Merge master into staging-next

2024-11-17 06:06:13 +03:00 · 2024-03-20 12:01:15 +00:00 · 2024-03-20 12:01:15 +00:00 · 90461ffe37
commit 90461ffe37
parent 199a214038 6f8d5811de
78 changed files with 1079 additions and 405 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -8654,6 +8654,12 @@
    githubId = 2179419;
    name = "Arseniy Seroka";
  };
+  jakedevs = {
+    email = "work@jakedevs.net";
+    github = "jakedevs";
+    githubId = 153585330;
+    name = "Jacob Levi";
+  };
  jakehamilton = {
    name = "Jake Hamilton";
    email = "jake.hamilton@hey.com";
@ -15046,6 +15052,12 @@
    github = "pennae";
    githubId = 82953136;
  };
+  perchun = {
+    name = "Perchun Pak";
+    email = "nixpkgs@perchun.it";
+    github = "PerchunPak";
+    githubId = 68118654;
+  };
  peret = {
    name = "Peter Retzlaff";
    github = "peret";
@ -16722,6 +16734,15 @@
    githubId = 1312525;
    name = "Rongcui Dong";
  };
+  rookeur = {
+    email = "adrien.langou@hotmail.com";
+    github = "Rookeur";
+    githubId = 57438432;
+    name = "Adrien Langou";
+    keys = [{
+      fingerprint = "3B8F FC41 0094 2CB4 5A2A  7DF2 5A44 DA8F 9071 91B0";
+    }];
+  };
  roosemberth = {
    email = "roosembert.palacios+nixpkgs@posteo.ch";
    matrix = "@roosemberth:orbstheorem.ch";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -154,6 +154,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `idris2` was updated to v0.7.0. This version introduces breaking changes. Check out the [changelog](https://github.com/idris-lang/Idris2/blob/v0.7.0/CHANGELOG.md#v070) for details.

+- `nvtop` family of packages was reorganized into nested attrset. `nvtop` has been renamed to `nvtopPackages.full`, and all `nvtop-{amd,nvidia,intel,msm}` packages are now named as `nvtopPackages.{amd,nvidia,intel,msm}`
+
 - `neo4j` has been updated to 5, you may want to read the [release notes for Neo4j 5](https://neo4j.com/release-notes/database/neo4j-5/)

 - `services.neo4j.allowUpgrade` was removed and no longer has any effect. Neo4j 5 supports automatic rolling upgrades.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1034,6 +1034,7 @@
  ./services/networking/multipath.nix
  ./services/networking/murmur.nix
  ./services/networking/mxisd.nix
+  ./services/networking/mycelium.nix
  ./services/networking/namecoind.nix
  ./services/networking/nar-serve.nix
  ./services/networking/nat.nix
--- a/nixos/modules/programs/starship.nix
+++ b/nixos/modules/programs/starship.nix
@ -12,7 +12,7 @@ let
      nativeBuildInputs = [ pkgs.yq ];
    } ''
    tomlq -s -t 'reduce .[] as $item ({}; . * $item)' \
-      ${lib.concatStringsSep " " (map (f: "${pkgs.starship}/share/starship/presets/${f}.toml") cfg.presets)} \
+      ${lib.concatStringsSep " " (map (f: "${cfg.package}/share/starship/presets/${f}.toml") cfg.presets)} \
      ${userSettingsFile} \
      > $out
  '';
@ -26,23 +26,20 @@ let
 in
 {
  options.programs.starship = {
-    enable = lib.mkEnableOption (lib.mdDoc "the Starship shell prompt");
+    enable = lib.mkEnableOption "the Starship shell prompt";

-    interactiveOnly = lib.mkOption {
-      default = true;
-      example = false;
-      type = lib.types.bool;
-      description = lib.mdDoc ''
-        Whether to enable starship only when the shell is interactive.
-        Some plugins require this to be set to false to function correctly.
-      '';
-    };
+    package = lib.mkPackageOption pkgs "starship" { };
+
+    interactiveOnly = lib.mkEnableOption ''
+      starship only when the shell is interactive.
+      Some plugins require this to be set to false to function correctly
+    '' // { default = true; };

    presets = lib.mkOption {
      default = [ ];
      example = [ "nerd-font-symbols" ];
      type = with lib.types; listOf str;
-      description = lib.mdDoc ''
+      description = ''
        Presets files to be merged with settings in order.
      '';
    };
@ -50,7 +47,7 @@ in
    settings = lib.mkOption {
      inherit (settingsFormat) type;
      default = { };
-      description = lib.mdDoc ''
+      description = ''
        Configuration included in `starship.toml`.

        See https://starship.rs/config/#prompt for documentation.
@ -68,7 +65,7 @@ in
        if [[ ! -f "$HOME/.config/starship.toml" ]]; then
          export STARSHIP_CONFIG=${settingsFile}
        fi
-        eval "$(${pkgs.starship}/bin/starship init bash)"
+        eval "$(${cfg.package}/bin/starship init bash)"
      fi
    '';

@ -81,7 +78,7 @@ in
        if not test -f "$HOME/.config/starship.toml";
          set -x STARSHIP_CONFIG ${settingsFile}
        end
-        eval (${pkgs.starship}/bin/starship init fish)
+        eval (${cfg.package}/bin/starship init fish)
      end
    '';

@ -94,7 +91,7 @@ in
        if [[ ! -f "$HOME/.config/starship.toml" ]]; then
          export STARSHIP_CONFIG=${settingsFile}
        fi
-        eval "$(${pkgs.starship}/bin/starship init zsh)"
+        eval "$(${cfg.package}/bin/starship init zsh)"
      fi
    '';
  };
--- a/nixos/modules/services/misc/etebase-server.nix
+++ b/nixos/modules/services/misc/etebase-server.nix
@ -177,6 +177,7 @@ in

    systemd.tmpfiles.rules = [
      "d '${cfg.dataDir}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
+    ] ++ lib.optionals (cfg.unixSocket != null) [
      "d '${builtins.dirOf cfg.unixSocket}' - ${cfg.user} ${config.users.users.${cfg.user}.group} - -"
    ];

--- a/nixos/modules/services/networking/mycelium.nix
+++ b/nixos/modules/services/networking/mycelium.nix
@ -0,0 +1,126 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.services.mycelium;
+in
+{
+  options.services.mycelium = {
+    enable = lib.mkEnableOption "mycelium network";
+    peers = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = ''
+        List of peers to connect to in the format quic://1.2.3.4:9651.
+        If addHostedPublicNodes is set to true, the hosted public nodes will be added to this list.
+      '';
+      default = [];
+    };
+    keyFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        optional path to a keyFile, if unset the default location (/var/lib/mycelium/key) will be used
+        If this key does not exist, it will be generated
+      '';
+    };
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Open the firewall for mycelium";
+    };
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.mycelium;
+      defaultText = lib.literalExpression ''"''${pkgs.mycelium}"'';
+      description = "The mycelium package to use";
+    };
+    addHostedPublicNodes = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        add the hosted peers from https://github.com/threefoldtech/mycelium#hosted-public-nodes
+      '';
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ 9651 ];
+    networking.firewall.allowedUDPPorts = lib.optionals cfg.openFirewall [ 9650 9651 ];
+
+    systemd.services.mycelium = {
+      description = "Mycelium network";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [
+        cfg.keyFile
+      ];
+
+      unitConfig.Documentation = "https://github.com/threefoldtech/mycelium";
+
+      serviceConfig = {
+        User = "mycelium";
+        DynamicUser = true;
+        StateDirectory = "mycelium";
+        ProtectHome = true;
+        ProtectSystem = true;
+        LoadCredential = lib.mkIf (cfg.keyFile != null) "keyfile:${cfg.keyFile}";
+        SyslogIdentifier = "mycelium";
+        AmbientCapabilities = [ "CAP_NET_ADMIN" ];
+        MemoryDenyWriteExecute = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged @keyring" ];
+        ExecStart = lib.concatStringsSep " " ([
+          (lib.getExe cfg.package)
+          (if (cfg.keyFile != null) then
+            "--key-file \${CREDENTIALS_DIRECTORY}/keyfile" else
+            "--key-file %S/mycelium/key.bin"
+          )
+          "--tun-name" "mycelium"
+        ] ++
+          (lib.optional (cfg.addHostedPublicNodes || cfg.peers != []) "--peers")
+        ++ cfg.peers ++ (lib.optionals cfg.addHostedPublicNodes [
+          "tcp://188.40.132.242:9651" # DE 01
+          "tcp://[2a01:4f8:221:1e0b::2]:9651"
+          "quic://188.40.132.242:9651"
+          "quic://[2a01:4f8:221:1e0b::2]:9651"
+
+          "tcp://136.243.47.186:9651" # DE 02
+          "tcp://[2a01:4f8:212:fa6::2]:9651"
+          "quic://136.243.47.186:9651"
+          "quic://[2a01:4f8:212:fa6::2]:9651"
+
+          "tcp://185.69.166.7:9651" # BE 03
+          "tcp://[2a02:1802:5e:0:8478:51ff:fee2:3331]:9651"
+          "quic://185.69.166.7:9651"
+          "quic://[2a02:1802:5e:0:8478:51ff:fee2:3331]:9651"
+
+          "tcp://185.69.166.8:9651" # BE 04
+          "tcp://[2a02:1802:5e:0:8c9e:7dff:fec9:f0d2]:9651"
+          "quic://185.69.166.8:9651"
+          "quic://[2a02:1802:5e:0:8c9e:7dff:fec9:f0d2]:9651"
+
+          "tcp://65.21.231.58:9651" # FI 05
+          "tcp://[2a01:4f9:6a:1dc5::2]:9651"
+          "quic://65.21.231.58:9651"
+          "quic://[2a01:4f9:6a:1dc5::2]:9651"
+
+          "tcp://65.109.18.113:9651" # FI 06
+          "tcp://[2a01:4f9:5a:1042::2]:9651"
+          "quic://65.109.18.113:9651"
+          "quic://[2a01:4f9:5a:1042::2]:9651"
+        ]));
+        Restart = "always";
+        RestartSec = 5;
+        TimeoutStopSec = 5;
+      };
+    };
+  };
+  meta = {
+    maintainers = with lib.maintainers; [ flokli lassulus ];
+  };
+}
+
--- a/nixos/modules/system/boot/uki.nix
+++ b/nixos/modules/system/boot/uki.nix
@ -7,8 +7,6 @@ let
  inherit (pkgs.stdenv.hostPlatform) efiArch;

  format = pkgs.formats.ini { };
-  ukifyConfig = format.generate "ukify.conf" cfg.settings;
-
 in

 {
@ -48,6 +46,15 @@ in
          contains and how it is built.
        '';
      };
+
+      configFile = lib.mkOption {
+        type = lib.types.path;
+        description = lib.mdDoc ''
+          The configuration file passed to {manpage}`ukify(1)` to create the UKI.
+
+          By default this configuration file is created from {option}`boot.uki.settings`.
+        '';
+      };
    };

    system.boot.loader.ukiFile = lib.mkOption {
@ -80,6 +87,8 @@ in
      };
    };

+    boot.uki.configFile = lib.mkOptionDefault (format.generate "ukify.conf" cfg.settings);
+
    system.boot.loader.ukiFile =
      let
        name = config.boot.uki.name;
@ -92,7 +101,7 @@ in
    system.build.uki = pkgs.runCommand config.system.boot.loader.ukiFile { } ''
      mkdir -p $out
      ${pkgs.buildPackages.systemdUkify}/lib/systemd/ukify build \
-        --config=${ukifyConfig} \
+        --config=${cfg.configFile} \
        --output="$out/${config.system.boot.loader.ukiFile}"
    '';

