Merge master into haskell-updates

2024-09-29 00:27:49 +03:00 · 2024-03-11 00:12:54 +00:00 · 2024-03-11 00:12:54 +00:00 · 97e35dcd05
commit 97e35dcd05
parent 84269dc031 3668a9ff62
228 changed files with 3187 additions and 2069 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -5600,6 +5600,12 @@
    githubId = 5737945;
    name = "Elia Argentieri";
  };
+  elisesouche = {
+    email = "elise@souche.one";
+    github = "elisesouche";
+    githubId = 161958668;
+    name = "Élise Souche";
+  };
  elitak = {
    email = "elitak@gmail.com";
    github = "elitak";
@ -7421,6 +7427,12 @@
    githubId = 21156405;
    name = "GuangTao Zhang";
  };
+  Guanran928 = {
+    email = "guanran928@outlook.com";
+    github = "Guanran928";
+    githubId = 68757440;
+    name = "Guanran928";
+  };
  guekka = {
    github = "Guekka";
    githubId = 39066502;
--- a/nixos/doc/manual/installation/installing.chapter.md
+++ b/nixos/doc/manual/installation/installing.chapter.md
@ -272,6 +272,9 @@ update /etc/fstab.
    # parted /dev/sda -- mkpart ESP fat32 1MB 512MB
    # parted /dev/sda -- set 3 esp on
    ```
+    ::: {.note}
+    In case you decided to not create a swap partition, replace `3` by `2`. To be sure of the id number of ESP, run `parted --list`.
+    :::

 Once complete, you can follow with
 [](#sec-installation-manual-partitioning-formatting).
--- a/nixos/modules/programs/clash-verge.nix
+++ b/nixos/modules/programs/clash-verge.nix
@ -3,6 +3,7 @@
 {
  options.programs.clash-verge = {
    enable = lib.mkEnableOption (lib.mdDoc "Clash Verge");
+    package = lib.mkPackageOption pkgs "clash-verge" {};
    autoStart = lib.mkEnableOption (lib.mdDoc "Clash Verge auto launch");
    tunMode = lib.mkEnableOption (lib.mdDoc "Clash Verge TUN mode");
  };
@ -14,10 +15,10 @@
    lib.mkIf cfg.enable {

      environment.systemPackages = [
-        pkgs.clash-verge
+        cfg.package
        (lib.mkIf cfg.autoStart (pkgs.makeAutostartItem {
          name = "clash-verge";
-          package = pkgs.clash-verge;
+          package = cfg.package;
        }))
      ];

@ -25,7 +26,7 @@
        owner = "root";
        group = "root";
        capabilities = "cap_net_bind_service,cap_net_admin=+ep";
-        source = "${lib.getExe pkgs.clash-verge}";
+        source = "${lib.getExe cfg.package}";
      };
    };

--- a/nixos/modules/services/networking/nebula.nix
+++ b/nixos/modules/services/networking/nebula.nix
@ -10,6 +10,15 @@ let
  format = pkgs.formats.yaml {};

  nameToId = netName: "nebula-${netName}";
+
+  resolveFinalPort = netCfg:
+    if netCfg.listen.port == null then
+      if (netCfg.isLighthouse || netCfg.isRelay) then
+        4242
+      else
+        0
+    else
+      netCfg.listen.port;
 in
 {
  # Interface
@ -95,8 +104,15 @@ in
            };

            listen.port = mkOption {
-              type = types.port;
-              default = 4242;
+              type = types.nullOr types.port;
+              default = null;
+              defaultText = lib.literalExpression ''
+                if (config.services.nebula.networks.''${name}.isLighthouse ||
+                    config.services.nebula.networks.''${name}.isRelay) then
+                  4242
+                else
+                  0;
+              '';
              description = lib.mdDoc "Port number to listen on.";
            };

@ -174,7 +190,7 @@ in
          };
          listen = {
            host = netCfg.listen.host;
-            port = netCfg.listen.port;
+            port = resolveFinalPort netCfg;
          };
          tun = {
            disabled = netCfg.tun.disable;
@ -185,7 +201,15 @@ in
            outbound = netCfg.firewall.outbound;
          };
        } netCfg.settings;
-        configFile = format.generate "nebula-config-${netName}.yml" settings;
+        configFile = format.generate "nebula-config-${netName}.yml" (
+          warnIf
+            ((settings.lighthouse.am_lighthouse || settings.relay.am_relay) && settings.listen.port == 0)
+            ''
+              Nebula network '${netName}' is configured as a lighthouse or relay, and its port is ${builtins.toString settings.listen.port}.
+              You will likely experience connectivity issues: https://nebula.defined.net/docs/config/listen/#listenport
+            ''
+            settings
+          );
        in
        {
          # Create the systemd service for Nebula.
@ -229,7 +253,7 @@ in

    # Open the chosen ports for UDP.
    networking.firewall.allowedUDPPorts =
-      unique (mapAttrsToList (netName: netCfg: netCfg.listen.port) enabledNetworks);
+      unique (filter (port: port > 0) (mapAttrsToList (netName: netCfg: resolveFinalPort netCfg) enabledNetworks));

    # Create the service users and groups.
    users.users = mkMerge (mapAttrsToList (netName: netCfg:
--- a/nixos/modules/services/security/yubikey-agent.nix
+++ b/nixos/modules/services/security/yubikey-agent.nix
@ -37,7 +37,7 @@ in

    # This overrides the systemd user unit shipped with the
    # yubikey-agent package
-    systemd.user.services.yubikey-agent = mkIf (pinentryFlavor != null) {
+    systemd.user.services.yubikey-agent = mkIf (config.programs.gnupg.agent.pinentryPackage != null) {
      path = [ config.programs.gnupg.agent.pinentryPackage ];
      wantedBy = [ "default.target" ];
    };
--- a/nixos/modules/services/web-servers/stargazer.nix
+++ b/nixos/modules/services/web-servers/stargazer.nix
@ -129,6 +129,12 @@ in
      example = lib.literalExpression "\"1y\"";
    };

+    debugMode = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = lib.mdDoc "Run Stargazer in debug mode.";
+    };
+
    routes = lib.mkOption {
      type = lib.types.listOf
        (lib.types.submodule {
@ -195,7 +201,7 @@ in
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
-        ExecStart = "${pkgs.stargazer}/bin/stargazer ${configFile}";
+        ExecStart = "${pkgs.stargazer}/bin/stargazer ${configFile} ${lib.optionalString cfg.debugMode "-D"}";
        Restart = "always";
        # User and group
        User = cfg.user;
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -97,7 +97,7 @@ let

      # Maintaining state across reboots.
      "systemd-random-seed.service"
-      "systemd-boot-random-seed.service"
+      ] ++ (optional cfg.package.withBootloader "systemd-boot-random-seed.service") ++ [
      "systemd-backlight@.service"
      "systemd-rfkill.service"
      "systemd-rfkill.socket"
--- a/nixos/tests/nebula.nix
+++ b/nixos/tests/nebula.nix
@ -10,6 +10,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: let
      environment.systemPackages = [ pkgs.nebula ];
      users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
      services.openssh.enable = true;
+      networking.firewall.enable = true; # Implicitly true, but let's make sure.
      networking.interfaces.eth1.useDHCP = false;

      services.nebula.networks.smoke = {
@ -17,7 +18,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: let
        ca = "/etc/nebula/ca.crt";
        cert = "/etc/nebula/${name}.crt";
        key = "/etc/nebula/${name}.key";
-        listen = { host = "0.0.0.0"; port = 4242; };
+        listen = {
+          host = "0.0.0.0";
+          port = if (config.services.nebula.networks.smoke.isLighthouse || config.services.nebula.networks.smoke.isRelay) then 4242 else 0;
+        };
      };
    }
    extraConfig
--- a/nixos/tests/privoxy.nix
+++ b/nixos/tests/privoxy.nix
@ -77,6 +77,11 @@ in
    networking.proxy.httpsProxy = "http://localhost:8118";
  };

+  nodes.machine_socks4  = { ... }: { services.privoxy = { enable = true; settings.forward-socks4  = "/ 127.0.0.1:9050 ."; }; };
+  nodes.machine_socks4a = { ... }: { services.privoxy = { enable = true; settings.forward-socks4a = "/ 127.0.0.1:9050 ."; }; };
+  nodes.machine_socks5  = { ... }: { services.privoxy = { enable = true; settings.forward-socks5  = "/ 127.0.0.1:9050 ."; }; };
+  nodes.machine_socks5t = { ... }: { services.privoxy = { enable = true; settings.forward-socks5t = "/ 127.0.0.1:9050 ."; }; };
+
  testScript =
    ''
      with subtest("Privoxy is running"):
@ -109,5 +114,13 @@ in
          machine.systemctl("start systemd-tmpfiles-clean")
          # ...and count again
          machine.succeed("test $(ls /run/privoxy/certs | wc -l) -eq 0")
+
+      with subtest("Privoxy supports socks upstream proxies"):
+          for m in [machine_socks4, machine_socks4a, machine_socks5, machine_socks5t]:
+              m.wait_for_unit("privoxy")
+              m.wait_for_open_port(8118)
+              # We expect a 503 error because the dummy upstream proxy is not reachable.
+              # In issue #265654, instead privoxy segfaulted causing curl to exit with "Empty reply from server".
+              m.succeed("http_proxy=http://localhost:8118 curl -v http://does-not-exist/ 2>&1 | grep 'HTTP/1.1 503'")
    '';
 })
--- a/pkgs/applications/audio/qmmp/default.nix
+++ b/pkgs/applications/audio/qmmp/default.nix
@ -26,11 +26,11 @@

 stdenv.mkDerivation rec {
  pname = "qmmp";
-  version = "2.1.5";
+  version = "2.1.6";

  src = fetchurl {
    url = "https://qmmp.ylsoftware.com/files/qmmp/2.1/${pname}-${version}.tar.bz2";
-    hash = "sha256-Jb4/KxnY1wtrUTbD+X04Wl7b9A2sZ92E/N1K+dVU95U=";
+    hash = "sha256-knqo5yCkcO/bFmM++z+SdiWzpDKK9ooV0wqlcIKj7so=";
  };

  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
--- a/pkgs/applications/audio/youtube-music/default.nix
+++ b/pkgs/applications/audio/youtube-music/default.nix
@ -1,6 +1,5 @@
 { lib
 , fetchFromGitHub
-, buildNpmPackage
 , makeWrapper
 , electron
 , python3
@ -14,21 +13,17 @@
 , makeDesktopItem
 }:

-let
+stdenv.mkDerivation (finalAttrs: {
  pname = "youtube-music";
-  version = "3.1.0";
+  version = "3.3.1";

  src = fetchFromGitHub {
    owner = "th-ch";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-6ZiftpdCwxCkJzcHryVrUKzM+mM1eQpdLNFl0Dja59Q=";
+    repo = "youtube-music";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-N6TzDTKvMyasksE0qcEGKeNjGAD08OzxpmpoQ11/ZW4=";
  };

-in
-stdenv.mkDerivation (finalAttrs: {
-  inherit pname version src;
-
  pnpmDeps = stdenvNoCC.mkDerivation {
    pname = "${finalAttrs.pname}-pnpm-deps";
    inherit (finalAttrs) src version ELECTRON_SKIP_BINARY_DOWNLOAD;
@ -51,17 +46,15 @@ stdenv.mkDerivation (finalAttrs: {
    dontBuild = true;
    dontFixup = true;
    outputHashMode = "recursive";
-    outputHashAlgo = "sha256";
    outputHash = {
-      x86_64-linux = "sha256-Oy11V7FXfVhLUR9gX0sjQEFuVPFpbaVdT518oOSLcvA=";
-      aarch64-linux = "sha256-6nXemaGiQjp2stjjKItPJ62VcH5Q5pRf63qKtl2haXI=";
-      x86_64-darwin = "sha256-jSMAw+AMD63vqPckZjblw4EDngA4E8h0WlsZu3hUShY=";
-      aarch64-darwin = "sha256-zujXURpIcw7IOw63AW167h6cywYXydhHZMzA2apGZAs=";
+      x86_64-linux = "sha256-V6CSawxBWFbXmAPbck0xCXqRlANpqFAoqSAB4Duf8qM=";
+      aarch64-linux = "sha256-cqBn35soV14CmobKt0napRELio4HKKA8Iw3QSWTxzP8=";
+      x86_64-darwin = "sha256-DY9T1N8Hxr57/XisYT+u2+hQvYMIiyQ3UHeTuA6BhSY=";
+      aarch64-darwin = "sha256-3Zk0SyhVKaz5QdO69/xzWFZj9ueJS6GLWhfW7odWvHc=";
    }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
  };

-  nativeBuildInputs =
-    [ makeWrapper python3 nodePackages.pnpm nodePackages.nodejs ]
+  nativeBuildInputs = [ makeWrapper python3 nodePackages.pnpm nodePackages.nodejs ]
    ++ lib.optionals (!stdenv.isDarwin) [ copyDesktopItems ];


