Merge master into haskell-updates

2024-09-20 12:08:17 +03:00 · 2023-12-24 00:13:55 +00:00 · 2023-12-24 00:13:55 +00:00 · 9cced8ed31
commit 9cced8ed31
parent 660a21d9e5 0fe31382c0
174 changed files with 2049 additions and 887 deletions
--- a/doc/build-helpers/images/appimagetools.section.md
+++ b/doc/build-helpers/images/appimagetools.section.md
@ -1,48 +1,167 @@
 # pkgs.appimageTools {#sec-pkgs-appimageTools}

-`pkgs.appimageTools` is a set of functions for extracting and wrapping [AppImage](https://appimage.org/) files. They are meant to be used if traditional packaging from source is infeasible, or it would take too long. To quickly run an AppImage file, `pkgs.appimage-run` can be used as well.
+`pkgs.appimageTools` is a set of functions for extracting and wrapping [AppImage](https://appimage.org/) files.
+They are meant to be used if traditional packaging from source is infeasible, or if it would take too long.
+To quickly run an AppImage file, `pkgs.appimage-run` can be used as well.

 ::: {.warning}
 The `appimageTools` API is unstable and may be subject to backwards-incompatible changes in the future.
 :::

-## AppImage formats {#ssec-pkgs-appimageTools-formats}
-
-There are different formats for AppImages, see [the specification](https://github.com/AppImage/AppImageSpec/blob/74ad9ca2f94bf864a4a0dac1f369dd4f00bd1c28/draft.md#image-format) for details.
-
- Type 1 images are ISO 9660 files that are also ELF executables.
- Type 2 images are ELF executables with an appended filesystem.
-
-They can be told apart with `file -k`:
-
-```ShellSession
-$ file -k type1.AppImage
-type1.AppImage: ELF 64-bit LSB executable, x86-64, version 1 (SYSV) ISO 9660 CD-ROM filesystem data 'AppImage' (Lepton 3.x), scale 0-0,
-spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000, dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.18, BuildID[sha1]=d629f6099d2344ad82818172add1d38c5e11bc6d, stripped\012- data
-
-$ file -k type2.AppImage
-type2.AppImage: ELF 64-bit LSB executable, x86-64, version 1 (SYSV) (Lepton 3.x), scale 232-60668, spot sensor temperature -4.187500, color scheme 15, show scale bar, calibration: offset -0.000000, slope 0.000000 (Lepton 2.x), scale 4111-45000, spot sensor temperature 412442.250000, color scheme 3, minimum point enabled, calibration: offset -75402534979642766821519867692934234112.000000, slope 5815371847733706829839455140374904832.000000, dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.18, BuildID[sha1]=79dcc4e55a61c293c5e19edbd8d65b202842579f, stripped\012- data
-```
-
-Note how the type 1 AppImage is described as an `ISO 9660 CD-ROM filesystem`, and the type 2 AppImage is not.
-
 ## Wrapping {#ssec-pkgs-appimageTools-wrapping}

-Depending on the type of AppImage you're wrapping, you'll have to use `wrapType1` or `wrapType2`.
+Use `wrapType2` to wrap any AppImage.
+This will create a FHS environment with many packages [expected to exist](https://github.com/AppImage/pkg2appimage/blob/master/excludelist) for the AppImage to work.
+`wrapType2` expects an argument with the `src` attribute, and either a `name` attribute or `pname` and `version` attributes.
+
+It will eventually call into [`buildFHSEnv`](#sec-fhs-environments), and any extra attributes in the argument to `wrapType2` will be passed through to it.
+This means that you can pass the `extraInstallCommands` attribute, for example, and it will have the same effect as described in [`buildFHSEnv`](#sec-fhs-environments).
+
+::: {.note}
+In the past, `appimageTools` provided both `wrapType1` and `wrapType2`, to be used depending on the type of AppImage that was being wrapped.
+However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/81833), meaning that both `wrapType1` and `wrapType2` have the same behaviour now.
+:::
+
+:::{.example #ex-wrapping-appimage-from-github}
+
+# Wrapping an AppImage from GitHub

 ```nix
-appimageTools.wrapType2 { # or wrapType1
-  name = "patchwork";
+{ appimageTools, fetchurl }:
+let
+  pname = "nuclear";
+  version = "0.6.30";
+
  src = fetchurl {
-    url = "https://github.com/ssbc/patchwork/releases/download/v3.11.4/Patchwork-3.11.4-linux-x86_64.AppImage";
-    hash = "sha256-OqTitCeZ6xmWbqYTXp8sDrmVgTNjPZNW0hzUPW++mq4=";
+    url = "https://github.com/nukeop/nuclear/releases/download/v${version}/${pname}-v${version}.AppImage";
+    hash = "sha256-he1uGC1M/nFcKpMM9JKY4oeexJcnzV0ZRxhTjtJz6xw=";
  };
-  extraPkgs = pkgs: with pkgs; [ ];
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
 }
 ```

- `name` specifies the name of the resulting image.
- `src` specifies the AppImage file to extract.
- `extraPkgs` allows you to pass a function to include additional packages inside the FHS environment your AppImage is going to run in. There are a few ways to learn which dependencies an application needs:
-  - Looking through the extracted AppImage files, reading its scripts and running `patchelf` and `ldd` on its executables. This can also be done in `appimage-run`, by setting `APPIMAGE_DEBUG_EXEC=bash`.
+:::
+
+The argument passed to `wrapType2` can also contain an `extraPkgs` attribute, which allows you to include additional packages inside the FHS environment your AppImage is going to run in.
+`extraPkgs` must be a function that returns a list of packages.
+There are a few ways to learn which dependencies an application needs:
+
+  - Looking through the extracted AppImage files, reading its scripts and running `patchelf` and `ldd` on its executables.
+    This can also be done in `appimage-run`, by setting `APPIMAGE_DEBUG_EXEC=bash`.
  - Running `strace -vfefile` on the wrapped executable, looking for libraries that can't be found.
+
+:::{.example #ex-wrapping-appimage-with-extrapkgs}
+
+# Wrapping an AppImage with extra packages
+
+```nix
+{ appimageTools, fetchurl }:
+let
+  pname = "irccloud";
+  version = "0.16.0";
+
+  src = fetchurl {
+    url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
+    sha256 = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
+  };
+in appimageTools.wrapType2 {
+  inherit pname version src;
+  extraPkgs = pkgs: [ pkgs.at-spi2-core ];
+}
+```
+
+:::
+
+## Extracting {#ssec-pkgs-appimageTools-extracting}
+
+Use `extract` if you need to extract the contents of an AppImage.
+This is usually used in Nixpkgs to install extra files in addition to [wrapping](#ssec-pkgs-appimageTools-wrapping) the AppImage.
+`extract` expects an argument with the `src` attribute, and either a `name` attribute or `pname` and `version` attributes.
+
+::: {.note}
+In the past, `appimageTools` provided both `extractType1` and `extractType2`, to be used depending on the type of AppImage that was being extracted.
+However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/81572), meaning that both `extractType1` and `extractType2` have the same behaviour as `extract` now.
+:::
+
+:::{.example #ex-extracting-appimage}
+
+# Extracting an AppImage to install extra files
+
+This example was adapted from a real package in Nixpkgs to show how `extract` is usually used in combination with `wrapType2`.
+Note how `appimageContents` is used in `extraInstallCommands` to install additional files that were extracted from the AppImage.
+
+```nix
+{ appimageTools, fetchurl }:
+let
+  pname = "irccloud";
+  version = "0.16.0";
+
+  src = fetchurl {
+    url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
+    sha256 = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
+  };
+
+  appimageContents = appimageTools.extract {
+    inherit pname version src;
+  };
+in appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraPkgs = pkgs: [ pkgs.at-spi2-core ];
+
+  extraInstallCommands = ''
+    mv $out/bin/${pname}-${version} $out/bin/${pname}
+    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
+      $out/share/icons/hicolor/512x512/apps/irccloud.png
+    substituteInPlace $out/share/applications/irccloud.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+  '';
+}
+```
+
+:::
+
+The argument passed to `extract` can also contain a `postExtract` attribute, which allows you to execute additional commands after the files are extracted from the AppImage.
+`postExtract` must be a string with commands to run.
+
+:::{.example #ex-extracting-appimage-with-postextract}
+
+# Extracting an AppImage to install extra files, using `postExtract`
+
+This is a rewrite of [](#ex-extracting-appimage) to use `postExtract`.
+
+```nix
+{ appimageTools, fetchurl }:
+let
+  pname = "irccloud";
+  version = "0.16.0";
+
+  src = fetchurl {
+    url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
+    sha256 = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
+  };
+
+  appimageContents = appimageTools.extract {
+    inherit pname version src;
+    postExtract = ''
+      substituteInPlace $out/irccloud.desktop --replace 'Exec=AppRun' 'Exec=${pname}'
+    '';
+  };
+in appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraPkgs = pkgs: [ pkgs.at-spi2-core ];
+
+  extraInstallCommands = ''
+    mv $out/bin/${pname}-${version} $out/bin/${pname}
+    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
+      $out/share/icons/hicolor/512x512/apps/irccloud.png
+  '';
+}
+```
+
+:::
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -14128,6 +14128,12 @@
    githubId = 15645854;
    name = "Brad Christensen";
  };
+  paulsmith = {
+    email = "paulsmith@pobox.com";
+    github = "paulsmith";
+    name = "Paul Smith";
+    githubId = 1210;
+  };
  paumr = {
    github = "paumr";
    name = "Michael Bergmeister";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -24,6 +24,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [maubot](https://github.com/maubot/maubot), a plugin-based Matrix bot framework. Available as [services.maubot](#opt-services.maubot.enable).

+- [GNS3](https://www.gns3.com/), a network software emulator. Available as [services.gns3-server](#opt-services.gns3-server.enable).
+
 - [Anki Sync Server](https://docs.ankiweb.net/sync-server.html), the official sync server built into recent versions of Anki. Available as [services.anki-sync-server](#opt-services.anki-sync-server.enable).
 The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been marked deprecated and will be dropped after 24.05 due to lack of maintenance of the anki-sync-server softwares.

@ -39,6 +41,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - `k9s` was updated to v0.29. There have been breaking changes in the config file format, check out the [changelog](https://github.com/derailed/k9s/releases/tag/v0.29.0) for details.

+- `idris2` was updated to v0.7.0. This version introduces breaking changes. Check out the [changelog](https://github.com/idris-lang/Idris2/blob/v0.7.0/CHANGELOG.md#v070) for details.
+
 - `nitter` requires a `guest_accounts.jsonl` to be provided as a path or loaded into the default location at `/var/lib/nitter/guest_accounts.jsonl`. See [Guest Account Branch Deployment](https://github.com/zedeus/nitter/wiki/Guest-Account-Branch-Deployment) for details.

 - Invidious has changed its default database username from `kemal` to `invidious`. Setups involving an externally provisioned database (i.e. `services.invidious.database.createLocally == false`) should adjust their configuration accordingly. The old `kemal` user will not be removed automatically even when the database is provisioned automatically.(https://github.com/NixOS/nixpkgs/pull/265857)
--- a/nixos/modules/image/repart-image.nix
+++ b/nixos/modules/image/repart-image.nix
@ -0,0 +1,80 @@
+# This is an expression meant to be called from `./repart.nix`, it is NOT a
+# NixOS module that can be imported.
+
+{ lib
+, runCommand
+, python3
+, black
+, ruff
+, mypy
+, systemd
+, fakeroot
+, util-linux
+, dosfstools
+, mtools
+, e2fsprogs
+, squashfsTools
+, erofs-utils
+, btrfs-progs
+, xfsprogs
+
+  # arguments
+, name
+, fileSystems
+, partitions
+, split
+, seed
+, definitionsDirectory
+}:
+
+let
+  amendRepartDefinitions = runCommand "amend-repart-definitions.py"
+    {
+      # TODO: ruff does not splice properly in nativeBuildInputs
+      depsBuildBuild = [ ruff ];
+      nativeBuildInputs = [ python3 black mypy ];
+    } ''
+    install ${./amend-repart-definitions.py} $out
+    patchShebangs --build $out
+
+    black --check --diff $out
+    ruff --line-length 88 $out
+    mypy --strict $out
+  '';
+
+  fileSystemToolMapping = {
+    "vfat" = [ dosfstools mtools ];
+    "ext4" = [ e2fsprogs.bin ];
+    "squashfs" = [ squashfsTools ];
+    "erofs" = [ erofs-utils ];
+    "btrfs" = [ btrfs-progs ];
+    "xfs" = [ xfsprogs ];
+  };
+
+  fileSystemTools = builtins.concatMap (f: fileSystemToolMapping."${f}") fileSystems;
+in
+
+runCommand name
+{
+  nativeBuildInputs = [
+    systemd
+    fakeroot
+    util-linux
+  ] ++ fileSystemTools;
+} ''
+  amendedRepartDefinitions=$(${amendRepartDefinitions} ${partitions} ${definitionsDirectory})
+
+  mkdir -p $out
+  cd $out
+
+  unshare --map-root-user fakeroot systemd-repart \
+    --dry-run=no \
+    --empty=create \
+    --size=auto \
+    --seed="${seed}" \
+    --definitions="$amendedRepartDefinitions" \
+    --split="${lib.boolToString split}" \
+    --json=pretty \
+    image.raw \
+    | tee repart-output.json
+''
--- a/nixos/modules/image/repart.nix
+++ b/nixos/modules/image/repart.nix
@ -90,8 +90,10 @@ in
    };

    package = lib.mkPackageOption pkgs "systemd-repart" {
-      default = "systemd";
-      example = "pkgs.systemdMinimal.override { withCryptsetup = true; }";
+      # We use buildPackages so that repart images are built with the build
+      # platform's systemd, allowing for cross-compiled systems to work.
+      default = [ "buildPackages" "systemd" ];
+      example = "pkgs.buildPackages.systemdMinimal.override { withCryptsetup = true; }";
    };

    partitions = lib.mkOption {
@ -131,22 +133,10 @@ in

    system.build.image =
      let
-        fileSystemToolMapping = with pkgs; {
-          "vfat" = [ dosfstools mtools ];
-          "ext4" = [ e2fsprogs.bin ];
-          "squashfs" = [ squashfsTools ];
-          "erofs" = [ erofs-utils ];
-          "btrfs" = [ btrfs-progs ];
-          "xfs" = [ xfsprogs ];
-        };
-
        fileSystems = lib.filter
          (f: f != null)
          (lib.mapAttrsToList (_n: v: v.repartConfig.Format or null) cfg.partitions);

-        fileSystemTools = builtins.concatMap (f: fileSystemToolMapping."${f}") fileSystems;
-
-
        makeClosure = paths: pkgs.closureInfo { rootPaths = paths; };

        # Add the closure of the provided Nix store paths to cfg.partitions so
@ -157,23 +147,8 @@ in
            { closure = "${makeClosure partitionConfig.storePaths}/store-paths"; }
        );

-
        finalPartitions = lib.mapAttrs addClosure cfg.partitions;

-
-        amendRepartDefinitions = pkgs.runCommand "amend-repart-definitions.py"
-          {
-            nativeBuildInputs = with pkgs; [ black ruff mypy ];
-            buildInputs = [ pkgs.python3 ];
-          } ''
-          install ${./amend-repart-definitions.py} $out
-          patchShebangs --host $out
-
-          black --check --diff $out
-          ruff --line-length 88 $out
-          mypy --strict $out
-        '';
-
        format = pkgs.formats.ini { };

        definitionsDirectory = utils.systemdUtils.lib.definitions
@ -183,30 +158,11 @@ in

        partitions = pkgs.writeText "partitions.json" (builtins.toJSON finalPartitions);
      in
-      pkgs.runCommand cfg.name
-        {
-          nativeBuildInputs = [
-            cfg.package
-            pkgs.fakeroot
-            pkgs.util-linux
-          ] ++ fileSystemTools;
-        } ''
-        amendedRepartDefinitions=$(${amendRepartDefinitions} ${partitions} ${definitionsDirectory})
-
-        mkdir -p $out
-        cd $out
-
-        unshare --map-root-user fakeroot systemd-repart \
-          --dry-run=no \
-          --empty=create \
-          --size=auto \
-          --seed="${cfg.seed}" \
-          --definitions="$amendedRepartDefinitions" \
-          --split="${lib.boolToString cfg.split}" \
-          --json=pretty \
-          image.raw \
-          | tee repart-output.json
-      '';
+      pkgs.callPackage ./repart-image.nix {
+        systemd = cfg.package;
+        inherit (cfg) name split seed;
+        inherit fileSystems definitionsDirectory partitions;
+      };

    meta.maintainers = with lib.maintainers; [ nikstur ];