--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@ -509,6 +509,12 @@ in
                                for details).
                              '';
                            }
+                            {
+                              assertion = !lib.strings.hasInfix "_" name;
+                              message = ''
+                                Names containing underscores are not allowed in nixos-containers. Please rename the container '${name}'
+                              '';
+                            }
                          ];
                        };
                      };
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -561,6 +561,7 @@ in {
  munin = handleTest ./munin.nix {};
  mutableUsers = handleTest ./mutable-users.nix {};
  mxisd = handleTest ./mxisd.nix {};
+  mycelium = handleTest ./mycelium {};
  mympd = handleTest ./mympd.nix {};
  mysql = handleTest ./mysql/mysql.nix {};
  mysql-autobackup = handleTest ./mysql/mysql-autobackup.nix {};
--- a/nixos/tests/mycelium/default.nix
+++ b/nixos/tests/mycelium/default.nix
@ -0,0 +1,57 @@
+import ../make-test-python.nix ({ lib, ... }: let
+  peer1-ip = "531:c350:28c1:dfde:ea6d:77d1:a60b:7209";
+  peer2-ip = "49f:3942:3a55:d100:4c78:c558:c4f:695b";
+in
+  {
+    name = "mycelium";
+    meta.maintainers = with lib.maintainers; [ lassulus ];
+
+    nodes = {
+
+      peer1 = { config, pkgs, ... }: {
+        virtualisation.vlans = [ 1 ];
+        networking.interfaces.eth1.ipv4.addresses = [{
+          address = "192.168.1.11";
+          prefixLength = 24;
+        }];
+
+        services.mycelium = {
+          enable = true;
+          addHostedPublicNodes = false;
+          openFirewall = true;
+          keyFile = ./peer1.key;
+          peers = [
+            "quic://192.168.1.12:9651"
+            "tcp://192.168.1.12:9651"
+          ];
+        };
+      };
+
+      peer2 = { config, pkgs, ... }: {
+        virtualisation.vlans = [ 1 ];
+        networking.interfaces.eth1.ipv4.addresses = [{
+          address = "192.168.1.12";
+          prefixLength = 24;
+        }];
+
+        services.mycelium = {
+          enable = true;
+          addHostedPublicNodes = false;
+          openFirewall = true;
+          keyFile = ./peer2.key;
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      peer1.wait_for_unit("network-online.target")
+      peer2.wait_for_unit("network-online.target")
+      peer1.wait_for_unit("mycelium.service")
+      peer2.wait_for_unit("mycelium.service")
+
+      peer1.succeed("ping -c5 ${peer2-ip}")
+      peer2.succeed("ping -c5 ${peer1-ip}")
+    '';
+  })
--- a/nixos/tests/mycelium/peer1.key
+++ b/nixos/tests/mycelium/peer1.key
@ -0,0 +1 @@
+sì	B0ã”ŸŽdûR<C3BB>æÈôÌH¶5œu?à»í…^
--- a/nixos/tests/mycelium/peer2.key
+++ b/nixos/tests/mycelium/peer2.key
@ -0,0 +1 @@
+ΟX<>1®yGΟΥ…<CEA5>SAM»<4D>eΘΐ«Ύ‡<0C>έ7]
--- a/pkgs/applications/audio/monkeys-audio/default.nix
+++ b/pkgs/applications/audio/monkeys-audio/default.nix
@ -5,13 +5,13 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "10.52";
+  version = "10.60";
  pname = "monkeys-audio";

  src = fetchzip {
    url = "https://monkeysaudio.com/files/MAC_${
      builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-n+bQzvuCTt7dnqkPO592KKZeShmMlbp/KAXK0F2dlTg=";
+    hash = "sha256-llOo9G65UDDCzaSahq5qssw6SmOJ5C9qS2bdXB/pKF0=";
    stripRoot = false;
  };
  nativeBuildInputs = [
--- a/pkgs/applications/editors/bluefish/default.nix
+++ b/pkgs/applications/editors/bluefish/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "bluefish";
-  version = "2.2.14";
+  version = "2.2.15";

  src = fetchurl {
    url = "mirror://sourceforge/bluefish/bluefish-${version}.tar.bz2";
-    sha256 = "sha256-IszfnOTlyWIQY+bPfXOr+wc2q3pyvOCG0Gxc9e4SXt4=";
+    sha256 = "sha256-YUPlHGtVedWW86moXg8NhYDJ9Y+ChXWxGYgODKHZQbw=";
  };

  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
--- a/pkgs/applications/misc/kuro/default.nix
+++ b/pkgs/applications/misc/kuro/default.nix
@ -5,18 +5,21 @@
 , makeDesktopItem
 , copyDesktopItems
 , mkYarnPackage
-, electron
+, electron_29
 }:

+let
+  electron = electron_29;
+in
 mkYarnPackage rec {
  pname = "kuro";
  version = "9.0.0";

  src = fetchFromGitHub {
    owner = "davidsmorais";
-    repo = pname;
+    repo = "kuro";
    rev = "v${version}";
-    sha256 = "sha256-9Z/r5T5ZI5aBghHmwiJcft/x/wTRzDlbIupujN2RFfU=";
+    hash = "sha256-9Z/r5T5ZI5aBghHmwiJcft/x/wTRzDlbIupujN2RFfU=";
  };

  packageJSON = ./package.json;
@ -26,7 +29,7 @@ mkYarnPackage rec {
    hash = "sha256-GTiNv7u1QK/wjQgpka7REuoLn2wjZG59kYJQaZZPycI=";
  };

-  ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

  nativeBuildInputs = [
    makeWrapper
@ -68,21 +71,23 @@ mkYarnPackage rec {

  desktopItems = [
    (makeDesktopItem {
-      name = pname;
-      exec = pname;
-      icon = pname;
+      name = "kuro";
+      exec = "kuro";
+      icon = "kuro";
      desktopName = "Kuro";
      genericName = "Microsoft To-Do Client";
      comment = meta.description;
      categories = [ "Office" ];
-      startupWMClass = pname;
+      startupWMClass = "kuro";
    })
  ];

  meta = with lib; {
+    changelog = "https://github.com/davidsmorais/kuro/releases/tag/${src.rev}";
    description = "An unofficial, featureful, open source, community-driven, free Microsoft To-Do app";
    homepage = "https://github.com/davidsmorais/kuro";
    license = licenses.mit;
+    mainProgram = "kuro";
    maintainers = with maintainers; [ ChaosAttractor ];
    inherit (electron.meta) platforms;
  };
--- a/pkgs/applications/misc/passky-desktop/default.nix
+++ b/pkgs/applications/misc/passky-desktop/default.nix
@ -1,12 +1,15 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, electron_22
+, electron_29
 , makeWrapper
 , makeDesktopItem
 , copyDesktopItems
 }:

+let
+  electron = electron_29;
+in
 stdenv.mkDerivation rec {
  pname = "passky-desktop";
  version = "8.1.1";
@ -18,7 +21,10 @@ stdenv.mkDerivation rec {
    sha256 = "1ma8s1bngjdzclcc4m5pcmavk38sidaskmz7dgfnv84y35si18dr";
  };

-  nativeBuildInputs = [ makeWrapper copyDesktopItems ];
+  nativeBuildInputs = [
+    makeWrapper
+    copyDesktopItems
+  ];

  installPhase = ''
    runHook preInstall
@ -35,7 +41,7 @@ stdenv.mkDerivation rec {
    done

    mkdir "$out/share/applications"
-    makeWrapper ${electron_22}/bin/electron "$out/bin/passky" \
+    makeWrapper ${electron}/bin/electron "$out/bin/passky" \
      --add-flags "$out/share/passky/electron/" \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"

@ -45,12 +51,13 @@ stdenv.mkDerivation rec {
  desktopItems = [
    (
      makeDesktopItem {
-        name = "Passky";
+        name = "passky";
        type = "Application";
-        desktopName = "passky";
+        desktopName = "Passky";
        comment = "Simple, modern, open source and secure password manager.";
        icon = "passky";
        exec = "passky %U";
+        terminal = false;
        categories = [ "Utility" ];
        startupWMClass = "Passky";
      }
--- a/pkgs/applications/misc/waycorner/default.nix
+++ b/pkgs/applications/misc/waycorner/default.nix
@ -8,14 +8,14 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "waycorner";
-  version = "0.2.1";
+  version = "0.2.2";
  src = fetchFromGitHub {
    owner = "AndreasBackx";
    repo = "waycorner";
    rev = version;
-    hash = "sha256-xvmvtn6dMqt8kUwvn5d5Nl1V84kz1eWa9BSIN/ONkSQ=";
+    hash = "sha256-b0wGqtCvWzCV9mj2eZ0SXzxM02fbyQ+OfKcbZ2MhLOE=";
  };
-  cargoHash = "sha256-Dl+GhJywWhaC4QMS70klazPsFipGVRW+6jrXH2XsEAI=";
+  cargoHash = "sha256-Xl2nBBcfWjULKG2L+qX4ruw7gux6+qfFg/dTAarqgAU=";
  buildInputs = [
    wayland
  ];
--- a/pkgs/applications/networking/browsers/mullvad-browser/default.nix
+++ b/pkgs/applications/networking/browsers/mullvad-browser/default.nix
@ -90,7 +90,7 @@ let
      ++ lib.optionals mediaSupport [ ffmpeg ]
  );

-  version = "13.0.10";
+  version = "13.0.12";

  sources = {
    x86_64-linux = fetchurl {
@ -102,7 +102,7 @@ let
        "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-+8b3K3XLSPlndR12KNUH0lsPquhTupxQrLBuSEGac7Y=";
+      hash = "sha256-qqz3tdic2muBQI6JXc0/uxBeenWFYHN43K7qJee9q78=";
    };
  };

--- a/pkgs/applications/networking/browsers/tor-browser/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser/default.nix
@ -101,7 +101,7 @@ lib.warnIf (useHardenedMalloc != null)
      ++ lib.optionals mediaSupport [ ffmpeg ]
  );

-  version = "13.0.11";
+  version = "13.0.12";

  sources = {
    x86_64-linux = fetchurl {
@ -111,7 +111,7 @@ lib.warnIf (useHardenedMalloc != null)
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-a8BAesBp85oaHJrkQYcYufH9cy7OrFrfnljZZrFPlGE=";
+      hash = "sha256-2AzcDYngLr+J+s12tAMdB9SjDzOWPnQY9WL7/3+N0FA=";
    };

    i686-linux = fetchurl {
@ -121,7 +121,7 @@ lib.warnIf (useHardenedMalloc != null)
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
      ];
-      hash = "sha256-cyZnLcJmXNjBJhBLwBoW09K6dsT6Og+h0ufc4/6zxac=";
+      hash = "sha256-ect++2xZe00Hlikz6eMNMiiHnVoETSvjD0Cf1oBgj9E=";
    };
  };

--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "werf";
-  version = "1.2.296";
+  version = "1.2.297";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    hash = "sha256-D0bWva6Y0x9uMdKMONsiGC3SV2ktGPzfMq9BELqgk3E=";
+    hash = "sha256-AFuEpMSsfwjqoiLCiSyXecIe/UA72BEHs+kUaUtZU2U=";
  };

-  vendorHash = "sha256-6q13vMxu0iQgaXS+Z6V0jjSIhxMscw6sLANzK07gAlI=";
+  vendorHash = "sha256-mOHrNXaLnTt0WRVJI8GD48pxLvbSa6oWoxa4YFaIA6Y=";

  proxyVendor = true;

