Merge staging-next into staging

2026-10-02 21:10:08 +00:00 · 2024-04-24 12:01:57 +00:00
parent 564a9656b0 0977f8605c
commit 1b9bd5d1e0
160 changed files with 6231 additions and 847 deletions
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -48,9 +48,7 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi

 - GNOME has been updated to v46. Refer to the [release notes](https://release.gnome.org/46/) for more details. Notably this release brings experimental VRR support, default GTK renderer changes and WebDAV support in Online Accounts. This release we have also stopped including the legacy and unsupported Adwaita-Dark theme by default.

- A new option `virtualisation.containers.cdi` was added. It contains `static` and `dynamic` attributes (corresponding to `/etc/cdi` and `/run/cdi` respectively) to configure the Container Device Interface (CDI).
-
- `virtualisation.docker.enableNvidia` and `virtualisation.podman.enableNvidia` options are deprecated. `virtualisation.containers.cdi.dynamic.nvidia.enable` should be used instead. This option will expose GPUs on containers with the `--device` CLI option. This is supported by Docker 25, Podman 3.2.0 and Singularity 4. Any container runtime that supports the CDI specification will take advantage of this feature.
+- `virtualisation.docker.enableNvidia` and `virtualisation.podman.enableNvidia` options are deprecated. `hardware.nvidia-container-toolkit.enable` should be used instead. This option will expose GPUs on containers with the `--device` CLI option. This is supported by Docker 25, Podman 3.2.0 and Singularity 4. Any container runtime that supports the CDI specification will take advantage of this feature.

 - `system.etc.overlay.enable` option was added. If enabled, `/etc` is
  mounted via an overlayfs instead of being created by a custom perl script.
@@ -403,6 +401,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
  upgrade NetBox by changing `services.netbox.package`. Database migrations
  will be run automatically.

+- `gauge` now supports installing plugins using nix. For the old imperative approach, switch to `gauge-unwrapped`.
+  You can load plugins from an existing gauge manifest file using `gauge.fromManifest ./path/to/manifest.json` or
+  specify plugins in nix using `gauge.withPlugins (p: with p; [ js html-report xml-report ])`.
+
 - `firefox-devedition`, `firefox-beta`, `firefox-esr` executable file names for now match their package names, which is consistent with the `firefox-*-bin` packages. The desktop entries are also updated so that you can have multiple editions of firefox in your app launcher.

 - switch-to-configuration does not directly call systemd-tmpfiles anymore.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -559,7 +559,7 @@
  ./services/hardware/kanata.nix
  ./services/hardware/lcd.nix
  ./services/hardware/lirc.nix
-  ./services/hardware/nvidia-container-toolkit-cdi-generator
+  ./services/hardware/nvidia-container-toolkit
  ./services/hardware/monado.nix
  ./services/hardware/nvidia-optimus.nix
  ./services/hardware/openrgb.nix
--- a/nixos/modules/services/editors/emacs.md
+++ b/nixos/modules/services/editors/emacs.md
@@ -366,44 +366,3 @@ convenient if you regularly edit Nix files.
 You can use `woman` to get completion of all available
 man pages. For example, type `M-x woman <RET> nixos-rebuild <RET>.`