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -946,6 +946,7 @@
  ./services/networking/ghostunnel.nix
  ./services/networking/git-daemon.nix
  ./services/networking/globalprotect-vpn.nix
+  ./services/networking/gns3-server.nix
  ./services/networking/gnunet.nix
  ./services/networking/go-autoconfig.nix
  ./services/networking/go-neb.nix
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@ -779,6 +779,19 @@ in
            ExecStart = "${pkgs.postfix}/bin/postfix start";
            ExecStop = "${pkgs.postfix}/bin/postfix stop";
            ExecReload = "${pkgs.postfix}/bin/postfix reload";
+
+            # Hardening
+            PrivateTmp = true;
+            PrivateDevices = true;
+            ProtectSystem = "full";
+            CapabilityBoundingSet = [ "~CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE" ];
+            MemoryDenyWriteExecute = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectControlGroups = true;
+            RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_NETLINK" "AF_UNIX" ];
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
          };
        };

--- a/nixos/modules/services/networking/gns3-server.md
+++ b/nixos/modules/services/networking/gns3-server.md
@ -0,0 +1,31 @@
+# GNS3 Server {#module-services-gns3-server}
+
+[GNS3](https://www.gns3.com/), a network software emulator.
+
+## Basic Usage {#module-services-gns3-server-basic-usage}
+
+A minimal configuration looks like this:
+
+```nix
+{
+  services.gns3-server = {
+    enable = true;
+
+    auth = {
+      enable = true;
+      user = "gns3";
+      passwordFile = "/var/lib/secrets/gns3_password";
+    };
+
+    ssl = {
+      enable = true;
+      certFile = "/var/lib/gns3/ssl/cert.pem";
+      keyFile = "/var/lib/gns3/ssl/key.pem";
+    };
+
+    dynamips.enable = true;
+    ubridge.enable = true;
+    vpcs.enable = true;
+  };
+}
+```
--- a/nixos/modules/services/networking/gns3-server.nix
+++ b/nixos/modules/services/networking/gns3-server.nix
@ -0,0 +1,263 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.gns3-server;
+
+  settingsFormat = pkgs.formats.ini { };
+  configFile = settingsFormat.generate "gns3-server.conf" cfg.settings;
+
+in {
+  meta = {
+    doc = ./gns3-server.md;
+    maintainers = [ lib.maintainers.anthonyroussel ];
+  };
+
+  options = {
+    services.gns3-server = {
+      enable = lib.mkEnableOption (lib.mdDoc "GNS3 Server daemon");
+
+      package = lib.mkPackageOptionMD pkgs "gns3-server" { };
+
+      auth = {
+        enable = lib.mkEnableOption (lib.mdDoc "password based HTTP authentication to access the GNS3 Server");
+
+        user = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+          example = "gns3";
+          description = lib.mdDoc ''Username used to access the GNS3 Server.'';
+        };
+
+        passwordFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          example = "/run/secrets/gns3-server-password";
+          description = lib.mdDoc ''
+            A file containing the password to access the GNS3 Server.
+
+            ::: {.warning}
+            This should be a string, not a nix path, since nix paths
+            are copied into the world-readable nix store.
+            :::
+          '';
+        };
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule { freeformType = settingsFormat.type; };
+        default = {};
+        example = { host = "127.0.0.1"; port = 3080; };
+        description = lib.mdDoc ''
+          The global options in `config` file in ini format.
+
+          Refer to <https://docs.gns3.com/docs/using-gns3/administration/gns3-server-configuration-file/>
+          for all available options.
+        '';
+      };
+
+      log = {
+        file = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = "/var/log/gns3/server.log";
+          description = lib.mdDoc ''Path of the file GNS3 Server should log to.'';
+        };
+
+        debug = lib.mkEnableOption (lib.mdDoc "debug logging");
+      };
+
+      ssl = {
+        enable = lib.mkEnableOption (lib.mdDoc "SSL encryption");
+
+        certFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          example = "/var/lib/gns3/ssl/server.pem";
+          description = lib.mdDoc ''
+            Path to the SSL certificate file. This certificate will
+            be offered to, and may be verified by, clients.
+          '';
+        };
+
+        keyFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          example = "/var/lib/gns3/ssl/server.key";
+          description = lib.mdDoc "Private key file for the certificate.";
+        };
+      };
+
+      dynamips = {
+        enable = lib.mkEnableOption (lib.mdDoc ''Whether to enable Dynamips support.'');
+        package = lib.mkPackageOptionMD pkgs "dynamips" { };
+      };
+
+      ubridge = {
+        enable = lib.mkEnableOption (lib.mdDoc ''Whether to enable uBridge support.'');
+        package = lib.mkPackageOptionMD pkgs "ubridge" { };
+      };
+
+      vpcs = {
+        enable = lib.mkEnableOption (lib.mdDoc ''Whether to enable VPCS support.'');
+        package = lib.mkPackageOptionMD pkgs "vpcs" { };
+      };
+    };
+  };
+
+  config = let
+    flags = {
+      enableDocker = config.virtualisation.docker.enable;
+      enableLibvirtd = config.virtualisation.libvirtd.enable;
+    };
+
+  in lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.ssl.enable -> cfg.ssl.certFile != null;
+        message = "Please provide a certificate to use for SSL encryption.";
+      }
+      {
+        assertion = cfg.ssl.enable -> cfg.ssl.keyFile != null;
+        message = "Please provide a private key to use for SSL encryption.";
+      }
+      {
+        assertion = cfg.auth.enable -> cfg.auth.user != null;
+        message = "Please provide a username to use for HTTP authentication.";
+      }
+      {
+        assertion = cfg.auth.enable -> cfg.auth.passwordFile != null;
+        message = "Please provide a password file to use for HTTP authentication.";
+      }
+    ];
+
+    users.groups.ubridge = lib.mkIf cfg.ubridge.enable { };
+
+    security.wrappers.ubridge = lib.mkIf cfg.ubridge.enable {
+      capabilities = "cap_net_raw,cap_net_admin=eip";
+      group = "ubridge";
+      owner = "root";
+      permissions = "u=rwx,g=rx,o=r";
+      source = lib.getExe cfg.ubridge.package;
+    };
+
+    services.gns3-server.settings = lib.mkMerge [
+      {
+        Server = {
+          appliances_path = lib.mkDefault "/var/lib/gns3/appliances";
+          configs_path = lib.mkDefault "/var/lib/gns3/configs";
+          images_path = lib.mkDefault "/var/lib/gns3/images";
+          projects_path = lib.mkDefault "/var/lib/gns3/projects";
+          symbols_path = lib.mkDefault "/var/lib/gns3/symbols";
+        };
+      }
+      (lib.mkIf (cfg.ubridge.enable) {
+        Server.ubridge_path = lib.mkDefault (lib.getExe cfg.ubridge.package);
+      })
+      (lib.mkIf (cfg.auth.enable) {
+        Server = {
+          auth = lib.mkDefault (lib.boolToString cfg.auth.enable);
+          user = lib.mkDefault cfg.auth.user;
+          password = lib.mkDefault "@AUTH_PASSWORD@";
+        };
+      })
+      (lib.mkIf (cfg.vpcs.enable) {
+        VPCS.vpcs_path = lib.mkDefault (lib.getExe cfg.vpcs.package);
+      })
+      (lib.mkIf (cfg.dynamips.enable) {
+        Dynamips.dynamips_path = lib.mkDefault (lib.getExe cfg.dynamips.package);
+      })
+    ];
+
+    systemd.services.gns3-server = let
+      commandArgs = lib.cli.toGNUCommandLineShell { } {
+        config = "/etc/gns3/gns3_server.conf";
+        pid = "/run/gns3/server.pid";
+        log = cfg.log.file;
+        ssl = cfg.ssl.enable;
+        # These are implicitly not set if `null`
+        certfile = cfg.ssl.certFile;
+        certkey = cfg.ssl.keyFile;
+      };
+    in
+    {
+      description = "GNS3 Server";
+
+      after = [ "network.target" "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+
+      # configFile cannot be stored in RuntimeDirectory, because GNS3
+      # uses the `--config` base path to stores supplementary configuration files at runtime.
+      #
+      preStart = ''
+        install -m660 ${configFile} /etc/gns3/gns3_server.conf
+
+        ${lib.optionalString cfg.auth.enable ''
+          ${pkgs.replace-secret}/bin/replace-secret \
+            '@AUTH_PASSWORD@' \
+            "''${CREDENTIALS_DIRECTORY}/AUTH_PASSWORD" \
+            /etc/gns3/gns3_server.conf
+        ''}
+      '';
+
+      path = lib.optional flags.enableLibvirtd pkgs.qemu;
+
+      reloadTriggers = [ configFile ];
+
+      serviceConfig = {
+        ConfigurationDirectory = "gns3";
+        ConfigurationDirectoryMode = "0750";
+        DynamicUser = true;
+        Environment = "HOME=%S/gns3";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        ExecStart = "${lib.getExe cfg.package} ${commandArgs}";
+        Group = "gns3";
+        LimitNOFILE = 16384;
+        LoadCredential = lib.mkIf cfg.auth.enable [ "AUTH_PASSWORD:${cfg.auth.passwordFile}" ];
+        LogsDirectory = "gns3";
+        LogsDirectoryMode = "0750";
+        PIDFile = "/run/gns3/server.pid";
+        Restart = "on-failure";
+        RestartSec = 5;
+        RuntimeDirectory = "gns3";
+        StateDirectory = "gns3";
+        StateDirectoryMode = "0750";
+        SupplementaryGroups = lib.optional flags.enableDocker "docker"
+          ++ lib.optional flags.enableLibvirtd "libvirtd"
+          ++ lib.optional cfg.ubridge.enable "ubridge";
+        User = "gns3";
+        WorkingDirectory = "%S/gns3";
+
+        # Hardening
+        DeviceAllow = lib.optional flags.enableLibvirtd "/dev/kvm";
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        # Don't restrict ProcSubset because python3Packages.psutil requires read access to /proc/stat
+        # ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+          "AF_UNIX"
+          "AF_PACKET"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        UMask = "0077";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@ -79,20 +79,19 @@ in
          package = mkDefault pkgs.cinnamon.mint-cursor-themes;
        };
      };
-      services.xserver.displayManager.sessionCommands = ''
-        if test "$XDG_CURRENT_DESKTOP" = "Cinnamon"; then
-            true
-            ${concatMapStrings (p: ''
-              if [ -d "${p}/share/gsettings-schemas/${p.name}" ]; then
-                export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${p}/share/gsettings-schemas/${p.name}
-              fi

-              if [ -d "${p}/lib/girepository-1.0" ]; then
-                export GI_TYPELIB_PATH=$GI_TYPELIB_PATH''${GI_TYPELIB_PATH:+:}${p}/lib/girepository-1.0
-                export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${p}/lib
-              fi
-            '') cfg.sessionPath}
-        fi
+      # Have to take care of GDM + Cinnamon on Wayland users
+      environment.extraInit = ''
+        ${concatMapStrings (p: ''
+          if [ -d "${p}/share/gsettings-schemas/${p.name}" ]; then
+            export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${p}/share/gsettings-schemas/${p.name}
+          fi
+
+          if [ -d "${p}/lib/girepository-1.0" ]; then
+            export GI_TYPELIB_PATH=$GI_TYPELIB_PATH''${GI_TYPELIB_PATH:+:}${p}/lib/girepository-1.0
+            export LD_LIBRARY_PATH=$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}${p}/lib
+          fi
+        '') cfg.sessionPath}
      '';

      # Default services
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -342,6 +342,7 @@ in {
  gnome-extensions = handleTest ./gnome-extensions.nix {};
  gnome-flashback = handleTest ./gnome-flashback.nix {};
  gnome-xorg = handleTest ./gnome-xorg.nix {};
+  gns3-server = handleTest ./gns3-server.nix {};
  gnupg = handleTest ./gnupg.nix {};
  go-neb = handleTest ./go-neb.nix {};
  gobgpd = handleTest ./gobgpd.nix {};
--- a/nixos/tests/cinnamon-wayland.nix
+++ b/nixos/tests/cinnamon-wayland.nix
@ -12,6 +12,9 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
      autoLogin.user = nodes.machine.users.users.alice.name;
      defaultSession = "cinnamon-wayland";
    };
+
+    # For the sessionPath subtest.
+    services.xserver.desktopManager.cinnamon.sessionPath = [ pkgs.gnome.gpaste ];
  };

  enableOCR = true;
@ -47,6 +50,9 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
          machine.wait_until_succeeds("journalctl -b --grep 'Loaded applet menu@cinnamon.org'")
          machine.wait_until_succeeds("journalctl -b --grep 'calendar@cinnamon.org: Calendar events supported'")

+      with subtest("Check if sessionPath option actually works"):
+          machine.succeed("${eval "imports.gi.GIRepository.Repository.get_search_path\\(\\)"} | grep gpaste")
+
      with subtest("Open Cinnamon Settings"):
          machine.succeed("${su "cinnamon-settings themes >&2 &"}")
          machine.wait_until_succeeds("${eval "global.display.focus_window.wm_class"} | grep -i 'cinnamon-settings'")
--- a/nixos/tests/cinnamon.nix
+++ b/nixos/tests/cinnamon.nix
@ -7,6 +7,9 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
    imports = [ ./common/user-account.nix ];
    services.xserver.enable = true;
    services.xserver.desktopManager.cinnamon.enable = true;
+
+    # For the sessionPath subtest.
+    services.xserver.desktopManager.cinnamon.sessionPath = [ pkgs.gnome.gpaste ];
  };

  enableOCR = true;
@ -49,6 +52,9 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
          machine.wait_until_succeeds("journalctl -b --grep 'Loaded applet menu@cinnamon.org'")
          machine.wait_until_succeeds("journalctl -b --grep 'calendar@cinnamon.org: Calendar events supported'")

+      with subtest("Check if sessionPath option actually works"):
+          machine.succeed("${eval "imports.gi.GIRepository.Repository.get_search_path\\(\\)"} | grep gpaste")
+
      with subtest("Open Cinnamon Settings"):
          machine.succeed("${su "cinnamon-settings themes >&2 &"}")
          machine.wait_until_succeeds("${eval "global.display.focus_window.wm_class"} | grep -i 'cinnamon-settings'")
--- a/nixos/tests/gns3-server.nix
+++ b/nixos/tests/gns3-server.nix
@ -0,0 +1,55 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "gns3-server";
+  meta.maintainers = [ lib.maintainers.anthonyroussel ];
+
+  nodes.machine =
+    { ... }:
+    let
+      tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
+        openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -days 365 \
+          -subj '/CN=localhost'
+        install -D -t $out key.pem cert.pem
+      '';
+    in {
+      services.gns3-server = {
+        enable = true;
+        auth = {
+          enable = true;
+          user = "user";
+          passwordFile = pkgs.writeText "gns3-auth-password-file" "password";
+        };
+        ssl = {
+          enable = true;
+          certFile = "${tls-cert}/cert.pem";
+          keyFile = "${tls-cert}/key.pem";
+        };
+        dynamips.enable = true;
+        ubridge.enable = true;
+        vpcs.enable = true;
+      };
+
+      security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
+    };
+
+  testScript = let
+    createProject = pkgs.writeText "createProject.json" (builtins.toJSON {
+      name = "test_project";
+    });
+  in
+  ''
+    start_all()
+
+    machine.wait_for_unit("gns3-server.service")
+    machine.wait_for_open_port(3080)
+
+    with subtest("server is listening"):
+      machine.succeed("curl -sSfL -u user:password https://localhost:3080/v2/version")
+
+    with subtest("create dummy project"):
+      machine.succeed("curl -sSfL -u user:password https://localhost:3080/v2/projects -d @${createProject}")
+
+    with subtest("logging works"):
+      log_path = "/var/log/gns3/server.log"
+      machine.wait_for_file(log_path)
+  '';
+})
--- a/nixos/tests/opentabletdriver.nix
+++ b/nixos/tests/opentabletdriver.nix
@ -20,9 +20,11 @@ in {
    ''
      machine.start()
      machine.wait_for_x()
+
+      machine.wait_for_unit('graphical.target')
      machine.wait_for_unit("opentabletdriver.service", "${testUser}")