--- a/pkgs/applications/networking/instant-messengers/chatty/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatty/default.nix
@ -15,6 +15,7 @@
 , gnome-desktop
 , gspell
 , gtk4
+, gst_all_1
 , json-glib
 , libgcrypt
 , libadwaita
@ -29,7 +30,7 @@

 stdenv.mkDerivation rec {
  pname = "chatty";
-  version = "0.8.1";
+  version = "0.8.2";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
@ -37,7 +38,7 @@ stdenv.mkDerivation rec {
    repo = "Chatty";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-5IkQnXAKl0duy/B6+z7PXYv5zxakxJCgQhWBw5wioWg=";
+    hash = "sha256-7SdoN9JjGwELOdISJwS1Afcydp/rE2uq/tHO/UrFKNU=";
  };

  nativeBuildInputs = [
@ -58,6 +59,7 @@ stdenv.mkDerivation rec {
    gnome-desktop
    gspell
    gtk4
+    gst_all_1.gstreamer
    json-glib
    libgcrypt
    libadwaita
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@ -37,17 +37,14 @@ buildGoModule rec {

  postInstall = ''
    mv $out/bin/Desktop-Bridge $out/bin/protonmail-bridge # The cli is named like that in other distro packages
-    install -Dm444 dist/proton-bridge.desktop -t $out/share/applications
-    install -Dm444 dist/bridge.svg $out/share/icons/hicolor/scalable/apps/protonmail-bridge.svg
  '';

-  meta = with lib; {
-    homepage = "https://github.com/ProtonMail/proton-bridge";
+  meta = {
    changelog = "https://github.com/ProtonMail/proton-bridge/blob/${src.rev}/Changelog.md";
-    downloadPage = "https://github.com/ProtonMail/proton-bridge/releases";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ mrfreezeex ];
    description = "Use your ProtonMail account with your local e-mail client";
+    downloadPage = "https://github.com/ProtonMail/proton-bridge/releases";
+    homepage = "https://github.com/ProtonMail/proton-bridge";
+    license = lib.licenses.gpl3Plus;
    longDescription = ''
      An application that runs on your computer in the background and seamlessly encrypts
      and decrypts your mail as it enters and leaves your computer.
@ -55,5 +52,6 @@ buildGoModule rec {
      To work, use secret-service freedesktop.org API (e.g. Gnome keyring) or pass.
    '';
    mainProgram = "protonmail-bridge";
+    maintainers = with lib.maintainers; [ mrfreezeex daniel-fahey ];
  };
 }
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -19,14 +19,14 @@
 let
  pname = "qownnotes";
  appname = "QOwnNotes";
-  version = "24.3.3";
+  version = "24.3.4";
 in
 stdenv.mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-1PnGccbEKkFZGE7mxMD8onMkFd/f9qyvERSu+VL3yUE=";
+    hash = "sha256-PQoZKb0kf/tMQBJ5OpL9XqXv7fAftGTVsg3tZYe3j5c=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/as/asciiquarium-transparent/package.nix
+++ b/pkgs/by-name/as/asciiquarium-transparent/package.nix
@ -3,32 +3,35 @@
  stdenv,
  fetchFromGitHub,
  makeWrapper,
-  perlPackages,
+  perl,
 }:
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "asciiquarium-transparent";
-  version = "unstable-2023-02-19";
+  version = "1.3";
+
  src = fetchFromGitHub {
    owner = "nothub";
    repo = "asciiquarium";
-    rev = "653cd99a611080c776d18fc7991ae5dd924c72ce";
-    hash = "sha256-72LRFydbObFDXJllmlRjr5O8qjDqtlp3JunE3kwb5aU=";
+    rev = "${finalAttrs.version}";
+    hash = "sha256-zQyVIfwmhF3WsCeIZLwjDufvKzAfjLxaK2s7WTedqCg=";
  };
-  nativeBuildInputs = [makeWrapper];
-  buildInputs = [perlPackages.perl];
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ perl ];
  installPhase = ''
    runHook preInstall
-    mkdir -p $out/bin
-    cp asciiquarium $out/bin/asciiquarium
-    wrapProgram $out/bin/asciiquarium --set PERL5LIB ${perlPackages.makeFullPerlPath [perlPackages.TermAnimation]}
+    install -Dm555 asciiquarium -t $out/bin
+    wrapProgram $out/bin/asciiquarium \
+      --set PERL5LIB ${with perl.pkgs; makeFullPerlPath [ TermAnimation ]}
    runHook postInstall
  '';
-  meta = with lib; {
+
+  meta = {
    description = "An aquarium/sea animation in ASCII art (with option of transparent background)";
-    mainProgram = "asciiquarium";
    homepage = "https://github.com/nothub/asciiquarium";
-    license = with licenses; [gpl2Only];
-    platforms = platforms.unix;
-    maintainers = with maintainers; [quantenzitrone];
+    license = lib.licenses.gpl2Only;
+    mainProgram = "asciiquarium";
+    maintainers = with lib.maintainers; [ quantenzitrone ];
+    platforms = perl.meta.platforms;
  };
-}
+})
--- a/pkgs/by-name/ca/cargo-pgo/package.nix
+++ b/pkgs/by-name/ca/cargo-pgo/package.nix
@ -0,0 +1,29 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-pgo";
+  version = "0.2.6";
+
+  src = fetchFromGitHub {
+    owner = "kobzol";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-u3kWYPLJYarwwudRpeBdJglP9kNbLRTYgEvZT2pBBoY=";
+  };
+
+  cargoHash = "sha256-Peicupa2vFDzPCH0OQYk7plkWIn82o45oGutOyMlI2s=";
+
+  # Integration tests do not run in Nix build environment due to needing to
+  # create and build Cargo workspaces.
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Cargo subcommand for optimizing Rust binaries/libraries with PGO and BOLT";
+    homepage = "https://github.com/kobzol/cargo-pgo";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ dannixon ];
+  };
+}
--- a/pkgs/by-name/ce/cert-viewer/package.nix
+++ b/pkgs/by-name/ce/cert-viewer/package.nix
@ -0,0 +1,26 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "cert-viewer";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "mgit-at";
+    repo = "cert-viewer";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-q4FLKH0ZA/79zLo7dt+CSOjfKyygTiQKSuungQTtue0=";
+  };
+
+  vendorHash = "sha256-55zDUAe5s+03/OnDcK1DqmMUpFO2sBaVjEk6vbrHgzY=";
+
+  meta = {
+    description = "Admin tool to view and inspect multiple x509 Certificates";
+    homepage = "https://github.com/mgit-at/cert-viewer";
+    license = lib.licenses.apsl20;
+    maintainers = [ lib.maintainers.mkg20001 ];
+    mainProgram = "cert-viewer";
+  };
+}
--- a/pkgs/applications/graphics/displaycal/default.nix
+++ b/pkgs/applications/graphics/displaycal/default.nix
@ -10,13 +10,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "displaycal";
-  version = "3.9.11";
+  version = "3.9.12";
  format = "setuptools";

  src = fetchPypi {
    pname = "DisplayCAL";
    inherit version;
-    hash = "sha256-zAZW2eMjwRYevlz8KEzTxzGO8vx5AydfY3vGTapNo1c=";
+    hash = "sha256-0NZ+fr3ilnyWE6+Xa8xqpccNe7WVvvQfQEYvdQ8rf/Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gh/gh-copilot/package.nix
+++ b/pkgs/by-name/gh/gh-copilot/package.nix
@ -0,0 +1,59 @@
+{ stdenv
+, lib
+, fetchurl
+}:
+let
+  inherit (stdenv.hostPlatform) system;
+  throwSystem = throw "Unsupported system: ${system}";
+
+  systemToPlatform = {
+    "x86_64-linux" = {
+      name = "linux-amd64";
+      hash = "sha256-FKzvERcVYkyy1aNYHZIftC2WvSHRxFqSG/g7gpTTvoo=";
+    };
+    "aarch64-linux" = {
+      name = "linux-arm64";
+      hash = "sha256-4vX9On0upgfjM/IL/UzQj5ioeVnSsd2rUgIz6w4szZM=";
+    };
+    "x86_64-darwin" = {
+      name = "darwin-amd64";
+      hash = "sha256-W4ElKXsMo47dVRNJEnLzH2rpvkua56lj/NkJd3R8CCE=";
+    };
+    "aarch64-darwin" = {
+      name = "darwin-arm64";
+      hash = "sha256-F2OA66h/ptkjLZ2oQgkbZlDo31YDZzhk5Pre36TkHvI=";
+    };
+  };
+  platform = systemToPlatform.${system} or throwSystem;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gh-copilot";
+  version = "0.5.4-beta";
+
+  src = fetchurl {
+    name = "gh-copilot";
+    url = "https://github.com/github/gh-copilot/releases/download/v${finalAttrs.version}/${platform.name}";
+    hash = platform.hash;
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -m755 -D $src $out/bin/gh-copilot
+
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/github/gh-copilot/releases/tag/v${finalAttrs.version}";
+    description = "Ask for assistance right in your terminal.";
+    homepage = "https://github.com/github/gh-copilot";
+    license = lib.licenses.unfree;
+    mainProgram = "gh-copilot";
+    maintainers = with lib.maintainers; [ perchun ];
+    platforms = lib.attrNames systemToPlatform;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@ -16,14 +16,14 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "home-manager";
-  version = "unstable-2024-03-15";
+  version = "unstable-2024-03-19";

  src = fetchFromGitHub {
    name = "home-manager-source";
    owner = "nix-community";
    repo = "home-manager";
-    rev = "206f457fffdb9a73596a4cb2211a471bd305243d";
-    hash = "sha256-SUXGZNrXX05YA9G6EmgupxhOr3swI1gcxLUeDMUhrEY=";
+    rev = "022464438a85450abb23d93b91aa82e0addd71fb";
+    hash = "sha256-2bNMraoRB4pdw/HtxgYTFeMhEekBZeQ53/a8xkqpbZc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ja/jan/package.nix
+++ b/pkgs/by-name/ja/jan/package.nix
@ -5,10 +5,10 @@

 let
  pname = "jan";
-  version = "0.4.8";
+  version = "0.4.9";
  src = fetchurl {
    url = "https://github.com/janhq/jan/releases/download/v${version}/jan-linux-x86_64-${version}.AppImage";
-    hash = "sha256-8Vi2KK+5Wk/K+RJZ0/cbRUb8L25WEiLdo5ay8+ichdw=";
+    hash = "sha256-6XnDrr+AkZH69zXf0OKdi8R6LoRWWMZNqWilZhLGynk=";
  };

  appimageContents = appimageTools.extractType2 { inherit pname version src; };
--- a/pkgs/by-name/me/mercure/package.nix
+++ b/pkgs/by-name/me/mercure/package.nix
@ -8,18 +8,18 @@

 buildGoModule rec {
  pname = "mercure";
-  version = "0.15.9";
+  version = "0.15.10";

  src = fetchFromGitHub {
    owner = "dunglas";
    repo = "mercure";
    rev = "v${version}";
-    hash = "sha256-4Y+yZSZrBDLPbQXaOCSKk/EY20Ka8CS4ivUg1TEaqXo=";
+    hash = "sha256-ot4Gb2Zg4VaF/ip9cLJYP69WGmKw/+WQSf20o1aQtpM=";
  };

  sourceRoot = "${src.name}/caddy";