-### Editing DocBook 5 XML Documents {#sec-emacs-docbook-xml}
-
-Emacs includes
-[nXML](https://www.gnu.org/software/emacs/manual/html_node/nxml-mode/Introduction.html),
-a major-mode for validating and editing XML documents. When editing DocBook
-5.0 documents, such as [this one](#book-nixos-manual),
-nXML needs to be configured with the relevant schema, which is not
-included.
-
-To install the DocBook 5.0 schemas, either add
-{var}`pkgs.docbook5` to [](#opt-environment.systemPackages)
-([NixOS](#sec-declarative-package-mgmt)), or run
-`nix-env -f '<nixpkgs>' -iA docbook5`
-([Nix](#sec-ad-hoc-packages)).
-
-Then customize the variable {var}`rng-schema-locating-files` to
-include {file}`~/.emacs.d/schemas.xml` and put the following
-text into that file:
-::: {.example #ex-emacs-docbook-xml}
-### nXML Schema Configuration (`~/.emacs.d/schemas.xml`)
-
-```xml
-<?xml version="1.0"?>
-<!--
-  To let emacs find this file, evaluate:
-  (add-to-list 'rng-schema-locating-files "~/.emacs.d/schemas.xml")
-->
-<locatingRules xmlns="http://thaiopensource.com/ns/locating-rules/1.0">
-  <!--
-    Use this variation if pkgs.docbook5 is added to environment.systemPackages
-  -->
-  <namespace ns="http://docbook.org/ns/docbook"
-             uri="/run/current-system/sw/share/xml/docbook-5.0/rng/docbookxi.rnc"/>
-  <!--
-    Use this variation if installing schema with "nix-env -iA pkgs.docbook5".
-  <namespace ns="http://docbook.org/ns/docbook"
-             uri="../.nix-profile/share/xml/docbook-5.0/rng/docbookxi.rnc"/>
-  -->
-</locatingRules>
-```
-:::
--- a/nixos/modules/services/hardware/nvidia-container-toolkit-cdi-generator/cdi-generate.nix
+++ b/nixos/modules/services/hardware/nvidia-container-toolkit-cdi-generator/cdi-generate.nix
@@ -1,60 +0,0 @@
-{
-  addDriverRunpath,
-  glibc,
-  jq,
-  lib,
-  nvidia-container-toolkit,
-  nvidia-driver,
-  runtimeShell,
-  writeScriptBin,
-}:
-let
-  mountOptions = { options = ["ro" "nosuid" "nodev" "bind"]; };
-  mounts = [
-    # FIXME: Making /usr mounts optional
-    { hostPath = lib.getExe' nvidia-driver "nvidia-cuda-mps-control";
-      containerPath = "/usr/bin/nvidia-cuda-mps-control"; }
-    { hostPath = lib.getExe' nvidia-driver "nvidia-cuda-mps-server";
-      containerPath = "/usr/bin/nvidia-cuda-mps-server"; }
-    { hostPath = lib.getExe' nvidia-driver "nvidia-debugdump";
-      containerPath = "/usr/bin/nvidia-debugdump"; }
-    { hostPath = lib.getExe' nvidia-driver "nvidia-powerd";
-      containerPath = "/usr/bin/nvidia-powerd"; }
-    { hostPath = lib.getExe' nvidia-driver "nvidia-smi";
-      containerPath = "/usr/bin/nvidia-smi"; }
-    { hostPath = lib.getExe' nvidia-container-toolkit "nvidia-ctk";
-      containerPath = "/usr/bin/nvidia-ctk"; }
-    { hostPath = "${lib.getLib glibc}/lib";
-      containerPath = "${lib.getLib glibc}/lib"; }
-
-    # FIXME: use closureinfo
-    {
-      hostPath = addDriverRunpath.driverLink;
-      containerPath = addDriverRunpath.driverLink;
-    }
-    { hostPath = "${lib.getLib glibc}/lib";
-      containerPath = "${lib.getLib glibc}/lib"; }
-    { hostPath = "${lib.getLib glibc}/lib64";
-      containerPath = "${lib.getLib glibc}/lib64"; }
-  ];
-  jqAddMountExpression = ".containerEdits.mounts[.containerEdits.mounts | length] |= . +";
-  mountsToJq = lib.concatMap
-    (mount:
-      ["${lib.getExe jq} '${jqAddMountExpression} ${builtins.toJSON (mount // mountOptions)}'"])
-    mounts;
-in
-writeScriptBin "nvidia-cdi-generator"
-''
-#! ${runtimeShell}
-
-function cdiGenerate {
-  ${lib.getExe' nvidia-container-toolkit "nvidia-ctk"} cdi generate \
-    --format json \
-    --ldconfig-path ${lib.getExe' glibc "ldconfig"} \
-    --library-search-path ${lib.getLib nvidia-driver}/lib \
-    --nvidia-ctk-path ${lib.getExe' nvidia-container-toolkit "nvidia-ctk"}
-}
-
-cdiGenerate | \
-  ${lib.concatStringsSep " | " mountsToJq} > $RUNTIME_DIRECTORY/nvidia-container-toolkit.json
-''
--- a/nixos/modules/services/hardware/nvidia-container-toolkit-cdi-generator/default.nix