--- a/pkgs/applications/editors/eclipse/default.nix
+++ b/pkgs/applications/editors/eclipse/default.nix
@ -9,7 +9,7 @@
 # use ./update.sh to help with updating for each quarterly release
 #
 # then, to test:
-# for e in cpp dsl embedcpp modeling platform sdk java jee committers rcp; do for s in pkgs pkgsCross.aarch64-multiplatform; do echo; echo $s $e; nix build -f default.nix ${s}.eclipses.eclipse-${e} -o eclipse-${s}-${e}; done; done
+# for e in cpp dsl embedcpp modeling platform sdk java jee committers rcp; do for s in pkgs pkgsCross.aarch64-multiplatform; do echo; echo $s $e; nix-build -A ${s}.eclipses.eclipse-${e} -o eclipse-${s}-${e}; done; done

 let
  platform_major = "4";
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1785,8 +1785,8 @@ let
        mktplcRef = {
          publisher = "github";
          name = "copilot";
-          version = "1.156.691";
-          sha256 = "sha256-K7lzwfgqb0gUJAivro/ePaQetM31M+zTBRZMBy92ZuA=";
+          version = "1.172.758";
+          sha256 = "sha256-sK3IiA4mQ6Hse+UpZ81Zb5iBSREzTrs7ypsfGbJiXm4=";
        };

        meta = {
@ -1802,7 +1802,7 @@ let
        mktplcRef = {
          publisher = "github";
          name = "copilot-chat";
-          version = "0.12.2024013003"; # latest version compatible with vscode 1.86
+          version = "0.14.2024030801"; # compatible with vscode >= 1.87
          sha256 = "sha256-4ArWVFko2T6ze/i+HTdXAioWC7euWCycDsQxFTrEtUw=";
        };
        meta = {
--- a/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix
@ -30,14 +30,24 @@

 let
  gdbDefaultsTo = if gdbUseFixed then "${gdb}/bin/gdb" else "gdb";
+  supported = {
+    x86_64-linux = {
+      sha256 = "sha256-4mKCBqUCOndKEfsJqTIsfwEt+0CZI8QAhBj3Y4+wKlg=";
+      arch = "linux-x64";
+    };
+    aarch64-linux = {
+      sha256 = "sha256-Kjl8mEpayA1xMHEAMJ5k3Ctk3l48KlUBU5w3dL4pGWM=";
+      arch = "linux-arm64";
+    };
+  };
+
+  base = supported.${stdenv.system} or (throw "unsupported platform ${stdenv.system}");
 in
 vscode-utils.buildVscodeMarketplaceExtension {
-  mktplcRef = {
+  mktplcRef = base // {
    name = "cpptools";
    publisher = "ms-vscode";
    version = "1.17.3";
-    sha256 = "sha256-4mKCBqUCOndKEfsJqTIsfwEt+0CZI8QAhBj3Y4+wKlg=";
-    arch = "linux-x64";
  };

  nativeBuildInputs = [
@ -85,6 +95,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
    homepage = "https://marketplace.visualstudio.com/items?itemName=ms-vscode.cpptools";
    license = lib.licenses.unfree;
    maintainers = [ lib.maintainers.jraygauthier lib.maintainers.stargate01 ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
  };
 }
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -15,11 +15,11 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "0pz2dn245jzjw2n79mm9angvdlwlwxb4lwdq8za1i99g2m4il1bz";
-    x86_64-darwin = "0d0ivs672zh7w60pxy95awq7c8gxhs7d8wv5cf25289gnzcd6qff";
-    aarch64-linux = "1srir5gr0bdvnxyqrfq00p34ligg0pppr22g9zrdm8jasvrz6fb0";
-    aarch64-darwin = "046kcsanz5msf5xd94b1lxcwclsp3dcwxgzrcxycbsykxslz9gpq";
-    armv7l-linux = "0h576q3jbdy48bvg4h9swd2w7cynxmnm2klj6p719myigx7h2jzg";
+    x86_64-linux = "02rkp86rj7irs5011g6180yihllwfx47afk5vybxab4v23vigidr";
+    x86_64-darwin = "1hpj6kkyby9chr27w2382az7h2bg3x1x7c9j6i5bh8vl81s9yfd4";
+    aarch64-linux = "04fhmfplvyqg2l5xlqldl6kfy1m3y19sf2nikigmsm550b8m6sgc";
+    aarch64-darwin = "1yhyybd27ympg12mp4w46z64g2mi1hbv4d6hfl34l7fq4c5jkjf2";
+    armv7l-linux = "0jpjsfal67la123hqp9607bih3vnjdpbnrghyy1vywy15z71pff5";
  }.${system} or throwSystem;

  sourceRoot = lib.optionalString (!stdenv.isDarwin) ".";
@ -29,7 +29,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.86.2.24057";
+    version = "1.87.1.24068";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/emulators/cemu/default.nix
+++ b/pkgs/applications/emulators/cemu/default.nix
@ -46,13 +46,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "cemu";
-  version = "2.0-66";
+  version = "2.0-68";

  src = fetchFromGitHub {
    owner = "cemu-project";
    repo = "Cemu";
    rev = "v${version}";
-    hash = "sha256-1s1H2rJuN9lRNanKXxKWMLBOFg5z3IwpJCZCmymAH9Y=";
+    hash = "sha256-/c0rpj4s3aNJVH+AlU9R4t321OqTvJHfZQCfyzYB4m8=";
  };

  patches = [
--- a/pkgs/applications/emulators/ripes/default.nix
+++ b/pkgs/applications/emulators/ripes/default.nix
@ -14,14 +14,14 @@
 stdenv.mkDerivation rec {
  pname = "ripes";
  # Pulling unstable version as latest stable does not build against gcc-13.
-  version = "2.2.6-unstable-2024-01-02";
+  version = "2.2.6-unstable-2024-03-03";

  src = fetchFromGitHub {
    owner = "mortbopet";
    repo = "Ripes";
-    rev = "0faf41b669a93a1944707cd7d111a5e9241425fe";
+    rev = "b71f0ddd5d2d346cb97b28fd3f70fef55bb9b6b7";
    fetchSubmodules = true;
-    hash = "sha256-3+jibS1mGYBy9jmucytc7GvB1ZKRfh7aXtDty77hA3k=";
+    hash = "sha256-zQrrWBHNIacRoAEIjR0dlgUTncBCiodcBeT/wbDClWg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/emulators/xemu/default.nix
+++ b/pkgs/applications/emulators/xemu/default.nix
@ -28,13 +28,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xemu";
-  version = "0.7.118";
+  version = "0.7.119";

  src = fetchFromGitHub {
    owner = "xemu-project";
    repo = "xemu";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-IGzPxwNxuqMsZhQ63VUyDzPSBpAgc0U0oUjM/blEd7g=";
+    hash = "sha256-5gH1pQqy45vmgeW61peEi6+ZXpPgyQMUg3dh37oqR6s=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/graphics/xournalpp/default.nix
+++ b/pkgs/applications/graphics/xournalpp/default.nix
@ -7,6 +7,7 @@
 , pkg-config

 , alsa-lib
+, binutils
 , glib
 , gsettings-desktop-schemas
 , gtk3
@ -25,16 +26,22 @@

 stdenv.mkDerivation rec {
  pname = "xournalpp";
-  version = "1.2.2";
+  version = "1.2.3";

  src = fetchFromGitHub {
    owner = "xournalpp";
-    repo = pname;
+    repo = "xournalpp";
    rev = "v${version}";
-    sha256 = "sha256-6ND0Y+TzdN2rRI10cusgSK1sYMC55Wn5qFCHP4hsdes=";
+    sha256 = "sha256-8UAAX/kixqiY9zEYs5eva0G2K2vlfnYd1yyVHMSfSeY=";
  };

+  postPatch = ''
+    substituteInPlace src/util/Stacktrace.cpp \
+      --replace-fail "addr2line" "${binutils}/bin/addr2line"
+  '';
+
  nativeBuildInputs = [ cmake gettext pkg-config wrapGAppsHook ];
+
  buildInputs =
    lib.optionals stdenv.isLinux [
      alsa-lib
@ -56,8 +63,6 @@ stdenv.mkDerivation rec {

  buildFlags = [ "translations" ];

-  hardeningDisable = [ "format" ];
-
  meta = with lib; {
    description = "Xournal++ is a handwriting Notetaking software with PDF annotation support";
    homepage    = "https://xournalpp.github.io/";
@ -65,5 +70,6 @@ stdenv.mkDerivation rec {
    license     = licenses.gpl2Plus;
    maintainers = with maintainers; [ andrew-d sikmir ];
    platforms   = platforms.unix;
+    mainProgram = "xournalpp";
  };
 }
--- a/pkgs/applications/misc/clight/default.nix
+++ b/pkgs/applications/misc/clight/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "clight";
-  version = "4.10";
+  version = "4.11";

  src = fetchFromGitHub {
    owner = "FedeDP";
    repo = "Clight";
    rev = version;
-    sha256 = "sha256-IAoz4f4XrX8bgesWL4yLK6m5F+c75WNIMFgKBj+W61Q=";
+    sha256 = "sha256-Fu38HRP83Yn2jsq9xnCWOXNlV/0hJKD1/cOOp3EV45Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/makehuman/default.nix
+++ b/pkgs/applications/misc/makehuman/default.nix
@ -0,0 +1,145 @@
+{ stdenv
+, lib
+, fetchpatch
+, fetchFromGitHub
+, python3
+, qtbase
+, qttools
+, git-lfs
+, wrapQtAppsHook
+}:
+
+let
+  pydeps = with python3.pkgs; [
+    numpy
+    pyqt5
+    pyopengl
+  ];
+  python = python3.withPackages (pkgs: pydeps);
+in
+stdenv.mkDerivation rec {
+  pname = "makehuman";
+  version = "1.2.0";
+
+  source = fetchFromGitHub {
+    owner = "makehumancommunity";
+    repo = "makehuman";
+    rev = "v${version}";
+    hash = "sha256-mCv6H0B7b4uxozpNHkKsG+Is2H0QYEJnnzKCHixhBpY=";
+    name = "${pname}-source";
+  };
+
+  assets = fetchFromGitHub {
+    owner = "makehumancommunity";
+    repo = "makehuman-assets";
+    rev = "v${version}";
+    hash = "sha256-Jd2A0PAHVdFMnDLq4Mu5wsK/E6A4QpKjUyv66ix1Gbo=";
+    name = "${pname}-assets-source";
+  };
+
+  patches = [
+    # work with numpy>=1.24
+    (fetchpatch {
+      name = "fix-compile_targets.py-when-using-numpy-1.24.0-or-newer";
+      url = "https://patch-diff.githubusercontent.com/raw/makehumancommunity/makehuman/pull/220.patch";
+      hash = "sha256-ip7U83cCBrl+4gM1GZ2QQIER5Qur6HRu3a/TnHqk//g=";
+    })
+    # crash related to collections.Callable -> collections.abc.Callable
+    (fetchpatch {
+      name = "remove-unnecessary-compatibility-test";
+      url = "https://patch-diff.githubusercontent.com/raw/makehumancommunity/makehuman/pull/188.patch";
+      hash = "sha256-HGrk3n7rhV4YgK8mNUdfHwQl8dFT8yuzjxorvwfMmJw=";
+    })
+    # some OpenGL issue causing blank windows on recent Qt
+    (fetchpatch {
+      name = "qt-opengl-update-from-qglwidget-to-qopenglwidget-to-fix-blank";
+      url = "https://patch-diff.githubusercontent.com/raw/makehumancommunity/makehuman/pull/197.patch";
+      hash = "sha256-fEqBwg1Jd36nKWIT9XPr6Buj1N3AmTQg2LBaoX3eTxw=";
+    })
+    # multisampling issue
+    (fetchpatch {
+      name = "switch-default-for-multisampling-and-disable-sample-buffers";
+      url = "https://github.com/makehumancommunity/makehuman/commit/c47b884028a24eb190d097e7523a3059e439cb6f.patch";
+      hash = "sha256-tknQHX9qQYH15gyOLNhxfO3bsFVIv3Z1F7ZXD1IT1h4=";
+    })
+    # PyQt >= 5.12
+    (fetchpatch {
+      name = "fix-scrolling-issue-on-pyqt5>=5.12";
+      url = "https://github.com/makehumancommunity/makehuman/commit/02c4269a2d4c57f68159fe8f437a8b1978b99099.patch";
+      hash = "sha256-yR5tZcELX0N83PW/vS6yB5xKoZcHhVp48invlu7quWM=";
+    })
+  ];
+
+  srcs = [
+    source
+    assets
+  ];
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [
+    python
+    qtbase
+    git-lfs
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    python
+    qtbase
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pydeps
+  ];
+
+  finalSource = "${pname}-final";
+
+  postUnpack = ''
+    mkdir -p $finalSource
+    cp -r $source/makehuman $finalSource
+    chmod u+w $finalSource --recursive
+    cp -r $assets/base/* $finalSource/makehuman/data
+    chmod u+w $finalSource --recursive
+    sourceRoot=$finalSource
+  '';
+
+  configurePhase = ''
+    runHook preConfigure
+    pushd ./makehuman
+    bash ./cleannpz.sh
+    bash ./cleanpyc.sh
+    python3 ./compile_targets.py
+    python3 ./compile_models.py
+    python3 ./compile_proxies.py
+    popd
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    mkdir -p $out/opt $out/bin
+    cp -r * $out/opt
+    python -m compileall -o 0 -o 2 $out/opt
+    ln -s $out/opt/makehuman/makehuman.py $out/bin/makehuman
+    chmod +x $out/bin/makehuman
+    runHook postBuild
+  '';
+
+  preFixup = ''
+    wrapQtApp $out/bin/makehuman
+  '';
+
+  meta = {
+    description = "Software to create realistic humans";
+    homepage = "http://www.makehumancommunity.org/";
+    license = with lib.licenses; [ agpl3Plus cc0 ];
+    longDescription = ''
+      MakeHuman is a GUI program for procedurally generating
+      realistic-looking humans.
+    '';
+    mainProgram = "makehuman";
+    maintainers = with lib.maintainers; [ elisesouche ];
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/applications/misc/mkgmap/build.xml.patch
+++ b/pkgs/applications/misc/mkgmap/build.xml.patch
@ -1,14 +1,6 @@
 --- a/build.xml	(revision 4555)
 +++ a/build.xml	(working copy)
-@@ -222,13 +222,13 @@
- 		<property name="svn.version.build" value="none"/>
- 
- 		<propertyfile file="${build.classes}/mkgmap-version.properties">
-			<entry key="svn.version" value="${svn.version.build}" />
-			<entry key="build.timestamp" value="${build.timestamp}" />
-+			<entry key="svn.version" value="@version@" />
-+			<entry key="build.timestamp" value="unknown" />
- 		</propertyfile>
+@@ -228,7 +228,7 @@
 	</target>
 
 	<!-- Compile the product itself (no tests). -->
@ -35,12 +27,3 @@
 		<mkdir dir="tmp/report"/>
 		<junit printsummary="yes" failureproperty="junit.failure" forkmode="once">
 