-  vendorHash = "sha256-N0RmvhBlTiWmBb4TzLmaThD9jVkKgcIO9vPWxJAvLRQ=";
+  vendorHash = "sha256-K+9LQ9wI0ltZI7N2mshiDsjEMc2FzenqSGP00fEWuMQ=";

  subPackages = [ "mercure" ];
  excludedPackages = [ "../cmd/mercure" ];
--- a/pkgs/by-name/oc/octorpki/package.nix
+++ b/pkgs/by-name/oc/octorpki/package.nix
@ -1,51 +0,0 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, fetchpatch
-}:
-
-buildGoModule rec {
-  pname = "octorpki";
-  version = "1.5.10";
-
-  src = fetchFromGitHub {
-    owner = "cloudflare";
-    repo = "cfrpki";
-    rev = "v${version}";
-    hash = "sha256-eqIAauwFh1Zbv3Jkk8plz1OR3ZW8fs0ugNwwTnSHSFM=";
-  };
-
-  patches = [
-    # https://github.com/cloudflare/cfrpki/pull/150
-    (fetchpatch {
-      url = "https://github.com/cloudflare/cfrpki/commit/fd0c4e95b880c463430c91ce1f86205b9309399b.patch";
-      hash = "sha256-cJ0mWkjtGvgTIH5eEum8h2Gy2PqR+nPto+mj5m/I/d4=";
-    })
-  ];
-
-  ldflags = [
-    "-X main.version=v${version}"
-    "-X main.talpath=${placeholder "out"}/share/tals"
-  ];
-
-  subPackages = [
-    "cmd/octorpki"
-  ];
-
-  postInstall = ''
-    mkdir -p $out/share
-    cp -R cmd/octorpki/tals $out/share/tals
-  '';
-
-  vendorHash = null;
-
-  meta = with lib; {
-    homepage = "https://github.com/cloudflare/cfrpki#octorpki";
-    changelog = "https://github.com/cloudflare/cfrpki/releases/tag/v${version}";
-    description = "A software used to download RPKI (RFC 6480) certificates and validate them";
-    mainProgram = "octorpki";
-    license = licenses.bsd3;
-    platforms = platforms.all;
-    maintainers = teams.wdz.members;
-  };
-}
--- a/pkgs/by-name/ol/olvid/package.nix
+++ b/pkgs/by-name/ol/olvid/package.nix
@ -0,0 +1,108 @@
+{ stdenv
+, lib
+, fetchurl
+, zlib
+, libXext
+, libX11
+, libXrender
+, libXtst
+, libXi
+, freetype
+, alsa-lib
+, jdk21
+, openjfx21
+, autoPatchelfHook
+, makeBinaryWrapper
+, wrapGAppsHook
+}:
+
+let
+  repo = "olvid";
+
+  javafxModules = [ "swing" "controls" "media" "fxml" "graphics" "base" ];
+
+  classpath =
+    lib.concatMap (mod: [
+      "${openjfx21}/modules_src/javafx.${mod}/module-info.java"
+      "${openjfx21}/modules/javafx.${mod}"
+      "${openjfx21}/modules_libs/javafx.${mod}"
+    ]) javafxModules ++
+    [ "$out/share/${repo}/*" ];
+
+  jvmArgs = [
+    "-cp" (lib.concatStringsSep ":" classpath)
+    "-Djpackage.app-version=$version"
+    "-Dolvid.sqlcipher=true"
+    "-Dolvid.dev=false"
+    "-Dolvid.packaged=true"
+    "-Dolvid.multiuser=false"
+    "-Dolvid.debug=false"
+    "-Dolvid.version=$version"
+    "-Djava.net.useSystemProxies=true"
+    "-Djava.library.path=$out/lib/"
+    "-Xss8M"
+    "-XX:+ShowCodeDetailsInExceptionMessages"
+    "--add-opens=java.desktop/java.awt=ALL-UNNAMED"
+    "--add-opens=java.desktop/java.awt.geom=ALL-UNNAMED"
+    "--add-opens=java.desktop/sun.awt.geom=ALL-UNNAMED"
+    "--add-opens=java.base/java.util=ALL-UNNAMED"
+    "--add-opens=java.desktop/javax.swing=ALL-UNNAMED"
+    "--add-opens=java.desktop/sun.awt.shell=ALL-UNNAMED"
+  ];
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "olvid";
+  version = "1.5.0";
+
+  dontUnpack = true;
+  dontWrapGApps = true;
+
+  src = fetchurl {
+    url = "https://static.olvid.io/linux/${repo}-${finalAttrs.version}.tar.gz";
+    hash = "sha256-iiMc9mM+uUVeS1i1gzXMZaMwSChdz7vNrL9uqJlR8NU=";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeBinaryWrapper
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    zlib
+    libXext
+    libX11
+    libXrender
+    libXtst
+    libXi
+    freetype
+    alsa-lib
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -dm755 "$out/share/${repo}"
+    tar -xf "$src" -C "$out/share/${repo}" --wildcards --strip-components 3 olvid/lib/app/'*.jar'
+
+    install -dm755 "$out/lib"
+    tar -xf "$src" -C "$out/lib" --strip-components 4 olvid/lib/runtime/lib/
+
+    install -dm755 "$out/bin"
+    makeBinaryWrapper ${jdk21}/bin/java $out/bin/${repo} \
+      "''${gappsWrapperArgs[@]}" \
+      --add-flags "${lib.concatStringsSep " " jvmArgs} io.olvid.windows.messenger.start_up.Launcher"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "The secure french messenger";
+    homepage = "https://www.olvid.io";
+    license = licenses.agpl3;
+    mainProgram = "olvid";
+    maintainers = with maintainers; [ rookeur ];
+    platforms = platforms.linux;
+  };
+})
--- a/pkgs/by-name/pr/protonmail-bridge-gui/package.nix
+++ b/pkgs/by-name/pr/protonmail-bridge-gui/package.nix
@ -0,0 +1,113 @@
+{ lib
+, stdenv
+, pkg-config
+, libsecret
+, cmake
+, ninja
+, qt6
+, grpc
+, protobuf
+, zlib
+, gtest
+, sentry-native
+, protonmail-bridge
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "protonmail-bridge-gui";
+
+  inherit (protonmail-bridge) version src;
+
+  patches = [
+    # Use `gtest` from Nixpkgs to allow an offline build
+    ./use-nix-googletest.patch
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    ninja
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtwayland
+    qt6.qtsvg
+    qt6.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    libsecret
+    grpc
+    protobuf
+    zlib
+    gtest
+    sentry-native
+  ];
+
+  sourceRoot = "${finalAttrs.src.name}/internal/frontend/bridge-gui";
+
+  postPatch = ''
+    # Bypass `vcpkg` by deleting lines that `include` BridgeSetup.cmake
+    find . -type f -name "CMakeLists.txt" -exec sed -i "/BridgeSetup\\.cmake/d" {} \;
+
+    # Use the available ICU version
+    sed -i "s/libicu\(i18n\|uc\|data\)\.so\.56/libicu\1.so/g" bridge-gui/DeployLinux.cmake
+
+    # Create a Desktop Entry that uses a `protonmail-bridge-gui` binary without upstream's launcher
+    sed "s/^\(Icon\|Exec\)=.*$/\1=protonmail-bridge-gui/" ../../../dist/proton-bridge.desktop > proton-bridge-gui.desktop
+
+    # Also update `StartupWMClass` to match the GUI binary's `wmclass` (Wayland app id)
+    sed -i "s/^\(StartupWMClass=\)Proton Mail Bridge$/\1ch.proton.bridge-gui/" proton-bridge-gui.desktop
+
+    # Don't build `bridge-gui-tester`
+    sed -i "/add_subdirectory(bridge-gui-tester)/d" CMakeLists.txt
+  '';
+
+  preConfigure = ''
+    cmakeFlagsArray+=(
+      "-DCMAKE_BUILD_TYPE=Release"
+      "-DBRIDGE_APP_FULL_NAME=Proton Mail Bridge"
+      "-DBRIDGE_VENDOR=Proton AG"
+      "-DBRIDGE_REVISION=${finalAttrs.src.rev}"
+      "-DBRIDGE_TAG=${finalAttrs.version}"
+      "-DBRIDGE_BUILD_ENV=Nix"
+      "-DBRIDGE_APP_VERSION=${finalAttrs.version}"
+    )
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # Install the GUI binary
+    install -Dm755 bridge-gui/bridge-gui $out/lib/bridge-gui
+
+    # Symlink the backend binary from the protonmail-bridge (CLI) package
+    ln -s ${protonmail-bridge}/bin/protonmail-bridge $out/lib/bridge
+
+    # Symlink the GUI binary
+    mkdir -p $out/bin
+    ln -s $out/lib/bridge-gui $out/bin/protonmail-bridge-gui
+
+    # Install desktop assets
+    install -Dm644 ../proton-bridge-gui.desktop -t $out/share/applications
+    install -Dm644 ../../../../dist/bridge.svg $out/share/icons/hicolor/scalable/apps/protonmail-bridge-gui.svg
+
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/ProtonMail/proton-bridge/blob/${finalAttrs.src.rev}/Changelog.md";
+    description = "Qt-based GUI to use your ProtonMail account with your local e-mail client";
+    downloadPage = "https://github.com/ProtonMail/proton-bridge/releases";
+    homepage = "https://github.com/ProtonMail/proton-bridge";
+    license = lib.licenses.gpl3Plus;
+    longDescription = ''
+      Provides a GUI application that runs in the background and seamlessly encrypts
+      and decrypts your mail as it enters and leaves your computer.
+
+      To work, use secret-service freedesktop.org API (e.g. Gnome keyring) or pass.
+    '';
+    mainProgram = "protonmail-bridge-gui";
+    maintainers = with lib.maintainers; [ daniel-fahey ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/pr/protonmail-bridge-gui/use-nix-googletest.patch
+++ b/pkgs/by-name/pr/protonmail-bridge-gui/use-nix-googletest.patch
@ -0,0 +1,23 @@
+diff --git a/bridgepp/CMakeLists.txt b/bridgepp/CMakeLists.txt
+index f4a0a553..02d631dc 100644
+--- a/bridgepp/CMakeLists.txt
+++ b/bridgepp/CMakeLists.txt
+@@ -172,16 +172,8 @@ if (CMAKE_VERSION VERSION_GREATER_EQUAL "3.24.0")
+     cmake_policy(SET CMP0135 NEW) # avoid warning DOWNLOAD_EXTRACT_TIMESTAMP
+ endif ()
+ 
+-include(FetchContent)
+-FetchContent_Declare(
+-    googletest
+-    URL https://github.com/google/googletest/archive/b796f7d44681514f58a683a3a71ff17c94edb0c1.zip
+-)
+-
+-# For Windows: Prevent overriding the parent project's compiler/linker settings
+-set(gtest_force_shared_crt ON CACHE BOOL "" FORCE)
+-
+-FetchContent_MakeAvailable(googletest)
+# Use find_package to use the gtest package provided by Nix
+find_package(GTest REQUIRED)
+ 
+ enable_testing()
+ 
--- a/pkgs/by-name/xd/xdg-terminal-exec/package.nix
+++ b/pkgs/by-name/xd/xdg-terminal-exec/package.nix
@ -2,16 +2,17 @@
  lib,
  stdenvNoCC,
  fetchFromGitHub,
+  dash,
 }:
-stdenvNoCC.mkDerivation {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "xdg-terminal-exec";
-  version = "unstable-2023-12-08";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "Vladimir-csp";
    repo = "xdg-terminal-exec";
-    rev = "04f37d4337b6ce157d4a7338dd600a32deb43a28";
-    hash = "sha256-QIPdF+/dMUEVcz5j9o+wQ4dnw2yWwz7slnLdMNETkGs=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-uLUHvSjxIjmy0ejqLfliB6gHFRwyTWNH1RL5kTXebUM=";
  };

  dontBuild = true;
@ -21,6 +22,12 @@ stdenvNoCC.mkDerivation {
    runHook postInstall
  '';