+++ b/nixos/modules/services/hardware/nvidia-container-toolkit-cdi-generator/default.nix
@@ -1,40 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-
-  options = {
-
-    hardware.nvidia-container-toolkit-cdi-generator.enable = lib.mkOption {
-      default = false;
-      internal = true;
-      visible = false;
-      type = lib.types.bool;
-      description = ''
-        Enable dynamic CDI configuration for NVidia devices by running
-        nvidia-container-toolkit on boot.
-      '';
-    };
-
-  };
-
-  config = {
-
-    systemd.services.nvidia-container-toolkit-cdi-generator = lib.mkIf config.hardware.nvidia-container-toolkit-cdi-generator.enable {
-      description = "Container Device Interface (CDI) for Nvidia generator";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "systemd-udev-settle.service" ];
-      serviceConfig = {
-        RuntimeDirectory = "cdi";
-        RemainAfterExit = true;
-        ExecStart =
-          let
-            script = pkgs.callPackage ./cdi-generate.nix { nvidia-driver = config.hardware.nvidia.package; };
-          in
-          lib.getExe script;
-        Type = "oneshot";
-      };
-    };
-
-  };
-
-}
--- a/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix
+++ b/nixos/modules/services/hardware/nvidia-container-toolkit/cdi-generate.nix
@@ -0,0 +1,35 @@
+{
+  glibc,
+  jq,
+  lib,
+  mounts,
+  nvidia-container-toolkit,
+  nvidia-driver,
+  runtimeShell,
+  writeScriptBin,
+}: let
+  mkMount = {hostPath, containerPath, mountOptions}: {
+    inherit hostPath containerPath;
+    options = mountOptions;
+  };
+  jqAddMountExpression = ".containerEdits.mounts[.containerEdits.mounts | length] |= . +";
+  allJqMounts = lib.concatMap
+    (mount:
+      ["${lib.getExe jq} '${jqAddMountExpression} ${builtins.toJSON (mkMount mount)}'"])
+    mounts;
+in
+writeScriptBin "nvidia-cdi-generator"
+''
+#! ${runtimeShell}
+
+function cdiGenerate {
+  ${lib.getExe' nvidia-container-toolkit "nvidia-ctk"} cdi generate \
+    --format json \
+    --ldconfig-path ${lib.getExe' glibc "ldconfig"} \
+    --library-search-path ${lib.getLib nvidia-driver}/lib \
+    --nvidia-ctk-path ${lib.getExe' nvidia-container-toolkit "nvidia-ctk"}
+}
+
+cdiGenerate | \
+  ${lib.concatStringsSep " | " allJqMounts} > $RUNTIME_DIRECTORY/nvidia-container-toolkit.json
+''
--- a/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
+++ b/nixos/modules/services/hardware/nvidia-container-toolkit/default.nix
@@ -0,0 +1,121 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "virtualisation" "containers" "cdi" "dynamic" "nvidia" "enable" ]
+      [ "hardware" "nvidia-container-toolkit" "enable" ])
+  ];
+
+  options = let
+    mountType = {
+      options = {
+        hostPath = lib.mkOption {
+          type = lib.types.str;
+          description = "Host path.";
+        };
+        containerPath = lib.mkOption {
+          type = lib.types.str;
+          description = "Container path.";
+        };
+        mountOptions = lib.mkOption {
+          default = [ "ro" "nosuid" "nodev" "bind" ];
+          type = lib.types.listOf lib.types.str;
+          description = "Mount options.";
+        };
+      };
+    };
+  in {
+
+    hardware.nvidia-container-toolkit = {
+      enable = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Enable dynamic CDI configuration for NVidia devices by running
+          nvidia-container-toolkit on boot.
+        '';
+      };
+
+      mounts = lib.mkOption {
+        type = lib.types.listOf (lib.types.submodule mountType);
+        default = [];
+        description = "Mounts to be added to every container under the Nvidia CDI profile.";
+      };
+
+      mount-nvidia-executables = lib.mkOption {
+        default = true;
+        type = lib.types.bool;
+        description = ''
+          Mount executables nvidia-smi, nvidia-cuda-mps-control, nvidia-cuda-mps-server,
+          nvidia-debugdump, nvidia-powerd and nvidia-ctk on containers.
+        '';
+      };