-      machine.succeed("cat /etc/udev/rules.d/99-opentabletdriver.rules")
+      machine.succeed("cat /etc/udev/rules.d/70-opentabletdriver.rules")
      # Will fail if service is not running
      # Needs to run as the same user that started the service
      machine.succeed("su - ${testUser} -c 'otd detect'")
--- a/pkgs/applications/blockchains/snarkos/default.nix
+++ b/pkgs/applications/blockchains/snarkos/default.nix
@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "snarkos";
-  version = "2.2.4";
+  version = "2.2.7";

  src = fetchFromGitHub {
    owner = "AleoHQ";
    repo = "snarkOS";
    rev = "v${version}";
-    sha256 = "sha256-sq99lJqSJ436wdSjdOlooGD2PysZzbyb7hTfJ9OUg/U=";
+    sha256 = "sha256-+z9dgg5HdR+Gomug03gI1zdCU6t4SBHkl1Pxoq69wrc=";
  };

-  cargoHash = "sha256-0x/YKPLh5yf3y/CjrQF18yDfPJ8IlArVVczgyVPzpEI=";
+  cargoHash = "sha256-qW/ZV4JqpNqqh8BYc+/d5g8junwhdZ38NhHclx+k/0M=";

  # buildAndTestSubdir = "cli";

--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -1,23 +1,20 @@
 { lib
 , stdenv
-
-  # nixpkgs functions
-, buildGoModule
+, # nixpkgs functions
+  buildGoModule
 , buildVimPlugin
 , fetchFromGitHub
 , fetchFromSourcehut
 , fetchpatch
 , fetchurl
 , substituteAll
-
-  # Language dependencies
-, fetchYarnDeps
+, # Language dependencies
+  fetchYarnDeps
 , mkYarnModules
 , python3
 , rustPlatform
-
-  # Misc dependencies
-, Cocoa
+, # Misc dependencies
+  Cocoa
 , code-minimap
 , dasht
 , deno
@ -34,7 +31,7 @@
 , languagetool
 , llvmPackages
 , meson
-, nim
+, nim1
 , nodePackages
 , openscad
 , pandoc
@ -60,50 +57,40 @@
 , xxd
 , zathura
 , zsh
-
-  # command-t dependencies
-, getconf
+, # command-t dependencies
+  getconf
 , ruby
-
-  # cpsm dependencies
-, boost
+, # cpsm dependencies
+  boost
 , cmake
 , icu
 , ncurses
-
-  # LanguageClient-neovim dependencies
-, CoreFoundation
+, # LanguageClient-neovim dependencies
+  CoreFoundation
 , CoreServices
-
-  # nvim-treesitter dependencies
-, callPackage
-
-  # sg.nvim dependencies
-, darwin
-
-  # sved dependencies
-, glib
+, # nvim-treesitter dependencies
+  callPackage
+, # sg.nvim dependencies
+  darwin
+, # sved dependencies
+  glib
 , gobject-introspection
 , wrapGAppsHook
-
-  # sniprun dependencies
-, bashInteractive
+, # sniprun dependencies
+  bashInteractive
 , coreutils
 , curl
 , gnugrep
 , gnused
 , makeWrapper
 , procps
-
-  # sg-nvim dependencies
-, openssl
+, # sg-nvim dependencies
+  openssl
 , pkg-config
-
-  # vim-agda dependencies
-, agda
-
-  # vim-go dependencies
-, asmfmt
+, # vim-agda dependencies
+  agda
+, # vim-go dependencies
+  asmfmt
 , delve
 , errcheck
 , go-motion
@ -121,16 +108,14 @@
 , iferr
 , impl
 , reftools
-
-# hurl dependencies
-, hurl
-
-  # must be lua51Packages
-, luaPackages
+, # hurl dependencies
+  hurl
+, # must be lua51Packages
+  luaPackages
 , luajitPackages
-}:
-
-self: super: {
+,
+}: self: super:
+{
  alpha-nvim = super.alpha-nvim.overrideAttrs {
    dependencies = [
      self.nvim-web-devicons # required by the startify theme
@ -179,11 +164,12 @@ self: super: {
  };

  chadtree = super.chadtree.overrideAttrs {
-    passthru.python3Dependencies = ps: with ps; [
-      pynvim-pp
-      pyyaml
-      std2
-    ];
+    passthru.python3Dependencies = ps:
+      with ps; [
+        pynvim-pp
+        pyyaml
+        std2
+      ];

    # We need some patches so it stops complaining about not being in a venv
    patches = [ ./patches/chadtree/emulate-venv.patch ];
@ -199,13 +185,16 @@ self: super: {
    # These usually implicitly set by cc-wrapper around clang (pkgs/build-support/cc-wrapper).
    # The linked ruby code shows generates the required '.clang_complete' for cmake based projects
    # https://gist.github.com/Mic92/135e83803ed29162817fce4098dec144
-    preFixup = ''
-      substituteInPlace "$out"/plugin/clang_complete.vim \
-        --replace "let g:clang_library_path = '' + "''" + ''" "let g:clang_library_path='${llvmPackages.libclang.lib}/lib/libclang.so'"
+    preFixup =
+      ''
+        substituteInPlace "$out"/plugin/clang_complete.vim \
+          --replace "let g:clang_library_path = ''
+      + "''"
+      + ''        " "let g:clang_library_path='${llvmPackages.libclang.lib}/lib/libclang.so'"

-      substituteInPlace "$out"/plugin/libclang.py \
-        --replace "/usr/lib/clang" "${llvmPackages.clang.cc}/lib/clang"
-    '';
+              substituteInPlace "$out"/plugin/libclang.py \
+                --replace "/usr/lib/clang" "${llvmPackages.clang.cc}/lib/clang"
+      '';
  };

  clighter8 = super.clighter8.overrideAttrs {
@ -374,11 +363,12 @@ self: super: {
  };

  coq_nvim = super.coq_nvim.overrideAttrs {
-    passthru.python3Dependencies = ps: with ps; [
-      pynvim-pp
-      pyyaml
-      std2
-    ];
+    passthru.python3Dependencies = ps:
+      with ps; [
+        pynvim-pp
+        pyyaml
+        std2
+      ];

    # We need some patches so it stops complaining about not being in a venv
    patches = [ ./patches/coq_nvim/emulate-venv.patch ];
@ -469,11 +459,14 @@ self: super: {
  };

  direnv-vim = super.direnv-vim.overrideAttrs (old: {
-    preFixup = old.preFixup or "" + ''
-      substituteInPlace $out/autoload/direnv.vim \
-        --replace "let s:direnv_cmd = get(g:, 'direnv_cmd', 'direnv')" \
-          "let s:direnv_cmd = get(g:, 'direnv_cmd', '${lib.getBin direnv}/bin/direnv')"
-    '';
+    preFixup =
+      old.preFixup
+        or ""
+      + ''
+        substituteInPlace $out/autoload/direnv.vim \
+          --replace "let s:direnv_cmd = get(g:, 'direnv_cmd', 'direnv')" \
+            "let s:direnv_cmd = get(g:, 'direnv_cmd', '${lib.getBin direnv}/bin/direnv')"
+      '';
  });

  executor-nvim = super.executor-nvim.overrideAttrs {
@ -513,7 +506,7 @@ self: super: {
      };
    in
    super.fruzzy.overrideAttrs (old: {
-      buildInputs = [ nim ];
+      buildInputs = [ nim1 ];
      patches = [
        (substituteAll {
          src = ./patches/fruzzy/get_version.patch;
@ -544,7 +537,6 @@ self: super: {
  };

  fzf-hoogle-vim = super.fzf-hoogle-vim.overrideAttrs {
-
    # add this to your lua config to prevent the plugin from trying to write in the
    # nix store:
    # vim.g.hoogle_fzf_cache_file = vim.fn.stdpath('cache')..'/hoogle_cache.json'
@ -621,7 +613,6 @@ self: super: {
    # dontUnpack = true;

    src = "${hurl.src}/contrib/vim";
-
  };

  image-nvim = super.image-nvim.overrideAttrs {
@ -737,48 +728,51 @@ self: super: {
      rev = "5d916c39c1852e09fcd39eab174b8e5bbdb25f8f";
      sha256 = "10d6dh0czdpgfpzqs5vzxfffkm0460qjzi2mfkacgghqf3iwkbja";
    };
-    passthru.python3Dependencies = ps: with ps; [
-      pynvim
-      jupyter-client
-      ueberzug
-      pillow
-      cairosvg
-      plotly
-      ipykernel
-      pyperclip
-      pnglatex
-    ];
+    passthru.python3Dependencies = ps:
+      with ps; [
+        pynvim
+        jupyter-client
+        ueberzug
+        pillow
+        cairosvg
+        plotly
+        ipykernel
+        pyperclip
+        pnglatex
+      ];
    meta.homepage = "https://github.com/WhiteBlackGoose/magma-nvim-goose/";
  };

-  markdown-preview-nvim =  let
-    # We only need its dependencies `node-modules`.
-    nodeDep = mkYarnModules rec {
-      inherit (super.markdown-preview-nvim) pname version;
-      packageJSON = ./markdown-preview-nvim/package.json;
-      yarnLock = "${super.markdown-preview-nvim.src}/yarn.lock";
-      offlineCache = fetchYarnDeps {
-        inherit yarnLock;
-        hash = "sha256-kzc9jm6d9PJ07yiWfIOwqxOTAAydTpaLXVK6sEWM8gg=";
+  markdown-preview-nvim =
+    let
+      # We only need its dependencies `node-modules`.
+      nodeDep = mkYarnModules rec {
+        inherit (super.markdown-preview-nvim) pname version;
+        packageJSON = ./markdown-preview-nvim/package.json;
+        yarnLock = "${super.markdown-preview-nvim.src}/yarn.lock";
+        offlineCache = fetchYarnDeps {
+          inherit yarnLock;
+          hash = "sha256-kzc9jm6d9PJ07yiWfIOwqxOTAAydTpaLXVK6sEWM8gg=";
+        };
      };
-    };
-  in super.markdown-preview-nvim.overrideAttrs {
-    patches = [
-      (substituteAll {
-        src = ./markdown-preview-nvim/fix-node-paths.patch;
-        node = "${nodejs}/bin/node";
-      })
-    ];
-    postInstall = ''
-      ln -s ${nodeDep}/node_modules $out/app
-    '';
+    in
+    super.markdown-preview-nvim.overrideAttrs {
+      patches = [
+        (substituteAll {
+          src = ./markdown-preview-nvim/fix-node-paths.patch;
+          node = "${nodejs}/bin/node";
+        })
+      ];
+      postInstall = ''
+        ln -s ${nodeDep}/node_modules $out/app
+      '';

-    nativeBuildInputs = [ nodejs ];
-    doInstallCheck = true;
-    installCheckPhase = ''
-      node $out/app/index.js --version
-    '';
-  };
+      nativeBuildInputs = [ nodejs ];
+      doInstallCheck = true;
+      installCheckPhase = ''
+        node $out/app/index.js --version
+      '';
+    };

  mason-lspconfig-nvim = super.mason-lspconfig-nvim.overrideAttrs {
    dependencies = with self; [ mason-nvim nvim-lspconfig ];
@ -1019,10 +1013,12 @@ self: super: {

        nativeBuildInputs = [ pkg-config ];

-        buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [
-          darwin.apple_sdk.frameworks.Security
-          darwin.apple_sdk.frameworks.SystemConfiguration
-        ];
+        buildInputs =
+          [ openssl ]
+          ++ lib.optionals stdenv.isDarwin [
+            darwin.apple_sdk.frameworks.Security
+            darwin.apple_sdk.frameworks.SystemConfiguration
+          ];

        prePatch = ''
          rm .cargo/config.toml
@ -1077,7 +1073,7 @@ self: super: {

        postInstall = ''
          wrapProgram $out/bin/sniprun \
-            --prefix PATH ${lib.makeBinPath [ bashInteractive coreutils curl gnugrep gnused procps ]}
+            --prefix PATH ${lib.makeBinPath [bashInteractive coreutils curl gnugrep gnused procps]}
        '';

        doCheck = false;
@ -1109,12 +1105,14 @@ self: super: {
  };

  sqlite-lua = super.sqlite-lua.overrideAttrs {
-    postPatch = let
-      libsqlite = "${sqlite.out}/lib/libsqlite3${stdenv.hostPlatform.extensions.sharedLibrary}";
-    in ''
-      substituteInPlace lua/sqlite/defs.lua \
-        --replace "path = vim.g.sqlite_clib_path" "path = vim.g.sqlite_clib_path or ${lib.escapeShellArg libsqlite}"
-    '';
+    postPatch =
+      let
+        libsqlite = "${sqlite.out}/lib/libsqlite3${stdenv.hostPlatform.extensions.sharedLibrary}";
+      in
+      ''
+        substituteInPlace lua/sqlite/defs.lua \
+          --replace "path = vim.g.sqlite_clib_path" "path = vim.g.sqlite_clib_path or ${lib.escapeShellArg libsqlite}"
+      '';
  };

  ssr = super.ssr-nvim.overrideAttrs {
@ -1203,17 +1201,16 @@ self: super: {
    preFixup =
      let
        fzy-lua-native-path = "deps/fzy-lua-native";
-        fzy-lua-native =
-          stdenv.mkDerivation {
-            name = "fzy-lua-native";
-            src = "${old.src}/${fzy-lua-native-path}";
-            # remove pre-compiled binaries
-            preBuild = "rm -rf static/*";
-            installPhase = ''
-              install -Dm 444 -t $out/static static/*
-              install -Dm 444 -t $out/lua lua/*
-            '';
-          };
+        fzy-lua-native = stdenv.mkDerivation {
+          name = "fzy-lua-native";
+          src = "${old.src}/${fzy-lua-native-path}";
+          # remove pre-compiled binaries
+          preBuild = "rm -rf static/*";
+          installPhase = ''
+            install -Dm 444 -t $out/static static/*
+            install -Dm 444 -t $out/lua lua/*
+          '';
+        };
      in
      ''
        rm -rf $target/${fzy-lua-native-path}/*
@ -1269,7 +1266,7 @@ self: super: {
        cp "${ftdetect}" vim-plugin/ftdetect/tup.vim
        cd vim-plugin
      '';
-      meta.maintainers = with lib.maintainers; [enderger];
+      meta.maintainers = with lib.maintainers; [ enderger ];
    };

  typescript-tools-nvim = super.typescript-tools-nvim.overrideAttrs {
@ -1284,7 +1281,6 @@ self: super: {
      };
    in
    super.unicode-vim.overrideAttrs {
-
      # redirect to /dev/null else changes terminal color
      buildPhase = ''
        cp "${unicode-data}" autoload/unicode/UnicodeData.txt
@ -1387,9 +1383,11 @@ self: super: {
  # https://github.com/NixOS/nixpkgs/issues/157609
  vim-colorschemes = super.vim-colorschemes.overrideAttrs (old: {
    src = old.src.overrideAttrs (srcOld: {
-      postFetch = (srcOld.postFetch or "") + lib.optionalString (!stdenv.isDarwin) ''
-        rm $out/colors/darkBlue.vim
-      '';
+      postFetch =
+        (srcOld.postFetch or "")
+        + lib.optionalString (!stdenv.isDarwin) ''
+          rm $out/colors/darkBlue.vim
+        '';
    });
  });