+  dontPatchShebangs = true;
+  postFixup = ''
+    substituteInPlace $out/bin/xdg-terminal-exec \
+      --replace-fail '#!/bin/sh' '#!${lib.getExe dash}'
+  '';
+
  meta = {
    description = "Proposal for XDG terminal execution utility";
    homepage = "https://github.com/Vladimir-csp/xdg-terminal-exec";
@ -29,4 +36,4 @@ stdenvNoCC.mkDerivation {
    maintainers = with lib.maintainers; [quantenzitrone];
    platforms = lib.platforms.unix;
  };
-}
+})
--- a/pkgs/data/themes/andromeda-gtk-theme/default.nix
+++ b/pkgs/data/themes/andromeda-gtk-theme/default.nix
@ -0,0 +1,60 @@
+{ lib, stdenvNoCC, fetchFromGitHub, gtk-engine-murrine }:
+
+stdenvNoCC.mkDerivation {
+  pname = "andromeda-gtk-theme";
+  version = "0-unstable-2024-03-04";
+
+  srcs = [
+    (fetchFromGitHub {
+      owner = "EliverLara";
+      repo = "Andromeda-gtk";
+      rev = "250751a546dd0fa2e67eef86d957fbf993b61dfe";
+      hash = "sha256-exr9j/jW2P9cBhKUPQy3AtK5Vgav5vOyWInXUyVhBk0=";
+      name = "Andromeda-gtk";
+    })
+
+    (fetchFromGitHub {
+      owner = "EliverLara";
+      repo = "Andromeda-gtk";
+      rev = "11a6194d19cb846447db048455a5e782ec830ae1";
+      hash = "sha256-Yy3mih0nyA+ahLqj2D99EKqtmWYJRsvQMkmlLfUPcqQ=";
+      name = "Andromeda-gtk-standard-buttons";
+    })
+  ];
+
+  sourceRoot = ".";
+
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/themes
+    cp -a Andromeda* $out/share/themes
+
+    # remove uneeded files, which are not distributed in https://www.gnome-look.org/p/2039961/
+    rm -rf $out/share/themes/*/Art
+    rm -rf $out/share/themes/*/LICENSE
+    rm -rf $out/share/themes/*/README.md
+    rm -rf $out/share/themes/*/{package.json,package-lock.json,Gulpfile.js}
+    rm -rf $out/share/themes/*/src
+    rm -rf $out/share/themes/*/cinnamon/*.scss
+    rm -rf $out/share/themes/*/gnome-shell/{earlier-versions,extensions,*.scss}
+    rm -rf $out/share/themes/*/gtk-2.0/{assets.svg,assets.txt,links.fish,render-assets.sh}
+    rm -rf $out/share/themes/*/gtk-3.0/{apps,widgets,*.scss}
+    rm -rf $out/share/themes/*/gtk-4.0/{apps,widgets,*.scss}
+    rm -rf $out/share/themes/*/xfwm4/{assets,render_assets.fish}
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "An elegant dark theme for gnome, mate, budgie, cinnamon, xfce";
+    homepage = "https://github.com/EliverLara/Andromeda-gtk";
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ jakedevs ];
+  };
+}
--- a/pkgs/development/python-modules/aws-encryption-sdk/default.nix
+++ b/pkgs/development/python-modules/aws-encryption-sdk/default.nix
@ -7,7 +7,6 @@
 , mock
 , pytest-mock
 , pytestCheckHook
-, pythonAtLeast
 , pythonOlder
 , setuptools
 , wrapt
@ -15,14 +14,14 @@

 buildPythonPackage rec {
  pname = "aws-encryption-sdk";
-  version = "3.1.1";
+  version = "3.2.0";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-jV+/AY/GjWscrL5N0Df9gFKWx3Nqn+RX62hNBT9/lWM=";
+    hash = "sha256-QwT8+M4qo/qYsaz/ejvzzQUowynAxDe1Xg9Fa79iNH4=";
  };

  nativeBuildInputs = [
@ -52,9 +51,8 @@ buildPythonPackage rec {
    "test/integration"
  ];

-  disabledTests = lib.optionals (pythonAtLeast "3.12") [
-    # AssertionError: Regex pattern did not match, https://github.com/aws/aws-encryption-sdk-python/issues/644
-    "test_abstracts"
+  pythonImportsCheck = [
+    "aws_encryption_sdk"
  ];

  meta = with lib; {
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@ -365,14 +365,14 @@

 buildPythonPackage rec {
  pname = "boto3-stubs";
-  version = "1.34.65";
+  version = "1.34.66";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-EF2koE3LXk3ckPIauLJKNCPs+stHdbjM04eVdOXc41g=";
+    hash = "sha256-oFemuSAJwZ/qDZvQFY1JQ9TB9IL/T62dDejLRJ9E5vc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "botocore-stubs";
-  version = "1.34.65";
+  version = "1.34.66";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "botocore_stubs";
    inherit version;
-    hash = "sha256-fFEK2yxv/uLipfGYwQMLuO3/ITbuVuRnKcAuo3skJKU=";
+    hash = "sha256-paoSQMPIzMYtQ5FjlZQ4lq+oE5ncXUIDEnzA/7og+Zk=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/django-anymail/default.nix
+++ b/pkgs/development/python-modules/django-anymail/default.nix
@ -1,25 +1,29 @@
 { lib
-, buildPythonPackage
-, fetchFromGitHub
-, requests
-, django
 , boto3
+, buildPythonPackage
+, django
+, fetchFromGitHub
 , hatchling
-, python
 , mock
+, python
+, pythonOlder
+, requests
 , responses
+, urllib3
 }:

 buildPythonPackage rec {
  pname = "django-anymail";
-  version = "10.2";
+  version = "10.3";
  pyproject = true;

+  disabled = pythonOlder "3.7";
+
  src = fetchFromGitHub {
    owner = "anymail";
-    repo = pname;
+    repo = "django-anymail";
    rev = "refs/tags/v${version}";
-    hash = "sha256-k4C82OYm2SdjxeLScrkkitumjYgWkMNFlNeGW+C1Z8o=";
+    hash = "sha256-5uSpPeXpMkpuzMXzsGE6uQJWP/Dt/oqakB8Xb5G1eZY=";
  };

  nativeBuildInputs = [
@ -27,8 +31,9 @@ buildPythonPackage rec {
  ];

  propagatedBuildInputs = [
-    requests
    django
+    requests
+    urllib3
  ];

  nativeCheckInputs = [
@ -37,7 +42,9 @@ buildPythonPackage rec {
  ] ++ passthru.optional-dependencies.amazon-ses;

  passthru.optional-dependencies = {
-    amazon-ses = [ boto3 ];
+    amazon-ses = [
+      boto3
+    ];
  };

  checkPhase = ''
@ -46,11 +53,14 @@ buildPythonPackage rec {
    runHook postCheck
  '';

-  pythonImportsCheck = [ "anymail" ];
+  pythonImportsCheck = [
+    "anymail"
+  ];

  meta = with lib; {
    description = "Django email backends and webhooks for Mailgun";
    homepage = "https://github.com/anymail/django-anymail";
+    changelog = "https://github.com/anymail/django-anymail/blob/v${version}/CHANGELOG.rst";
    license = licenses.bsd3;
    maintainers = with maintainers; [ onny ];
  };
--- a/pkgs/development/python-modules/etils/default.nix
+++ b/pkgs/development/python-modules/etils/default.nix
@ -28,14 +28,14 @@

 buildPythonPackage rec {
  pname = "etils";
-  version = "1.7.0";
+  version = "1.8.0";
  pyproject = true;

  disabled = pythonOlder "3.10";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-l7aP0l4YVoMhUobvOlTjgZm2JF9f6L5r7cEYm+QlY1A=";
+    hash = "sha256-+0ePV/7CAuJg5UyRkrMXaS/WPbLRHZk+cLzf+inMzVg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/firebase-messaging/default.nix
+++ b/pkgs/development/python-modules/firebase-messaging/default.nix
@ -1,40 +1,35 @@
 { lib
-, buildPythonPackage
-, fetchFromGitHub
-
-# build-system
-, poetry-core
-
-# dependencies
-, cryptography
-, http-ece
-, protobuf
-, requests
-
-# docs
-, sphinx
-, sphinxHook
-, sphinx-autodoc-typehints
-, sphinx-rtd-theme
-
-# tests
 , async-timeout
-, requests-mock
+, buildPythonPackage
+, cryptography
+, fetchFromGitHub
+, http-ece
+, poetry-core
+, protobuf
 , pytest-asyncio
 , pytest-mock
 , pytestCheckHook
+, pythonOlder
+, requests
+, requests-mock
+, sphinx
+, sphinx-autodoc-typehints
+, sphinx-rtd-theme
+, sphinxHook
 }:

 buildPythonPackage rec {
  pname = "firebase-messaging";
-  version = "0.2.0";
+  version = "0.2.1";
  pyproject = true;

+  disabled = pythonOlder "3.8";
+
  src = fetchFromGitHub {
    owner = "sdb9696";
    repo = "firebase-messaging";
-    rev = version;
-    hash = "sha256-e3Ny3pnAfOpNERvvtE/jqSDIsM+YwLq/hbw753QpJ6o=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-8e+S12ZMqAmK7OR7O45QsRa0UKQq6cngeaqz2ugi6iY=";
  };

  outputs = [
@ -75,9 +70,9 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
-    description = "A library to subscribe to GCM/FCM and receive notifications within a python application";
+    description = "Library to subscribe to GCM/FCM and receive notifications within a python application";
    homepage = "https://github.com/sdb9696/firebase-messaging";
-    changelog = "https://github.com/sdb9696/firebase-messaging/blob/${src.rev}/CHANGELOG.rst";
+    changelog = "https://github.com/sdb9696/firebase-messaging/releases/tag/${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ ];
  };
--- a/pkgs/development/python-modules/garminconnect/default.nix
+++ b/pkgs/development/python-modules/garminconnect/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "garminconnect";
-  version = "0.2.14";
+  version = "0.2.15";
  pyproject = true;

  disabled = pythonOlder "3.10";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "cyberjunky";
    repo = "python-garminconnect";
    rev = "refs/tags/${version}";
-    hash = "sha256-FytgckIu99ZKfmxJ0KU+fpbBEgszdp8iwK3SFCL9Ejs=";
+    hash = "sha256-N6PJLsT8BnjGaOLeohDo3ACOyVb/iOCw3LAXZMjwoyw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-logging/default.nix
@ -22,14 +22,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-logging";
-  version = "3.9.0";
+  version = "3.10.0";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-TeyxsL7UoOPA5Yo3ZkbmAC1r58rQOeNGaCLoZlBy6jM=";
+    hash = "sha256-2T00c1EkDdsUz+IBmHotMs+df0eLiy+r7TAVtCWzJ08=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/griffe/default.nix
+++ b/pkgs/development/python-modules/griffe/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "griffe";
-  version = "0.42.0";
+  version = "0.42.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "mkdocstrings";
    repo = "griffe";
    rev = "refs/tags/${version}";
-    hash = "sha256-gleVVwi2exSHz+u8zHhH3nF1duz7qDOpiZBm228ZsSs=";
+    hash = "sha256-KaD3j96FJJx43m/nfHa4kAft4FcDOdq+2dsiaMY7PPY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/internetarchive/default.nix
+++ b/pkgs/development/python-modules/internetarchive/default.nix
@ -11,32 +11,36 @@
 , tqdm
 , urllib3
 , pythonOlder
+, importlib-metadata
 }:

 buildPythonPackage rec {
  pname = "internetarchive";
-  version = "3.6.0";
+  version = "3.7.0";
+  pyproject = true;

-  format = "pyproject";
+  disabled = pythonOlder "3.8";