+
+      mount-nvidia-docker-1-directories = lib.mkOption {
+        default = true;
+        type = lib.types.bool;
+        description = ''
+          Mount nvidia-docker-1 directories on containers: /usr/local/nvidia/lib and
+          /usr/local/nvidia/lib64.
+        '';
+      };
+    };
+
+  };
+
+  config = {
+
+    hardware.nvidia-container-toolkit.mounts = let
+      nvidia-driver = config.hardware.nvidia.package;
+    in (lib.mkMerge [
+      [{ hostPath = pkgs.addDriverRunpath.driverLink;
+         containerPath = pkgs.addDriverRunpath.driverLink; }
+       { hostPath = "${lib.getLib pkgs.glibc}/lib";
+         containerPath = "${lib.getLib pkgs.glibc}/lib"; }
+       { hostPath = "${lib.getLib pkgs.glibc}/lib64";
+         containerPath = "${lib.getLib pkgs.glibc}/lib64"; }]
+      (lib.mkIf config.hardware.nvidia-container-toolkit.mount-nvidia-executables
+        [{ hostPath = lib.getExe' nvidia-driver "nvidia-cuda-mps-control";
+           containerPath = "/usr/bin/nvidia-cuda-mps-control"; }
+         { hostPath = lib.getExe' nvidia-driver "nvidia-cuda-mps-server";
+           containerPath = "/usr/bin/nvidia-cuda-mps-server"; }
+         { hostPath = lib.getExe' nvidia-driver "nvidia-debugdump";
+           containerPath = "/usr/bin/nvidia-debugdump"; }
+         { hostPath = lib.getExe' nvidia-driver "nvidia-powerd";
+           containerPath = "/usr/bin/nvidia-powerd"; }
+         { hostPath = lib.getExe' nvidia-driver "nvidia-smi";
+           containerPath = "/usr/bin/nvidia-smi"; }])
+      # nvidia-docker 1.0 uses /usr/local/nvidia/lib{,64}
+      #   e.g.
+      #     - https://gitlab.com/nvidia/container-images/cuda/-/blob/e3ff10eab3a1424fe394899df0e0f8ca5a410f0f/dist/12.3.1/ubi9/base/Dockerfile#L44
+      #     - https://github.com/NVIDIA/nvidia-docker/blob/01d2c9436620d7dde4672e414698afe6da4a282f/src/nvidia/volumes.go#L104-L173
+      (lib.mkIf config.hardware.nvidia-container-toolkit.mount-nvidia-docker-1-directories
+        [{ hostPath = "${lib.getLib nvidia-driver}/lib";
+           containerPath = "/usr/local/nvidia/lib"; }
+         { hostPath = "${lib.getLib nvidia-driver}/lib";
+           containerPath = "/usr/local/nvidia/lib64"; }])
+    ]);
+
+    systemd.services.nvidia-container-toolkit-cdi-generator = lib.mkIf config.hardware.nvidia-container-toolkit.enable {
+      description = "Container Device Interface (CDI) for Nvidia generator";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "systemd-udev-settle.service" ];
+      serviceConfig = {
+        RuntimeDirectory = "cdi";
+        RemainAfterExit = true;
+        ExecStart =
+          let
+            script = pkgs.callPackage ./cdi-generate.nix {
+              inherit (config.hardware.nvidia-container-toolkit) mounts;
+              nvidia-driver = config.hardware.nvidia.package;
+            };
+          in
+          lib.getExe script;
+        Type = "oneshot";
+      };
+    };
+
+  };
+
+}
--- a/nixos/modules/services/home-automation/evcc.nix
+++ b/nixos/modules/services/home-automation/evcc.nix
@@ -63,6 +63,7 @@ in
        DynamicUser = true;
        LockPersonality = true;
        MemoryDenyWriteExecute = true;
+        Restart = "on-failure";
        RestrictAddressFamilies = [
          "AF_INET"
          "AF_INET6"
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -346,6 +346,7 @@ in
                violates the privacy of users and is not recommended.
              '';
            };
+            UsePAM = mkEnableOption "PAM authentication" // { default = true; };
            UseDns = mkOption {
              type = types.bool;
              # apply if cfg.useDns then "yes" else "no"
@@ -489,6 +490,8 @@ in
                {manpage}`sshd_config(5)` for details.
              '';
            };
+            # Disabled by default, since pam_motd handles this.
+            PrintMotd = mkEnableOption "printing /etc/motd when a user logs in interactively";
          };
        });
      };
@@ -622,7 +625,7 @@ in

