontNpmBuild = true;
+
+  npmFlags = [ "--ignore-scripts" ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    mkdir -p $out/node_modules
+    mkdir -p $out/dist/spectral-language-server
+    cp -R ${vscodeSpectral}/dist/* $out/dist/spectral-language-server/
+    cp ./bin/* $out/bin
+    cp -R ./node_modules/* $out/node_modules
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/luizcorreia/spectral-language-server";
+    description = "Awesome Spectral JSON/YAML linter with OpenAPI/AsyncAPI support";
+    maintainers = with maintainers; [ momeemt ];
+    license = licenses.mit;
+    mainProgram = "spectral-language-server";
+  };
+}
--- a/pkgs/by-name/te/tenv/package.nix
+++ b/pkgs/by-name/te/tenv/package.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "tenv";
-  version = "1.9.4";
+  version = "1.10.1";

  src = fetchFromGitHub {
    owner = "tofuutils";
    repo = "tenv";
    rev = "v${version}";
-    hash = "sha256-lrBoZwdhDPE2cGTxptMV6PChUdHe99n7AqCozMUkXk0=";
+    hash = "sha256-c283egT5KOcR+PjwWnKkCI3RKr+Tqa6a+ORsjq4wuXs=";
  };

-  vendorHash = "sha256-NMkR90+kJ3VsuhF45l5K68uOqenPfINZDEE0GfjULro=";
+  vendorHash = "sha256-GAUpQbZfaF3N2RaQO0ZDe8DywOZwIfXNImsZCk6iB+U=";

  # Tests disabled for requiring network access to release.hashicorp.com
  doCheck = false;
--- a/pkgs/by-name/th/the-powder-toy/package.nix
+++ b/pkgs/by-name/th/the-powder-toy/package.nix
@ -0,0 +1,75 @@
+{
+  bzip2,
+  Cocoa,
+  copyDesktopItems,
+  curl,
+  fetchFromGitHub,
+  fftwFloat,
+  jsoncpp,
+  lib,
+  libpng,
+  lua,
+  luajit,
+  meson,
+  ninja,
+  pkg-config,
+  SDL2,
+  stdenv,
+  zlib,
+}:
+stdenv.mkDerivation rec {
+  pname = "the-powder-toy";
+  version = "98.2.365";
+
+  src = fetchFromGitHub {
+    owner = "The-Powder-Toy";
+    repo = "The-Powder-Toy";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-S2aUa25EnUfX6ShW6D+wHrsTLxTcCFcZ/uLE9EWGu4Q=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ] ++ lib.optional stdenv.isLinux copyDesktopItems;
+
+  buildInputs = [
+    bzip2
+    curl
+    fftwFloat
+    jsoncpp
+    libpng
+    lua
+    luajit
+    SDL2
+    zlib
+  ] ++ lib.optional stdenv.isDarwin Cocoa;
+
+  mesonFlags = [ "-Dworkaround_elusive_bzip2=false" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm 755 powder $out/bin/powder
+
+    mkdir -p $out/share
+    mv ../resources $out/share
+
+    runHook postInstall
+  '';
+
+  desktopItems = [ "resources/powder.desktop" ];
+
+  meta = with lib; {
+    description = "A free 2D physics sandbox game";
+    homepage = "https://powdertoy.co.uk/";
+    platforms = platforms.unix;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [
+      abbradar
+      siraben
+    ];
+    mainProgram = "powder";
+  };
+}
--- a/pkgs/by-name/va/varia/package.nix
+++ b/pkgs/by-name/va/varia/package.nix
@ -13,14 +13,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "varia";
-  version = "2024.3.20";
+  version = "2024.5.7";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "giantpinkrobots";
    repo = "varia";
    rev = "v${version}";
-    hash = "sha256-kvpARXunKaybw9mNCvCTjtHTGbnbVmja5npcjFY5cdM=";
+    hash = "sha256-axBBJYIFCt3J0aCY8tMYehho0QN1eIcUMPhWb5g5uDc=";
  };

  postPatch = ''
--- a/pkgs/by-name/wl/wlr-layout-ui/package.nix
+++ b/pkgs/by-name/wl/wlr-layout-ui/package.nix
@ -5,14 +5,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "wlr-layout-ui";
-  version = "1.4.7";
+  version = "1.6.10";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "fdev31";
    repo = "wlr-layout-ui";
-    rev = "${version}";
-    hash = "sha256-3NV02/Lk43h3r17jwmSAqx7wofaHFJKDh+vaWwU17Gw=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-UM1p5b5+xJY6BgPUMXjluIC9zQxe388+gBWTbNQPWYQ=";
  };