-@@ -351,7 +351,7 @@
- 			ignoreerrors="true"/>
- 	</target>
- 
-	<target name="dist" depends="build, check-version, version-file"
-+	<target name="dist" depends="build, version-file"
- 					description="Make the distribution area">
- 
- 		<mkdir dir="${dist}"/>
--- a/pkgs/applications/misc/mkgmap/default.nix
+++ b/pkgs/applications/misc/mkgmap/default.nix
@ -1,7 +1,7 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , fetchsvn
-, substituteAll
 , jdk
 , jre
 , ant
@ -24,14 +24,24 @@ stdenv.mkDerivation rec {
  };

  patches = [
-    (substituteAll {
-      # Disable automatic download of dependencies
-      src = ./build.xml.patch;
-      inherit version;
-    })
+    # Disable automatic download of dependencies
+    ./build.xml.patch
+    ./ignore-impure-test.patch
  ];

  postPatch = with deps; ''
+    # Fix the output jar timestamps for reproducibility
+    substituteInPlace build.xml \
+        --replace-fail '<jar ' '<jar modificationtime="0" '
+
+    # Manually create version properties file for reproducibility
+    mkdir -p build/classes
+    cat > build/classes/mkgmap-version.properties << EOF
+      svn.version=${version}
+      build.timestamp=unknown
+    EOF
+
+    # Put pre-fetched dependencies into the right place
    mkdir -p lib/compile
    cp ${fastutil} lib/compile/${fastutil.name}
    cp ${osmpbf} lib/compile/${osmpbf.name}
@ -53,36 +63,51 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ jdk ant makeWrapper ];

-  buildPhase = "ant";
+  buildPhase = ''
+    runHook preBuild
+    ant
+    runHook postBuild
+  '';

  inherit doCheck;

-  checkPhase = "ant test";
+  checkPhase = ''
+    runHook preCheck
+    ant test
+    runHook postCheck
+  '';

  installPhase = ''
+    runHook preInstall
+
    install -Dm644 dist/mkgmap.jar -t $out/share/java/mkgmap
    install -Dm644 dist/doc/mkgmap.1 -t $out/share/man/man1
    cp -r dist/lib/ $out/share/java/mkgmap/
    makeWrapper ${jre}/bin/java $out/bin/mkgmap \
      --add-flags "-jar $out/share/java/mkgmap/mkgmap.jar"
-  '' + lib.optionalString withExamples ''
-    mkdir -p $out/share/mkgmap
-    cp -r dist/examples $out/share/mkgmap/
+
+    ${lib.optionalString withExamples ''
+      mkdir -p $out/share/mkgmap
+      cp -r dist/examples $out/share/mkgmap/
+    ''}
+
+    runHook postInstall
  '';

  passthru.updateScript = [ ./update.sh "mkgmap" meta.downloadPage ];

  meta = with lib; {
    description = "Create maps for Garmin GPS devices from OpenStreetMap (OSM) data";
-    homepage = "https://www.mkgmap.org.uk/";
    downloadPage = "https://www.mkgmap.org.uk/download/mkgmap.html";
-    sourceProvenance = with sourceTypes; [
-      fromSource
-      binaryBytecode  # deps
-    ];
+    homepage = "https://www.mkgmap.org.uk/";
    license = licenses.gpl2Only;
+    mainProgram = "mkgmap";
    maintainers = with maintainers; [ sikmir ];
    platforms = platforms.all;
-    mainProgram = "mkgmap";
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode # deps
+    ];
  };
+
 }
--- a/pkgs/applications/misc/mkgmap/ignore-impure-test.patch
+++ b/pkgs/applications/misc/mkgmap/ignore-impure-test.patch
@ -0,0 +1,20 @@
+diff --git a/test/uk/me/parabola/imgfmt/app/srt/SrtCollatorTest.java b/test/uk/me/parabola/imgfmt/app/srt/SrtCollatorTest.java
+index e1e4ac7..954b918 100644
+--- a/test/uk/me/parabola/imgfmt/app/srt/SrtCollatorTest.java
+++ b/test/uk/me/parabola/imgfmt/app/srt/SrtCollatorTest.java
+@@ -17,6 +17,7 @@ import java.text.Collator;
+ import uk.me.parabola.mkgmap.srt.SrtTextReader;
+ 
+ import org.junit.Before;
+import org.junit.Ignore;
+ import org.junit.Test;
+ 
+ import static org.junit.Assert.*;
+@@ -111,6 +112,7 @@ public class SrtCollatorTest {
+ 	 * meant to be identical to the java one.
+ 	 */
+ 	@Test
+	@Ignore
+ 	public void testJavaRules() {
+ 		Collator collator = Collator.getInstance();
+ 
--- a/pkgs/applications/misc/mkgmap/splitter/build.xml.patch
+++ b/pkgs/applications/misc/mkgmap/splitter/build.xml.patch
@ -1,13 +1,6 @@
 --- a/build.xml	(revision 597)
 +++ a/build.xml	(working copy)
-@@ -207,12 +207,12 @@
- 		<property name="svn.version.build" value="unknown"/>
- 
- 		<propertyfile file="${build.classes}/splitter-version.properties">
-			<entry key="svn.version" value="${svn.version.build}" />
-			<entry key="build.timestamp" value="${build.timestamp}" />
-+			<entry key="svn.version" value="@version@" />
-+			<entry key="build.timestamp" value="unknown" />
+@@ -212,7 +212,7 @@
 		</propertyfile>
 	</target>
 
@ -25,15 +18,6 @@
     <javac srcdir="${test}" destdir="${build.test-classes}" debug="yes" includeantruntime="false">
       <include name="**/*.java"/>
       <classpath refid="test.classpath"/>
-@@ -261,7 +261,7 @@
- 	  <fail if="junit.failure" message="Test failed.  See test-reports/index.html"/>
- 	</target>
- 
-  <target name="dist" depends="build, check-version, version-file" description="Make the distribution area">
-+  <target name="dist" depends="build, version-file" description="Make the distribution area">
- 
-     <mkdir dir="${dist}"/>
-     <mkdir dir="${dist}/doc/api"/>
@@ -324,7 +324,7 @@
 	</target>
 
--- a/pkgs/applications/misc/mkgmap/splitter/default.nix
+++ b/pkgs/applications/misc/mkgmap/splitter/default.nix
@ -1,7 +1,7 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , fetchsvn
-, substituteAll
 , jdk
 , jre
 , ant
@ -23,17 +23,25 @@ stdenv.mkDerivation rec {
  };

  patches = [
-    (substituteAll {
-      # Disable automatic download of dependencies
-      src = ./build.xml.patch;
-      inherit version;
-    })
-
+    # Disable automatic download of dependencies
+    ./build.xml.patch
    # Fix func.SolverAndProblemGeneratorTest test
    ./fix-failing-test.patch
  ];

  postPatch = with deps; ''
+    # Fix the output jar timestamps for reproducibility
+    substituteInPlace build.xml \
+        --replace-fail '<jar ' '<jar modificationtime="0" '
+
+    # Manually create version properties file for reproducibility
+    mkdir -p build/classes
+    cat > build/classes/splitter-version.properties << EOF
+      svn.version=${version}
+      build.timestamp=unknown
+    EOF
+
+    # Put pre-fetched dependencies into the right place
    mkdir -p lib/compile
    cp ${fastutil} lib/compile/${fastutil.name}
    cp ${osmpbf} lib/compile/${osmpbf.name}
@ -52,32 +60,46 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ jdk ant makeWrapper ];

-  buildPhase = "ant";
+  buildPhase = ''
+    runHook preBuild
+    ant
+    runHook postBuild
+  '';

  inherit doCheck;

-  checkPhase = "ant run.tests && ant run.func-tests";
+  checkPhase = ''
+    runHook preCheck
+    ant run.tests
+    ant run.func-tests
+    runHook postCheck
+  '';

  installPhase = ''
+    runHook preInstall
+
    install -Dm644 dist/splitter.jar -t $out/share/java/splitter
    install -Dm644 doc/splitter.1 -t $out/share/man/man1
    cp -r dist/lib/ $out/share/java/splitter/
    makeWrapper ${jre}/bin/java $out/bin/splitter \
      --add-flags "-jar $out/share/java/splitter/splitter.jar"
+
+    runHook postInstall
  '';

  passthru.updateScript = [ ../update.sh "mkgmap-splitter" meta.downloadPage ];

  meta = with lib; {
    description = "Utility for splitting OpenStreetMap maps into tiles";
-    homepage = "https://www.mkgmap.org.uk/";
    downloadPage = "https://www.mkgmap.org.uk/download/splitter.html";
-    sourceProvenance = with sourceTypes; [
-      fromSource
-      binaryBytecode  # deps
-    ];
+    homepage = "https://www.mkgmap.org.uk/";
    license = licenses.gpl2Only;
+    mainProgram = "splitter";
    maintainers = with maintainers; [ sikmir ];
    platforms = platforms.all;
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode # deps
+    ];
  };
 }
--- a/pkgs/applications/misc/phoc/default.nix
+++ b/pkgs/applications/misc/phoc/default.nix
@ -65,7 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
        inherit (finalAttrs) src;
        preferLocalBuild = true;
        allowSubstitutes = false;
-        phases = "unpackPhase installPhase";
        installPhase = "cp subprojects/packagefiles/wlroots/$name $out";
      })
    ];
--- a/pkgs/applications/misc/swaynotificationcenter/default.nix
+++ b/pkgs/applications/misc/swaynotificationcenter/default.nix
@ -30,13 +30,13 @@

 stdenv.mkDerivation (finalAttrs: rec {
  pname = "SwayNotificationCenter";
-  version = "0.10.0";
+  version = "0.10.1";

  src = fetchFromGitHub {
    owner = "ErikReider";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-7O+DX4uuncUqx5zEKQprZE6tctteT6NU01V2EBHiFqA=";
+    hash = "sha256-SR3FfEit50y4XSCLh3raUoigRNXpxh0mk4qLhQ/FozM=";
  };

  # build pkg-config is required to locate the native `scdoc` input
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "glooctl";
-  version = "1.16.5";
+  version = "1.16.6";

  src = fetchFromGitHub {
    owner = "solo-io";
    repo = "gloo";
    rev = "v${version}";
-    hash = "sha256-pxF5X3fCBeWFLQj8S0xYDcQNRs375RJIrl62nGjZZr0=";
+    hash = "sha256-vn04bNkg0De46kLcyuaWt9watBXFIGI+4X8SBW3XNyg=";
  };

-  vendorHash = "sha256-kbbgEnpqev7b4Sycmhs8xbu+yO4oMELh9xDmw7YyWYU=";
+  vendorHash = "sha256-UyzqKpF2WBj25Bm4MtkF6yjl87A61vGsteBNCjJV178=";

  subPackages = [ "projects/gloo/cli/cmd" ];

--- a/pkgs/applications/networking/cluster/kubent/default.nix
+++ b/pkgs/applications/networking/cluster/kubent/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubent";
-  version = "0.7.1";
+  version = "0.7.2";

  src = fetchFromGitHub {
    owner = "doitintl";
    repo = "kube-no-trouble";
    rev = version;
-    sha256 = "sha256-fJRaahK/tDns+edi1GIdYRk4+h2vbY2LltZN2hxvKGI=";
+    sha256 = "sha256-/gCbj0RDwV5E8kNkEu+37ilzw/A0BAXiYfHGPdkCsRs=";
  };

-  vendorHash = "sha256-nEc0fngop+0ju8hDu7nowBsioqCye15Jo1mRlM0TtlQ=";
+  vendorHash = "sha256-6hp7mzE45Tlmt4ybhpdJLYCv+WqQ9ak2S47kJTwyGVI=";

  ldflags = [
    "-w" "-s"
--- a/pkgs/applications/networking/cluster/kubeshark/default.nix
+++ b/pkgs/applications/networking/cluster/kubeshark/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubeshark";
-  version = "52.1.63";
+  version = "52.1.66";

  src = fetchFromGitHub {
    owner = "kubeshark";
    repo = "kubeshark";
    rev = "v${version}";
-    hash = "sha256-Ub8FsynnsAiLF4YwZHbhmQIJANAe/lCUgfq3ys/dtO8=";
+    hash = "sha256-4xw4DQ5C3QpykMSac7jGuW5L8Yx1XcBAMLypTvD5T7c=";
  };

  vendorHash = "sha256-SmvO9DYOXxnmN2dmHPPOguVwEbWSH/xNLBB+idpzopo=";
--- a/pkgs/applications/networking/gnmic/default.nix
+++ b/pkgs/applications/networking/gnmic/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "gnmic";
-  version = "0.35.1";
+  version = "0.36.2";

  src = fetchFromGitHub {
    owner = "openconfig";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-1Rtq/tRDU8hwrEYhP2/2qPWAYeCPL03m4NpXO3sGUdo=";
+    hash = "sha256-PUOIKPkzM6riiXR8R1Io0QI/qr6HaexfFgbp2Hx2SOo=";
  };

-  vendorHash = "sha256-HoOjVfpowb5jvAYdQ3cbCQmSl1RJKPDjvOaOGfhe5TY=";
+  vendorHash = "sha256-zrG/rNoYtfVNN50g41txLQIcBAKi1yE5p1TODrDiXzU=";

  ldflags = [
    "-s" "-w"
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@ -36,16 +36,16 @@ let
 in
 buildNpmPackage rec {
  pname = "deltachat-desktop";
-  version = "1.44.0";
+  version = "1.44.1";

  src = fetchFromGitHub {
    owner = "deltachat";
    repo = "deltachat-desktop";
    rev = "v${version}";
-    hash = "sha256-EHMKk5V77b+wTf72K9FUclrUzmAm51l4uv3vhOrCloA=";
+    hash = "sha256-fL+9oPQ5dAgvQREZ7A+hKo2MnZKeVvadQDvDPsDNbnQ=";
  };

-  npmDepsHash = "sha256-nuhOrgHXKK01EirWYmGF17V+aYhZipwmhnAuNqwSQ/c=";
+  npmDepsHash = "sha256-rUxJLDsAfp+brecTThYTdHIVIfVkKwZ/W5sHV0hHHIk=";

  postPatch = ''
    test \
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -2,7 +2,7 @@
 let
  versions =
    if stdenv.isLinux then {
-      stable = "0.0.43";
+      stable = "0.0.44";
      ptb = "0.0.72";
      canary = "0.0.285";
      development = "0.0.13";
@ -17,7 +17,7 @@ let
    x86_64-linux = {
      stable = fetchurl {
        url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-DO8bS5luSKhKW6sJZhz4xVeIPexQVoaD4xYugHCN3uk=";
+        hash = "sha256-mzpir5Js3pDtuOK5bKocd74p0PcDnMpNpx8PpchE6FE=";
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
--- a/pkgs/applications/networking/irc/halloy/default.nix
+++ b/pkgs/applications/networking/irc/halloy/default.nix
@ -15,13 +15,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "halloy";
-  version = "2024.2";
+  version = "2024.3";

  src = fetchFromGitHub {
    owner = "squidowl";
    repo = "halloy";
    rev = "refs/tags/${version}";
-    hash = "sha256-SzjMoXISd4fMHoenF1CK3Yn8bfLq9INuOmt86QTcgk8=";
+    hash = "sha256-9yEkM65c8R71oQ0C54xZqwRh609+HSaq4Hb8izNM52A=";
  };

  cargoLock = {
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "rclone";
-  version = "1.65.2";
+  version = "1.66.0";

  src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "rclone";
+    repo = "rclone";
    rev = "v${version}";
-    hash = "sha256-P7VJ6pauZ7J8LvyYNi7ANsKrYOcmInZCfRO+X+K6LzI=";
+    hash = "sha256-75RnAROICtRUDn95gSCNO0F6wes4CkJteNfUN38GQIY=";
  };