    networking.firewall.allowedTCPPorts = optionals cfg.openFirewall cfg.ports;

-    security.pam.services.sshd =
+    security.pam.services.sshd = lib.mkIf cfg.settings.UsePAM
      { startSession = true;
        showMotd = true;
        unixAuth = cfg.settings.PasswordAuthentication;
@@ -638,8 +641,6 @@ in

    services.openssh.extraConfig = mkOrder 0
      ''
-        UsePAM yes
-
        Banner ${if cfg.banner == null then "none" else pkgs.writeText "ssh_banner" cfg.banner}

        AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
@@ -657,7 +658,6 @@ in
        ${optionalString cfg.allowSFTP ''
          Subsystem sftp ${cfg.sftpServerExecutable} ${concatStringsSep " " cfg.sftpFlags}
        ''}
-        PrintMotd no # handled by pam_motd
        AuthorizedKeysFile ${toString cfg.authorizedKeysFiles}
        ${optionalString (cfg.authorizedKeysCommand != "none") ''
          AuthorizedKeysCommand ${cfg.authorizedKeysCommand}
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@@ -28,43 +28,6 @@ in
      description = "Enable the OCI seccomp BPF hook";
    };

-    cdi = {
-      dynamic.nvidia.enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Enable dynamic CDI configuration for NVidia devices by running nvidia-container-toolkit on boot.
-        '';
-      };
-
-      static = mkOption {
-        type = types.attrs;
-        default = { };
-        description = ''
-          Declarative CDI specification. Each key of the attribute set
-          will be mapped to a file in /etc/cdi. It is required for every
-          key to be provided in JSON format.
-        '';
-        example = {
-          some-vendor = builtins.fromJSON ''
-              {
-                "cdiVersion": "0.5.0",
-                "kind": "some-vendor.com/foo",
-                "devices": [],
-                "containerEdits": []
-              }
-            '';
-
-          some-other-vendor = {
-            cdiVersion = "0.5.0";
-            kind = "some-other-vendor.com/bar";
-            devices = [];
-            containerEdits = [];
-          };
-        };
-      };
-    };
-
    containersConf.settings = mkOption {
      type = toml.type;
      default = { };
@@ -150,8 +113,6 @@ in

  config = lib.mkIf cfg.enable {

-    hardware.nvidia-container-toolkit-cdi-generator.enable = lib.mkIf cfg.cdi.dynamic.nvidia.enable true;
-
    virtualisation.containers.containersConf.cniPlugins = [ pkgs.cni-plugins ];

    virtualisation.containers.containersConf.settings = {
@@ -163,13 +124,7 @@ in
      };
    };

-    environment.etc = let
-      cdiStaticConfigurationFiles = (lib.attrsets.mapAttrs'
-        (name: value:
-          lib.attrsets.nameValuePair "cdi/${name}.json"
-            { text = builtins.toJSON value; })
-        cfg.cdi.static);
-    in {
+    environment.etc = {
      "containers/containers.conf".source =
        toml.generate "containers.conf" cfg.containersConf.settings;

@@ -183,7 +138,7 @@ in
      "containers/policy.json".source =
        if cfg.policy != { } then pkgs.writeText "policy.json" (builtins.toJSON cfg.policy)
        else "${pkgs.skopeo.policy}/default-policy.json";
-    } // cdiStaticConfigurationFiles;
+    };

  };

--- a/nixos/tests/openssh.nix
+++ b/nixos/tests/openssh.nix
@@ -22,6 +22,19 @@ in {
        ];
      };