@ -1539,11 +1537,14 @@ self: super: {
  };

  vim-stylish-haskell = super.vim-stylish-haskell.overrideAttrs (old: {
-    postPatch = old.postPatch or "" + ''
-      substituteInPlace ftplugin/haskell/stylish-haskell.vim --replace \
-        'g:stylish_haskell_command = "stylish-haskell"' \
-        'g:stylish_haskell_command = "${stylish-haskell}/bin/stylish-haskell"'
-    '';
+    postPatch =
+      old.postPatch
+        or ""
+      + ''
+        substituteInPlace ftplugin/haskell/stylish-haskell.vim --replace \
+          'g:stylish_haskell_command = "stylish-haskell"' \
+          'g:stylish_haskell_command = "${stylish-haskell}/bin/stylish-haskell"'
+      '';
  });

  vim-surround = super.vim-surround.overrideAttrs {
@ -1699,8 +1700,8 @@ self: super: {
    '';
    stripDebugList = [ "autoload/leaderf/python" ];
  };
-
-} // (
+}
+  // (
  let
    nodePackageNames = [
      "coc-clangd"
@ -1753,11 +1754,12 @@ self: super: {
      "coc-yaml"
      "coc-yank"
    ];
-    nodePackage2VimPackage = name: buildVimPlugin {
-      pname = name;
-      inherit (nodePackages.${name}) version meta;
-      src = "${nodePackages.${name}}/lib/node_modules/${name}";
-    };
+    nodePackage2VimPackage = name:
+      buildVimPlugin {
+        pname = name;
+        inherit (nodePackages.${name}) version meta;
+        src = "${nodePackages.${name}}/lib/node_modules/${name}";
+      };
  in
  lib.genAttrs nodePackageNames nodePackage2VimPackage
 )
--- a/pkgs/applications/graphics/halftone/default.nix
+++ b/pkgs/applications/graphics/halftone/default.nix
@ -15,13 +15,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "halftone";
-  version = "0.3.1";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "tfuxu";
    repo = pname;
    rev = version;
-    hash = "sha256-hUaI5omYUa5Fq95N0FqJJe+WVoRWkANy0/mmaURWIzg=";
+    hash = "sha256-Yh3LxeO90N45LSefV1RZoO+8C0TUmFELzXaaQ1rCo2o=";
  };

  format = "other";
--- a/pkgs/applications/graphics/komikku/default.nix
+++ b/pkgs/applications/graphics/komikku/default.nix
@ -19,7 +19,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "komikku";
-  version = "1.31.0";
+  version = "1.32.0";

  format = "other";

@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "valos";
    repo = "Komikku";
    rev = "v${version}";
-    hash = "sha256-7u7F2Z1fYr3S1Sx9FAVmimQbT0o6tb96jXG0o9+4/rc=";
+    hash = "sha256-aF7EByUQ6CO+rXfGz4ivU18N5sh0X8nGgJT94dCuN8c=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/krita/default.nix
+++ b/pkgs/applications/graphics/krita/default.nix
@ -1,7 +1,7 @@
 { callPackage, ... }:

 callPackage ./generic.nix {
-  version = "5.2.0";
+  version = "5.2.2";
  kde-channel = "stable";
-  hash = "sha256-02oZc4pZw2dQucx1IuPJslWQGjOqwGmgeDgnUIqKkpc=";
+  hash = "sha256-wdLko219iqKW0CHlK+STzGedP+Xoqk/BPENNM+gVTOI=";
 }
--- a/pkgs/applications/graphics/krita/generic.nix
+++ b/pkgs/applications/graphics/krita/generic.nix
@ -21,15 +21,6 @@ mkDerivation rec {
    inherit hash;
  };

-  patches = [
-    (fetchpatch {
-      name = "krita-opencolorio-2.3-compat.patch";
-      url = "https://invent.kde.org/graphics/krita/-/commit/520c633c2c868f2236d8e56eefecdcb6e3ebd840.patch";
-      hash = "sha256-eXsgBN8OnKjZOQsOxViPypts6CVh3L+IYKMB/mDUcfQ=";
-      includes = [ "plugins/dockers/lut/ocio_display_filter_vfx2021.cpp" ];
-    })
-  ];
-
  nativeBuildInputs = [ cmake extra-cmake-modules pkg-config python3Packages.sip makeWrapper ];

  buildInputs = [
--- a/pkgs/applications/graphics/photoqt/default.nix
+++ b/pkgs/applications/graphics/photoqt/default.nix
@ -25,11 +25,11 @@

 stdenv.mkDerivation rec {
  pname = "photoqt";
-  version = "4.0.1";
+  version = "4.1";

  src = fetchurl {
    url = "https://photoqt.org/pkgs/photoqt-${version}.tar.gz";
-    hash = "sha256-nmEipzatselwtBR//ayajqgmhaUnAMKW7JBLKdzutHg=";
+    hash = "sha256-vxQZFlS4C+Dg9I6BKeMUFOYHz74d28gbhJlIpxSKTvs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@ -12,12 +12,12 @@ let
    if extension == "zip" then fetchzip args else fetchurl args;

  pname = "1password-cli";
-  version = "2.23.0";
+  version = "2.24.0";
  sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-WBUHS1qoKHGJb6ktw8BD3V0H0419BO3EyTh675UnZRA=" "zip";
-    i686-linux = fetch "linux_386" "sha256-pulMvdE8COwRBk3IBBXqYPk2+A1XuCN9TxtGqm1HFeM=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-w0ieg9MxjmkABc4LRZIGyfDjbOter0pKRigLZBhosz4=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-fRkvkLnhr0oZCcCGhQd53Oj8uTxsgaSUkxD7p7CPOwI=" "pkg";
+    aarch64-linux = fetch "linux_arm64" "sha256-wISQ4528+rYxaIvxAa9jrF6E6A3SvMGbLyqB4JO3Mbw=" "zip";
+    i686-linux = fetch "linux_386" "sha256-A+sQY6Q0JfHuusdP96M7BqjMCn2YobAekieN3HdRJac=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-hgMZ3gSqpb04ixTwMnEg0EpYgzuTF1CMEGGl6LbYKjY=" "zip";
+    aarch64-darwin = fetch "apple_universal" "sha256-R0gGUgN+f5DQF57AyAI6P4X3ySktxQ60DCPJPknwxPY=" "pkg";
    x86_64-darwin = aarch64-darwin;
  };
  platforms = builtins.attrNames sources;
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@ -32,11 +32,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "calibre";
-  version = "7.1.0";
+  version = "7.2.0";

  src = fetchurl {
    url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-cKUV+tBZ5ZdXkoLdJPdURKnWP5B5gzCUQQehVQIRgko=";
+    hash = "sha256-1OZPSXF5cQlmwbD2bHVWtYHLUgCo8LaR1WPpuSUWoR8=";
  };

  patches = [
@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
    (fetchpatch {
      name = "0007-Hardening-Qt-code.patch";
      url = "https://raw.githubusercontent.com/debian-calibre/calibre/debian/${finalAttrs.version}+ds-1/debian/patches/hardening/0007-Hardening-Qt-code.patch";
-      hash = "sha256-eTzwo8aAIJnZTIZ/8DqCQi3ZbKxycEdiv+UxRuxo12g=";
+      hash = "sha256-a6yyG0RUsQJBBNxeJsTtQSBV2lxdzz1hnTob88O+SKg=";
    })
  ]
  ++ lib.optional (!unrarSupport) ./dont_build_unrar_plugin.patch;
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@ -2,13 +2,13 @@

 buildPythonApplication rec {
  pname = "gallery-dl";
-  version = "1.26.4";
+  version = "1.26.5";
  format = "setuptools";

  src = fetchPypi {
    inherit version;
    pname = "gallery_dl";
-    sha256 = "sha256-qoNWH7fomOQEdOz0+sEXtfhXItPofSMbDvQCmHcOPXo=";
+    sha256 = "sha256-XlHfCPwTgy66CiIvEu/NU8gNXfLg+8i98anngyeRfGU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/misc/gimoji/default.nix
+++ b/pkgs/applications/misc/gimoji/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "gimoji";
-  version = "0.6.1";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "zeenix";
    repo = "gimoji";
    rev = version;
-    hash = "sha256-7UzdZsidLHLZBj7mpRJQhvr3VP7HtkKPfAc7dnxS7kE=";
+    hash = "sha256-rXGnSXqKxxmC2V2qapWZb+TB89a854ZGq1kG/3JjlUg=";
  };

-  cargoHash = "sha256-oWImiIUFgy/pKHlZPPd1IWDG5l5LYCWTYJjgEqiXzLA=";
+  cargoHash = "sha256-WYMqKwe78D00ZZ+uwV61keRBNiJQKNqlpQtteVR0bVA=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.AppKit
--- a/pkgs/applications/misc/rtfm/default.nix
+++ b/pkgs/applications/misc/rtfm/default.nix
@ -18,14 +18,14 @@ let
 in
 crystal.buildCrystalPackage rec {
  pname = "rtfm";
-  version = "0.2.3";
+  version = "0.2.4";

  src = fetchFromGitHub {
    owner = "hugopl";
    repo = "rtfm";
    rev = "v${version}";
    name = "rtfm";
-    hash = "sha256-ulv5US5EBBb0rK/Qaw8ZpHI4QwEQGlzscmAoe17946k=";
+    hash = "sha256-IfI7jYM1bsrCq2NiANv/SWkCjPyT/HYUofJMUYy0Sbk=";
  };

  patches = [
--- a/pkgs/applications/misc/wallust/default.nix
+++ b/pkgs/applications/misc/wallust/default.nix
@ -4,7 +4,7 @@
 , nix-update-script
 }:
 let
-  version = "2.7.1";
+  version = "2.8.0";
 in
 rustPlatform.buildRustPackage {
  pname = "wallust";
@ -15,10 +15,14 @@ rustPlatform.buildRustPackage {
    owner = "explosion-mental";
    repo = "wallust";
    rev = version;
-    hash = "sha256-WhL2HWM1onRrCqWJPLnAVMd/f/xfLrK3mU8jFSLFjAM=";
+    hash = "sha256-qX+pU/ovRV7dA35qSA724vV9azz7dMbEyMVBzqS47Ps=";
  };

-  cargoSha256 = "sha256-pR2vdqMGJZ6zvXwwKUIPjb/lWzVgYqQ7C7/sk/+usc4=";
+  cargoHash = "sha256-PAO7qxaKrRKYoC5RElNCylqRzOgvzPyxb6tTzW4jNi4=";
+
+  # temporarily skip tests for args due to a string formatting conflict
+  # https://codeberg.org/explosion-mental/wallust/issues/30
+  cargoTestFlags = [ "--test config" "--test cache" "--test template" ];

  passthru.updateScript = nix-update-script { };

--- a/pkgs/applications/misc/waybar/default.nix
+++ b/pkgs/applications/misc/waybar/default.nix
@ -39,7 +39,6 @@
 , upower
 , wayland
 , wireplumber
-, wlroots
 , wrapGAppsHook

 , cavaSupport ? true
@ -115,7 +114,6 @@ stdenv.mkDerivation (finalAttrs: {
    libxkbcommon
    spdlog
    wayland
-    wlroots
  ]
  ++ lib.optionals cavaSupport [
    SDL2
@ -187,6 +185,6 @@ stdenv.mkDerivation (finalAttrs: {
      synthetica
      khaneliman
    ];
-    inherit (wlroots.meta) platforms;
+    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -92,11 +92,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.61.101";
+  version = "1.61.109";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    hash = "sha256-s+YjTZs+dT/T/MSzOAvXMHzd3pWMbLa8v9amnd2sqns=";
+    hash = "sha256-vIi205FqgoQEZCV4iWCFxjH2hJNWH9HjRU94jt7Ee8A=";
  };

  dontConfigure = true;
@ -205,7 +205,8 @@ stdenv.mkDerivation rec {
    '';
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.mpl20;
-    maintainers = with maintainers; [ uskudnik rht jefflabonte nasirhm ];
+    maintainers = with maintainers; [ uskudnik rht jefflabonte nasirhm buckley310 ];
    platforms = [ "x86_64-linux" ];
+    mainProgram = "brave";
  };
 }
--- a/pkgs/applications/networking/browsers/floorp/default.nix
+++ b/pkgs/applications/networking/browsers/floorp/default.nix
@ -7,7 +7,7 @@

 ((buildMozillaMach rec {
  pname = "floorp";
-  packageVersion = "11.6.1";
+  packageVersion = "11.7.1";
  applicationName = "Floorp";
  binaryName = "floorp";

@ -19,7 +19,7 @@
    repo = "Floorp";
    fetchSubmodules = true;
    rev = "v${packageVersion}";
-    hash = "sha256-pxKzRS7uTFMxJ1F1CMRHdyU/zcqGDjLWMWZCmoT/eh8=";
+    hash = "sha256-1GxWqibUR10gz0TjQuCtFntlxoNkq4CY5Yt/4FcIDDQ=";
  };

  extraConfigureFlags = [
--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "istioctl";
-  version = "1.20.0";
+  version = "1.20.1";

  src = fetchFromGitHub {
    owner = "istio";
    repo = "istio";
    rev = version;
-    hash = "sha256-V07e0IbHlQLSVxzWClHX8PrwKY4DaMZmwy3IwGTD7jI=";
+    hash = "sha256-baY9O2F5qte6v8HM905VYdvqQZxkTSeu3ydB4Y4UM4E=";
  };
-  vendorHash = "sha256-PQYlqi4KDietVV2J5KiaoFqHg12l0bomj57lsTYkSPo=";
+  vendorHash = "sha256-QEP7qG3RLVhEGsNJU0r/grVrcepouAC8usL9nLeaJFs=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/cluster/kops/default.nix
+++ b/pkgs/applications/networking/cluster/kops/default.nix
@ -61,8 +61,8 @@ rec {
  };

  kops_1_28 = mkKops rec {
-    version = "1.28.1";
-    sha256 = "sha256-jVaSqBdxg70XODwmFIpufJGXqB4r0UfNc/J+ZnjkhDU=";
+    version = "1.28.2";
+    sha256 = "sha256-l8budNU+sXZY/hA6jluM+s5pA43j0stQM5vmkwDPuio=";
    rev = "v${version}";
  };
 }
--- a/pkgs/applications/networking/cluster/rke2/default.nix
+++ b/pkgs/applications/networking/cluster/rke2/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "rke2";
-  version = "1.28.3+rke2r1";
+  version = "1.29.0+rke2r1";

  src = fetchFromGitHub {
    owner = "rancher";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-0a659XE/Pg8g5Ui3ugUQeFnXJiWqkPbvhtdpLp4/5i8=";
+    hash = "sha256-E59GUcbnbvsGZYn87RGNrGTVUsydKsjL+C5h15q74p0=";
  };

-  vendorHash = "sha256-Kexu3l4iV8bIIFFae0KVypy2bTKwtl5ibEDQ7YP0JK0=";
+  vendorHash = "sha256-Og0CqxNnhRN6PdggneGK05uprZ2D7lux/snXcArIm8Q=";

  postPatch = ''
    # Patch the build scripts so they work in the Nix build environment.
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -24,7 +24,7 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "flexget";
-  version = "3.10.1";
+  version = "3.10.6";
  format = "pyproject";