  postPatch = ''
--- a/pkgs/by-name/xe/xemu/package.nix
+++ b/pkgs/by-name/xe/xemu/package.nix
@ -28,14 +28,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xemu";
-  version = "0.7.120";
+  version = "0.7.121";

  src = fetchFromGitHub {
    owner = "xemu-project";
    repo = "xemu";
    rev = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-FFxYp53LLDOPZ1Inr70oyQXhNjJO23G+gNmXd/lvrYs=";
+    hash = "sha256-VcztVzG/IN9N0SVKj6BipyqnhxXC2nTTuMjKMtFKzGw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/yt/ytermusic/Cargo.lock
+++ b/pkgs/by-name/yt/ytermusic/Cargo.lock
--- a/pkgs/by-name/yt/ytermusic/package.nix
+++ b/pkgs/by-name/yt/ytermusic/package.nix
@ -0,0 +1,54 @@
+{ alsa-lib
+, dbus
+, fetchFromGitHub
+, lib
+, openssl
+, pkg-config
+, rustPlatform
+, stdenv
+,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ytermusic";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "ccgauche";
+    repo = "ytermusic";
+    rev = "beta-${version}";
+    hash = "sha256-nu/vedQNs5TgCG1v5qwwDTnFTyXCS2KnLVrnEhCtzCs=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "rusty_ytdl-0.6.6" = "sha256-htXD8v9Yd7S0iLjP6iZu94tP5KO5vbmkdUybqA7OtlU=";
+      "symphonia-0.5.1" = "sha256-rGvde5w7czMLcOPARK1gFfDLn70VeIrn4nKOL6FPc2U=";
+    };
+  };
+  postPatch = "cp ${./Cargo.lock} Cargo.lock";
+
+  doCheck = true;
+
+  cargoBuildType = "release";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    alsa-lib
+    dbus
+  ];
+
+  meta = {
+    description = "TUI based Youtube Music Player that aims to be as fast and simple as possible";
+    homepage = "https://github.com/ccgauche/ytermusic";
+    changelog = "https://github.com/ccgauche/ytermusic/releases/tag/${src.rev}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ codebam ];
+    mainProgram = "ytermusic";
+  };
+}
--- a/pkgs/data/themes/flat-remix-gnome/default.nix
+++ b/pkgs/data/themes/flat-remix-gnome/default.nix
@ -7,25 +7,25 @@
 let
  # make install will use dconf to find desktop background file uri.
  # consider adding an args to allow specify pictures manually.
-  # https://github.com/daniruiz/flat-remix-gnome/blob/20240418/Makefile#L38
+  # https://github.com/daniruiz/flat-remix-gnome/blob/20240503/Makefile#L38
  fake-dconf = writeScriptBin "dconf" "echo -n";
 in
 stdenv.mkDerivation rec {
  pname = "flat-remix-gnome";
-  version = "20240418";
+  version = "20240503";

  src = fetchFromGitHub {
    owner = "daniruiz";
    repo = pname;
    rev = version;
-    hash = "sha256-o6WjXPE4uuCDYNqzj0rkOC/RLmZVenEuaSiu8PS4kx4=";
+    hash = "sha256-02hYxgq8Go++oYT8r86wA7HVXQJeUZ0JpwIu3VWfjQE=";
  };

  nativeBuildInputs = [ glib fake-dconf ];
  makeFlags = [ "PREFIX=$(out)" ];

  # make install will back up this file, it will fail if the file doesn't exist.
-  # https://github.com/daniruiz/flat-remix-gnome/blob/20240418/Makefile#L56
+  # https://github.com/daniruiz/flat-remix-gnome/blob/20240503/Makefile#L56
  preInstall = ''
    mkdir -p $out/share/gnome-shell/
    touch $out/share/gnome-shell/gnome-shell-theme.gresource
--- a/pkgs/desktops/lxqt/libfm-qt/default.nix
+++ b/pkgs/desktops/lxqt/libfm-qt/default.nix
@ -15,7 +15,7 @@
 , qttools
 , wrapQtAppsHook
 , gitUpdater
-, version ? "2.0.0"
+, version ? "2.0.2"
 , qtx11extras ? null
 }:

@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
    rev = version;
    hash = {
      "1.4.0" = "sha256-QxPYSA7537K+/dRTxIYyg+Q/kj75rZOdzlUsmSdQcn4=";
-      "2.0.0" = "sha256-vWkuPdG5KaT6KMr1NJGt7JBUd1z3wROKY79otsrRsuI=";
+      "2.0.2" = "sha256-Ntj+yixGGGgL8ylRv2IJsWtapxE71JNl9cC9K0JToNU=";
    }."${version}";
  };

--- a/pkgs/desktops/lxqt/lximage-qt/default.nix
+++ b/pkgs/desktops/lxqt/lximage-qt/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "lximage-qt";
-  version = "2.0.0";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = pname;
    rev = version;
-    hash = "sha256-yjsdXVV/EOgpNI5kY12lNH9Wpru8A6eWxayslFdioiQ=";
+    hash = "sha256-I0DyC8i+OnHxHcpp/xPsKjr3UgvUHlVO8h9Tjhg7Pg8=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/lxqt/lxqt-notificationd/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-notificationd/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "lxqt-notificationd";
-  version = "2.0.0";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = pname;
    rev = version;
-    hash = "sha256-zEoTjDD65bBJBbvAZVtov8HyiN1G6CqYkmcPH4T8Jhc=";
+    hash = "sha256-qmBHeXKBJD97Me2zNSn7bNr0UrObGmvj8Pn19GQGktI=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/lxqt/lxqt-panel/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-panel/default.nix
@ -35,13 +35,13 @@

 stdenv.mkDerivation rec {
  pname = "lxqt-panel";
-  version = "2.0.0";
+  version = "2.0.1";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = pname;
    rev = version;
-    hash = "sha256-2I7I3AiLptKbBXiTPbbpcj16zuIx0e9SQnvbalpoFvM=";
+    hash = "sha256-m+LUG7hnkIJj48HJIy6pMyv3YZ/RfuSXbdBKJ9mi764=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/lxqt/pcmanfm-qt/default.nix
+++ b/pkgs/desktops/lxqt/pcmanfm-qt/default.nix
@ -13,6 +13,7 @@
 , qtimageformats
 , qttools
 , qtwayland
+, qtsvg
 , wrapQtAppsHook
 , gitUpdater
 }:
@ -45,6 +46,7 @@ stdenv.mkDerivation rec {
    qtbase
    qtimageformats # add-on module to support more image file formats
    qtwayland
+    qtsvg
  ];

  passthru.updateScript = gitUpdater { };
--- a/pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix
+++ b/pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "xdg-desktop-portal-lxqt";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = pname;
    rev = version;
-    hash = "sha256-JSbFZ7R1Cu5VPPb50fRVSAsaE0LE15BbbHpvJZP6+w0=";
+    hash = "sha256-zXZ0Un56uz1hKoPvZitJgQpJ7ko0LrSSFxl+agiqZ4A=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/pantheon/granite/7/default.nix
+++ b/pkgs/desktops/pantheon/granite/7/default.nix
@ -19,7 +19,7 @@

 stdenv.mkDerivation rec {
  pname = "granite";
-  version = "7.4.0";
+  version = "7.5.0";

  outputs = [ "out" "dev" ];

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "sha256-z/6GxWfbsngySv2ziNwzhcEfTamxP1DnJ2ld9fft/1U=";
+    sha256 = "sha256-mwivme79zsPcS+Ol8iApECjpQz+fYcBLZwkULagXVvI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/gnu-cim/default.nix
+++ b/pkgs/development/compilers/gnu-cim/default.nix
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    done
  '';

-  CFLAGS = lib.optionalString stdenv.cc.isClang "-Wno-return-type";
+  env.CFLAGS = lib.optionalString stdenv.cc.isClang "-Wno-return-type -Wno-error=implicit-function-declaration -Wno-error=implicit-int";

  doCheck = true;