+    server-allowed-users =
+      { ... }:
+
+      {
+        services.openssh = { enable = true; settings.AllowUsers = [ "alice" "bob" ]; };
+        users.groups = { alice = { }; bob = { }; carol = { }; };
+        users.users = {
+          alice = { isNormalUser = true; group = "alice"; openssh.authorizedKeys.keys = [ snakeOilPublicKey ]; };
+          bob = { isNormalUser = true; group = "bob"; openssh.authorizedKeys.keys = [ snakeOilPublicKey ]; };
+          carol = { isNormalUser = true; group = "carol"; openssh.authorizedKeys.keys = [ snakeOilPublicKey ]; };
+        };
+      };
+
    server-lazy =
      { ... }:

@@ -95,17 +108,21 @@ in {
        };
      };

-    server_allowedusers =
-      { ... }:
-
+    server-no-pam =
+      { pkgs, ... }:
      {
-        services.openssh = { enable = true; settings.AllowUsers = [ "alice" "bob" ]; };
-        users.groups = { alice = { }; bob = { }; carol = { }; };
-        users.users = {
-          alice = { isNormalUser = true; group = "alice"; openssh.authorizedKeys.keys = [ snakeOilPublicKey ]; };
-          bob = { isNormalUser = true; group = "bob"; openssh.authorizedKeys.keys = [ snakeOilPublicKey ]; };
-          carol = { isNormalUser = true; group = "carol"; openssh.authorizedKeys.keys = [ snakeOilPublicKey ]; };
+        programs.ssh.package = pkgs.opensshPackages.openssh.override {
+          withPAM = false;
        };
+        services.openssh = {
+          enable = true;
+          settings = {
+            UsePAM = false;
+          };
+        };
+        users.users.root.openssh.authorizedKeys.keys = [
+          snakeOilPublicKey
+        ];
      };

    client =
@@ -119,8 +136,10 @@ in {
    start_all()

    server.wait_for_unit("sshd", timeout=30)
+    server_allowed_users.wait_for_unit("sshd", timeout=30)
    server_localhost_only.wait_for_unit("sshd", timeout=30)
    server_match_rule.wait_for_unit("sshd", timeout=30)
+    server_no_pam.wait_for_unit("sshd", timeout=30)

    server_lazy.wait_for_unit("sshd.socket", timeout=30)
    server_localhost_only_lazy.wait_for_unit("sshd.socket", timeout=30)
@@ -166,8 +185,9 @@ in {
            "cat ${snakeOilPrivateKey} > privkey.snakeoil"
        )
        client.succeed("chmod 600 privkey.snakeoil")
+        # The final segment in this IP is allocated according to the alphabetical order of machines in this test.
        client.succeed(
-            "ssh -p 2222 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.2.4 true",
+            "ssh -p 2222 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.2.5 true",
            timeout=30
        )

@@ -198,15 +218,25 @@ in {
        )
        client.succeed("chmod 600 privkey.snakeoil")
        client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil alice@server_allowedusers true",
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil alice@server-allowed-users true",
            timeout=30
        )
        client.succeed(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil bob@server_allowedusers true",
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil bob@server-allowed-users true",
            timeout=30
        )
        client.fail(
-            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil carol@server_allowedusers true",
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil carol@server-allowed-users true",
+            timeout=30
+        )
+
+    with subtest("no-pam"):
+        client.succeed(
+            "cat ${snakeOilPrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-no-pam true",
            timeout=30
        )
  '';
--- a/pkgs/applications/audio/galaxy-buds-client/default.nix
+++ b/pkgs/applications/audio/galaxy-buds-client/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , buildDotnetModule
 , fetchFromGitHub
-, autoPatchelfHook
 , fontconfig
 , xorg
 , libglvnd
@@ -27,7 +26,6 @@ buildDotnetModule rec {
  dotnetFlags = [ "-p:Runtimeidentifier=linux-x64" ];

  nativeBuildInputs = [
-    autoPatchelfHook
    copyDesktopItems
    graphicsmagick
  ];
--- a/pkgs/applications/audio/pyradio/default.nix
+++ b/pkgs/applications/audio/pyradio/default.nix
@@ -6,13 +6,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "pyradio";
-  version = "0.9.3.2";
+  version = "0.9.3.4";