  # Fetch from GitHub in order to use `requirements.in`
@ -32,7 +32,7 @@ python.pkgs.buildPythonApplication rec {
    owner = "Flexget";
    repo = "Flexget";
    rev = "refs/tags/v${version}";
-    hash = "sha256-4r+PADMUpyvWNvA7MSgjx1VcCJKrYJLyvEn9esZKCRw=";
+    hash = "sha256-cDfeSCG+L8ALCC2CdfKIPzqMrWtwwN6KSvZS5n8rdXQ=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/gns3/server.nix
+++ b/pkgs/applications/networking/gns3/server.nix
@ -8,6 +8,7 @@
 , fetchFromGitHub
 , pkgsStatic
 , stdenv
+, nixosTests
 , testers
 , gns3-server
 }:
@ -75,9 +76,12 @@ python3.pkgs.buildPythonApplication {
    "--reruns 3"
  ];

-  passthru.tests.version = testers.testVersion {
-    package = gns3-server;
-    command = "${lib.getExe gns3-server} --version";
+  passthru.tests = {
+    inherit (nixosTests) gns3-server;
+    version = testers.testVersion {
+      package = gns3-server;
+      command = "${lib.getExe gns3-server} --version";
+    };
  };

  meta = with lib; {
--- a/pkgs/applications/networking/p2p/stig/default.nix
+++ b/pkgs/applications/networking/p2p/stig/default.nix
@ -1,25 +1,25 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, python3Packages
+, python310Packages
 , testers
 , stig
 }:

-python3Packages.buildPythonApplication rec {
+python310Packages.buildPythonApplication rec {
  pname = "stig";
  # This project has a different concept for pre release / alpha,
  # Read the project's README for details: https://github.com/rndusr/stig#stig
-  version = "0.12.5a0";
+  version = "0.12.8a0";

  src = fetchFromGitHub {
    owner = "rndusr";
    repo = "stig";
    rev = "v${version}";
-    sha256 = "sha256-e27DBzing38llFxPIsMGkZJXp2q7jjFlQdtfsqLXNHw=";
+    sha256 = "sha256-vfmuA6DqWvAygcS6N+qX1h+Ag+P4eOwm41DhAFZR3r8=";
  };

-  propagatedBuildInputs = with python3Packages; [
+  propagatedBuildInputs = with python310Packages; [
    urwid
    urwidtrees
    aiohttp
@ -30,7 +30,7 @@ python3Packages.buildPythonApplication rec {
    setproctitle
  ];

-  nativeCheckInputs = with python3Packages; [
+  nativeCheckInputs = with python310Packages; [
    asynctest
    pytestCheckHook
  ];
@ -41,16 +41,15 @@ python3Packages.buildPythonApplication rec {
    export LC_ALL=C
  '';

-  pytestFlagsArray = [
-    "tests"
-    # TestScrollBarWithScrollable.test_wrapping_bug fails
-    "--deselect=tests/tui_test/scroll_test.py::TestScrollBarWithScrollable::test_wrapping_bug"
-    # https://github.com/rndusr/stig/issues/214
-    "--deselect=tests/completion_test/classes_test.py::TestCandidates::test_candidates_are_sorted_case_insensitively"
-  ] ++ lib.optionals stdenv.isDarwin [
-    "--deselect=tests/client_test/ttypes_test.py::TestTimestamp::test_string__month_day_hour_minute_second"
-    "--deselect=tests/client_test/aiotransmission_test/api_torrent_test.py"
-    "--deselect=tests/client_test/aiotransmission_test/rpc_test.py"
+  disabledTestPaths = [
+    # Almost all tests fail in this file, it is reported upstream in:
+    # https://github.com/rndusr/stig/issues/214 , and upstream fails to
+    # reproduce the issue unfortunately.
+    "tests/client_test/aiotransmission_test/api_settings_test.py"
+  ];
+  disabledTests = [
+    # Another failure with similar circumstances to the above
+    "test_candidates_are_sorted_case_insensitively"
  ];

  passthru.tests = testers.testVersion {
--- a/pkgs/applications/networking/pyload-ng/default.nix
+++ b/pkgs/applications/networking/pyload-ng/default.nix
@ -50,5 +50,6 @@ python3.pkgs.buildPythonApplication rec {
    homepage = "https://github.com/pyload/pyload";
    license = licenses.agpl3Plus;
    maintainers = with maintainers; [ ruby0b ];
+    mainProgram = "pyload";
  };
 }
--- a/pkgs/applications/networking/shellhub-agent/default.nix
+++ b/pkgs/applications/networking/shellhub-agent/default.nix
@ -11,18 +11,18 @@

 buildGoModule rec {
  pname = "shellhub-agent";
-  version = "0.13.4";
+  version = "0.13.6";

  src = fetchFromGitHub {
    owner = "shellhub-io";
    repo = "shellhub";
    rev = "v${version}";
-    hash = "sha256-oUgxYVnSPlUxQW3egZuzGad1IduvG9pvgFiR9jmljQU=";
+    hash = "sha256-jdZNfNdykkpuIzA0TXEXkH21HTJzhndyRlMj3Kt7WlM=";
  };

  modRoot = "./agent";

-  vendorHash = "sha256-SNQuw9RRWuRndUwUiXwGs95CrXRrk72Gey5h1rtwWeo=";
+  vendorHash = "sha256-Dg9TL/B9KgYGA0lILxVt+kXy5kfnW2sYJuP0lc+CROM=";

  ldflags = [ "-s" "-w" "-X main.AgentVersion=v${version}" ];

--- a/pkgs/applications/networking/sniffers/kismet/default.nix
+++ b/pkgs/applications/networking/sniffers/kismet/default.nix
@ -1,5 +1,6 @@
 { lib
 , stdenv
+, autoreconfHook
 , binutils
 , elfutils
 , fetchurl
@ -20,7 +21,7 @@
 , python3
 , sqlite
 , withNetworkManager ? false
-, withPython ? true
+, withPython ? stdenv.buildPlatform.canExecute stdenv.hostPlatform
 , withSensors ? false
 , zlib
 }:
@ -37,6 +38,8 @@ stdenv.mkDerivation rec {
  postPatch = ''
    substituteInPlace Makefile.in \
      --replace "-m 4550" ""
+    substituteInPlace configure.ac \
+      --replace "pkg-config" "$PKG_CONFIG"
  '';

  postConfigure = ''
@ -47,10 +50,21 @@ stdenv.mkDerivation rec {
        -i Makefile
  '';

+  strictDeps = true;
+
  nativeBuildInputs = [
+    autoreconfHook
    pkg-config
+    protobuf
+    protobufc
  ] ++ lib.optionals withPython [
-    python3
+    (python3.withPackages (ps: [
+      ps.numpy
+      ps.protobuf
+      ps.pyserial
+      ps.setuptools
+      ps.websockets
+    ]))
  ];

  buildInputs = [
@ -75,17 +89,6 @@ stdenv.mkDerivation rec {
    lm_sensors
  ];

-  propagatedBuildInputs = [
-  ] ++ lib.optionals withPython [
-    (python3.withPackages (ps: [
-      ps.numpy
-      ps.protobuf
-      ps.pyserial
-      ps.setuptools
-      ps.websockets
-    ]))
-  ];
-
  configureFlags = [
    "--disable-wifi-coconut"  # Until https://github.com/kismetwireless/kismet/issues/478
  ] ++ lib.optionals (!withNetworkManager) [
--- a/pkgs/applications/networking/sniffers/sngrep/default.nix
+++ b/pkgs/applications/networking/sniffers/sngrep/default.nix
@ -12,23 +12,15 @@

 stdenv.mkDerivation rec {
  pname = "sngrep";
-  version = "1.7.0";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "irontec";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-gFba2wOU4GwpOZTo5A2QpBgnC6OgDJEeyaPGHbA+7tA=";
+    sha256 = "sha256-9ccp5Pxhs7jOQuWHCmU9yvzLKeOAN8lEaieCIvnXJRA=";
  };

-  patches = [
-    (fetchpatch {
-      name = "CVE-2023-36192.patch";
-      url = "https://github.com/irontec/sngrep/commit/ad1daf15c8387bfbb48097c25197bf330d2d98fc.patch";
-      hash = "sha256-g8fxvxi3d7jmZEKTbxqw29hJbm/ShsKKxstsOUGxTug=";
-    })
-  ];
-
  nativeBuildInputs = [
    autoconf
    automake
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -19,14 +19,14 @@
 let
  pname = "qownnotes";
  appname = "QOwnNotes";
-  version = "23.11.1";
+  version = "23.12.3";
 in
 stdenv.mkDerivation {
  inherit pname appname version;

  src = fetchurl {
    url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-rsYB8aLVVpGGbiEDWCpGCPdZEsOajoGfoh6YYxilxpg=";
+    hash = "sha256-cQjO5LgGDU9ZHnvKniFMBzcxgWRFfS+PQ0OSe+NFv+c=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/biology/seqkit/default.nix
+++ b/pkgs/applications/science/biology/seqkit/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "seqkit";
-  version = "2.6.0";
+  version = "2.6.1";

  src = fetchFromGitHub {
    owner = "shenwei356";
    repo = "seqkit";
    rev = "v${version}";
-    sha256 = "sha256-ahCLPYRRH6xIRFhgpjvnw7G1AIOfrkzLKPA8t9+k9gg=";
+    sha256 = "sha256-zdn5jyb8mQ8CXHu3bHpZ7+c6K6lwoSLnmhMspMeDzy0=";
  };

-  vendorHash = "sha256-OpLLJdwEW7UnMKr6r8+EDUlpiahfa5k9AkBqcd+SE5k=";
+  vendorHash = "sha256-iVsLJ7UcUVTg14yEdThb6HBx6XutG0m+S9OW4iiFPUE=";

  meta = with lib; {
    description = "cross-platform and ultrafast toolkit for FASTA/Q file manipulation";
--- a/pkgs/applications/science/computer-architecture/qtrvsim/default.nix
+++ b/pkgs/applications/science/computer-architecture/qtrvsim/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "QtRVSim";
-  version = "0.9.5";
+  version = "0.9.6";

  src = fetchFromGitHub {
    owner = "cvut";
    repo = "qtrvsim";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-TKF7nkhnp+JXTD2J/FyVxQoVZgOSKX1IQ/RPqRBOI/4=";
+    sha256 = "sha256-cC3DvQj2VBnGad6ZDn3x4gHQfsPpySzjTi17PQoaxPU=";
  };

  nativeBuildInputs = [ cmake wrapQtAppsHook ];
--- a/pkgs/applications/science/logic/lean4/default.nix
+++ b/pkgs/applications/science/logic/lean4/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "lean4";
-  version = "4.3.0";
+  version = "4.4.0";

  src = fetchFromGitHub {
    owner = "leanprover";
    repo = "lean4";
    rev = "v${version}";
-    hash = "sha256-2F6sibGMG1U5By/aKGluLgkXIlMpZ7m06gVEG2Uz4RQ=";
+    hash = "sha256-lU67wjl6yJP2r97lHYxrJqn+JhqMcBIbz/+qlCgY3/o=";
  };

  postPatch = ''
--- a/pkgs/applications/science/physics/xflr5/default.nix
+++ b/pkgs/applications/science/physics/xflr5/default.nix
@ -1,11 +1,14 @@
-{ mkDerivation, lib, fetchzip, qmake }:
+{ mkDerivation, lib, qmake, fetchsvn }:

 mkDerivation rec {
  pname = "xflr5";
  version = "6.61";
-  src = fetchzip {
-    url = "https://sourceforge.net/code-snapshots/svn/x/xf/xflr5/code/xflr5-code-r1481-tags-v6.61-xflr5.zip";
-    sha256 = "sha256-voWnXiBo7+kBPiZLVpSiXyBsYJv/Phd3noA81SQ5Vtw=";
+
+  sourceRoot = "${src.name}/xflr5";
+  src = fetchsvn {
+    url = "https://svn.code.sf.net/p/xflr5/code/trunk";
+    rev = "1480";
+    sha256 = "sha256-Uj6R15OT5i5tAJEYWqyFyN5Z51Wz5RjO26mWC3Y6QAI=";
  };

  nativeBuildInputs = [ qmake ];
--- a/pkgs/applications/version-management/forgejo/default.nix
+++ b/pkgs/applications/version-management/forgejo/default.nix
@ -24,7 +24,7 @@ let
    pname = "forgejo-frontend";
    inherit (forgejo) src version;

-    npmDepsHash = "sha256-7ruJczJ2cE51UmoER8C3JsGm0p3RTwfqKx0eErB7LZs=";
+    npmDepsHash = "sha256-bxgkJODph88aXYYj50gNNP4gpsd18uOj0dQEX6GqEsc=";

    patches = [
      ./package-json-npm-build-frontend.patch
@ -39,17 +39,17 @@ let
 in
 buildGoModule rec {
  pname = "forgejo";
-  version = "1.21.2-1";
+  version = "1.21.3-0";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "forgejo";
    repo = "forgejo";
    rev = "v${version}";
-    hash = "sha256-2dkl8QI82URhPV2f4cOUZfpAhlGwU197ZkLD9KitIiA=";
+    hash = "sha256-iBZIn2VGagG1RMBKm9qyg4RRscStr+PsdxOpprrInyo=";
  };

-  vendorHash = "sha256-+/wOEF44dSqy7ZThZyd66xyI3wVnFwZbsAd4ujyVku8=";
+  vendorHash = "sha256-+ukS9+SxymwnMSnr/BaL4lhc83wYC6+4BWYTbBTrWy8=";

  subPackages = [ "." ];

--- a/pkgs/applications/video/kodi/addons/pvr-hts/default.nix
+++ b/pkgs/applications/video/kodi/addons/pvr-hts/default.nix
@ -2,13 +2,13 @@
 buildKodiBinaryAddon rec {
  pname = "pvr-hts";
  namespace = "pvr.hts";
-  version = "20.6.5";
+  version = "20.7.0";

  src = fetchFromGitHub {
    owner = "kodi-pvr";
    repo = "pvr.hts";
    rev = "${version}-${rel}";
-    sha256 = "sha256-NrSLWZn+aeWUKxM/ETvoE4gRo4JZsD1snpLvMLDlpFw=";
+    sha256 = "sha256-Mc540n+TfZiAV2uDSGrItsoPOkEBNyyQlW2DJZLwYA4=";
  };

  meta = with lib; {
--- a/pkgs/applications/video/streamlink/default.nix
+++ b/pkgs/applications/video/streamlink/default.nix
@ -6,12 +6,12 @@

 python3Packages.buildPythonApplication rec {
  pname = "streamlink";
-  version = "6.4.2";
+  version = "6.5.0";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-tftxn0JRppLIh4ih1G4s0PoiMZYMUrKBy4IQhxxyLnY=";
+    hash = "sha256-j01hWTvM4Q+NXoTKlWqsT6Y5wKNJ5983mDQ3Oog5Zu0=";
  };

  nativeCheckInputs = with python3Packages; [
--- a/pkgs/applications/virtualization/conmon/default.nix
+++ b/pkgs/applications/virtualization/conmon/default.nix
@ -12,23 +12,15 @@

 stdenv.mkDerivation rec {
  pname = "conmon";
-  version = "2.1.9";
+  version = "2.1.10";

  src = fetchFromGitHub {
    owner = "containers";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-GDbCjR3UWDo/AEKO3TZq29fxO9EUfymxWtvLBikJJ04=";
+    hash = "sha256-WUXyx5OWIJDamzHUahN+0/rcn2pxQgCgYAE/d0mxk2A=";
  };

-  patches = [
-    (fetchpatch2 {
-      # Fix regression with several upstream bug reports; also caused podman NixOS tests to fail
-      url = "https://github.com/containers/conmon/commit/53531ac78d35aa9e18a20cfff9f30b910e25ecaa.patch";
-      hash = "sha256-rbLoXDmRK8P94rrhx2r22/EHZVpCsGTWItd/GW1VqZA=";
-    })
-  ];
-
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ glib libseccomp systemd ]
    ++ lib.optionals (!stdenv.hostPlatform.isMusl) [ glibc glibc.static ];
--- a/pkgs/applications/virtualization/libnvidia-container/default.nix
+++ b/pkgs/applications/virtualization/libnvidia-container/default.nix
@ -3,7 +3,7 @@
 , addOpenGLRunpath
 , fetchFromGitHub
 , pkg-config
-, libelf
+, elfutils
 , libcap
 , libseccomp
 , rpcsvc-proto
@ -89,7 +89,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkg-config go rpcsvc-proto makeWrapper removeReferencesTo ];