-  vendorHash = "sha256-budC8psvTtfVi3kYOaJ+dy/9H11ekJVkXMmeV9RhXVU=";
+  vendorHash = "sha256-zGBwgIuabLDqWbutvPHDbPRo5Dd9kNfmgToZXy7KVgI=";

  subPackages = [ "." ];

--- a/pkgs/applications/office/jameica/default.nix
+++ b/pkgs/applications/office/jameica/default.nix
@ -1,4 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, makeDesktopItem, makeWrapper, wrapGAppsHook, ant, jdk, jre, gtk2, glib, xorg, Cocoa }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeDesktopItem
+, makeWrapper
+, wrapGAppsHook
+, ant
+, jdk
+, jre
+, gtk2
+, glib
+, libXtst
+, Cocoa
+}:

 let
  _version = "2.10.4";
@ -26,10 +39,6 @@ stdenv.mkDerivation rec {
  pname = "jameica";
  inherit version;

-  nativeBuildInputs = [ ant jdk wrapGAppsHook makeWrapper ];
-  buildInputs = lib.optionals stdenv.isLinux [ gtk2 glib xorg.libXtst ]
-    ++ lib.optional stdenv.isDarwin Cocoa;
-
  src = fetchFromGitHub {
    owner = "willuhn";
    repo = "jameica";
@ -37,15 +46,29 @@ stdenv.mkDerivation rec {
    hash = "sha256-MSVSd5DyVL+dcfTDv1M99hxickPwT2Pt6QGNsu6DGZI=";
  };

+  postPatch = ''
+    # Fix jar timestamps for reproducibility
+    substituteInPlace build/build.xml \
+        --replace-fail '<jar ' '<jar modificationtime="0" '
+  '';
+
+  nativeBuildInputs = [ ant jdk wrapGAppsHook makeWrapper ];
+  buildInputs = lib.optionals stdenv.isLinux [ gtk2 glib libXtst ]
+    ++ lib.optional stdenv.isDarwin Cocoa;
+
  dontWrapGApps = true;

  # there is also a build.gradle, but it only seems to be used to vendor 3rd party libraries
  # and is not able to build the application itself
  buildPhase = ''
-    (cd build; ant -Dsystem.version=${version} init compile jar)
+    runHook preBuild
+    ant -f build -Dsystem.version=${version} init compile jar
+    runHook postBuild
  '';

  installPhase = ''
+    runHook preInstall
+
    mkdir -p $out/libexec $out/lib $out/bin $out/share/{applications,jameica-${version},java}/

    # copy libraries except SWT
@ -57,6 +80,8 @@ stdenv.mkDerivation rec {
    install -Dm644 plugin.xml $out/share/java/
    install -Dm644 build/jameica-icon.png $out/share/pixmaps/jameica.png
    cp ${desktopItem}/share/applications/* $out/share/applications/
+
+    runHook postInstall
  '';

  postFixup = ''
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "PortfolioPerformance";
-  version = "0.68.0";
+  version = "0.68.1";

  src = fetchurl {
    url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-AzWbmew1kleFdhX1IYHwxzNGEe8rw3rvRKGtF9J7tWw=";
+    hash = "sha256-ZXtBKc5vQz9fDyiG+DYOx7DsnnsORiltOacdx4AqFjg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/office/tryton/default.nix
+++ b/pkgs/applications/office/tryton/default.nix
@ -21,13 +21,13 @@ with lib;

 python3Packages.buildPythonApplication rec {
  pname = "tryton";
-  version = "7.0.5";
+  version = "7.0.7";

  disabled = !python3Packages.isPy3k;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-NAnNBfwnMky0qbtU3P5+kHJwCj6nfIQCtYgu6nXLcaQ=";
+    sha256 = "sha256-NODeDEgmf/nSKrM+RxAUsUwsbVQT7OSDrTOGVBwOzpw=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/logic/elan/0001-dynamically-patchelf-binaries.patch
+++ b/pkgs/applications/science/logic/elan/0001-dynamically-patchelf-binaries.patch
@ -2,7 +2,7 @@ diff --git a/src/elan-dist/src/component/package.rs b/src/elan-dist/src/componen
 index c51e76d..ae8159e 100644
 --- a/src/elan-dist/src/component/package.rs
 +++ b/src/elan-dist/src/component/package.rs
-@@ -56,6 +56,35 @@ fn unpack_without_first_dir<R: Read>(archive: &mut tar::Archive<R>, path: &Path)
+@@ -56,6 +56,37 @@ fn unpack_without_first_dir<R: Read>(archive: &mut tar::Archive<R>, path: &Path)
         entry
             .unpack(&full_path)
             .chain_err(|| ErrorKind::ExtractingPackage)?;
@ -26,9 +26,11 @@ index c51e76d..ae8159e 100644
 +        use std::os::unix::fs::PermissionsExt;
 +        let new_path = dest_path.with_extension("orig");
 +        ::std::fs::rename(dest_path, &new_path)?;
-+        ::std::fs::write(dest_path, format!(r#"#! @shell@
-+LEAN_CC="${{LEAN_CC:-@cc@}}" exec -a "$0" {} "$@" -L {}/lib  # use bundled libraries, but not bundled compiler that doesn't know about NIX_LDFLAGS
-+"#, new_path.to_str().unwrap(), dest_path.parent().unwrap().parent().unwrap().to_str().unwrap()))?;
+        ::std::fs::write(dest_path, r#"#! @shell@
+dir="$(dirname "${BASH_SOURCE[0]}")"
+# use bundled libraries, but not bundled compiler that doesn't know about NIX_LDFLAGS
+LEAN_CC="${LEAN_CC:-@cc@}" exec -a "$0" "$dir/leanc.orig" "$@" -L"$dir/../lib"
+"#)?;
 +        ::std::fs::set_permissions(dest_path, ::std::fs::Permissions::from_mode(0o755))?;
 +    }
 +
--- a/pkgs/applications/science/logic/elan/default.nix
+++ b/pkgs/applications/science/logic/elan/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, runCommand, patchelf, makeWrapper, pkg-config, curl, runtimeShell, fetchpatch
+{ stdenv, lib, runCommand, patchelf, makeWrapper, pkg-config, curl, runtimeShell
 , openssl, zlib, fetchFromGitHub, rustPlatform, libiconv }:

 rustPlatform.buildRustPackage rec {
@ -23,14 +23,6 @@ rustPlatform.buildRustPackage rec {
  buildFeatures = [ "no-self-update" ];

  patches = lib.optionals stdenv.isLinux [
-    # revert temporary directory creation, because it break the wrapper
-    # https://github.com/NixOS/nixpkgs/pull/289941#issuecomment-1980778358
-    (fetchpatch {
-      url = "https://github.com/leanprover/elan/commit/bd54acaab75d08b3912ee1f051af8657f3a9cfdf.patch";
-      hash = "sha256-6If/wxWSea8Zjlp3fx9wh3D0TjmWZbvCuY9q5c2qJGA=";
-      revert = true;
-    })
-
    # Run patchelf on the downloaded binaries.
    # This is necessary because Lean 4 is now dynamically linked.
    (runCommand "0001-dynamically-patchelf-binaries.patch" {
--- a/pkgs/applications/science/math/primesieve/default.nix
+++ b/pkgs/applications/science/math/primesieve/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "primesieve";
-  version = "12.0";
+  version = "12.1";

  src = fetchFromGitHub {
    owner = "kimwalisch";
    repo = "primesieve";
    rev = "v${version}";
-    hash = "sha256-xmOq18falvT8PKhJPwWm/aeOMf7I3ywR+h5OkTM3G6s=";
+    hash = "sha256-AHl2GfZ1oJ8ZyjJzvg10AqN7TA7HFZ+qa6N2v51Qa78=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/version-management/jujutsu/default.nix
+++ b/pkgs/applications/version-management/jujutsu/default.nix
@ -11,7 +11,6 @@
 , libssh2
 , libgit2
 , zstd
-, fetchpatch
 , installShellFiles
 , nix-update-script
 , testers
@ -20,19 +19,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "jujutsu";
-  version = "0.14.0";
+  version = "0.15.1";

  src = fetchFromGitHub {
    owner = "martinvonz";
    repo = "jj";
    rev = "v${version}";
-    hash = "sha256-xnGnervyXPfZyQTYsPu09fj+QvbEZ6rDJ4fYHBeF/RY=";
+    hash = "sha256-yppQIffjpyQ2nqhiZbV2pSMQJx8srmHjAk+UClCQfRw=";
  };

-  cargoHash = "sha256-wuZ0zthaemzyDn5J2au2L2k0QJnzbrCRjSBIPivEbnQ=";
+  cargoHash = "sha256-2BmKC8DaOdD/THchImmGqplhDrHQHEMyWORWnE2ygSM=";

  cargoBuildFlags = [ "--bin" "jj" ]; # don't install the fake editors
-  useNextest = true; # nextest is the upstream integration framework
+  useNextest = false; # nextest is the upstream integration framework, but is problematic for test skipping
  ZSTD_SYS_USE_PKG_CONFIG = "1";    # disable vendored zlib
  LIBSSH2_SYS_USE_PKG_CONFIG = "1"; # disable vendored libssh2

@ -63,6 +62,11 @@ rustPlatform.buildRustPackage rec {
      --zsh <($out/bin/jj util completion zsh)
  '';

+  checkFlags = [
+    # signing tests spin up an ssh-agent and do git checkouts
+    "--skip=test_ssh_signing"
+  ];
+
  passthru = {
    updateScript = nix-update-script { };
    tests = {
--- a/pkgs/applications/video/rtabmap/default.nix
+++ b/pkgs/applications/video/rtabmap/default.nix
@ -27,32 +27,20 @@

 stdenv.mkDerivation rec {
  pname = "rtabmap";
-  version = "0.21.0";
+  version = "0.21.4";

  src = fetchFromGitHub {
    owner = "introlab";
    repo = "rtabmap";
    rev = "refs/tags/${version}";
-    hash = "sha256-1xb8O3VrErldid2OgAUMG28mSUO7QBUsPuSz8p03tSI";
+    hash = "sha256-HrIATYRuhFfTlO4oTRZo7CM30LFVyatZJON31Fe4HTQ=";
  };

-  patches = [
-    # Fix build with g2o 20230806
-    (fetchpatch {
-      url = "https://github.com/introlab/rtabmap/commit/85cc6fe3c742855ad16c8442895e12dbb10b6e8b.patch";
-      hash = "sha256-P6GkYKCNwe9dgZdgF/oEhgjA3bJnwXFWJCPoyIknQCo=";
-    })
-    # Fix typo in previous patch
-    (fetchpatch {
-      url = "https://github.com/introlab/rtabmap/commit/c4e94bcdc31b859c1049724dbb7671e4597d86de.patch";
-      hash = "sha256-1btkV4/y+bnF3xEVqlUy/9F6BoANeTOEJjZLmRzG3iA=";
-    })
-  ];
-
  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook wrapGAppsHook ];
  buildInputs = [
    ## Required
    opencv
+    opencv.cxxdev
    pcl
    liblapack
    xorg.libSM
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@ -2,6 +2,7 @@
 , rustPlatform
 , fetchFromGitHub
 , stdenv
+, installShellFiles
 }:

 rustPlatform.buildRustPackage rec {
@ -22,11 +23,20 @@ rustPlatform.buildRustPackage rec {
    NIX_LDFLAGS = "-l${stdenv.cc.libcxx.cxxabi.libName}";
  };

+  nativeBuildInputs = [ installShellFiles ];
+
  # error: linker `aarch64-linux-gnu-gcc` not found
  postPatch = ''
    rm .cargo/config.toml
  '';

+  postInstall = ''
+    installShellCompletion --cmd sg \
+      --bash <($out/bin/sg completions bash) \
+      --fish <($out/bin/sg completions fish) \
+      --zsh <($out/bin/sg completions zsh)
+  '';
+
  checkFlags = [
    # disable flaky test
    "--skip=test::test_load_parser_mac"
--- a/pkgs/by-name/bi/bitwarden-cli/package.nix
+++ b/pkgs/by-name/bi/bitwarden-cli/package.nix
@ -10,18 +10,18 @@

 buildNpmPackage rec {
  pname = "bitwarden-cli";
-  version = "2024.2.0";
+  version = "2024.2.1";

  src = fetchFromGitHub {
    owner = "bitwarden";
    repo = "clients";
    rev = "cli-v${version}";
-    hash = "sha256-nCjcwe+7Riml/J0hAVv/t6/oHIDPhwFD5A3iQ/LNR5Y=";
+    hash = "sha256-g9enDEIdVj9R3xkx5qllf7aTDa6F+MvozhwbJn9w/VY=";
  };

  nodejs = nodejs_18;

-  npmDepsHash = "sha256-GJl9pVwFWEg9yku9IXLcu2XMJZz+ZoQOxCf1TrW715Y=";
+  npmDepsHash = "sha256-fkoI8a8iVMWxtXAj5zNg2xwK/ZPyRZGPo7rnxHpKV7k=";

  nativeBuildInputs = [
    python3
--- a/pkgs/by-name/bo/bochs/package.nix
+++ b/pkgs/by-name/bo/bochs/package.nix
@ -25,11 +25,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bochs";
-  version = "2.7";
+  version = "2.8";

  src = fetchurl {
    url = "mirror://sourceforge/project/bochs/bochs/${finalAttrs.version}/bochs-${finalAttrs.version}.tar.gz";
-    hash = "sha256-oBCrG/3HKsWgjS4kEs1HHA/r1mrx2TSbwNeWh53lsXo=";
+    hash = "sha256-qFsTr/fYQR96nzVrpsM7X13B+7EH61AYzCOmJjnaAFk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/cl/clash-meta/package.nix
+++ b/pkgs/by-name/cl/clash-meta/package.nix
@ -1,45 +1,13 @@
-{ lib
-, fetchFromGitHub
-, buildGoModule
-}:
+{ mihomo }:

-buildGoModule rec {
+mihomo.overrideAttrs (finalAttrs: previousAttrs: {
  pname = "clash-meta";
-  version = "1.18.1";
-
-  src = fetchFromGitHub {
-    owner = "MetaCubeX";
-    repo = "mihomo";
-    rev = "v${version}";
-    hash = "sha256-ezOkDrpytZQdc+Txe4eUyuWY6oipn9jIrmu7aO8lNlQ=";
-  };
-
-  vendorHash = "sha256-tvPR5kAta4MlMTwjfxwVOacRr2nVpfalbN08mfxml64=";
-
-  excludedPackages = [ "./test" ];
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X github.com/metacubex/mihomo/constant.Version=${version}"
-  ];
-
-  tags = [
-    "with_gvisor"
-  ];
-
-  # network required
-  doCheck = false;

  postInstall = ''
-    mv $out/bin/mihomo $out/bin/clash-meta
+    mv $out/bin/${previousAttrs.meta.mainProgram} $out/bin/${finalAttrs.meta.mainProgram}
  '';

-  meta = with lib; {
-    description = "A rule-based tunnel in Go. Present named mihomo";
-    homepage = "https://github.com/MetaCubeX/mihomo";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ oluceps ];
+  meta = previousAttrs.meta // {
    mainProgram = "clash-meta";
  };
-}
+})
--- a/pkgs/by-name/cl/clash-nyanpasu/package.nix
+++ b/pkgs/by-name/cl/clash-nyanpasu/package.nix
@ -0,0 +1,23 @@
+{ lib
+, clash-verge
+, mihomo
+, fetchurl
+}:
+
+(clash-verge.override {
+  clash-meta = mihomo;
+}).overrideAttrs (old: rec {
+  pname = "clash-nyanpasu";
+  version = "1.4.5";
+
+  src = fetchurl {
+    url = "https://github.com/keiko233/clash-nyanpasu/releases/download/v${version}/clash-nyanpasu_${version}_amd64.deb";
+    hash = "sha256-cxaq7Rndf0ytEaqc7CGQix5SOAdsTOoTj1Jlhjr5wEA=";
+  };
+
+  meta = old.meta // (with lib; {
+    homepage = "https://github.com/keiko233/clash-nyanpasu";
+    maintainers = with maintainers; [ Guanran928 ];
+    mainProgram = "clash-nyanpasu";
+  });
+})
--- a/pkgs/by-name/cl/clash-verge-rev/package.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/package.nix
@ -0,0 +1,19 @@
+{ lib
+, clash-verge
+, fetchurl
+}:
+
+clash-verge.overrideAttrs (old: rec {
+  pname = "clash-verge-rev";
+  version = "1.5.4";
+
+  src = fetchurl {
+    url = "https://github.com/clash-verge-rev/clash-verge-rev/releases/download/v${version}/clash-verge_${version}_amd64.deb";
+    hash = "sha256-UJYLfefgUASBmh0gyNmjsWdAadluKhwaXZL1wlVlbjU=";
+  };
+
+  meta = old.meta // (with lib; {
+    homepage = "https://github.com/clash-verge-rev/clash-verge-rev";
+    maintainers = with maintainers; [ Guanran928 ];
+  });
+})
--- a/pkgs/applications/networking/clash-verge/default.nix
+++ b/pkgs/applications/networking/clash-verge/default.nix
@ -42,13 +42,13 @@ stdenv.mkDerivation rec {

    mkdir -p $out/bin
    mv usr/* $out
-    rm $out/bin/{clash,clash-meta}

    runHook postInstall
  '';

  postFixup = ''
-    ln -s ${lib.getExe clash-meta} $out/bin/clash-meta
+    rm -f $out/bin/clash
+    ln -sf ${lib.getExe clash-meta} $out/bin/${clash-meta.meta.mainProgram}
  '';

  meta = with lib; {
--- a/pkgs/by-name/de/dep-scan/package.nix
+++ b/pkgs/by-name/de/dep-scan/package.nix
@ -5,19 +5,21 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "dep-scan";
-  version = "5.0.2";
+  version = "5.2.11";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "owasp-dep-scan";
    repo = "dep-scan";
    rev = "refs/tags/v${version}";
-    hash = "sha256-qiJyGBGxznNF4LNG9fbmjG7wX0odhrUO2LxOWABtLQA=";
+    hash = "sha256-BEvuCdQcr35jWe9r9KR4Uov1zNVxfPSnENNPgy4N+nc=";
  };

  postPatch = ''
    substituteInPlace pytest.ini \
      --replace " --cov-append --cov-report term --cov depscan" ""
+    substituteInPlace pyproject.toml \
+      --replace "oras==0.1.26" "oras~=0.1.26"
  '';

  nativeBuildInputs = with python3.pkgs; [
@ -26,9 +28,11 @@ python3.pkgs.buildPythonApplication rec {

  propagatedBuildInputs = with python3.pkgs; [
    appthreat-vulnerability-db
+    cvss
    defusedxml
    jinja2
    oras
+    packageurl-python
    pdfkit
    pygithub
    pyyaml
--- a/pkgs/by-name/et/etlegacy/package.nix
+++ b/pkgs/by-name/et/etlegacy/package.nix
@ -15,7 +15,7 @@
 , libogg
 , libpng
 , libtheora
-, lua
+, lua5_4
 , minizip
 , openal
 , SDL2
@ -23,7 +23,7 @@
 , zlib
 }:
 let
-  version = "2.81.1";
+  version = "2.82.0";

  fetchAsset = { asset, hash }: fetchurl {
    url = "https://mirror.etlegacy.com/etmain/${asset}";
@ -63,7 +63,7 @@ stdenv.mkDerivation {
    owner = "etlegacy";
    repo = "etlegacy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-CGXtc51vaId/SHbD34ZeT0gPsrl7p2DEw/Kp+GBZIaA="; # 2.81.1
+    hash = "sha256-yNVVEa+3+Swm3hgwm9cSLV0K88E37TgVVjh1uUl8O2o=";
  };

  nativeBuildInputs = [
@ -83,7 +83,7 @@ stdenv.mkDerivation {
    libogg
    libpng
    libtheora
-    lua
+    lua5_4
    minizip
    openal
    SDL2
--- a/pkgs/by-name/fr/fritz-exporter/console-script.patch
+++ b/pkgs/by-name/fr/fritz-exporter/console-script.patch
@ -1,14 +0,0 @@
-diff --git a/pyproject.toml b/pyproject.toml
-index ffad1a4..e7551da 100644
--- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -44,6 +44,9 @@ coverage = ">=6.4.4,<8.0.0"
- pytest-cov = ">=3,<5"
- ruff = "^0.1.7"
- 
-+[tool.poetry.scripts]
-+fritzexporter = "fritzexporter.__main__:main"
-+
- [build-system]
- requires = ["poetry-core"]
- build-backend = "poetry.core.masonry.api"
--- a/pkgs/by-name/fr/fritz-exporter/package.nix
+++ b/pkgs/by-name/fr/fritz-exporter/package.nix
@ -5,21 +5,16 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "fritz-exporter";
-  version = "2.3.1";
+  version = "2.4.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pdreker";
    repo = "fritz_exporter";
    rev = "fritzexporter-v${version}";
-    hash = "sha256-Dv/2Og1OJV7canZ8Y5Pai5gPRUvcRDYmSGoD2pnAkSs=";
+    hash = "sha256-2A8hw2XkdxkauG+lMlKfObEvLHUQk79xWmlp0hlrXYM=";
  };

-  patches = [
-    # https://github.com/pdreker/fritz_exporter/pull/282
-    ./console-script.patch
-  ];
-
  postPatch = ''
    # don't test coverage
    sed -i "/^addopts/d" pyproject.toml
@ -31,6 +26,7 @@ python3.pkgs.buildPythonApplication rec {

  propagatedBuildInputs = with python3.pkgs; [
    attrs
+    defusedxml
    fritzconnection
    prometheus-client
    pyyaml
--- a/pkgs/by-name/ga/gamja/package.nix
+++ b/pkgs/by-name/ga/gamja/package.nix
@ -0,0 +1,37 @@
+{
+  lib,
+  fetchFromSourcehut,
+  buildNpmPackage,
+  writeText,
+  # https://git.sr.ht/~emersion/gamja/tree/master/doc/config-file.md
+  gamjaConfig ? null,
+}:
+buildNpmPackage rec {
+  pname = "gamja";
+  version = "1.0.0-beta.9";
+
+  src = fetchFromSourcehut {
+    owner = "~emersion";
+    repo = "gamja";
+    rev = "v${version}";
+    hash = "sha256-09rCj9oMzldRrxMGH4rUnQ6wugfhfmJP3rHET5b+NC8=";
+  };
+
+  npmDepsHash = "sha256-LxShwZacCctKAfMNCUMyrSaI1hIVN80Wseq/d8WITkc=";
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r dist $out
+    ${lib.optionalString (gamjaConfig != null) "cp ${writeText "gamja-config" (builtins.toJSON gamjaConfig)} $out/config.json"}
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A simple IRC web client";
+    homepage = "https://git.sr.ht/~emersion/gamja";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [motiejus apfelkuchen6];
+  };
+}
--- a/pkgs/by-name/gm/gmetronome/package.nix
+++ b/pkgs/by-name/gm/gmetronome/package.nix
@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, pkg-config
+, autoreconfHook
+, wrapGAppsHook
+, gtkmm3
+, libpulseaudio
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gmetronome";
+  version = "0.3.3";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "dqpb";
+    repo = "gmetronome";
+    rev = version;
+    hash = "sha256-ilFO1HwleWIQ51Bkzck1sm1Yu3ugqkvZrpxPOYzXydM=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    autoreconfHook
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtkmm3
+    libpulseaudio
+  ];
+
+  meta = with lib; {
+    description = "A free software metronome and tempo measurement tool";
+    homepage = "https://gitlab.gnome.org/dqpb/gmetronome";
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ aleksana ];
+    mainProgram = "gmetronome";
+    broken = stdenv.isDarwin;
+  };
+}
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@ -10,13 +10,13 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.123.7";
+  version = "0.123.8";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = "hugo";
    rev = "refs/tags/v${version}";
-    hash = "sha256-uUE694xbu508vny/sbxndGlsFXnBz45fLhieuK4sX/c=";
+    hash = "sha256-sL/LiQwbn3nD2eDFNuAbDHRGemTiBhTfb5IaugYL9dM=";
  };

  vendorHash = "sha256-V7YRrC+6fOIjXOu7E0kIOZZt++4oFLPhmHeWmOVU3Xw=";
--- a/pkgs/by-name/in/invidtui/package.nix
+++ b/pkgs/by-name/in/invidtui/package.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "invidtui";
-  version = "0.4.2";
+  version = "0.4.4";

  src = fetchFromGitHub {
    owner = "darkhz";
    repo = "invidtui";
    rev = "refs/tags/v${version}";
-    hash = "sha256-/HsoV8HdMffD7dzRblSSBMv7kBPRpxUarM5WZoYVxvQ=";
+    hash = "sha256-nNJ2bjrHRIzcPs+jbZpgaHBxSWRzSRIsT6xx9EsbISg=";
  };

-  vendorHash = "sha256-T/muFaQQp/joOCehNZQc5CWmyGakoRaGAsO2mTOODJA=";
+  vendorHash = "sha256-C7O2GJuEdO8geRPfHx1Sq6ZveDE/u65JBx/Egh3cnK4=";

  doCheck = true;

--- a/pkgs/development/tools/just/default.nix
+++ b/pkgs/development/tools/just/default.nix
@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "just";
-  version = "1.25.0";
+  version = "1.25.1";
  outputs = [ "out" "man" "doc" ];

  src = fetchFromGitHub {
    owner = "casey";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-ymFBR40lY1ZX6vLH6KDX0a9mI9eOuOJY4bjp2UBubG4=";
+    hash = "sha256-CvOnvUez2mfta9aXmdsLFxpVB/TGDw0y0ha3OyNJ2DE=";
  };