-  disabled = pythonOlder "3.7";
-
-  # no tests data included in PyPI tarball
  src = fetchFromGitHub {
    owner = "jjjake";
    repo = "internetarchive";
-    rev = "v${version}";
-    hash = "sha256-hy5e6DEAwLKn0l2nJD7fyW5r4ZZiH+fuTEDLQen+dNk=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-krMOjXzI9tmLGLEswXLLqc8J68Gwnl1VrRO2fLbDv0o=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    tqdm
    docopt
    requests
    jsonpatch
    schema
-    setuptools # needs pkg_resources at runtime
    urllib3
+  ] ++ lib.optionals (pythonOlder "3.10") [
+    importlib-metadata
  ];

  nativeCheckInputs = [
@ -67,7 +71,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "A Python and Command-Line Interface to Archive.org";
    homepage = "https://github.com/jjjake/internetarchive";
-    changelog = "https://github.com/jjjake/internetarchive/raw/v${version}/HISTORY.rst";
+    changelog = "https://github.com/jjjake/internetarchive/blob/v${version}/HISTORY.rst";
    license = licenses.agpl3Plus;
    maintainers = [ maintainers.marsam ];
    mainProgram = "ia";
--- a/pkgs/development/python-modules/k5test/default.nix
+++ b/pkgs/development/python-modules/k5test/default.nix
@ -1,23 +1,24 @@
 { lib
+, stdenv
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
 , substituteAll
 , findutils
 , krb5
-, stdenv
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "k5test";
-  version = "0.10.3";
-  format = "setuptools";
+  version = "0.10.4";
+  pyproject = true;

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-nJ3uvK1joxXoGDPUXp/RK/IBZmQ7iry5/29NaxhMVx8=";
+    hash = "sha256-4VJJHmYC9qk7PVM9OHvUWQ8kdgk7aEIXD/C5PeZL7zA=";
  };

  patches = [
@ -29,16 +30,23 @@ buildPythonPackage rec {
    })
  ];

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  # No tests
  doCheck = false;

-  pythonImportsCheck = [ "k5test" ];
+  pythonImportsCheck = [
+    "k5test"
+  ];

  meta = with lib; {
-    broken = stdenv.isDarwin;
    description = "Library for setting up self-contained Kerberos 5 environment";
    homepage = "https://github.com/pythongssapi/k5test";
+    changelog = "https://github.com/pythongssapi/k5test/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ ];
+    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/development/python-modules/license-expression/default.nix
+++ b/pkgs/development/python-modules/license-expression/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "license-expression";
-  version = "30.2.0";
+  version = "30.3.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "nexB";
    repo = "license-expression";
    rev = "refs/tags/v${version}";
-    hash = "sha256-vsQsHi2jdB0OiV6stm1APjQvr+238UoKgaaeXVx/isI=";
+    hash = "sha256-nHqfnetVyz4W2Q6onH0mU/4x9e/vD4rbl9DF4TYqWzs=";
  };

  dontConfigure = true;
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@ -33,7 +33,7 @@

 buildPythonPackage rec {
  pname = "litellm";
-  version = "1.32.1";
+  version = "1.32.4";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -42,7 +42,7 @@ buildPythonPackage rec {
    owner = "BerriAI";
    repo = "litellm";
    rev = "refs/tags/v${version}";
-    hash = "sha256-qIEAtgfzTiUK+HzsocIH3L7z0Wfah3C4GByaA89wvso=";
+    hash = "sha256-rAHh4oCOfK4uS1GY8TXOxGwe/kRJKIBh/O6kLxYm8Qs=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/llama-index-core/default.nix
+++ b/pkgs/development/python-modules/llama-index-core/default.nix
@ -30,7 +30,7 @@

 buildPythonPackage rec {
  pname = "llama-index-core";
-  version = "0.10.18";
+  version = "0.10.20";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -39,7 +39,7 @@ buildPythonPackage rec {
    owner = "run-llama";
    repo = "llama_index";
    rev = "refs/tags/v${version}";
-    hash = "sha256-xNPvaXODY159x8Fl3HRdYCdYeFNIieX5TsLTfup8Dtg=";
+    hash = "sha256-F7k5gtmhFdn369Ws5PSJ/xTid6ONstoWPotk+DmDtLw=";
  };

  sourceRoot = "${src.name}/${pname}";
--- a/pkgs/development/python-modules/lnkparse3/default.nix
+++ b/pkgs/development/python-modules/lnkparse3/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "lnkparse3";
-  version = "1.3.3";
+  version = "1.4.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "Matmaus";
    repo = "LnkParse3";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Ej2Tv1RViHqm2z1EG/cAkImcvtJcwSc3I0DxIL/q8FI=";
+    hash = "sha256-aWMkLFbmikdj4mlAPpo0qrxfE8zgRcSV83aiws03XsQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/managesieve/default.nix
+++ b/pkgs/development/python-modules/managesieve/default.nix
@ -2,26 +2,40 @@
 , buildPythonPackage
 , fetchPypi
 , pytestCheckHook
+, pythonOlder
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "managesieve";
-  version = "0.7.1";
-  format = "setuptools";
+  version = "0.8";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "44930a3b48332d23b35a5305ae7ba47904d4485ed1b7a22208b7d5ad9d60427a";
+    hash = "sha256-2CCb6h69H58YT1byj/fkrfzGsMUbr0GHpJLcMpsSE/M=";
  };

-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "managesieve"
+  ];

  meta = with lib; {
    description = "ManageSieve client library for remotely managing Sieve scripts";
-    mainProgram = "sieveshell";
    homepage = "https://managesieve.readthedocs.io/";
    # PSFL for the python module, GPLv3 only for sieveshell
    license = with licenses; [ gpl3Only psfl ];
    maintainers = with maintainers; [ dadada ];
+    mainProgram = "sieveshell";
  };
 }
--- a/pkgs/development/python-modules/optuna/default.nix
+++ b/pkgs/development/python-modules/optuna/default.nix
@ -43,8 +43,8 @@

 buildPythonPackage rec {
  pname = "optuna";
-  version = "3.5.0";
-  format = "pyproject";
+  version = "3.6.0";
+  pyproject = true;

  disabled = pythonOlder "3.7";

@ -52,7 +52,7 @@ buildPythonPackage rec {
    owner = "optuna";
    repo = "optuna";
    rev = "refs/tags/v${version}";
-    hash = "sha256-lNurMkZZKpKXXQoqhuRUv8LCbdSi1ryj3kYYioYZPF0=";
+    hash = "sha256-KYSefIVGBUsN+A7nOWPBJyD4a+Wa+pO9WLyTpg8Cuy4=";
  };

  nativeBuildInputs = [
@ -134,10 +134,10 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "A hyperparameter optimization framework";
-    mainProgram = "optuna";
    homepage = "https://optuna.org/";
-    changelog = "https://github.com/optuna/optuna/releases/tag/${src.rev}";
+    changelog = "https://github.com/optuna/optuna/releases/tag/${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ natsukium ];
+    mainProgram = "optuna";
  };
 }
--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "pontos";
-  version = "24.3.1";
+  version = "24.3.2";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "greenbone";
    repo = "pontos";
    rev = "refs/tags/v${version}";
-    hash = "sha256-EYfhbIFD2p6ZZ4i6NCA22LS6mAZoJCJSYlTmRExWgw4=";
+    hash = "sha256-DXZDXipYBClqSdlTJsaPWaKr3qTiJ3osm3hHPp/MPow=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pvlib/default.nix
+++ b/pkgs/development/python-modules/pvlib/default.nix
@ -21,14 +21,14 @@

 buildPythonPackage rec {
  pname = "pvlib";
-  version = "0.10.3";
-  format = "pyproject";
+  version = "0.10.4";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi{
    inherit pname version;
-    hash = "sha256-AkobUj1zpjMyNhLn8xWhcJzwbR/UP/CCGQH2akBostk=";
+    hash = "sha256-DF+ov+ixSjmjC/7+WmzwFksuvYKikSbbPZBqhNk5+HI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pychromecast/default.nix
+++ b/pkgs/development/python-modules/pychromecast/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "pychromecast";
-  version = "14.0.0";
+  version = "14.0.1";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -19,7 +19,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "PyChromecast";
    inherit version;
-    hash = "sha256-3E+LBS52CpeNqbJWi3kCDLea9gigJkZfB1RM/+Q5c88=";
+    hash = "sha256-4W4Kf5SIMZGRuLT6IcoL60vxLu2lyb9kAkEYjyvqCj4=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pyformlang/default.nix
+++ b/pkgs/development/python-modules/pyformlang/default.nix
@ -11,12 +11,12 @@

 buildPythonPackage rec {
  pname = "pyformlang";
-  version = "1.0.7";
+  version = "1.0.9";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-i4ib18Ktyc9pRu4P+tQIHoZ/IbAOk8Dn0MXJoxw8gAA=";
+    hash = "sha256-oCwYM4yQ1KYZpC7vVpeHSIDH2Q930JAuTDq9mds9zoc=";
  };

  nativeBuildInputs = [
@ -34,11 +34,13 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  pythonImportsCheck = [ "pyformlang" ];
+  pythonImportsCheck = [
+    "pyformlang"
+  ];

  meta = with lib; {
    description = "A python framework for formal grammars";
-    homepage = "https://pypi.org/project/pyformlang/";
+    homepage = "https://github.com/Aunsiels/pyformlang";
    license = licenses.mit;
    maintainers = with maintainers; [ natsukium ];
  };
--- a/pkgs/development/python-modules/pytenable/default.nix
+++ b/pkgs/development/python-modules/pytenable/default.nix
@ -20,7 +20,7 @@

 buildPythonPackage rec {
  pname = "pytenable";
-  version = "1.4.20";
+  version = "1.4.21";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -29,7 +29,7 @@ buildPythonPackage rec {
    owner = "tenable";
    repo = "pyTenable";
    rev = "refs/tags/${version}";
-    hash = "sha256-NiAv0zNITpKIQ2TarNoU4HwKuHm22LTu8pJUi0SDlfE=";
+    hash = "sha256-+P+6EmKpR+qlvLMgeg6iIxSx7jtC995v2eijkjJdc70=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/python-fsutil/default.nix
+++ b/pkgs/development/python-modules/python-fsutil/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "python-fsutil";
-  version = "0.13.1";
+  version = "0.14.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "fabiocaccamo";
    repo = "python-fsutil";
    rev = "refs/tags/${version}";
-    hash = "sha256-yY8hhw6uNKqrcj0geoQeGN/JCDJVja7pCPUHwoViL64=";
+    hash = "sha256-Cs78zpf3W5UZJkkUBEP6l6fi2J4OtJXGvqqQ8PWKx+8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@ -38,7 +38,7 @@

 buildPythonPackage rec {
  pname = "sentry-sdk";
-  version = "1.41.0";
+  version = "1.42.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -47,7 +47,7 @@ buildPythonPackage rec {
    owner = "getsentry";
    repo = "sentry-python";
    rev = "refs/tags/${version}";
-    hash = "sha256-eoHoUW3cXxdGeWpo/0kBIfVkLECrnKA2wtobe3GeU2Q=";
+    hash = "sha256-LZn7oWwKdHi/KScitFnNDX7pI92mNkC6niGP+BixjtA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/toml-adapt/default.nix
+++ b/pkgs/development/python-modules/toml-adapt/default.nix
@ -10,16 +10,16 @@

 buildPythonPackage rec {
  pname = "toml-adapt";
-  version = "0.3.2";
-  format = "pyproject";
+  version = "0.3.3";
+  pyproject = true;