-  buildInputs = [ libelf libcap libseccomp libtirpc ];
+  buildInputs = [ elfutils libcap libseccomp libtirpc ];

  makeFlags = [
    "WITH_LIBELF=yes"
--- a/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
+++ b/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
@ -37,7 +37,7 @@ cd "$pkgs"
 for package in *; do
  cd "$package"
  for version in *; do
-    id=$(xq -r .package.metadata.id "$version/$package".nuspec)
+    id=$(xq -r .package.metadata.id "$version"/*.nuspec)

    if grep -qxF "$id.$version.nupkg" "$excluded_list"; then
      continue
--- a/pkgs/by-name/gi/gickup/package.nix
+++ b/pkgs/by-name/gi/gickup/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "gickup";
-  version = "0.10.23";
+  version = "0.10.24";

  src = fetchFromGitHub {
    owner = "cooperspencer";
    repo = "gickup";
    rev = "refs/tags/v${version}";
-    hash = "sha256-IiiYmzFr4EVBIFr0tZRRq/FPVSE3goA1XiSPJS0QkJM=";
+    hash = "sha256-c7IP5jYP8DbJkQEHmU2cMgClLqmMTAJkPCCHbdW5yLw=";
  };

-  vendorHash = "sha256-kEy6Per8YibUHRp7E4jzkOgATq3Ub5WCNIe0WiHo2Ro=";
+  vendorHash = "sha256-fqtZL3Tr9QTFRUsczs11Y3b127CqoYkHV+dPI+vYpDk=";

  ldflags = ["-X main.version=${version}"];

--- a/pkgs/applications/office/ledger/default.nix
+++ b/pkgs/applications/office/ledger/default.nix
--- a/pkgs/by-name/li/listen1/package.nix
+++ b/pkgs/by-name/li/listen1/package.nix
@ -0,0 +1,33 @@
+{ lib, fetchurl, appimageTools }:
+
+let
+  pname = "listen1";
+  version = "2.31.0";
+  src = fetchurl {
+    url = "https://github.com/listen1/listen1_desktop/releases/download/v${version}/listen1_${version}_linux_x86_64.AppImage";
+    hash = "sha256-nYDKexVzVuwPmv/eK9cB0oASgXEZbrPrzqPu5OHk6NQ=";
+  };
+  appimageContents = appimageTools.extractType2 { inherit pname version src; };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraInstallCommands = ''
+    mv $out/bin/${pname}-${version} $out/bin/${pname}
+    install -m 444 -D ${appimageContents}/listen1.desktop -t $out/share/applications
+    substituteInPlace $out/share/applications/listen1.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/listen1.png \
+      $out/share/icons/hicolor/512x512/apps/listen1.png
+  '';
+
+  meta = with lib; {
+    description = "One for all free music in China";
+    homepage = "http://listen1.github.io/listen1/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ running-grass ];
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    mainProgram = "listen1";
+  };
+}
--- a/pkgs/by-name/ni/nixos-anywhere/package.nix
+++ b/pkgs/by-name/ni/nixos-anywhere/package.nix
@ -28,12 +28,12 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "nixos-anywhere";
-  version = "1.1.0";
+  version = "1.1.1";
  src = fetchFromGitHub {
    owner = "numtide";
    repo = "nixos-anywhere";
    rev = finalAttrs.version;
-    hash = "sha256-43r1pwWv9SuMEG+Pe5laFsqE1/X0rFQ6s/wpEufPliE=";
+    hash = "sha256-GN0G3g3QEzb2ZG3zSzbRaRBsmQsWJu81CZy9mIofRZ0=";
  };
  nativeBuildInputs = [ makeWrapper ];
  installPhase = ''
--- a/pkgs/by-name/ov/ovn/generic.nix
+++ b/pkgs/by-name/ov/ovn/generic.nix
@ -0,0 +1,96 @@
+{
+  version,
+  hash,
+  updateScriptArgs ? "",
+}:
+
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  gnused,
+  libbpf,
+  libcap_ng,
+  numactl,
+  openssl,
+  pkg-config,
+  procps,
+  python3,
+  unbound,
+  xdp-tools,
+  writeScript,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ovn";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "ovn-org";
+    repo = "ovn";
+    rev = "refs/tags/v${version}";
+    inherit hash;
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    python3
+  ];
+
+  buildInputs = [
+    libbpf
+    libcap_ng
+    numactl
+    openssl
+    unbound
+    xdp-tools
+  ];
+
+  # need to build the ovs submodule first
+  preConfigure = ''
+    pushd ovs
+    ./boot.sh
+    ./configure
+    make -j $NIX_BUILD_CORES
+    popd
+  '';
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  nativeCheckInputs = [
+    gnused
+    procps
+  ];
+
+  # https://docs.ovn.org/en/latest/topics/testing.html
+  preCheck = ''
+    export TESTSUITEFLAGS="-j$NIX_BUILD_CORES"
+    # allow rechecks to retry flaky tests
+    export RECHECK=yes
+
+    # hack to stop tests from trying to read /etc/resolv.conf
+    export OVS_RESOLV_CONF="$PWD/resolv.conf"
+    touch $OVS_RESOLV_CONF
+  '';
+
+  passthru.updateScript = writeScript "ovs-update.nu" ''
+    ${./update.nu} ${updateScriptArgs}
+  '';
+
+  meta = with lib; {
+    description = "Open Virtual Network";
+    longDescription = ''
+      OVN (Open Virtual Network) is a series of daemons that translates virtual network configuration into OpenFlow, and installs them into Open vSwitch.
+    '';
+    homepage = "https://github.com/ovn-org/ovn";
+    changelog = "https://github.com/ovn-org/ovn/blob/${src.rev}/NEWS";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ adamcstephens ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/ov/ovn/lts.nix
+++ b/pkgs/by-name/ov/ovn/lts.nix
@ -0,0 +1,5 @@
+import ./generic.nix {
+  version = "22.03.5";
+  hash = "sha256-DMDWR7Dbgak0azPcVqDdFHGovTbLX8byp+jQ3rYvvX4=";
+  updateScriptArgs = "--lts=true --regex '22.03.*'";
+}
--- a/pkgs/by-name/ov/ovn/package.nix
+++ b/pkgs/by-name/ov/ovn/package.nix
@ -0,0 +1,4 @@
+import ./generic.nix {
+  version = "23.09.1";
+  hash = "sha256-t4DtV0wW/jQX7/TpsLFoDzzSPROrhUHHG09r9+lsdaQ=";
+}
--- a/pkgs/by-name/ov/ovn/update.nu
+++ b/pkgs/by-name/ov/ovn/update.nu
@ -0,0 +1,19 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i nu -p nushell common-updater-scripts
+
+def main [--lts: bool = false, --regex: string] {
+  let tags = list-git-tags --url=https://github.com/ovn-org/ovn | lines | sort --natural | str replace v ''
+
+  let latest_tag = if $regex == null { $tags } else { $tags | find --regex $regex } | last
+  let current_version = nix eval --raw -f default.nix $"ovn(if $lts {"-lts"}).version" | str trim
+
+  if $latest_tag != $current_version {
+    if $lts {
+      update-source-version ovn-lts $latest_tag $"--file=(pwd)/pkgs/by-name/ov/ovn/lts.nix"
+    } else {
+      update-source-version ovn $latest_tag $"--file=(pwd)/pkgs/by-name/ov/ovn/package.nix"
+    }
+  }
+
+  {"lts?": $lts, before: $current_version, after: $latest_tag}
+}
--- a/pkgs/by-name/pw/pwru/package.nix
+++ b/pkgs/by-name/pw/pwru/package.nix
@ -0,0 +1,42 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, clang
+, libpcap
+}:
+
+buildGoModule rec {
+  pname = "pwru";
+  version = "1.0.5";
+
+  src = fetchFromGitHub {
+    owner = "cilium";
+    repo = "pwru";
+    rev = "v${version}";
+    hash = "sha256-2CpjTVBuiGU5cYkdSIxIpk1EoZAUhlXxVU+KJXHosiA=";
+  };
+
+  vendorHash = null;
+
+  nativeBuildInputs = [ clang ];
+
+  buildInputs = [ libpcap ];
+
+  postPatch = ''
+    substituteInPlace internal/libpcap/compile.go \
+      --replace "-static" ""
+  '';
+
+  preBuild = ''
+    TARGET_GOARCH="$GOARCH" GOOS= GOARCH= go generate
+  '';
+
+  meta = with lib; {
+    description = "eBPF-based Linux kernel networking debugger";
+    homepage = "https://github.com/cilium/pwru";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ nickcao ];
+    platforms = platforms.linux;
+    mainProgram = "pwru";
+  };
+}
--- a/pkgs/by-name/qr/qrtool/package.nix
+++ b/pkgs/by-name/qr/qrtool/package.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "qrtool";
-  version = "0.8.5";
+  version = "0.10.1";

  src = fetchFromGitHub {
    owner = "sorairolake";
    repo = "qrtool";
    rev = "v${version}";
-    sha256 = "sha256-jrvNZGO1VIDo6Mz3NKda1C7qZUtF9T00CAFK8yoGWjc=";
+    sha256 = "sha256-96k3VgxVGuKPLA4rD9B20AigFW03YvedT04UUzzmX38=";
  };

-  cargoSha256 = "sha256-JOnvlabCr3fZsIIRc2qTjf50Ga83zL8Aoo2sqzMBs7g=";
+  cargoHash = "sha256-nAfW66vasnR0JHhz7n1XGA+OpPavOnGB6D6TfK9cr9Y=";

  nativeBuildInputs = [ asciidoctor installShellFiles ];

--- a/pkgs/by-name/ra/raft-cowsql/package.nix
+++ b/pkgs/by-name/ra/raft-cowsql/package.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "raft-cowsql";
-  version = "0.18.2";
+  version = "0.18.3";

  src = fetchFromGitHub {
    owner = "cowsql";
    repo = "raft";
    rev = "refs/tags/v${version}";
-    hash = "sha256-CMcKXX2u+qiroleg5GIovTOVAg9ycXBsRDqfsOCL3yo=";
+    hash = "sha256-lfmn+GfdgZ5fdp3Y6ROzEuXsrLNlH/qA98Ni5QAv0oQ=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/pkgs/by-name/ri/rita/package.nix
+++ b/pkgs/by-name/ri/rita/package.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "rita";
-  version = "4.8.0";
+  version = "4.8.1";

  src = fetchFromGitHub {
    owner = "activecm";
    repo = "rita";
    rev = "refs/tags/v${version}";
-    hash = "sha256-w86fGRH9pIqONgvdYpsHDNkE0BAuhzArET+NLIpRg/w=";
+    hash = "sha256-By0JvQ4LTm+NEnRMadE1x2PiiYqnJQCsF3Fy+gHulXs=";
  };

  vendorHash = "sha256-KyC7VPgWlgKD6KWWRo3hFQHl2HjTub+VSMtJCpYE6Zk=";
--- a/pkgs/by-name/sa/satty/package.nix
+++ b/pkgs/by-name/sa/satty/package.nix
@ -15,16 +15,16 @@
 rustPlatform.buildRustPackage rec {

  pname = "satty";
-  version = "0.8.0";
+  version = "0.8.2";

  src = fetchFromGitHub {
    owner = "gabm";
    repo = "Satty";
    rev = "v${version}";
-    hash = "sha256-w2kosnPDWUZqp6iyj6ypAGRlmYSby+9B6epsAkFK6eY=";
+    hash = "sha256-5FKEQUH43qx8w7s7lW8EDOWtWCUJTbWlXcMQazR8Thk=";
  };

-  cargoHash = "sha256-XeuzoHXSiKtA9ofCBOMHnKKzcmur+/TS96DnzIfpqUA=";
+  cargoHash = "sha256-FpCmzU2C+5+5eSB5Mno+lOFd4trHXmfp6e5oV+CvU1c=";

  nativeBuildInputs = [
    copyDesktopItems
--- a/pkgs/by-name/si/signaturepdf/package.nix
+++ b/pkgs/by-name/si/signaturepdf/package.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "signaturepdf";
-  version = "1.5.0";
+  version = "1.5.1";

  src = fetchFromGitHub {
    owner = "24eme";
    repo = "${pname}";
    rev = "v${version}";
-    hash = "sha256-7yhvTxpjxHcmRxTE7avM+dN+yz9iVr8Ea/e2yfkBURA=";
+    hash = "sha256-5isvVyT8s2ZAhLP4x/jjxDssBQ2WAvYDkGOWf3NcjHM=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/desktops/gnome/games/gnome-nibbles/default.nix
+++ b/pkgs/desktops/gnome/games/gnome-nibbles/default.nix
@ -3,30 +3,28 @@
 , fetchurl
 , pkg-config
 , gnome
-, gtk3
-, wrapGAppsHook
+, gtk4
+, wrapGAppsHook4
 , librsvg
 , gsound
-, clutter-gtk
 , gettext
 , itstool
 , vala
 , libxml2
 , libgee
-, libgnome-games-support
+, libgnome-games-support_2_0
 , meson
 , ninja
 , desktop-file-utils
-, hicolor-icon-theme
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-nibbles";
-  version = "3.38.3";
+  version = "4.0.1";

  src = fetchurl {
-    url = "mirror://gnome/sources/gnome-nibbles/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "l1/eHYPHsVs5Lqx6NZFhKQ/IrrdgXBHnHO4MPDJrXmE=";
+    url = "mirror://gnome/sources/gnome-nibbles/${lib.versions.majorMinor finalAttrs.version}/gnome-nibbles-${finalAttrs.version}.tar.xz";
+    sha256 = "xrG89vesx0RQAmveV7OONcJJ08K3xC2c/hH4YvPW12I=";
  };

  nativeBuildInputs = [
@ -34,22 +32,19 @@ stdenv.mkDerivation rec {
    ninja
    vala
    pkg-config
-    wrapGAppsHook
+    wrapGAppsHook4
    gettext
    itstool
    libxml2
    desktop-file-utils
-    hicolor-icon-theme
  ];

  buildInputs = [
-    gtk3
+    gtk4
    librsvg
    gsound
-    clutter-gtk
-    gnome.adwaita-icon-theme
    libgee
-    libgnome-games-support
+    libgnome-games-support_2_0
  ];

  passthru = {
@ -62,8 +57,8 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Guide a worm around a maze";
    homepage = "https://wiki.gnome.org/Apps/Nibbles";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
    maintainers = teams.gnome.members;
    platforms = platforms.linux;
  };
-}
+})
--- a/pkgs/development/beam-modules/default.nix
+++ b/pkgs/development/beam-modules/default.nix
@ -45,6 +45,11 @@ let
      # BEAM-based languages.
      elixir = elixir_1_15;