-  cargoHash = "sha256-B10p57SZSzccs53/OtqFuftHJSxaHRpa+cHODqBo8t4=";
+  cargoHash = "sha256-b4hprcYOcY0z0UnUe3pGc87j+X3n52btYlaCemETLYg=";

  nativeBuildInputs = [ installShellFiles mdbook ];
  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
--- a/pkgs/development/tools/just/setup-hook.sh
+++ b/pkgs/development/tools/just/setup-hook.sh
--- a/pkgs/by-name/ka/kanagawa-gtk-theme/package.nix
+++ b/pkgs/by-name/ka/kanagawa-gtk-theme/package.nix
@ -0,0 +1,42 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gtk3
+, gtk-engine-murrine
+}:
+stdenvNoCC.mkDerivation {
+  pname = "kanagawa-gtk-theme";
+  version = "0-unstable-2023-07-03";
+
+  src = fetchFromGitHub {
+    owner = "Fausto-Korpsvart";
+    repo = "Kanagawa-GKT-Theme";
+    rev = "35936a1e3bbd329339991b29725fc1f67f192c1e";
+    hash = "sha256-BZRmjVas8q6zsYbXFk4bCk5Ec/3liy9PQ8fqFGHAXe0=";
+  };
+
+  nativeBuildInputs = [
+    gtk3
+  ];
+
+  propagatedUserEnvPkgs = [
+    gtk-engine-murrine
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/themes
+    cp -a themes/* $out/share/themes
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A GTK theme with the Kanagawa colour palette";
+    homepage = "https://github.com/Fausto-Korpsvart/Kanagawa-GKT-Theme";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ iynaix ];
+    platforms = gtk3.meta.platforms;
+  };
+}
--- a/pkgs/by-name/ka/kanagawa-icon-theme/package.nix
+++ b/pkgs/by-name/ka/kanagawa-icon-theme/package.nix
@ -0,0 +1,47 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, gtk3
+, hicolor-icon-theme
+}:
+stdenvNoCC.mkDerivation {
+  pname = "kanagawa-icon-theme";
+  version = "0-unstable-2023-07-03";
+
+  src = fetchFromGitHub {
+    owner = "Fausto-Korpsvart";
+    repo = "Kanagawa-GKT-Theme";
+    rev = "35936a1e3bbd329339991b29725fc1f67f192c1e";
+    hash = "sha256-BZRmjVas8q6zsYbXFk4bCk5Ec/3liy9PQ8fqFGHAXe0=";
+  };
+
+  nativeBuildInputs = [
+    gtk3
+  ];
+
+  propagatedBuildInputs = [
+    hicolor-icon-theme
+  ];
+
+  dontDropIconThemeCache = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/icons
+    cp -a icons/* $out/share/icons
+    for theme in $out/share/icons/*; do
+      gtk-update-icon-cache -f $theme
+    done
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "An icon theme for the Kanagawa colour palette";
+    homepage = "https://github.com/Fausto-Korpsvart/Kanagawa-GKT-Theme";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ iynaix ];
+    platforms = gtk3.meta.platforms;
+  };
+}
--- a/pkgs/by-name/li/librum/package.nix
+++ b/pkgs/by-name/li/librum/package.nix
@ -0,0 +1,68 @@
+{ lib
+, mupdf
+, stdenv
+, fetchFromGitHub
+, substituteAll
+, cmake
+, qt6
+, desktopToDarwinBundle
+}:
+
+let
+  mupdf-cxx = mupdf.override { enableCxx = true; };
+in
+stdenv.mkDerivation rec {
+  pname = "librum";
+  version = "0.12.1";
+
+  src = fetchFromGitHub {
+    owner = "Librum-Reader";
+    repo = "Librum";
+    rev = "v.${version}";
+    fetchSubmodules = true;
+    hash = "sha256-/QxTWlTMoXykPe3z+mmn6eaGRJDu2IX8BJPcXi1gUqQ=";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./use_mupdf_in_nixpkgs.patch;
+      nixMupdfLibPath = "${mupdf-cxx.out}/lib";
+      nixMupdfIncludePath = "${mupdf-cxx.dev}/include";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    qt6.qttools
+    qt6.wrapQtAppsHook
+  ] ++ lib.optionals stdenv.isDarwin [
+    desktopToDarwinBundle
+  ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtsvg
+  ] ++ lib.optionals stdenv.isLinux [
+    qt6.qtwayland
+  ];
+
+  meta = with lib; {
+    description = "An application designed to make reading enjoyable and straightforward";
+    longDescription = ''
+      Librum is an application designed to make reading enjoyable
+      and straightforward for everyone. It's not just an e-book
+      reader. With Librum, you can manage your own online library
+      and access it from any device anytime, anywhere. It has
+      features like note-taking, AI tooling, and highlighting,
+      while offering customization to make it as personal as you
+      want! Librum also provides free access to over 70,000 books
+      and personal reading statistics while being free and
+      completely open source.
+    '';
+    homepage = "https://librumreader.com";
+    license = licenses.gpl3Plus;
+    mainProgram = "librum";
+    maintainers = with maintainers; [ aleksana oluceps ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/by-name/li/librum/use_mupdf_in_nixpkgs.patch
+++ b/pkgs/by-name/li/librum/use_mupdf_in_nixpkgs.patch
@ -0,0 +1,109 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 191ff732..de46f35b 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -71,7 +71,7 @@ endif()
+ 
+ # Dependencies
+ add_subdirectory(libs/rapidfuzz-cpp)
+-
+include_directories(@nixMupdfIncludePath@)
+ 
+ # Build
+ add_subdirectory(src/)
+diff --git a/src/application/CMakeLists.txt b/src/application/CMakeLists.txt
+index bf122a66..64415be3 100644
+--- a/src/application/CMakeLists.txt
+++ b/src/application/CMakeLists.txt
+@@ -102,10 +102,9 @@ if(ANDROID)
+ endif()
+ 
+ if(UNIX)
+-    set(MUPDF_OUTPUT_DIR "${PROJECT_SOURCE_DIR}/libs/mupdf/build/$<IF:$<CONFIG:Debug>,shared-debug,shared-release>")
+    set(MUPDF_OUTPUT_DIR "@nixMupdfLibPath@")
+     set(MUPDF_OUTPUT "${MUPDF_OUTPUT_DIR}/libmupdfcpp.so")
+     set(MUPDF_OUTPUT "${MUPDF_OUTPUT_DIR}/libmupdfcpp.so" PARENT_SCOPE)
+-    set(MUPDF_BUILD_COMMAND ./scripts/mupdfwrap.py ${VENV_OPTION} -d build/$<IF:$<CONFIG:Debug>,shared-debug,shared-release> -b --m-target libs ${EXTRA_MAKE_AGRS} -j 0 m01)
+ elseif(WIN32)
+     set(MUPDF_OUTPUT_DIR "${PROJECT_SOURCE_DIR}/libs/mupdf/platform/win32/x64/$<IF:$<CONFIG:Debug>,Debug,Release>")
+     set(MUPDF_OUTPUT "${MUPDF_OUTPUT_DIR}/mupdfcpp64.lib" PARENT_SCOPE)
+@@ -113,8 +112,6 @@ elseif(WIN32)
+     set(MUPDF_BUILD_COMMAND python scripts/mupdfwrap.py ${VENV_OPTION} -d build/$<IF:$<CONFIG:Debug>,shared-debug,shared-release> -b -j 0 m01)
+ endif()
+ 
+-message("MuPdf build command: " ${MUPDF_BUILD_COMMAND})
+-
+ 
+ set(CC_COMMAND "${CMAKE_C_COMPILER}")
+ set(CXX_COMMAND "${CMAKE_CXX_COMPILER}")
+@@ -135,18 +132,6 @@ else()
+ endif()
+ 
+ 
+-add_custom_target(mupdf
+-   COMMAND ${CMAKE_COMMAND} -E env
+-        ${ANDROID_COMPILERS}
+-        "USE_SYSTEM_LIBJPEG=${USE_SYSTEM_LIBJPEG_VALUE}"
+-        "USE_SONAME=no"
+-        ${MUPDF_BUILD_COMMAND}
+-   BYPRODUCTS ${MUPDF_OUTPUT}
+-   WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/libs/mupdf
+-   COMMENT "Building mupdf (This takes a while) ..."
+-)
+-
+-
+ #Copy the mupdf dlls to the build directory for windows
+ if(WIN32)
+     add_custom_command(
+@@ -168,8 +153,6 @@ add_library(application
+                     interfaces/utility/i_book_getter.hpp
+ )
+ 
+-add_dependencies(application mupdf) # Ensure the mupdf target is built before the application target
+-
+ target_compile_definitions(application PRIVATE APPLICATION_LIBRARY)
+ 
+ target_include_directories(application
+@@ -188,12 +171,6 @@ target_include_directories(application
+                     ${CMAKE_CURRENT_SOURCE_DIR}/core/utils
+ )
+ 
+-# Make sure to ignore warnings from mupdf by adding it as a system include directory
+-target_include_directories(application SYSTEM PUBLIC
+-                    ${PROJECT_SOURCE_DIR}/libs/mupdf/platform/c++/include
+-                    ${PROJECT_SOURCE_DIR}/libs/mupdf/include
+-)
+-
+ target_compile_definitions(application
+                 PRIVATE
+                     $<$<OR:$<CONFIG:Debug>,$<CONFIG:RelWithDebInfo>>:QT_QML_DEBUG>
+@@ -236,29 +213,10 @@ if(LINUX)
+     install(TARGETS application
+             DESTINATION lib
+             )
+-    
+-    # Install mupdf's shared libraries
+-    install(FILES ${MUPDF_OUTPUT_DIR}/libmupdfcpp.so
+-                  ${MUPDF_OUTPUT_DIR}/libmupdf.so
+-            DESTINATION lib)
+-
+-    # Install links with correct permissions
+-    if(EXISTS "${MUPDF_OUTPUT_DIR}/libmupdfcpp.so.24.0")
+-        install(FILES ${MUPDF_OUTPUT_DIR}/libmupdfcpp.so.24.0
+-                      ${MUPDF_OUTPUT_DIR}/libmupdf.so.24.0
+-                PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE
+-                            GROUP_READ GROUP_EXECUTE
+-                            WORLD_READ WORLD_EXECUTE
+-                DESTINATION lib)
+-    endif()
+ 
+ elseif(APPLE)
+     install(TARGETS application
+             DESTINATION lib
+             )
+     
+-    # Install mupdf's shared libraries
+-    install(FILES ${MUPDF_OUTPUT_DIR}/libmupdfcpp.so
+-                  ${MUPDF_OUTPUT_DIR}/libmupdf.dylib
+-            DESTINATION lib)
+ endif()
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@ -69,13 +69,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "2346";
+  version = "2382";

  src = fetchFromGitHub {
    owner = "ggerganov";
    repo = "llama.cpp";
    rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-s937fAOUjid2H+6OQEMicdkFQVqPJ37GR+DMrCV1ky4=";
+    hash = "sha256-VIh9StxfZrweOh6IU2MDJRFVu7TelngHGw7enSx5tL4=";
  };

  postPatch = ''
--- a/pkgs/by-name/mi/mihomo/package.nix
+++ b/pkgs/by-name/mi/mihomo/package.nix
@ -0,0 +1,41 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+}:
+
+buildGoModule rec {
+  pname = "mihomo";
+  version = "1.18.1";
+
+  src = fetchFromGitHub {
+    owner = "MetaCubeX";
+    repo = "mihomo";
+    rev = "v${version}";
+    hash = "sha256-ezOkDrpytZQdc+Txe4eUyuWY6oipn9jIrmu7aO8lNlQ=";
+  };
+
+  vendorHash = "sha256-tvPR5kAta4MlMTwjfxwVOacRr2nVpfalbN08mfxml64=";
+
+  excludedPackages = [ "./test" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/metacubex/mihomo/constant.Version=${version}"
+  ];
+
+  tags = [
+    "with_gvisor"
+  ];
+
+  # network required
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A rule-based tunnel in Go";
+    homepage = "https://github.com/MetaCubeX/mihomo";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ oluceps ];
+    mainProgram = "mihomo";
+  };
+}
--- a/pkgs/by-name/mo/movim/package.nix
+++ b/pkgs/by-name/mo/movim/package.nix
@ -1,6 +1,7 @@
 { lib
 , fetchFromGitHub
 , php
+, phpCfg ? null
 , withPgsql ? true # “strongly recommended” according to docs
 , withMysql ? false
 }:
@ -16,14 +17,16 @@ php.buildComposerProject (finalAttrs: {
    hash = "sha256-9MBe2IRYxvUuCc5m7ajvIlBU7YVm4A3RABlOOIjpKoM=";
  };

-  php = php.buildEnv {
+  php = php.buildEnv ({
    extensions = ({ all, enabled }:
      enabled
-      ++ (with all; [ curl dom gd imagick mbstring ])
-      ++ lib.optional withPgsql all.pgsql
-      ++ lib.optional withMysql all.mysqli
+        ++ (with all; [ curl dom gd imagick mbstring pdo simplexml ])
+        ++ lib.optionals withPgsql (with all; [ pdo_pgsql pgsql ])
+        ++ lib.optionals withMysql (with all; [ mysqli mysqlnd pdo_mysql ])
    );
-  };
+  } // lib.optionalAttrs (phpCfg != null) {
+    extraConfig = phpCfg;
+  });

  # no listed license
  # pinned commonmark
--- a/pkgs/by-name/my/mystmd/package.nix
+++ b/pkgs/by-name/my/mystmd/package.nix
@ -2,16 +2,16 @@

 buildNpmPackage rec {
  pname = "mystmd";
-  version = "1.1.45";
+  version = "1.1.46";

  src = fetchFromGitHub {
    owner = "executablebooks";
    repo = "mystmd";
    rev = "mystmd@${version}";
-    hash = "sha256-qHlgAc1ddSVevH/82QCVXjIlht/RMcypTUcY+A/gRRg=";
+    hash = "sha256-rMmq2xArkbVIZRFGCYSl9D65LxUdyiZMR6CbYJbKNSw=";
  };

-  npmDepsHash = "sha256-yEeATMpSEr20MJdzq8HWSSjRBd+rHEq2oMVOnKymWhY=";
+  npmDepsHash = "sha256-cwuKexK0S3pW0rJpjfbAHu7/MLSs8axbyX6BWJq2Ieo=";

  dontNpmInstall = true;

--- a/pkgs/by-name/ne/netease-cloud-music-gtk/Cargo.lock
+++ b/pkgs/by-name/ne/netease-cloud-music-gtk/Cargo.lock
--- a/pkgs/by-name/ne/netease-cloud-music-gtk/package.nix
+++ b/pkgs/by-name/ne/netease-cloud-music-gtk/package.nix
@ -22,19 +22,19 @@

 stdenv.mkDerivation rec {
  pname = "netease-cloud-music-gtk";
-  version = "2.3.0";
+  version = "2.3.1";

  src = fetchFromGitHub {
    owner = "gmg137";
-    repo = pname;
+    repo = "netease-cloud-music-gtk";
    rev = version;
-    hash = "sha256-/HvP82QqN+dWb5XJelsayeo4sz/pVvCKQ9RKQJv7PAI=";
+    hash = "sha256-75zovq7Q370L+bRczTCCC34G2w8xeMMUK5EUTfKAc+w=";
  };

  cargoDeps = rustPlatform.importCargoLock {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "netease-cloud-music-api-1.3.0" = "sha256-SzMu+klhcLi+jDYc9RZUWrBph5TjfddV0STHaijuQ8Q=";
+      "netease-cloud-music-api-1.3.1" = "sha256-ZIc5zj9ZtLBYlZqBR7iUW+KmD71M+OYDiv0dkZrpFos=";
    };
  };