  src = fetchFromGitHub {
    owner = "coderholic";
    repo = "pyradio";
    rev = "refs/tags/${version}";
-    hash = "sha256-aIWU68bdPUsIh8QRNnF0NcK7FemmYyUHbJg9KcUALBk=";
+    hash = "sha256-QifBzQsvYU5kP5mnidOgWGBh3h2MvJm8Wo0i1v6j/cU=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/backup/pika-backup/default.nix
+++ b/pkgs/applications/backup/pika-backup/default.nix
@@ -21,20 +21,20 @@

 stdenv.mkDerivation rec {
  pname = "pika-backup";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "pika-backup";
    rev = "v${version}";
-    hash = "sha256-WeFc/4TEIxw6uzLroJX1D/rEA419sghkjBt1nsPv2Ho=";
+    hash = "sha256-yxr98CJuu15TGiIXCBhU2bOgvct6jQ5xAraD9Z0sL2Q=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-fgPgUZxye9YUyX9/+hTye3cUypgRAegZMUTKfPxVH4s=";
+    hash = "sha256-ce8SdBvRdFp1BU9OPcByoJjCiSrAkQqtmfCeJ3B+Piw=";
  };

  patches = [
--- a/pkgs/applications/blockchains/wasabibackend/default.nix
+++ b/pkgs/applications/blockchains/wasabibackend/default.nix
@@ -4,7 +4,6 @@
  fetchFromGitHub,
  buildDotnetModule,
  dotnetCorePackages,
-  autoPatchelfHook,
  zlib,
  openssl,
 }:
@@ -25,7 +24,6 @@ buildDotnetModule rec {
  dotnet-sdk = dotnetCorePackages.sdk_7_0;
  dotnet-runtime = dotnetCorePackages.aspnetcore_7_0;

-  nativeBuildInputs = [autoPatchelfHook];
  buildInputs = [stdenv.cc.cc.lib zlib];

  runtimeDeps = [openssl zlib];
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ebuild-mode/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ebuild-mode/default.nix
@@ -1,21 +1,26 @@
-{ lib, melpaBuild, fetchurl, writeText }:
+{
+  lib,
+  melpaBuild,
+  fetchzip,
+  writeText,
+}:

 melpaBuild rec {
  pname = "ebuild-mode";
-  version = "1.67";
+  version = "1.70";

-  src = fetchurl {
-    url = "https://dev.gentoo.org/~ulm/emacs/ebuild-mode-${version}.tar.xz";
-    hash = "sha256-5qxHpu1BLtI8LFnL/sAoqmo80zeyElxIdFtAsfMefUE=";
+  src = fetchzip {
+    url = "https://gitweb.gentoo.org/proj/ebuild-mode.git/snapshot/ebuild-mode-${version}.tar.bz2";
+    hash = "sha256-dOm3xJMFLelwcImIwckeQHx1GqV9PB+I45QA9UT1nCM=";
  };

  # not used but needs to be set; why?
-  commit = "e7b45096283ac8836f208babddfd1ea1c1d1d1d";
+  commit = "a643f177b58aa8869f2f24814e990320aa4f0f96";

  recipe = writeText "recipe" ''
    (ebuild-mode
-      :url "https://anongit.gentoo.org/git/proj/ebuild-mode.git"
-      :fetcher git)
+     :url "https://gitweb.gentoo.org/proj/ebuild-mode.git"
+     :fetcher git)
  '';

  meta = {
--- a/pkgs/applications/misc/avalonia-ilspy/default.nix
+++ b/pkgs/applications/misc/avalonia-ilspy/default.nix
@@ -15,7 +15,6 @@
 , makeDesktopItem
 , copyDesktopItems
 , icoutils
-, autoPatchelfHook
 , bintools
 , fixDarwinDylibNames
 , autoSignDarwinBinariesHook
@@ -40,8 +39,7 @@ buildDotnetModule rec {
  nativeBuildInputs = [
    copyDesktopItems
    icoutils
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ bintools fixDarwinDylibNames ]
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ bintools fixDarwinDylibNames ]
    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [ autoSignDarwinBinariesHook ];