  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "firefly-cpp";
-    repo = pname;
+    repo = "toml-adapt";
    rev = "refs/tags/${version}";
-    hash = "sha256-Za2v1Mon6e0mmGGTNXf1bCV5CIL8hrl7jGz4Lk3N8xc=";
+    hash = "sha256-KD5dTr/wxFbDg3AbfE0jUbgNjvxqDmbHwjY5Dmp6JFI=";
  };

  nativeBuildInputs = [
@ -41,9 +41,10 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "A simple Command-line interface for manipulating toml files";
-    mainProgram = "toml-adapt";
    homepage = "https://github.com/firefly-cpp/toml-adapt";
+    changelog = "https://github.com/firefly-cpp/toml-adapt/releases/tag/${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ firefly-cpp ];
+    mainProgram = "toml-adapt";
  };
 }
--- a/pkgs/development/python-modules/types-setuptools/default.nix
+++ b/pkgs/development/python-modules/types-setuptools/default.nix
@ -6,12 +6,12 @@

 buildPythonPackage rec {
  pname = "types-setuptools";
-  version = "69.1.0.20240308";
+  version = "69.1.0.20240310";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-rU9eUSUe7cvkqo2whEr2ZUBUqvycD20/H6APcHPBd2c=";
+    hash = "sha256-/A4QgvVcl0YRvOhEseW+stGolVAfSkZOSDBVkqQmgQA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/whoosh/default.nix
+++ b/pkgs/development/python-modules/whoosh/default.nix
@ -1,30 +1,51 @@
-{ lib, buildPythonPackage, fetchPypi, pytest }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pytestCheckHook
+, pythonOlder
+, setuptools
+}:

 buildPythonPackage rec {
-  pname = "Whoosh";
+  pname = "whoosh";
  version = "2.7.4";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
  src = fetchPypi {
-    inherit pname version;
-    sha256 = "10qsqdjpbc85fykc1vgcs8xwbgn4l2l52c8d83xf1q59pwyn79bw";
+    pname = "Whoosh";
+    inherit version;
+    hash = "sha256-fKVjPb+p4OD6QA0xUaigxL7FO9Ls7cCmdwWxdWXDGoM=";
  };

-  nativeCheckInputs = [ pytest ];
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];

  # Wrong encoding
  postPatch = ''
    rm tests/test_reading.py
-    substituteInPlace setup.cfg --replace "[pytest]" "[tool:pytest]"
-  '';
-  checkPhase =  ''
-    # FIXME: test_minimize_dfa fails on python 3.6
-    py.test -k "not test_timelimit and not test_minimize_dfa"
+    substituteInPlace setup.cfg \
+      --replace-fail "[pytest]" "[tool:pytest]"
  '';

+  pythonImportsCheck = [
+    "whoosh"
+  ];
+
+  disabledTests = [
+    "test_minimize_dfa"
+  ];
+
  meta = with lib; {
-    description = "Fast, pure-Python full text indexing, search, and spell
-checking library.";
-    homepage    = "https://bitbucket.org/mchaput/whoosh";
-    license     = licenses.bsd2;
+    description = "Fast, pure-Python full text indexing, search, and spell checking library";
+    homepage = "https://github.com/mchaput/whoosh";
+    license = licenses.bsd2;
    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/tools/analysis/checkstyle/default.nix
+++ b/pkgs/development/tools/analysis/checkstyle/default.nix
@ -1,12 +1,12 @@
 { lib, stdenvNoCC, fetchurl, makeBinaryWrapper, jre }:

 stdenvNoCC.mkDerivation rec {
-  version = "10.14.1";
+  version = "10.14.2";
  pname = "checkstyle";

  src = fetchurl {
    url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "sha256-XgA8qzLBmvhbYq6c6WB8Yj9yudtKrFS3whbmobVAs2A=";
+    sha256 = "sha256-5OR/HJ0DqquvhWcB35TsKueGUfo7cM3b9mNszMJAz2o=";
  };

  nativeBuildInputs = [ makeBinaryWrapper ];
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "golangci-lint";
-  version = "1.56.2";
+  version = "1.57.0";

  src = fetchFromGitHub {
    owner = "golangci";
    repo = "golangci-lint";
    rev = "v${version}";
-    hash = "sha256-P1bgyYJCzHWWcmAHmBAyghFzKCwiQW3KNkbk5gogpn8=";
+    hash = "sha256-mBdK6HhoTVTRTU8agKETTZTR7NAH2cBQ/YQpbI2tyN0=";
  };

-  vendorHash = "sha256-9M9BPLEtNlhmZbS/Kn9yh2att2oIgF+smP7y1XCvrjI=";
+  vendorHash = "sha256-wTx4XbFKvpcZXQrloDWALf3yId1ANCBCvv0k3VwVoiM=";

  subPackages = [ "cmd/golangci-lint" ];

--- a/pkgs/development/tools/language-servers/metals/default.nix
+++ b/pkgs/development/tools/language-servers/metals/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "metals";
-  version = "1.2.1";
+  version = "1.2.2";

  deps = stdenv.mkDerivation {
    name = "${pname}-deps-${version}";
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    '';
    outputHashMode = "recursive";
    outputHashAlgo = "sha256";
-    outputHash = "sha256-L/ltoLlr4TdsDYwYtaCs6+Q2yTiyzoa2GQ3VK28AlzE=";
+    outputHash = "sha256-xk2ionn/lBV8AR7n7OR03UuRCoP1/K6KuohhpRwFock=";
  };

  nativeBuildInputs = [ makeWrapper setJavaClassPath ];
--- a/pkgs/development/tools/templ/default.nix
+++ b/pkgs/development/tools/templ/default.nix
@ -5,7 +5,7 @@

 buildGoModule rec {
  pname = "templ";
-  version = "0.2.598";
+  version = "0.2.639";

  subPackages = [ "cmd/templ" ];

@ -21,7 +21,7 @@ buildGoModule rec {
    owner = "a-h";
    repo = "templ";
    rev = "refs/tags/v${version}";
-    hash = "sha256-jMoAocMDq8U1JsYoH3PFzZbnjSAzhifLwNZoKY+ambA=";
+    hash = "sha256-W1efknPo45mmKYuiFakJ0AigmfQqlfQ/u+de0zTRwwY=";
  };

  vendorHash = "sha256-Upd5Wq4ajsyOMDiAWS2g2iNO1sm1XJc43AFQLIo5eDM=";
--- a/pkgs/os-specific/linux/rtl8814au/default.nix
+++ b/pkgs/os-specific/linux/rtl8814au/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation {
  pname = "rtl8814au";
-  version = "${kernel.version}-unstable-2023-03-21";
+  version = "${kernel.version}-unstable-2024-03-19";

  src = fetchFromGitHub {
    owner = "morrownr";
    repo = "8814au";
-    rev = "6f80699e68fd2a9f2bba3f1a56ca06d1b7992bd8";
-    hash = "sha256-7dv+8vNI1OLLA4SdZQPL87pTS9HR6mGijzWo9WL7vc0=";
+    rev = "d7945c1e0244c83cbbad4da331648246f12eaee9";
+    hash = "sha256-idjHlvyFpQgLGfNAPpZKRnLdXnAogUW3qGHC1WzGVmA=";
  };

  nativeBuildInputs = kernel.moduleBuildDependencies;
--- a/pkgs/shells/fish/plugins/puffer.nix
+++ b/pkgs/shells/fish/plugins/puffer.nix
@ -1,20 +1,24 @@
-{ lib, buildFishPlugin, fetchFromGitHub }:
+{
+  lib,
+  buildFishPlugin,
+  fetchFromGitHub,
+}:

 buildFishPlugin rec {
  pname = "puffer";
-  version = "unstable-2022-10-07";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "nickeb96";
    repo = "puffer-fish";
-    rev = "fd0a9c95da59512beffddb3df95e64221f894631";
-    hash = "sha256-aij48yQHeAKCoAD43rGhqW8X/qmEGGkg8B4jSeqjVU0=";
+    rev = "v${version}";
+    hash = "sha256-2niYj0NLfmVIQguuGTA7RrPIcorJEPkxhH6Dhcy+6Bk=";
  };

-  meta = with lib; {
+  meta = {
    description = "Text Expansions for Fish";
    homepage = "https://github.com/nickeb96/puffer-fish";
-    license = licenses.mit;
-    maintainers = with maintainers; [ quantenzitrone ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ quantenzitrone ];
  };
 }
--- a/pkgs/tools/misc/mise/default.nix
+++ b/pkgs/tools/misc/mise/default.nix
@ -17,16 +17,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "mise";
-  version = "2024.3.2";
+  version = "2024.3.6";

  src = fetchFromGitHub {
    owner = "jdx";
    repo = "mise";
    rev = "v${version}";
-    hash = "sha256-o8oYfah5Vveup9qdxl+Uzl+j4Sqoj+C6BA3c5kpofXo=";
+    hash = "sha256-jTfr4lJ/N3jFmeR0sqNr+V8IxOx7t7YyrDVkFDJSQnI=";
  };

-  cargoHash = "sha256-c6hN9JuMuUp1jl5wXf4N5S3hzyQeeLKAb56H9cLBAIY=";
+  cargoHash = "sha256-kfoTmXvGpXGTU7G7xEZmSgS721g0KM8hRZZnLg3XErM=";

  nativeBuildInputs = [ installShellFiles pkg-config ];
  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@ -5,18 +5,18 @@

 buildGoModule rec {
  pname = "cnspec";
-  version = "10.8.0";
+  version = "10.8.2";

  src = fetchFromGitHub {
    owner = "mondoohq";
    repo = "cnspec";
    rev = "refs/tags/v${version}";
-    hash = "sha256-EfVbYIGkjH0tHaMgnoyAGw7ZlAPVBlhbKTjryFRBF1A=";
+    hash = "sha256-F38qymDYAV2hc1jKrnyot6rk/vDPAvH+DP/JhucmZkE=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-xrWGILBxZEoNi4PHG1vixLpOVaW0LRKkTkJsx5mWBns=";
+  vendorHash = "sha256-w8iGRPnYbyNeHZ+cOA6K4GJdsIyES5zC3A70r9BEFuY=";

  subPackages = [
    "apps/cnspec"
--- a/pkgs/tools/security/dontgo403/default.nix
+++ b/pkgs/tools/security/dontgo403/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "dontgo403";
-  version = "1.0.0";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "devploit";
    repo = "dontgo403";
    rev = "refs/tags/${version}";
-    hash = "sha256-znmPXue+pzv7vAKnIYsjJQQGMeBETH+ekyVKGz9wRik=";
+    hash = "sha256-qA1i8l2oBQQ5IF8ho3K2k+TAndUTFGwb2NfhyFqfKzU=";
  };

  vendorHash = "sha256-IGnTbuaQH8A6aKyahHMd2RyFRh4WxZ3Vx/A9V3uelRg=";
--- a/pkgs/tools/security/gotestwaf/default.nix
+++ b/pkgs/tools/security/gotestwaf/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "gotestwaf";
-  version = "0.4.15";
+  version = "0.4.16";

  src = fetchFromGitHub {
    owner = "wallarm";
    repo = "gotestwaf";
    rev = "refs/tags/v${version}";
-    hash = "sha256-C5lDiHDSSweUZh83AOv5WIQ4JuC9OiCvpHshgius51k=";
+    hash = "sha256-fMSXnA8ZuyfOQINkWiYwX7NSffsHbdlfDcpfo/hahMY=";
  };