--- a/pkgs/by-name/nh/nh/package.nix
+++ b/pkgs/by-name/nh/nh/package.nix
@ -7,15 +7,11 @@
 , fetchFromGitHub
 , nix-update-script
 , nvd
-, use-nom ? true
-, nix-output-monitor ? null
+, nix-output-monitor
 }:
-
-assert use-nom -> nix-output-monitor != null;
-
 let
-  version = "3.5.3";
-  runtimeDeps = [ nvd ] ++ lib.optionals use-nom [ nix-output-monitor ];
+  version = "3.5.4";
+  runtimeDeps = [ nvd nix-output-monitor ];
 in
 rustPlatform.buildRustPackage {
  inherit version;
@ -25,7 +21,7 @@ rustPlatform.buildRustPackage {
    owner = "viperML";
    repo = "nh";
    rev = "refs/tags/v${version}";
-    hash = "sha256-37BcFt67NZj4YQ9kqm69O+OJkgt+TXWTu53bvJvOtn8=";
+    hash = "sha256-fnuVQqdK48c66EC4mL8t7uLhwsY6JDyn7H5tjRpx9Sg=";
  };

  strictDeps = true;
@ -48,11 +44,10 @@ rustPlatform.buildRustPackage {

  postFixup = ''
    wrapProgram $out/bin/nh \
-      --prefix PATH : ${lib.makeBinPath runtimeDeps} \
-      ${lib.optionalString use-nom "--set-default NH_NOM 1"}
+      --prefix PATH : ${lib.makeBinPath runtimeDeps}
  '';

-  cargoHash = "sha256-uRibycYznqzdf8QVX6bHfq3J3Imu8KnWCL0ZS1w4KFk=";
+  cargoHash = "sha256-njJdwaJtLB4S36mS8miwrk7jo5U7BzOIlXqh3qNyA5E=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/nu/numbat/package.nix
+++ b/pkgs/by-name/nu/numbat/package.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "numbat";
-  version = "1.10.1";
+  version = "1.11.0";

  src = fetchFromGitHub {
    owner = "sharkdp";
    repo = "numbat";
    rev = "v${version}";
-    hash = "sha256-/jt1+21yem0q/dlc7z89MRaVrnllb9QLSQUo2f/9q8o=";
+    hash = "sha256-/XUDtyOk//J4S9NoRP/s5s6URkdzePhW7UQ4FxDgmhs=";
  };

-  cargoHash = "sha256-8AA0LTw/9kd6yDme4N3/ANVkS67eoLrJviNhdqUftXM=";
+  cargoHash = "sha256-uM4LmD78ZHAzx5purTO+MUstaSrR+j2LuSDUBI2tl3s=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.Security
--- a/pkgs/by-name/py/pyprland/package.nix
+++ b/pkgs/by-name/py/pyprland/package.nix
@ -2,7 +2,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "pyprland";
-  version = "2.0.5";
+  version = "2.0.8";
  format = "pyproject";

  disabled = python3Packages.pythonOlder "3.10";
@ -11,7 +11,7 @@ python3Packages.buildPythonApplication rec {
    owner = "hyprland-community";
    repo = "pyprland";
    rev = "refs/tags/${version}";
-    hash = "sha256-VaNJ6hSdcH23Vk7JJpmNV6Qxb7gK5xWK6WHdeyfjUvQ=";
+    hash = "sha256-oLatPMTiDGRgci5rWBnB6dGDXQKOUMjoh8a7h/0EHxA=";
  };

  nativeBuildInputs = with python3Packages; [ poetry-core ];
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@ -7,10 +7,10 @@
  inherit buildUnstable;
 }).overrideAttrs (finalAttrs: _: {
  pname = "renode-unstable";
-  version = "1.14.0+20240305gitcec51e561";
+  version = "1.14.0+20240308git65e3eb0f5";

  src = fetchurl {
    url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-portable.tar.gz";
-    hash = "sha256-dXT4C/s7Aygqhq0U6MiPsQL8ZvjPfTzKYuhA6aRQKlI=";
+    hash = "sha256-s0SK4Ixl2hTbh6X3nddjKNpnxePjcd/SRXnP/xytInc=";
  };
 })
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@ -5,13 +5,13 @@

 python3.pkgs.toPythonModule (python3.pkgs.buildPythonApplication rec {
  pname = "searxng";
-  version = "0-unstable-2024-02-24";
+  version = "0-unstable-2024-03-08";

  src = fetchFromGitHub {
    owner = "searxng";
    repo = "searxng";
-    rev = "d72fa99bd0a4d702a55188b07919ce5a764b1d6c";
-    hash = "sha256-1A7dyWrF63fSSvWP+2HrCS6H8o/4CUlqiP0KANVZHUA=";
+    rev = "9c08a0cdddae7ceafbe5e00ce94cf7f1d36c97e0";
+    hash = "sha256-0qlOpJqpOmseIeIafd0NLd2lF5whu18QxmwOua8dKzg=";
  };

  postPatch = ''
--- a/pkgs/by-name/so/sophus/package.nix
+++ b/pkgs/by-name/so/sophus/package.nix
@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, eigen
+, fmt
+, fetchFromGitHub
+, cmake
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "sophus";
+  version = "1.22.10";
+
+  src = fetchFromGitHub {
+    owner = "strasdat";
+    repo = "Sophus";
+    rev = finalAttrs.version;
+    hash = "sha256-TNuUoL9r1s+kGE4tCOGFGTDv1sLaHJDUKa6c9x41Z7w=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    eigen
+    fmt
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SOPHUS_TESTS" false)
+    (lib.cmakeBool "BUILD_SOPHUS_EXAMPLES" false)
+  ];
+
+  meta = {
+    description = "C++ implementation of Lie Groups using Eigen";
+    homepage = "https://github.com/strasdat/Sophus";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ locochoco acowley ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/ss/ssh-openpgp-auth/daemon.nix
+++ b/pkgs/by-name/ss/ssh-openpgp-auth/daemon.nix
@ -0,0 +1,14 @@
+# Ideally, this file would have been placed in
+# pkgs/by-name/ss/sshd-openpgp-auth/package.nix, but since `./generic.nix` is
+# outside of the directory, the nixpkgs-check-by-name test will fail the CI. So
+# we call this file in all-packages.nix like in the old days.
+{ callPackage }:
+
+callPackage ./generic.nix {
+  pname = "sshd-openpgp-auth";
+  version = "0.3.0";
+  srcHash = "sha256-IV0Nhdqyn12HDOp1jaKz3sKTI3ktFd5b6qybCLWt27I=";
+  cargoHash = "sha256-/+lZkVMeFUMRD7NQ/MHDU5f3rkKDx1kDv5tjA41RExc=";
+  metaDescription =
+    "Command-line tool for creating and managing OpenPGP based trust anchors for SSH host keys";
+}
--- a/pkgs/by-name/ss/ssh-openpgp-auth/generic.nix
+++ b/pkgs/by-name/ss/ssh-openpgp-auth/generic.nix
@ -0,0 +1,82 @@
+# This file is based upon upstream's package.nix shared among both
+# "ssh-openpgp-auth" and "sshd-openpgpg-auth"
+{ lib
+, rustPlatform
+, fetchFromGitea
+, pkg-config
+, just
+, rust-script
+, installShellFiles
+, bzip2
+, nettle
+, openssl
+, sqlite
+, stdenv
+, darwin
+, openssh
+# Arguments not supplied by callPackage
+, pname , version , srcHash , cargoHash, metaDescription
+}:
+
+rustPlatform.buildRustPackage {
+  inherit pname version;
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "wiktor";
+    repo = "ssh-openpgp-auth";
+    # See also: https://codeberg.org/wiktor/ssh-openpgp-auth/pulls/92#issuecomment-1635274
+    rev = "${pname}/${version}";
+    hash = srcHash;
+  };
+  buildAndTestSubdir = pname;
+  inherit cargoHash;
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+    just
+    rust-script
+    installShellFiles
+  ];
+  # Otherwise just's build, check and install phases take precedence over
+  # buildRustPackage's phases.
+  dontUseJustBuild = true;
+  dontUseJustCheck = true;
+  dontUseJustInstall = true;
+
+  postInstall = ''
+    export HOME=$(mktemp -d)
+    just generate manpages ${pname} $out/share/man/man1
+    just generate shell_completions ${pname} shell_completions
+    installShellCompletion --cmd ${pname} \
+      --bash shell_completions/${pname}.bash \
+      --fish shell_completions/${pname}.fish \
+      --zsh  shell_completions/_${pname}
+  '';
+
+
+  buildInputs = [
+    nettle
+    openssl
+    sqlite
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk_11_0.frameworks.CoreFoundation
+    darwin.apple_sdk_11_0.frameworks.IOKit
+    darwin.apple_sdk_11_0.frameworks.Security
+    darwin.apple_sdk_11_0.frameworks.SystemConfiguration
+  ];
+
+  doCheck = true;
+  nativeCheckInputs = [
+    openssh
+  ];
+
+  meta = with lib; {
+    description = metaDescription;
+    homepage = "https://codeberg.org/wiktor/ssh-openpgp-auth";
+    license = with licenses; [ mit /* or */ asl20 ];
+    maintainers = with maintainers; [ doronbehar ];
+    mainProgram = pname;
+  };
+}
--- a/pkgs/by-name/ss/ssh-openpgp-auth/package.nix
+++ b/pkgs/by-name/ss/ssh-openpgp-auth/package.nix
@ -0,0 +1,10 @@
+{ callPackage }:
+
+callPackage ./generic.nix {
+  pname = "ssh-openpgp-auth";
+  version = "0.2.2";
+  srcHash = "sha256-5ew6jT6Zr54QYaWFQIGYXd8sqC3yHHZjPfoaCossm8o=";
+  cargoHash = "sha256-/k/XAp7PHIJaJWf4Oa1JC1mMSR5pyeM4SSPCcr77cAg=";
+  metaDescription =
+    "Command-line tool that provides client-side functionality to transparently verify the identity of remote SSH hosts";
+}
--- a/pkgs/by-name/ty/typst/Cargo.lock
+++ b/pkgs/by-name/ty/typst/Cargo.lock
--- a/pkgs/by-name/ty/typst/package.nix
+++ b/pkgs/by-name/ty/typst/package.nix
@ -2,38 +2,48 @@
 , rustPlatform
 , fetchFromGitHub
 , installShellFiles
+, pkg-config
+, openssl
+, xz
 , stdenv
 , darwin
 }:

 rustPlatform.buildRustPackage rec {
  pname = "typst";
-  version = "0.10.0";
+  version = "0.11.0-rc1";

  src = fetchFromGitHub {
    owner = "typst";
    repo = "typst";
    rev = "v${version}";
-    hash = "sha256-qiskc0G/ZdLRZjTicoKIOztRFem59TM4ki23Rl55y9s=";
+    hash = "sha256-jOq+aoBSRUTXldg8iWGSJ1z0y+3KbhZfVAgjZo9IsGo=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "iai-0.1.1" = "sha256-EdNzCPht5chg7uF9O8CtPWR/bzSYyfYIXNdLltqdlR0=";
+      "typst-dev-assets-0.10.0" = "sha256-EBOZbblbavtsr2LEnoIF0UFmpSsm8Sq7ibxxWcAMIHY=";
    };
  };

  nativeBuildInputs = [
    installShellFiles
+    pkg-config
  ];

-  buildInputs = lib.optionals stdenv.isDarwin [
+  buildInputs = [
+    openssl
+    xz
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.CoreFoundation
    darwin.apple_sdk.frameworks.CoreServices
+    darwin.apple_sdk.frameworks.Security
  ];

  env = {
    GEN_ARTIFACTS = "artifacts";
+    OPENSSL_NO_VENDOR = true;
  };

  postInstall = ''
--- a/pkgs/by-name/xd/xdg-desktop-portal-shana/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-shana/package.nix
@ -8,13 +8,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "xdg-desktop-portal-shana";
-  version = "0.3.9";
+  version = "0.3.11";

  src = fetchFromGitHub {
    owner = "Decodetalkers";
    repo = "xdg-desktop-portal-shana";
    rev = "v${version}";
-    sha256 = "cgiWlZbM0C47CisR/KlSV0xqfeKgM41QaQihjqSy9CU=";
+    sha256 = "sha256-bUskzFDd4qjH4Isp6vAJHe5qzgCLudQbkh+JNNTSMu8=";
  };

  nativeBuildInputs = [
@ -31,7 +31,7 @@ rustPlatform.buildRustPackage rec {

  mesonBuildType = "release";

-  cargoHash = "sha256-uDM4a7AB0753c/H1nfic/LjWrLmjEvi/p2S/tLIDXaQ=";
+  cargoHash = "sha256-FzEdQePDnSCuMDqbz0ZUywDzNfbiOwottSrE+eWL9to=";

  meta = with lib; {
    description = "A filechooser portal backend for any desktop environment";
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "yazi";
-  version = "0.2.3";
+  version = "0.2.4";

  src = fetchFromGitHub {
    owner = "sxyazi";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-2AiaJs6xY8hsB1DBxpPwdZtc8IZvsoCGWBOFVMf4dvk=";
+    hash = "sha256-c8fWWCOVBqQVdQch9BniCaJPrVEOCv35lLH8/hMIbvE=";
  };

-  cargoHash = "sha256-fRUmXv27sHYz8z0cc795JCPLHDQGgTV4wAWAtQ/pbg4=";
+  cargoHash = "sha256-VeDyO+KCD3Axse4iPIoRxIvoAn3L33e2ObBZFV/REeg=";

  env.YAZI_GEN_COMPLETIONS = true;

@ -29,9 +29,9 @@ rustPlatform.buildRustPackage rec {

  postInstall = ''
    installShellCompletion --cmd yazi \
-      --bash ./yazi-config/completions/yazi.bash \
-      --fish ./yazi-config/completions/yazi.fish \
-      --zsh  ./yazi-config/completions/_yazi
+      --bash ./yazi-boot/completions/yazi.bash \
+      --fish ./yazi-boot/completions/yazi.fish \
+      --zsh  ./yazi-boot/completions/_yazi
  '';

  passthru.updateScript = nix-update-script { };
--- a/pkgs/desktops/deepin/apps/deepin-compressor/0001-fix-build-on-new-dtk.diff
+++ b/pkgs/desktops/deepin/apps/deepin-compressor/0001-fix-build-on-new-dtk.diff
@ -0,0 +1,20 @@
+diff --git a/src/source/common/ddesktopservicesthread.h b/src/source/common/ddesktopservicesthread.h
+index 49313744..456a5e96 100644
+--- a/src/source/common/ddesktopservicesthread.h
+++ b/src/source/common/ddesktopservicesthread.h
+@@ -8,10 +8,14 @@
+ 
+ #include <QThread>
+ 
+#include <dtkwidget_global.h>
+#include <dtkgui_global.h>
+ #include <DDesktopServices>
+ #include <QDebug>
+ #include <QFileInfo>
+
+ DWIDGET_USE_NAMESPACE
+DGUI_USE_NAMESPACE
+ 
+ // 文管打开文件目录线程
+ class DDesktopServicesThread : public QThread
+
--- a/pkgs/desktops/deepin/apps/deepin-compressor/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-compressor/default.nix
@ -20,20 +20,24 @@

 stdenv.mkDerivation rec {
  pname = "deepin-compressor";
-  version = "5.12.23";
+  version = "5.12.24";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-8qfpNM2rci4subdodxfJZLP3OvAxXl7QRl4MHGr15nA=";
+    hash = "sha256-XNhG28VZifQrl3TZfx/OHnsAOo0eKrhGKDk+OjOYD8k=";
  };