--- a/pkgs/development/compilers/go/1.21.nix
+++ b/pkgs/development/compilers/go/1.21.nix
@ -47,11 +47,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "go";
-  version = "1.21.9";
+  version = "1.21.10";

  src = fetchurl {
    url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-WPDFztRaABK84v96nfA+Eoq8yIGOur5QJ7uSuv4g5CE=";
+    hash = "sha256-kA4K/okAwe5lqKjE8MWjygLc+FwdHLE6ZSviLCE5k5Q=";
  };

  strictDeps = true;
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@ -40,7 +40,7 @@
 , withAss ? withHeadlessDeps && stdenv.hostPlatform == stdenv.buildPlatform # (Advanced) SubStation Alpha subtitle rendering
 , withAudioToolbox ? withHeadlessDeps && stdenv.isDarwin # Apple AudioToolbox
 , withAvFoundation ? withHeadlessDeps && stdenv.isDarwin # Apple AVFoundation framework
-, withAvisynth ? withFullDeps && !stdenv.isDarwin # AviSynth script files reading; Darwin currently broken because libdevil fails to build
+, withAvisynth ? withFullDeps # AviSynth script files reading
 , withBluray ? withFullDeps # BluRay reading
 , withBs2b ? withFullDeps # bs2b DSP library
 , withBzlib ? withHeadlessDeps
--- a/pkgs/development/libraries/libdevil/default.nix
+++ b/pkgs/development/libraries/libdevil/default.nix
@ -35,6 +35,8 @@ stdenv.mkDerivation (finalAttrs: {

  configureFlags = [ "--enable-ILU" "--enable-ILUT" ];

+  CXXFLAGS = lib.optionalString stdenv.cc.isClang "-Wno-register";
+
  preConfigure = ''
    sed -i 's, -std=gnu99,,g' configure
    sed -i 's,malloc.h,stdlib.h,g' src-ILU/ilur/ilur.c
--- a/pkgs/development/libraries/libqalculate/default.nix
+++ b/pkgs/development/libraries/libqalculate/default.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libqalculate";
-  version = "5.1.0";
+  version = "5.1.1";

  src = fetchFromGitHub {
    owner = "qalculate";
    repo = "libqalculate";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-74P8jIeg0Pge+/U0cQsrEfE+P8upBAr8xSyLhB4zOVU=";
+    hash = "sha256-cmH92gdQ+fmtOLgx5ibKqLZaQFzx2z+GuXhR62dtftk=";
  };

  outputs = [ "out" "dev" "doc" ];
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@ -217,7 +217,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = with lib; {
    description = "A small library to render SVG images to Cairo surfaces";
-    homepage = "hhttps://gitlab.gnome.org/GNOME/librsvg";
+    homepage = "https://gitlab.gnome.org/GNOME/librsvg";
    license = licenses.lgpl2Plus;
    maintainers = teams.gnome.members;
    mainProgram = "rsvg-convert";
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@ -11,7 +11,7 @@
 , bind
 , cmake
 , knot-resolver
-, lispPackages
+, sbclPackages
 , luajitPackages
 , mosquitto
 , neovim
@ -105,7 +105,7 @@ stdenv.mkDerivation (finalAttrs: {

  passthru.tests = {
    inherit bind cmake knot-resolver mosquitto neovim nodejs;
-    inherit (lispPackages) cl-libuv;
+    inherit (sbclPackages) cl-libuv;
    luajit-libluv = luajitPackages.libluv;
    luajit-luv = luajitPackages.luv;
    ocaml-luv = ocamlPackages.luv;
--- a/pkgs/development/libraries/opendht/default.nix
+++ b/pkgs/development/libraries/opendht/default.nix
@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "opendht";
-  version = "3.1.4";
+  version = "3.1.11";

  src = fetchFromGitHub {
    owner = "savoirfairelinux";
    repo = "opendht";
    rev = "v${version}";
-    hash = "sha256-KtsQ25uStmlf7RZLAcabhPMyGbxKxvpR6Vm632+EBvw=";
+    hash = "sha256-lJaQGkhpKfSSNVbP+NqommagtoWyi8CdauVxEhiI9Bc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/simdjson/default.nix
+++ b/pkgs/development/libraries/simdjson/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "simdjson";
-  version = "3.9.1";
+  version = "3.9.2";

  src = fetchFromGitHub {
    owner = "simdjson";
    repo = "simdjson";
    rev = "v${version}";
-    sha256 = "sha256-Az5QZNnzLYpEE7O+1/VceIT6vykkg8vMuAuN9u8OseM=";
+    sha256 = "sha256-7YW0ylYQMi6D7YyRQGWRv980skjZ2t//QoZb8rRDHGk=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/xml-security-c/default.nix
+++ b/pkgs/development/libraries/xml-security-c/default.nix
@ -1,12 +1,24 @@
-{ lib, stdenv, fetchurl, xalanc, xercesc, openssl, pkg-config }:
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xalanc,
+  xercesc,
+  openssl,
+  darwin,
+}:

-stdenv.mkDerivation rec {
+let
+  inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices SystemConfiguration;
+in
+stdenv.mkDerivation (finalAttrs: {
  pname = "xml-security-c";
  version = "2.0.4";

  src = fetchurl {
-    url = "mirror://apache/santuario/c-library/${pname}-${version}.tar.gz";
-    sha256 = "sha256-p42mcg9sK6FBANJCYTHg0z6sWi26XMEb3QSXS364kAM=";
+    url = "mirror://apache/santuario/c-library/xml-security-c-${finalAttrs.version}.tar.gz";
+    hash = "sha256-p42mcg9sK6FBANJCYTHg0z6sWi26XMEb3QSXS364kAM=";
  };

  configureFlags = [
@ -16,7 +28,18 @@ stdenv.mkDerivation rec {
  ];

  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ xalanc xercesc openssl ];
+
+  buildInputs =
+    [
+      xalanc
+      xercesc
+      openssl
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      CoreFoundation
+      CoreServices
+      SystemConfiguration
+    ];

  meta = {
    homepage = "https://santuario.apache.org/";
@ -25,4 +48,4 @@ stdenv.mkDerivation rec {
    platforms = lib.platforms.unix;
    maintainers = [ lib.maintainers.jagajaga ];
  };
-}
+})
--- a/pkgs/development/lisp-modules-new-obsolete/.gitattributes
+++ b/pkgs/development/lisp-modules-new-obsolete/.gitattributes
@ -1 +0,0 @@
-imported.nix linguist-vendored
--- a/pkgs/development/lisp-modules-new-obsolete/.gitignore
+++ b/pkgs/development/lisp-modules-new-obsolete/.gitignore
@ -1,3 +0,0 @@
-result
-*.sqlite
-*.fasl
--- a/pkgs/development/lisp-modules-new-obsolete/doc/api.md
+++ b/pkgs/development/lisp-modules-new-obsolete/doc/api.md
@ -1,197 +0,0 @@
-## The API
-
-This page documents the Nix API of nix-cl.
-
-## Overview
-
-The core API functions are `build-asdf-system` and
-`lispWithPackagesInternal`.
-
-They are considered more low-level that the rest of the API, which
-builds on top of them to provide a more convenient interface with sane
-defaults.
-
-The higher-level API provides a lot of pre-configured packages,
-including all of Quicklisp, and consists of the functions:
-
- `lispPackagesFor`
- `lispWithPackages`
-
-Finally, there are functions that provide pre-defined Lisps, for
-people who don't need to customize that:
-
- `abclPackages`, `eclPackages`, `cclPackages`, `claspPackages`, `sbclPackages`
- `abclWithPackages`, `eclWithPackages`, `cclWithPackages`, `claspWithPackages`, `sbclWithPackages`
-
-The following is an attempt to document all of this.
-
-## Packaging systems - `build-asdf-system`
-
-Packages are declared using `build-asdf-system`. This function takes
-the following arguments and returns a `derivation`.
-
-#### Required arguments
-
-##### `pname`
-Name of the package/library
-
-##### `version`
-Version of the package/library
-
-##### `src`
-Source of the package/library (`fetchzip`, `fetchgit`, `fetchhg` etc.)
-
-##### `lisp`
-This command must load the provided file (`$buildScript`) then exit
-immediately. For example, SBCL's --script flag does just that.
-
-#### Optional arguments
-
-##### `patches ? []`
-
-Patches to apply to the source code before compiling it. This is a
-list of files.
-
-##### `nativeLibs ? []`
-
-Native libraries, will be appended to the library
-path. (`pkgs.openssl` etc.)
-
-##### `javaLibs ? []`
-
-Java libraries for ABCL, will be appended to the class path.
-
-##### `lispLibs ? []`
-
-Lisp dependencies These must themselves be packages built with
-`build-asdf-system`
-
-##### `systems ? [ pname ]`
-
-Some libraries have multiple systems under one project, for example,
-[cffi] has `cffi-grovel`, `cffi-toolchain` etc.  By default, only the
-`pname` system is build.
-
-`.asd's` not listed in `systems` are removed before saving the library