  vendorHash = null;
--- a/pkgs/tools/system/nvtop/build-nvtop.nix
+++ b/pkgs/tools/system/nvtop/build-nvtop.nix
@ -0,0 +1,90 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, gtest
+, cudatoolkit
+, libdrm
+, ncurses
+, testers
+, udev
+, addOpenGLRunpath
+, amd ? false
+, intel ? false
+, msm ? false
+, nvidia ? false
+, apple ? false
+, panfrost ? false
+, panthor ? false
+, ascend ? false
+}:
+
+let
+  drm-postFixup = ''
+    patchelf \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${lib.makeLibraryPath [ libdrm ncurses udev ]}" \
+      $out/bin/nvtop
+  '';
+  needDrm = (amd || msm || panfrost || panthor);
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nvtop";
+  version = "3.1.0";
+
+  src = fetchFromGitHub {
+    owner = "Syllo";
+    repo = "nvtop";
+    rev = finalAttrs.version;
+    hash = "sha256-MkkBY2PR6FZnmRMqv9MWqwPWRgixfkUQW5TWJtHEzwA=";
+  };
+
+  cmakeFlags = with lib.strings; [
+    (cmakeBool "BUILD_TESTING" true)
+    (cmakeBool "USE_LIBUDEV_OVER_LIBSYSTEMD" true)
+    (cmakeBool "AMDGPU_SUPPORT" amd)
+    (cmakeBool "NVIDIA_SUPPORT" nvidia)
+    (cmakeBool "INTEL_SUPPORT" intel)
+    (cmakeBool "APPLE_SUPPORT" apple)
+    (cmakeBool "MSM_SUPPORT" msm)
+    (cmakeBool "PANFROST_SUPPORT" panfrost)
+    (cmakeBool "PANTHOR_SUPPORT" panthor)
+    (cmakeBool "ASCEND_SUPPORT" ascend)
+  ];
+  nativeBuildInputs = [ cmake gtest ] ++ lib.optional nvidia addOpenGLRunpath;
+
+  buildInputs = with lib; [ ncurses udev ]
+    ++ optional nvidia cudatoolkit
+    ++ optional needDrm libdrm
+  ;
+
+  # this helps cmake to find <drm.h>
+  env.NIX_CFLAGS_COMPILE = lib.optionalString needDrm "-isystem ${lib.getDev libdrm}/include/libdrm";
+
+  # ordering of fixups is important
+  postFixup = (lib.optionalString needDrm drm-postFixup) + (lib.optionalString nvidia "addOpenGLRunpath $out/bin/nvtop");
+
+  doCheck = true;
+
+  passthru = {
+    tests.version = testers.testVersion {
+      inherit (finalAttrs) version;
+      package = finalAttrs.finalPackage;
+      command = "nvtop --version";
+    };
+  };
+
+  meta = with lib; {
+    description = "A (h)top like task monitor for AMD, Adreno, Intel and NVIDIA GPUs";
+    longDescription = ''
+      Nvtop stands for Neat Videocard TOP, a (h)top like task monitor for AMD, Adreno, Intel and NVIDIA GPUs.
+      It can handle multiple GPUs and print information about them in a htop familiar way.
+    '';
+    homepage = "https://github.com/Syllo/nvtop";
+    changelog = "https://github.com/Syllo/nvtop/releases/tag/${finalAttrs.version}";
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ willibutz gbtb anthonyroussel ];
+    mainProgram = "nvtop";
+  };
+})
--- a/pkgs/tools/system/nvtop/default.nix
+++ b/pkgs/tools/system/nvtop/default.nix
@ -1,83 +1,18 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, gtest
-, cudatoolkit
-, libdrm
-, ncurses
-, nvtop
-, testers
-, udev
-, addOpenGLRunpath
-, amd ? true
-, intel ? true
-, msm ? true
-, nvidia ? true
-}:
-
+{ callPackage }:
 let
-  nvidia-postFixup = "addOpenGLRunpath $out/bin/nvtop";
-  libPath = lib.makeLibraryPath [ libdrm ncurses udev ];
-  drm-postFixup = ''
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${libPath}" \
-      $out/bin/nvtop
-  '';
+  # this GPU families are supported "by-default" upstream (see https://github.com/Syllo/nvtop/blob/3a69c2d060298cd6f92cb09db944eded98be1c23/CMakeLists.txt#L81)
+  # coincidentally, these families are also easy to build in nixpkgs at the moment
+  defaultGPUFamilies = [ "amd" "intel" "msm" "nvidia" "panfrost" "panthor" ];
+  # these GPU families are partially supported upstream, they are also tricky to build in nixpkgs
+  # volunteers with specific hardware needed to build and test these package variants
+  additionalGPUFamilies = [ "apple" "ascend" ];
+  defaultSupport = builtins.listToAttrs (builtins.map (gpu: { name = gpu; value = true; }) defaultGPUFamilies);
 in
-stdenv.mkDerivation rec {
-  pname = "nvtop";
-  version = "3.0.2";
-
-  src = fetchFromGitHub {
-    owner = "Syllo";
-    repo = "nvtop";
-    rev = version;
-    hash = "sha256-SHKdjzbc3ZZfOW2p8RLFRKKBfLnO+Z8/bKVxcdLLqxw=";
-  };
-
-  cmakeFlags = with lib; [
-    "-DBUILD_TESTING=ON"
-    "-DUSE_LIBUDEV_OVER_LIBSYSTEMD=ON"
-  ] ++ optional nvidia "-DNVML_INCLUDE_DIRS=${cudatoolkit}/include"
-  ++ optional nvidia "-DNVML_LIBRARIES=${cudatoolkit}/targets/x86_64-linux/lib/stubs/libnvidia-ml.so"
-  ++ optional (!amd) "-DAMDGPU_SUPPORT=OFF"
-  ++ optional (!intel) "-DINTEL_SUPPORT=OFF"
-  ++ optional (!msm) "-DMSM_SUPPORT=OFF"
-  ++ optional (!nvidia) "-DNVIDIA_SUPPORT=OFF"
-  ++ optional (amd || msm) "-DLibdrm_INCLUDE_DIRS=${libdrm}/lib/stubs/libdrm.so.2"
-  ;
-  nativeBuildInputs = [ cmake gtest ] ++ lib.optional nvidia addOpenGLRunpath;
-  buildInputs = with lib; [ ncurses udev ]
-    ++ optional nvidia cudatoolkit
-    ++ optional (amd || msm) libdrm
-  ;
-
-  # ordering of fixups is important
-  postFixup = (lib.optionalString (amd || msm) drm-postFixup) + (lib.optionalString nvidia nvidia-postFixup);
-
-  doCheck = true;
-
-  passthru = {
-    tests.version = testers.testVersion {
-      inherit version;
-      package = nvtop;
-      command = "nvtop --version";
-    };
-  };
-
-  meta = with lib; {
-    description = "A (h)top like task monitor for AMD, Adreno, Intel and NVIDIA GPUs";
-    longDescription = ''
-      Nvtop stands for Neat Videocard TOP, a (h)top like task monitor for AMD, Adreno, Intel and NVIDIA GPUs.
-      It can handle multiple GPUs and print information about them in a htop familiar way.
-    '';
-    homepage = "https://github.com/Syllo/nvtop";
-    changelog = "https://github.com/Syllo/nvtop/releases/tag/${version}";
-    license = licenses.gpl3Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ willibutz gbtb anthonyroussel ];
-    mainProgram = "nvtop";
-  };
+{
+  full = callPackage ./build-nvtop.nix defaultSupport; #this package supports all default GPU families
 }
+# additional packages with only one specific GPU family support
+// builtins.listToAttrs (builtins.map (gpu: { name = gpu; value = (callPackage ./build-nvtop.nix { "${gpu}" = true; }); }) defaultGPUFamilies)
+
+
+
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -836,6 +836,11 @@ mapAliases ({
  noto-fonts-extra = noto-fonts; # Added 2023-04-08
  NSPlist = nsplist; # Added 2024-01-05
  nvidia-thrust = throw "nvidia-thrust has been removed because the project was deprecated; use cudaPackages.cuda_cccl";
+  nvtop = lib.warn "nvtop has been renamed to nvtopPackages.full" nvtopPackages.full; # Added 2024-02-25
+  nvtop-amd = lib.warn "nvtop-amd has been renamed to nvtopPackages.amd" nvtopPackages.amd; # Added 2024-02-25
+  nvtop-nvidia = lib.warn "nvtop-nvidia has been renamed to nvtopPackages.nvidia" nvtopPackages.nvidia; # Added 2024-02-25
+  nvtop-intel = lib.warn "nvtop-intel has been renamed to nvtopPackages.intel" nvtopPackages.intel; # Added 2024-02-25
+  nvtop-msm = lib.warn "nvtop-msm has been renamed to nvtopPackages.msm" nvtopPackages.msm; # Added 2024-02-25

  ### O ###

@ -844,6 +849,7 @@ mapAliases ({
  oauth2_proxy = oauth2-proxy; # Added 2021-04-18
  octant = throw "octant has been dropped due to being archived and vulnerable"; # Added 2023-09-29
  octant-desktop = throw "octant-desktop has been dropped due to being archived and vulnerable"; # Added 2023-09-29
+  octorpki = throw "octorpki has been removed, upstream says to use rpki-client instead"; # Added 2024-03-19
  ogre1_9 = throw "ogre1_9 has been removed, use ogre instead"; # Added 2023-03-22
  ogre1_10 = throw "ogre1_10 has been removed, use ogre instead"; # Added 2023-07-20
  opa = throw "opa has been removed from nixpkgs as upstream has abandoned the project"; # Added 2023-03-21
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -23843,31 +23843,7 @@ with pkgs;

  nvitop = callPackage ../tools/system/nvitop { };

-  nvtop = callPackage ../tools/system/nvtop { };
-  nvtop-amd = (callPackage ../tools/system/nvtop {
-    amd = true;
-    intel = false;
-    msm = false;
-    nvidia = false;
-  }).overrideAttrs { pname = "nvtop-amd"; };
-  nvtop-intel = (callPackage ../tools/system/nvtop {
-    amd = false;
-    intel = true;
-    msm = false;
-    nvidia = false;
-  }).overrideAttrs { pname = "nvtop-intel"; };
-  nvtop-msm = (callPackage ../tools/system/nvtop {
-    amd = false;
-    intel = false;
-    msm = true;
-    nvidia = false;
-  }).overrideAttrs { pname = "nvtop-msm"; };
-  nvtop-nvidia = (callPackage ../tools/system/nvtop {
-    amd = false;
-    intel = false;
-    msm = false;
-    nvidia = true;
-  }).overrideAttrs { pname = "nvtop-nvidia"; };
+  nvtopPackages = recurseIntoAttrs (import ../tools/system/nvtop { inherit callPackage; });

  ocl-icd = callPackage ../development/libraries/ocl-icd { };

@ -27326,8 +27302,6 @@ with pkgs;

  disk_indicator = callPackage ../os-specific/linux/disk-indicator { };

-  displaycal = callPackage ../applications/graphics/displaycal { };
-
  displaylink = callPackage ../os-specific/linux/displaylink {
    inherit (linuxPackages) evdi;
  };
@ -28601,6 +28575,8 @@ with pkgs;

  android-udev-rules = callPackage ../os-specific/linux/android-udev-rules { };

+  andromeda-gtk-theme = libsForQt5.callPackage ../data/themes/andromeda-gtk-theme { };
+
  ankacoder = callPackage ../data/fonts/ankacoder { };
  ankacoder-condensed = callPackage ../data/fonts/ankacoder/condensed.nix { };

@ -32739,9 +32715,7 @@ with pkgs;

  kupfer = callPackage ../applications/misc/kupfer { };

-  kuro = callPackage ../applications/misc/kuro {
-    electron = electron_22;
-  };
+  kuro = callPackage ../applications/misc/kuro { };

  timoni = callPackage ../applications/networking/cluster/timoni { };
				`@ -0,0 +1 @@`
				`sì B0ã”ŸŽdûR<C3BB>æÈôÌH¶5œu?à»í…^`
				`@ -0,0 +1 @@`
				`ΟX<>1®yGΟΥ…<CEA5>SAM»<4D>eΘΐ«Ύ‡<0C>έ7]`