+  patches = [
+    ./0001-fix-build-on-new-dtk.diff
+  ];
+
  postPatch = ''
    substituteInPlace src/source/common/pluginmanager.cpp \
-      --replace "/usr/lib/" "$out/lib/"
+      --replace-fail "/usr/lib/" "$out/lib/"
    substituteInPlace src/desktop/deepin-compressor.desktop \
-      --replace "/usr" "$out"
+      --replace-fail "/usr" "$out"
  '';

  nativeBuildInputs = [
@ -61,6 +65,11 @@ stdenv.mkDerivation rec {
    "-DUSE_TEST=OFF"
  ];

+  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
+  qtWrapperArgs = [
+    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
+  ];
+
  strictDeps = true;

  meta = with lib; {
--- a/pkgs/desktops/deepin/apps/deepin-screen-recorder/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-screen-recorder/default.nix
@ -78,6 +78,9 @@ stdenv.mkDerivation rec {
    gst-plugins-good
  ]);

+  # Fix build failure on dtk 5.6.20
+  env.NIX_CFLAGS_COMPILE = "-std=c++14";
+
  # qt5integration must be placed before qtsvg in QT_PLUGIN_PATH
  qtWrapperArgs = [
    "--prefix QT_PLUGIN_PATH : ${qt5integration}/${qtbase.qtPluginPrefix}"
--- a/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix
@ -27,13 +27,13 @@

 stdenv.mkDerivation rec {
  pname = "deepin-system-monitor";
-  version = "6.0.9";
+  version = "6.0.13";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-ompsCTPmmF7S0UHNNU0YDQiTdvcFglpEoS4o+XMZ7jg=";
+    hash = "sha256-QwZPvEOYypSmbe3deqLRsI3VL/CgVc+Ql3JlsMZ9MqY=";
  };

  postPatch = ''
--- a/pkgs/desktops/deepin/artwork/dde-account-faces/default.nix
+++ b/pkgs/desktops/deepin/artwork/dde-account-faces/default.nix
@ -5,13 +5,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "dde-account-faces";
-  version = "1.0.15";
+  version = "1.0.16";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-/eTGy+9fcYmGrh09RdCIZ2Cn12gTaGtg4Tluv25n5r0=";
+    hash = "sha256-PtbEsFQl6M5Ouadxy9CTVh1Bmmect83NODO4Ks+ckKU=";
  };

  makeFlags = [ "PREFIX=${placeholder "out"}/var" ];
--- a/pkgs/desktops/deepin/artwork/deepin-icon-theme/default.nix
+++ b/pkgs/desktops/deepin/artwork/deepin-icon-theme/default.nix
@ -8,13 +8,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "deepin-icon-theme";
-  version = "2023.11.28";
+  version = "2024.01.31";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-kCWJAmJa0VmhnuegE+acj82Ojl4Z5D8g7/q2PzppJwg=";
+    hash = "sha256-08maujG5Tibsv9N+5olOeD8MrXTRiZh0OQm0bg8t+Cc=";
  };

  makeFlags = [ "PREFIX=${placeholder "out"}" ];
--- a/pkgs/desktops/deepin/core/dde-app-services/default.nix
+++ b/pkgs/desktops/deepin/core/dde-app-services/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "dde-app-services";
-  version = "1.0.23";
+  version = "1.0.25";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-INxbRDpG3MqPW6IMTqEagDCGo7vwxkR6D1+lcWdjO3w=";
+    hash = "sha256-/lHiSUOTD8nC0WDLAHAFzm1YC0WjSS5W5JNC0cjeVEo=";
  };

  postPatch = ''
--- a/pkgs/desktops/deepin/core/dde-appearance/default.nix
+++ b/pkgs/desktops/deepin/core/dde-appearance/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "dde-appearance";
-  version = "1.1.6";
+  version = "1.1.25";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-7oRbydLXw8yRzi9L1GH/q0cjMY/DLyWbj4RUSyNpVNM=";
+    hash = "sha256-H9TvWF6Q0lX4GF4mQ71E3SUqWbhH7dzHIlScovbN7lM=";
  };

  patches = [
@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
    substituteInPlace src/service/modules/api/themethumb.cpp \
      --replace "/usr/lib/deepin-api" "/run/current-system/sw/lib/deepin-api"

-    substituteInPlace src/service/dbus/deepinwmfaker.cpp \
+    substituteInPlace fakewm/dbus/deepinwmfaker.cpp \
      --replace "/usr/lib/deepin-daemon" "/run/current-system/sw/lib/deepin-daemon"

    substituteInPlace src/service/modules/api/locale.cpp \
--- a/pkgs/desktops/deepin/core/dde-appearance/fix-custom-wallpapers-path.diff
+++ b/pkgs/desktops/deepin/core/dde-appearance/fix-custom-wallpapers-path.diff
@ -11,10 +11,10 @@ index b612e6e..371f966 100644
             "serial": 0,
             "flags": [],
             "name": "Background_Uris",
-diff --git a/src/service/dbus/deepinwmfaker.cpp b/src/service/dbus/deepinwmfaker.cpp
+diff --git a/fakewm/dbus/deepinwmfaker.cpp b/fakewm/dbus/deepinwmfaker.cpp
 index 5d455fa..40ec608 100644
--- a/src/service/dbus/deepinwmfaker.cpp
-+++ b/src/service/dbus/deepinwmfaker.cpp
+--- a/fakewm/dbus/deepinwmfaker.cpp
+++ b/fakewm/dbus/deepinwmfaker.cpp
@@ -54,13 +54,13 @@ Q_GLOBAL_STATIC_WITH_ARGS(QGSettings, _gsettings_dde_zone, ("com.deepin.dde.zone
 
 #define KWinDBusCompositorInterface "org.kde.kwin.Compositing"
--- a/pkgs/desktops/deepin/core/dde-application-manager/default.nix
+++ b/pkgs/desktops/deepin/core/dde-application-manager/default.nix
@ -1,42 +1,36 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , pkg-config
 , wrapQtAppsHook
 , qtbase
-, dtkwidget
-, dde-polkit-agent
-, gsettings-qt
-, libcap
-, jemalloc
-, xorg
-, iconv
 }:

 stdenv.mkDerivation rec {
  pname = "dde-application-manager";
-  version = "1.0.19";
+  version = "1.1.8";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-1P265xqlL/wML66nKdfTgkRx6MCpLwrt5rXu+CyeShU=";
+    hash = "sha256-ImyXSyQWMFLvmtx9mBxrr4/IFOgOH1BW650mbiwFh5U=";
  };

-  # remove this patch after next release
-  postPatch = ''
-    substituteInPlace src/modules/mimeapp/mime_app.cpp src/modules/launcher/common.h src/service/main.cpp \
-      misc/dconf/com.deepin.dde.appearance.json \
-      --replace "/usr/share" "/run/current-system/sw/share"
-
-    substituteInPlace src/lib/dlocale.cpp --replace "/usr/share/locale/locale.alias" "${iconv}/share/locale/locale.alias"
-
-    for file in $(grep -rl "/usr/bin"); do
-      substituteInPlace $file --replace "/usr/bin/" "/run/current-system/sw/bin/"
-    done
-  '';
+  patches = [
+    (fetchpatch {
+      name = "set-more-scale-envs-to-application.patch";
+      url = "https://github.com/linuxdeepin/dde-application-manager/commit/a1f8ad276d88c81249dd3468779862186a180238.patch";
+      hash = "sha256-/iKg6NZZomNEKYsZCZP1IfNr7ZAXiA9RVBnyf+M/f4w=";
+    })
+    (fetchpatch {
+      name = "support-execSearchPath-to-prevent-systemd-from-finding-binaries.patch";
+      url = "https://github.com/linuxdeepin/dde-application-manager/commit/2eaca7c6b8b841d571e9d3510f9f14c321cd976e.patch";
+      hash = "sha256-GWUIv4NIBLQpnY4GcjLShMjiXAfPi3zKdol3whchC/Y=";
+    })
+  ];

  nativeBuildInputs = [
    cmake
@ -46,12 +40,6 @@ stdenv.mkDerivation rec {

  buildInputs = [
    qtbase
-    dtkwidget
-    gsettings-qt
-    libcap
-    jemalloc
-    xorg.libXdmcp
-    xorg.libXres
  ];

  meta = with lib; {
--- a/pkgs/desktops/deepin/core/dde-calendar/default.nix
+++ b/pkgs/desktops/deepin/core/dde-calendar/default.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "dde-calendar";
-  version = "5.11.1";
+  version = "5.12.1";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-EQcB+a0dK2c6NdvGFbyp65a8nN2PmOpZLWx61UDOTJg=";
+    hash = "sha256-p+KtObh2JT7aPcDCi0jmaNmLqB1aU3IvAiYrGmhErcI=";
  };

  patches = [
--- a/pkgs/desktops/deepin/core/dde-control-center/default.nix
+++ b/pkgs/desktops/deepin/core/dde-control-center/default.nix
@ -17,19 +17,20 @@
 , polkit-qt
 , libxcrypt
 , librsvg
+, gtest
 , runtimeShell
 , dbus
 }:

 stdenv.mkDerivation rec {
  pname = "dde-control-center";
-  version = "6.0.28";
+  version = "6.0.44";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-kgQ4ySiYtaklOqER56QtKD9lk1CnRSEAU4QPHycl9eI=";
+    hash = "sha256-NN2CSIYByxeTZraK48lAsQSJYAOTDHzKT1FOa+VWMo0=";
  };

  postPatch = ''
@ -57,6 +58,7 @@ stdenv.mkDerivation rec {
    polkit-qt
    libxcrypt
    librsvg
+    gtest
  ];

  cmakeFlags = [
--- a/pkgs/desktops/deepin/core/dde-dock/default.nix
+++ b/pkgs/desktops/deepin/core/dde-dock/default.nix
@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "dde-dock";
-  version = "6.0.22";
+  version = "6.0.35";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-fhc2faiPH35ZKw6SCoGTz+6mgxabNpCFQeY2p68Ba5w=";
+    hash = "sha256-ATC/Ze6GyjT92eCgAt9g2FIQbXLVHUMuXuAslNnbkCE=";
  };

  postPatch = ''
--- a/pkgs/desktops/deepin/core/dde-file-manager/default.nix
+++ b/pkgs/desktops/deepin/core/dde-file-manager/default.nix
@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchpatch
 , runtimeShell
 , dtkwidget
 , qt5integration
@ -44,13 +43,13 @@

 stdenv.mkDerivation rec {
  pname = "dde-file-manager";
-  version = "6.0.31";
+  version = "6.0.40";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-mc2HcoLrwMXKU8w34KUEh62ZfEIfbJLVzz4JGnUE5EM=";
+    hash = "sha256-fvxP6wle4hezt9nEDpTgK+xB4J5XIC0mP5jWCmkjJPA=";
  };

  nativeBuildInputs = [
@ -63,13 +62,7 @@ stdenv.mkDerivation rec {
  dontWrapGApps = true;

  patches = [
-    ./use_v23_dbus_interface.diff
-
-    (fetchpatch {
-      name = "use-pkgconfig-to-check-mount.patch";
-      url = "https://github.com/linuxdeepin/dde-file-manager/commit/b6c210057d991591df45b80607a614e7a57a9dc0.patch";
-      hash = "sha256-k0ZYlOVN3hHs1qvvRaJ3i6okOhDE+DoUKGs9AhSFBGU=";
-    })
+    ./patch_check_v23_interface.diff
  ];

  postPatch = ''
@ -132,6 +125,8 @@ stdenv.mkDerivation rec {

  cmakeFlags = [
    "-DVERSION=${version}"
+    "-DNIX_DEEPIN_VERSION=23"
+    "-DSYSTEMD_USER_UNIT_DIR=${placeholder "out"}/lib/systemd/user"
  ];

  enableParallelBuilding = true;
--- a/pkgs/desktops/deepin/core/dde-file-manager/patch_check_v23_interface.diff
+++ b/pkgs/desktops/deepin/core/dde-file-manager/patch_check_v23_interface.diff
@ -1,13 +1,13 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index e93d3ad..94e3eca 100644
+index 8a8cfb079..34092aa57 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -30,7 +30,7 @@ if(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
+@@ -31,7 +31,7 @@ if(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
 endif()
 
 #Indentify the version
 -if (${DEEPIN_OS_VERSION} MATCHES "23")
-+if (TRUE)
+if (${NIX_DEEPIN_VERSION} MATCHES "23")
     add_definitions(-DCOMPILE_ON_V23)
     set(COMPLIE_ON_V23 TRUE)
     message("COMPILE ON v23")
--- a/pkgs/desktops/deepin/core/dde-launchpad/default.nix
+++ b/pkgs/desktops/deepin/core/dde-launchpad/default.nix
@ -15,15 +15,20 @@

 stdenv.mkDerivation rec {
  pname = "dde-launchpad";
-  version = "0.3.0";
+  version = "0.4.4";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-8m0DjQYih3hB/n2VHuJgUYBe8tpGwBU0NdkLxr1OsFc=";
+    hash = "sha256-az8BC3n44NGpATNu3Exjn3H7Rumx/YqDXztEGqCpAbY=";
  };

+  postPatch = ''
+    substituteInPlace desktopintegration.cpp \
+      --replace "AppStreamQt/pool.h" "AppStreamQt5/pool.h"
+  '';
+
  nativeBuildInputs = [
    cmake
    qttools
--- a/Show More
+++ b/Show More