-to the Nix store. This prevents ASDF from referring to uncompiled
-systems on run time.
-
-Also useful when the `pname` is different than the system name, such
-as when using [reverse domain naming]. (see `jzon` ->
-`com.inuoe.jzon`)
-
-[cffi]: https://cffi.common-lisp.dev/
-[reverse domain naming]: https://en.wikipedia.org/wiki/Reverse_domain_name_notation
-
-##### `asds ? systems`
-
-The .asd files that this package provides. By default, same as
-`systems`.
-
-#### Return value
-
-A `derivation` that, when built, contains the sources and pre-compiled
-FASL files (Lisp implementation dependent) alongside any other
-artifacts generated during compilation.
-
-#### Example
-
-[bordeaux-threads.nix] contains a simple example of packaging
-`alexandria` and `bordeaux-threads`.
-
-[bordeaux-threads.nix]: /examples/bordeaux-threads.nix
-
-## Building a Lisp with packages: `lispWithPackagesInternal`
-
-Generators of Lisps configured to be able to `asdf:load-system`
-pre-compiled libraries on run-time are built with
-`lispWithPackagesInternal`.
-
-#### Required Arguments
-
-##### `clpkgs`
-
-An attribute set of `derivation`s returned by `build-asdf-system`
-
-#### Return value
-
-`lispWithPackagesInternal` returns a function that takes one argument:
-a function `(lambda (clpkgs) packages)`, that, given a set of
-packages, returns a list of package `derivation`s to be included in
-the closure.
-
-#### Example
-
-The [sbcl-with-bt.nix] example creates a runnable Lisp where the
-`bordeaux-threads` defined in the previous section is precompiled and
-loadable via `asdf:load-system`:
-
-[sbcl-with-bt.nix]: /examples/sbcl-with-bt.nix
-
-## Reusing pre-packaged Lisp libraries: `lispPackagesFor`
-
-`lispPackagesFor` is a higher level version of
-`lispPackagesForInternal`: it only takes one argument - a Lisp command
-to use for compiling packages. It then provides a bunch of ready to
-use packages.
-
-#### Required Arguments
-
-##### `lisp`
-
-The Lisp command to use in calls to `build-asdf-system` while building
-the library-provided Lisp package declarations.
-
-#### Return value
-
-A set of packages built with `build-asdf-system`.
-
-#### Example
-
-The [abcl-package-set.nix] example generates a set of thousands of packages for ABCL.
-
-[abcl-package-set.nix]: /examples/abcl-package-set.nix
-
-## Reusing pre-packaged Lisp libraries, part 2: `lispWithPackages`
-
-This is simply a helper function to avoid having to call
-`lispPackagesFor` if all you want is a Lisp-with-packages wrapper.
-
-#### Required Arguments
-
-##### `lisp`
-
-The Lisp command to pass to `lispPackagesFor` in order for it to
-generate a package set. That set is then passed to
-`lispWithPackagesInternal`.
-
-#### Return value
-
-A Lisp-with-packages function (see sections above).
-
-#### Example
-
-The [abcl-with-packages.nix] example creates an `abclWithPackages` function.
-
-[abcl-with-packages.nix]: /examples/abcl-with-packages.nix
-
-## Using the default Lisp implementations
-
-This is the easiest way to get going with `nix-cl` in general. Choose
-the CL implementation of interest and a set of libraries, and get a
-lisp-with-packages wrapper with those libraries pre-compiled.
-
-#### `abclPackages`, `eclPackages`, `cclPackages`, `claspPackages`, `sbclPackages`
-
-Ready to use package sets.
-
-#### `abclWithPackages`, `eclWithPackages`, `cclWithPackages`, `claspWithPackages`, `sbclWithPackages`
-
-Ready to use wrapper generators.
-
-#### Example
-
-For example, to open a shell with SBCL + hunchentoot + sqlite in PATH:
-```
-nix-shell -p 'with import ./. {}; sbclWithPackages (ps: [ ps.hunchentoot ps.sqlite ])'
-```
--- a/Show More
+++ b/Show More