+      elixir_1_16 = lib'.callElixir ../interpreters/elixir/1.16.nix {
+        inherit erlang;
+        debugInfo = true;
+      };
+
      elixir_1_15 = lib'.callElixir ../interpreters/elixir/1.15.nix {
        inherit erlang;
        debugInfo = true;
--- a/pkgs/development/compilers/idris2/default.nix
+++ b/pkgs/development/compilers/idris2/default.nix
@ -23,13 +23,13 @@ let
 # Uses scheme to bootstrap the build of idris2
 in stdenv.mkDerivation rec {
  pname = "idris2";
-  version = "0.6.0";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "idris-lang";
    repo = "Idris2";
    rev = "v${version}";
-    sha256 = "sha256-80MAGM1IEtI09h5aCYfDL4PRrjGq2gT8OUEibOVk8H4=";
+    sha256 = "sha256-VwveX3fZfrxEsytpbOc5Tm6rySpLFhTt5132J6rmrmM=";
  };

  strictDeps = true;
--- a/pkgs/development/compilers/nim/default.nix
+++ b/pkgs/development/compilers/nim/default.nix
@ -76,12 +76,12 @@ in {

  nim-unwrapped-2 = stdenv.mkDerivation (finalAttrs: {
    pname = "nim-unwrapped";
-    version = "2.0.0";
+    version = "2.0.2";
    strictDeps = true;

    src = fetchurl {
      url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
-      hash = "sha256-vWEB2EADb7eOk6ad9s8/n9DCHNdUtpX/hKO0rdjtCvc=";
+      hash = "sha256-ZPUdO/Vt6dDueeLKapzpRFSvmmOhQaaWnOjFmmC4LM8=";
    };

    buildInputs = [ boehmgc openssl pcre readline sqlite ]
@ -161,10 +161,10 @@ in {
  });

  nim-unwrapped-1 = nim-unwrapped-2.overrideAttrs (finalAttrs: prevAttrs: {
-    version = "1.6.14";
+    version = "1.6.18";
    src = fetchurl {
      url = "https://nim-lang.org/download/nim-${finalAttrs.version}.tar.xz";
-      hash = "sha256-0HDS8oriQA33/kpJ7OufRc1TmQaxB0gYVqCveo+oLck=";
+      hash = "sha256-UCQaxyIpG6ljdT8EWqo1h7c8GqKK4pxXPBWluKYCoss=";
    };

    patches = [
--- a/pkgs/development/cuda-modules/cuda/overrides.nix
+++ b/pkgs/development/cuda-modules/cuda/overrides.nix
@ -61,7 +61,59 @@ attrsets.filterAttrs (attr: _: (builtins.hasAttr attr prev)) {

  cuda_nvcc = prev.cuda_nvcc.overrideAttrs (
    oldAttrs: {
-      propagatedBuildInputs = [final.setupCudaHook];
+
+      outputs = oldAttrs.outputs ++ [ "lib" ];
+
+      # Patch the nvcc.profile.
+      # Syntax:
+      # - `=` for assignment,
+      # - `?=` for conditional assignment,
+      # - `+=` to "prepend",
+      # - `=+` to "append".
+
+      # Cf. https://web.archive.org/web/20230308044351/https://arcb.csc.ncsu.edu/~mueller/cluster/nvidia/2.0/nvcc_2.0.pdf
+
+      # We set all variables with the lowest priority (=+), but we do force
+      # nvcc to use the fixed backend toolchain. Cf. comments in
+      # backend-stdenv.nix
+
+      postPatch =
+        (oldAttrs.postPatch or "")
+        + ''
+          substituteInPlace bin/nvcc.profile \
+            --replace \
+              '$(TOP)/lib' \
+              "''${!outputLib}/lib" \
+            --replace \
+              '$(TOP)/$(_NVVM_BRANCH_)' \
+              "''${!outputBin}/nvvm" \
+            --replace \
+              '$(TOP)/$(_TARGET_DIR_)/include' \
+              "''${!outputDev}/include"
+
+          cat << EOF >> bin/nvcc.profile
+
+          # Fix a compatible backend compiler
+          PATH += ${lib.getBin final.backendStdenv.cc}/bin:
+          LIBRARIES += "-L${lib.getLib final.backendStdenv.nixpkgsCompatibleLibstdcxx}/lib"
+
+          # Expose the split-out nvvm
+          LIBRARIES =+ -L''${!outputBin}/nvvm/lib
+          INCLUDES =+ -I''${!outputBin}/nvvm/include
+
+          # Expose cudart and the libcuda stubs
+          LIBRARIES =+ -L$static/lib" "-L${final.cuda_cudart.lib}/lib -L${final.cuda_cudart.lib}/lib/stubs
+          INCLUDES =+ -I${final.cuda_cudart.dev}/include
+          EOF
+        '';
+
+      propagatedBuildInputs = [ final.setupCudaHook ];
+
+      postInstall =
+        (oldAttrs.postInstall or "")
+        + ''
+          moveToOutput "nvvm" "''${!outputBin}"
+        '';

      meta = (oldAttrs.meta or {}) // {
        mainProgram = "nvcc";
--- a/pkgs/development/cuda-modules/saxpy/default.nix
+++ b/pkgs/development/cuda-modules/saxpy/default.nix
@ -14,6 +14,7 @@ let
    cudaVersion
    flags
    libcublas
+    setupCudaHook
    ;
 in
 backendStdenv.mkDerivation {
--- a/pkgs/development/cuda-modules/setup-hooks/setup-cuda-hook.sh
+++ b/pkgs/development/cuda-modules/setup-hooks/setup-cuda-hook.sh
@ -93,26 +93,6 @@ setupCUDAToolkitCompilers() {
    if [[ -z "${dontCompressFatbin-}" ]]; then
        export NVCC_PREPEND_FLAGS+=" -Xfatbin=-compress-all"
    fi
-
-    # CMake's enable_language(CUDA) runs a compiler test and it doesn't account for
-    # CUDAToolkit_ROOT. We have to help it locate libcudart
-    if [[ -z "${nvccDontPrependCudartFlags-}" ]] ; then
-        if [[ ! -v cudaOutputToPath["cuda_cudart-out"] ]] ; then
-            echo "setupCUDAToolkitCompilers: missing cudaPackages.cuda_cudart. This may become an an error in the future" >&2
-            # exit 1
-        fi
-        for pkg in "${!cudaOutputToPath[@]}" ; do
-            [[ ! "$pkg" = cuda_cudart* ]] && continue
-
-            local path="${cudaOutputToPath[$pkg]}"
-            if [[ -d "$path/include" ]] ; then
-                export NVCC_PREPEND_FLAGS+=" -I$path/include"
-            fi
-            if [[ -d "$path/lib" ]] ; then
-                export NVCC_PREPEND_FLAGS+=" -L$path/lib"
-            fi
-        done
-    fi
 }
 preConfigureHooks+=(setupCUDAToolkitCompilers)

--- a/pkgs/development/interpreters/elixir/1.16.nix
+++ b/pkgs/development/interpreters/elixir/1.16.nix
@ -0,0 +1,8 @@
+{ mkDerivation }:
+mkDerivation {
+  version = "1.16.0";
+  sha256 = "sha256-nM3TpX18zdjDAFkljsAqwKx/1AQmwDMIQCeL75etTQc=";
+  # https://hexdocs.pm/elixir/1.16.0/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp
+  minimumOTPVersion = "24";
+  escriptPath = "lib/elixir/scripts/generate_app.escript";
+}
--- a/pkgs/development/interpreters/luau/default.nix
+++ b/pkgs/development/interpreters/luau/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "luau";
-  version = "0.603";
+  version = "0.607";

  src = fetchFromGitHub {
    owner = "luau-lang";
    repo = "luau";
    rev = version;
-    hash = "sha256-8jm58F2AQcmjy19fydGLOD5fehaaNHGqXtDPu121jmw=";
+    hash = "sha256-2O+nOgOWXPEbBJlRYnW8PlpG2oeQNZB7k08lFgF+ceE=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/libpg_query/default.nix
+++ b/pkgs/development/libraries/libpg_query/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libpg_query";
-  version = "15-4.2.3";
+  version = "16-5.0.0";

  src = fetchFromGitHub {
    owner = "pganalyze";
    repo = "libpg_query";
    rev = version;
-    hash = "sha256-/HUg6x0il5WxENmgR3slu7nmXTKv6YscjpX569Dztko=";
+    hash = "sha256-nO4ZqjEpQqmIZcsrhayGhjD4HKUBD1tEZg/khmdgK68=";
  };

  nativeBuildInputs = [ which ];
--- a/pkgs/development/libraries/opencl-headers/default.nix
+++ b/pkgs/development/libraries/opencl-headers/default.nix
@ -2,25 +2,38 @@
 , stdenv
 , fetchFromGitHub
 , cmake
+, hashcat
+, ocl-icd
+, tesseract
+, testers
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "opencl-headers";
-  version = "2023.02.06";
+  version = "2023.12.14";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "OpenCL-Headers";
-    rev = "v${version}";
-    sha256 = "sha256-BJDaDokyHgmyl+bGqCwG1J7iOvu0E3P3iYZ1/krot8s=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-wF9KQjzYKJf6ulXRy80o53bp6lTtm8q1NubKbcH+RY0=";
  };

  nativeBuildInputs = [ cmake ];

+  passthru.tests = {
+    inherit ocl-icd tesseract hashcat;
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+      moduleNames = [ "OpenCL-Headers" ];
+    };
+  };
+
  meta = with lib; {
-    description = "Khronos OpenCL headers version ${version}";
+    description = "Khronos OpenCL headers version ${finalAttrs.version}";
    homepage = "https://www.khronos.org/registry/cl/";
    license = licenses.asl20;
    platforms = platforms.unix;
+    maintainers = [ ];
  };
-}
+})
--- a/pkgs/development/libraries/rure/Cargo.lock
+++ b/pkgs/development/libraries/rure/Cargo.lock
@ -13,9 +13,9 @@ dependencies = [

 [[package]]
 name = "libc"
-version = "0.2.150"
+version = "0.2.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
+checksum = "302d7ab3130588088d277783b1e2d2e10c9e9e4a16dd9050e6ec93fb3e7048f4"

 [[package]]
 name = "memchr"
--- a/pkgs/development/libraries/shapelib/default.nix
+++ b/pkgs/development/libraries/shapelib/default.nix
@ -1,26 +1,17 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 }:

 stdenv.mkDerivation rec {
  pname = "shapelib";
-  version = "1.5.0";
+  version = "1.6.0";

  src = fetchurl {
    url = "https://download.osgeo.org/shapelib/shapelib-${version}.tar.gz";
-    sha256 = "1qfsgb8b3yiqwvr6h9m81g6k9fjhfys70c22p7kzkbick20a9h0z";
+    sha256 = "sha256-GVKLJDdyQXBWNzIMNnlDAxrVCIZl0fsOHqpSpxJkpsQ=";
  };

-  patches = [
-    (fetchpatch {
-      name = "CVE-2022-0699.patch";
-      url = "https://github.com/OSGeo/shapelib/commit/c75b9281a5b9452d92e1682bdfe6019a13ed819f.patch";
-      sha256 = "sha256-zJ7JHUtInA5q/RbkSs1DqVK+UQi2vIw2t1jqxocnQQI=";
-    })
-  ];
-
  doCheck = true;
  preCheck = ''
    patchShebangs tests contrib/tests
--- a/pkgs/development/libraries/simdjson/default.nix
+++ b/pkgs/development/libraries/simdjson/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "simdjson";
-  version = "3.6.0";
+  version = "3.6.3";

  src = fetchFromGitHub {
    owner = "simdjson";
    repo = "simdjson";
    rev = "v${version}";
-    sha256 = "sha256-g1jrjRls9tJWh0koMg7MsUgRSNaty8YI+ivlwL6FCsk=";
+    sha256 = "sha256-PRXFZvwod/n27Tx9OALHdSlKsbsrNi5ij70A4ZSoeGc=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/ustream-ssl/default.nix
+++ b/pkgs/development/libraries/ustream-ssl/default.nix
@ -1,4 +1,12 @@
-{ stdenv, lib, fetchgit, cmake, pkg-config, libubox-nossl, ssl_implementation }:
+{ stdenv
+, lib
+, fetchgit
+, cmake
+, pkg-config
+, libubox-nossl
+, ssl_implementation
+, additional_buildInputs ? [ ]
+}:

 stdenv.mkDerivation {
  pname = "ustream-ssl";
@ -21,7 +29,7 @@ stdenv.mkDerivation {
  cmakeFlags = [ "-D${lib.toUpper ssl_implementation.pname}=ON" ];

  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ ssl_implementation ];
+  buildInputs = [ ssl_implementation ] ++ additional_buildInputs;

  passthru = {
    inherit ssl_implementation;
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , Security
 , autoreconfHook
 , util-linux
@ -15,23 +14,15 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "wolfssl-${variant}";
-  version = "5.6.4";
+  version = "5.6.6";

  src = fetchFromGitHub {
    owner = "wolfSSL";
    repo = "wolfssl";
    rev = "refs/tags/v${finalAttrs.version}-stable";
-    hash = "sha256-a9a3ca4Zb/XTS5YfPJwnXPYbDjmgD8qylhPQg5pjzJM=";
+    hash = "sha256-HXl8GgngC1J8Dlt7fXBrVRa+IV7thVr+MIpeuf3Khcg=";
  };

-  patches = [
-    (fetchpatch {
-      name = "fix-expected-test-response.patch";
-      url = "https://github.com/wolfSSL/wolfssl/commit/ca694938fd053a8557f9f08b1b4265292d8bef65.patch";
-      hash = "sha256-ETxszjjEMk0WdYgXHWTxTaWZPpyDs9jdko0jtkjzgwI=";
-    })
-  ];
-
  postPatch = ''
    patchShebangs ./scripts
    # ocsp stapling tests require network access, so skip them
--- a/pkgs/development/ocaml-modules/kqueue/default.nix
+++ b/pkgs/development/ocaml-modules/kqueue/default.nix
@ -0,0 +1,39 @@
+{ buildDunePackage
+, dune-configurator
+, lib
+, fetchurl
+, ppx_expect
+, ppx_optcomp
+}:
+
+buildDunePackage rec {
+  pname = "kqueue";
+  version = "0.3.0";
+
+  minimalOCamlVersion = "4.12";
+
+  src = fetchurl {
+    url = "https://github.com/anuragsoni/kqueue-ml/releases/download/${version}/kqueue-${version}.tbz";
+    hash = "sha256-MKRCyN6q9euTEgHIhldGGH8FwuLblWYNG+SiCMWBP6Y=";
+  };
+
+  buildInputs = [
+    dune-configurator
+    ppx_optcomp
+  ];
+
+  checkInputs = [
+    ppx_expect
+  ];
+
+  doCheck = true;
+
+  meta = {
+    description = "OCaml bindings for kqueue event notification interface";
+    homepage = "https://github.com/anuragsoni/kqueue-ml";
+    changelog = "https://github.com/anuragsoni/kqueue-ml/blob/${version}/CHANGES.md";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ sixstring982 ];
+  };
+}
+
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.2.79";
+  version = "9.2.81";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-aMp28g7a44u4VC0g3v9oVhYcBkSZkMJ/83eFTNNBbc0=";
+    hash = "sha256-ovV6BlhED9Du/jKQzgBFSp+XPYVAkNONU5iOEd52e2s=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aiohttp-zlib-ng/default.nix
+++ b/pkgs/development/python-modules/aiohttp-zlib-ng/default.nix
@ -1,39 +1,56 @@
 { lib
+, aiohttp
 , buildPythonPackage
+, cpufeature
 , fetchFromGitHub
 , poetry-core
-, aiohttp
+, pytestCheckHook
+, pythonOlder
 , zlib-ng
 }:

 buildPythonPackage rec {
  pname = "aiohttp-zlib-ng";
-  version = "0.1.1";
+  version = "0.1.2";
  pyproject = true;

+  disabled = pythonOlder "3.8";
+
  src = fetchFromGitHub {
    owner = "bdraco";
    repo = "aiohttp-zlib-ng";
-    rev = "v${version}";
-    hash = "sha256-dTNwt4eX6ZQ8ySK2/9ziVbc3KFg2aL/EsiBWaJRC4x8=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-lSzBmEgYrWKthpgceFn9LjsNw/ByPOrdPwVI8WU0Cvo=";
  };

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace " --cov=aiohttp_zlib_ng --cov-report=term-missing:skip-covered" ""
+  '';
+
  nativeBuildInputs = [
    poetry-core
  ];

  propagatedBuildInputs = [
    aiohttp
+    cpufeature
    zlib-ng
  ];

-  pythonImportsCheck = [ "aiohttp_zlib_ng" ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "aiohttp_zlib_ng"
+  ];

  meta = with lib; {
    description = "Enable zlib_ng on aiohttp";
    homepage = "https://github.com/bdraco/aiohttp-zlib-ng";
-    changelog = "https://github.com/bdraco/aiohttp-zlib-ng/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/bdraco/aiohttp-zlib-ng/blob/${version}/CHANGELOG.md";
    license = licenses.asl20;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ fab ];
  };
 }
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "angr";
-  version = "9.2.79";
+  version = "9.2.81";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -41,7 +41,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "angr";
    rev = "refs/tags/v${version}";
-    hash = "sha256-J5ZjJPX5bL3xuKB9dbSlEvHVQS4XnrQfpZ6IXy/1uMw=";
+    hash = "sha256-ckak602Uz8YqBDVmh3iDh9d9/SPNRZMil8PskUbrjLA=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/approvaltests/default.nix
+++ b/pkgs/development/python-modules/approvaltests/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "approvaltests";
-  version = "10.1.0";
+  version = "10.2.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "approvals";
    repo = "ApprovalTests.Python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-t+Vxo6Pn3b2H3yAg5LGsGTjrZr4MXeGOY2BF9eFFAdE=";
+    hash = "sha256-2NaqqgrHXJovoVExvbr0s86eRbcxy+DUrsdRH/vak3E=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.2.79";
+  version = "9.2.81";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-7gnNGUxl/K8GWV99uB/dEv9/ukQ4QV4nvyyByobhBt0=";
+    hash = "sha256-e/13v2hm0yYoO2A/kz6ekvN1FP8XNqqypfZdHKGEItM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.2.79";
+  version = "9.2.81";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "claripy";
    rev = "refs/tags/v${version}";
-    hash = "sha256-N2w4djqJ9r2inLHwhyqNVUqjrlKVo75BblN5xURkMIc=";
+    hash = "sha256-6DqIeLoJzpONte4WHI5EeV3iDDh1lNhegrNiKIgSAbY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@ -16,14 +16,14 @@

 let
  # The binaries are following the argr projects release cycle
-  version = "9.2.79";
+  version = "9.2.81";

  # Binary files from https://github.com/angr/binaries (only used for testing and only here)
  binaries = fetchFromGitHub {
    owner = "angr";
    repo = "binaries";
    rev = "refs/tags/v${version}";
-    hash = "sha256-HVCKw7L5Y/4TR26mWOZ8lKhWOcq0yQqo2LWKQjVSPX4=";
+    hash = "sha256-42J6uBM5Ek1uv5gc4ZwtWpVgUdS3Sd4Y+ge2hkG8QTA=";
  };

 in
@ -38,7 +38,7 @@ buildPythonPackage rec {
    owner = "angr";
    repo = "cle";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Zy62O3Mf9V7aGvQejsv4b6JVrHuDIrrqvTSs7/mVdtY=";
+    hash = "sha256-NS3yi5Ysu0s5PcqnLYOUYI0qpfOX4/E/UDmReX7aNGM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/cpufeature/default.nix
+++ b/pkgs/development/python-modules/cpufeature/default.nix
@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, unittestCheckHook
+, pythonOlder
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "cpufeature";
+  version = "0.2.1";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "robbmcleod";
+    repo = "cpufeature";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-dp569Tp8E5/avQpYvhPNPgS/A+q2e/ie+7BR7h2Ip+I=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "cpufeature"
+  ];
+
+  preCheck = ''
+    # Change into the test directory due to a relative resource path
+    cd cpufeature
+  '';
+
+  meta = with lib; {
+    description = "Python module for detection of CPU features";
+    homepage = "https://github.com/robbmcleod/cpufeature";
+    license = licenses.cc0;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/dnf-plugins-core/default.nix
+++ b/pkgs/development/python-modules/dnf-plugins-core/default.nix
@ -0,0 +1,122 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+
+  # dependencies
+, cmake
+, dateutil
+, dbus-python
+, dnf4
+, gettext
+, libcomps
+, libdnf
+, python
+, rpm
+, sphinx
+, systemd
+}:
+
+let
+  pyMajor = lib.versions.major python.version;
+in
+
+buildPythonPackage rec {
+  pname = "dnf-plugins-core";
+  version = "4.4.3";
+  format = "other";
+
+  outputs = [ "out" "man" ];
+
+  src = fetchFromGitHub {
+    owner = "rpm-software-management";
+    repo = "dnf-plugins-core";
+    rev = version;
+    hash = "sha256-YEw8REvK2X7mBg9HDI6V2p8QtZ3TJh4Dzn8Uuhfbrgo=";
+  };
+
+  patches = [
+    ./fix-python-install-dir.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace "@PYTHON_INSTALL_DIR@" "$out/${python.sitePackages}" \
+      --replace "SYSCONFDIR /etc" "SYSCONFDIR $out/etc" \
+      --replace "SYSTEMD_DIR /usr/lib/systemd/system" "SYSTEMD_DIR $out/lib/systemd/system"
+    substituteInPlace doc/CMakeLists.txt \
+      --replace 'SPHINX_BUILD_NAME "sphinx-build-3"' 'SPHINX_BUILD_NAME "${sphinx}/bin/sphinx-build"'
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    gettext
+    sphinx
+  ];
+
+  propagatedBuildInputs = [
+    dateutil
+    dbus-python
+    dnf4.py
+    libcomps
+    libdnf
+    rpm
+    systemd
+  ];
+
+  cmakeFlags = [
+    "-DPYTHON_DESIRED=${pyMajor}"
+    "-DWITHOUT_LOCAL=0"
+  ];
+
+  postBuild = ''
+    make doc-man
+  '';
+
+  pythonImportsCheck = [
+    # This is the python module imported by dnf4 when plugins are loaded.
+    "dnfpluginscore"
+  ];
+
+  # Don't use symbolic links so argv[0] is set to the correct value.
+  postInstall = ''
+    # See https://github.com/rpm-software-management/dnf-plugins-core/blob/aee9cacdeb50768c1e869122cd432924ec533213/dnf-plugins-core.spec#L478
+    mv $out/libexec/dnf-utils-${pyMajor} $out/libexec/dnf-utils
+
+    # See https://github.com/rpm-software-management/dnf-plugins-core/blob/aee9cacdeb50768c1e869122cd432924ec533213/dnf-plugins-core.spec#L487-L503
+    bins=(
+      "debuginfo-install"
+      "needs-restarting"
+      "find-repos-of-install"
+      "repo-graph"
+      "package-cleanup"
+      "repoclosure"
+      "repodiff"
+      "repomanage"
+      "repoquery"
+      "reposync"
+      "repotrack"
+      "yum-builddep"
+      "yum-config-manager"
+      "yum-debug-dump"
+      "yum-debug-restore"
+      "yum-groups-manager"
+      "yumdownloader"
+    )
+    mkdir -p $out/bin
+    for bin in "''${bins[@]}"; do
+      ln $out/libexec/dnf-utils $out/bin/$bin
+    done
+  '';
+
+  makeWrapperArgs = [
+    ''--add-flags "--setopt=pluginpath=$out/${python.sitePackages}/dnf-plugins"''
+  ];
+
+  meta = with lib; {
+    description = "Core plugins to use with DNF package manager";
+    homepage = "https://github.com/rpm-software-management/dnf-plugins-core";
+    changelog = "https://github.com/rpm-software-management/dnf-plugins-core/releases/tag/${version}";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ katexochen ];
+  };
+}
--- a/pkgs/development/python-modules/dnf-plugins-core/fix-python-install-dir.patch
+++ b/pkgs/development/python-modules/dnf-plugins-core/fix-python-install-dir.patch
@ -0,0 +1,13 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index a1eea7b..00fbaf3 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -18,7 +18,7 @@ ELSE ()
+     MESSAGE (FATAL_ERROR "Invalid PYTHON_DESIRED value: " ${PYTHON_DESIRED})
+ ENDIF()
+
+-EXECUTE_PROCESS(COMMAND ${PYTHON_EXECUTABLE} -c "from sys import stdout; from sysconfig import get_path; stdout.write(get_path('purelib'))" OUTPUT_VARIABLE PYTHON_INSTALL_DIR)
+SET(PYTHON_INSTALL_DIR "@PYTHON_INSTALL_DIR@")
+ MESSAGE(STATUS "Python install dir is ${PYTHON_INSTALL_DIR}")
+
+ SET (SYSCONFDIR /etc)
--- a/pkgs/development/python-modules/dnf4/default.nix
+++ b/pkgs/development/python-modules/dnf4/default.nix
@ -10,12 +10,16 @@
 , sphinx
 }:

+let
+  pyMajor = lib.versions.major python.version;
+in
+
 buildPythonPackage rec {
  pname = "dnf4";
  version = "4.18.2";
  format = "other";

-  outputs = [ "out" "man" ];
+  outputs = [ "out" "man" "py" ];

  src = fetchFromGitHub {
    owner = "rpm-software-management";
@ -36,7 +40,8 @@ buildPythonPackage rec {
    substituteInPlace etc/tmpfiles.d/CMakeLists.txt \
      --replace "DESTINATION /usr/lib/tmpfiles.d" "DESTINATION $out/usr/lib/tmpfiles.d"
    substituteInPlace dnf/const.py.in \
-      --replace "/etc" "$out/etc"
+      --replace "/etc" "$out/etc" \
+      --replace "/var/tmp" "/tmp"
    substituteInPlace doc/CMakeLists.txt \
      --replace 'SPHINX_BUILD_NAME "sphinx-build-3"' 'SPHINX_BUILD_NAME "${sphinx}/bin/sphinx-build"'
  '';
@ -54,21 +59,32 @@ buildPythonPackage rec {
  ];

  cmakeFlags = [
-    "-DPYTHON_DESIRED=${lib.head (lib.splitString ["."] python.version)}"
+    "-DPYTHON_DESIRED=${pyMajor}"
  ];

+  dontWrapPythonPrograms = true;
+
  postBuild = ''
    make doc-man
  '';

  postInstall = ''
    # See https://github.com/rpm-software-management/dnf/blob/41a287e2bd60b4d1100c329a274776ff32ba8740/dnf.spec#L218-L220
-    ln -s dnf-3 $out/bin/dnf
-    ln -s dnf-3 $out/bin/dnf4
-    mv $out/bin/dnf-automatic-3 $out/bin/dnf-automatic
+    ln -s dnf-${pyMajor} $out/bin/dnf
+    ln -s dnf-${pyMajor} $out/bin/dnf4
+    mv $out/bin/dnf-automatic-${pyMajor} $out/bin/dnf-automatic
+
    # See https://github.com/rpm-software-management/dnf/blob/41a287e2bd60b4d1100c329a274776ff32ba8740/dnf.spec#L231-L232
    ln -s $out/etc/dnf/dnf.conf $out/etc/yum.conf
-    ln -s dnf-3 $out/bin/yum
+    ln -s dnf-${pyMajor} $out/bin/yum
+
+    mkdir -p $out/share/bash-completion/completions
+    mv $out/etc/bash_completion.d/dnf $out/share/bash-completion/completions/dnf
+    rm -r $out/etc/bash_completion.d
+  '';
+
+  postFixup = ''
+    moveToOutput "lib/${python.libPrefix}" "$py"
  '';

  meta = with lib; {
--- a/pkgs/development/python-modules/dnf4/wrapper.nix
+++ b/pkgs/development/python-modules/dnf4/wrapper.nix
@ -0,0 +1,53 @@
+{ lib
+, wrapPython
+, python3
+, stdenv
+, dnf-plugins-core
+, plugins ? [ dnf-plugins-core ]
+}:
+let
+  pluginPaths = map (p: "${p}/${python3.sitePackages}/dnf-plugins") plugins;
+
+  dnf4-unwrapped = python3.pkgs.dnf4;
+in
+
+stdenv.mkDerivation {
+  pname = "dnf4";
+  inherit (dnf4-unwrapped) version;
+
+  outputs = [ "out" "man" "py" ];
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [
+    wrapPython
+  ];
+
+  propagatedBuildInputs = [
+    dnf4-unwrapped
+  ] ++ plugins;
+
+  makeWrapperArgs = lib.optional (plugins != [ ]) ''--add-flags "--setopt=pluginpath=${lib.concatStringsSep "," pluginPaths}"'';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -R ${dnf4-unwrapped} $out
+    cp -R ${dnf4-unwrapped.py} $py
+    cp -R ${dnf4-unwrapped.man} $man
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    wrapPythonPrograms
+  '';
+
+  passthru = {
+    unwrapped = dnf4-unwrapped;
+  };
+
+  meta = dnf4-unwrapped.meta // {
+    priority = (dnf4-unwrapped.meta.priority or 0) - 1;
+  };
+}
--- a/pkgs/development/python-modules/flask-restx/default.nix
+++ b/pkgs/development/python-modules/flask-restx/default.nix
@ -20,7 +20,7 @@

 buildPythonPackage rec {
  pname = "flask-restx";
-  version = "1.2.0";
+  version = "1.3.0";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "python-restx";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-9o0lgDtjsZta9fVJnD02In6wvxNwPA667WeIkpRv8Z4=";
+    hash = "sha256-CBReP/u96fsr28lMV1BfLjjdBMXEvsD03wvsxkIcteI=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/getjump/default.nix
+++ b/pkgs/development/python-modules/getjump/default.nix
@ -4,29 +4,22 @@
 , fetchPypi
 , pillow
 , poetry-core
-, pythonRelaxDepsHook
 , requests
 , rich
 }:

 buildPythonPackage rec {
  pname = "getjump";
-  version = "2.4.0";
-  format = "pyproject";
+  version = "2.4.1";
+  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-gu6h9Yb0xdfvdmoeZGQPFCJhBJxuQ4iWlQquig1ljnY=";
+    hash = "sha256-rNMhyUqrliKf6CPhZfyUwN00D4TgOWjPCoqihOB0PDE=";
  };

  nativeBuildInputs = [
    poetry-core
-    pythonRelaxDepsHook
-  ];
-
-  pythonRelaxDeps = [
-    # remove after https://github.com/eggplants/getjump/pull/123 is released
-    "pillow"
  ];

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@ -25,7 +25,7 @@

 buildPythonPackage rec {
  pname = "openai";
-  version = "1.5.0";
+  version = "1.6.0";
  pyproject = true;

  disabled = pythonOlder "3.7.1";
@ -34,7 +34,7 @@ buildPythonPackage rec {
    owner = "openai";
    repo = "openai-python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-KLXDzXpT9F/JqA8Jeo8AF/eTD3hHXQQcTrblQJ4BHug=";
+    hash = "sha256-bRnsUpHhi+CAzUQSqMFmVWItn6KIKaXMjggxNixaY6Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pynitrokey/default.nix
+++ b/pkgs/development/python-modules/pynitrokey/default.nix
@ -30,7 +30,7 @@

 let
  pname = "pynitrokey";
-  version = "0.4.43";
+  version = "0.4.44";
  mainProgram = "nitropy";
 in

@ -40,7 +40,7 @@ buildPythonPackage {

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-dYOdokqALDg4Xn7N6Yd0skM/tit+j5+xY73sm9k76hE=";
+    hash = "sha256-SWLxiUAE8AVa+EYjOk0kzOcW65TJbvUe627VmJY7nFY=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pyqt/6.x.nix
+++ b/pkgs/development/python-modules/pyqt/6.x.nix
@ -23,14 +23,14 @@

 buildPythonPackage rec {
  pname = "PyQt6";
-  version = "6.6.0";
+  version = "6.6.1";
  format = "pyproject";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-1BUS1mBEwt+cX1FaVqkiFw1oo3s0Bv/dyLStxXGBtXY=";
+    hash = "sha256-nxWKop0gUULFbw810HeEuN8L4oN40gqXvNqL1k/9A3k=";
  };

  patches = [
--- a/Show More
+++ b/Show More