  buildInputs = [
--- a/pkgs/applications/misc/bambu-studio/default.nix
+++ b/pkgs/applications/misc/bambu-studio/default.nix
@@ -1,49 +1,50 @@
-{ stdenv
-, lib
-, openexr
-, jemalloc
-, c-blosc
-, binutils
-, fetchFromGitHub
-, cmake
-, pkg-config
-, wrapGAppsHook
-, boost179
-, cereal
-, cgal_5
-, curl
-, dbus
-, eigen
-, expat
-, gcc-unwrapped
-, glew
-, glfw
-, glib
-, glib-networking
-, gmp
-, gstreamer
-, gst-plugins-base
-, gst-plugins-bad
-, gst-plugins-good
-, gtest
-, gtk3
-, hicolor-icon-theme
-, ilmbase
-, libpng
-, mesa
-, mpfr
-, nlopt
-, opencascade-occt
-, openvdb
-, pcre
-, qhull
-, systemd
-, tbb_2021_11
-, webkitgtk
-, wxGTK31
-, xorg
-, fetchpatch
-, withSystemd ? stdenv.isLinux
+{
+  stdenv,
+  lib,
+  openexr,
+  jemalloc,
+  c-blosc,
+  binutils,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  wrapGAppsHook,
+  boost179,
+  cereal,
+  cgal_5,
+  curl,
+  dbus,
+  eigen,
+  expat,
+  gcc-unwrapped,
+  glew,
+  glfw,
+  glib,
+  glib-networking,
+  gmp,
+  gstreamer,
+  gst-plugins-base,
+  gst-plugins-bad,
+  gst-plugins-good,
+  gtest,
+  gtk3,
+  hicolor-icon-theme,
+  ilmbase,
+  libpng,
+  mesa,
+  mpfr,
+  nlopt,
+  opencascade-occt,
+  openvdb,
+  pcre,
+  qhull,
+  systemd,
+  tbb_2021_11,
+  webkitgtk,
+  wxGTK31,
+  xorg,
+  fetchpatch,
+  withSystemd ? stdenv.isLinux,
 }:
 let
  wxGTK31' = wxGTK31.overrideAttrs (old: {
@@ -53,7 +54,14 @@ let
    ];
  });
  openvdb_tbb_2021_8 = openvdb.overrideAttrs (old: rec {
-    buildInputs = [ openexr boost179 tbb_2021_11 jemalloc c-blosc ilmbase ];
+    buildInputs = [
+      openexr
+      boost179
+      tbb_2021_11
+      jemalloc
+      c-blosc
+      ilmbase
+    ];
  });
 in
 stdenv.mkDerivation rec {
@@ -106,9 +114,7 @@ stdenv.mkDerivation rec {
    webkitgtk
    wxGTK31'
    xorg.libX11
-  ] ++ lib.optionals withSystemd [
-    systemd
-  ] ++ checkInputs;
+  ] ++ lib.optionals withSystemd [ systemd ] ++ checkInputs;

  patches = [
    # Fix for webkitgtk linking
@@ -169,11 +175,8 @@ stdenv.mkDerivation rec {
  # needed to prevent collisions between the LICENSE.txt files of
  # bambu-studio and orca-slicer.
  postInstall = ''
-    mkdir -p $out/share/doc
-    mv $out/LICENSE.txt $out/share/doc/LICENSE.txt
-    if [ -f $out/README.md ]; then
-      mv $out/README.md $out/share/doc/README.md
-    fi
+    mv $out/LICENSE.txt $out/share/BambuStudio/LICENSE.txt
+    mv $out/README.md $out/share/BambuStudio/README.md
  '';

  meta = with lib; {
--- a/pkgs/applications/misc/bambu-studio/orca-slicer.nix
+++ b/pkgs/applications/misc/bambu-studio/orca-slicer.nix
@@ -1,27 +1,41 @@
-{ lib, fetchFromGitHub, makeDesktopItem, bambu-studio }:
+{
+  lib,
+  fetchFromGitHub,
+  bambu-studio,
+}:

-bambu-studio.overrideAttrs (finalAttrs: previousAttrs: {
-  version = "2.0.0";
-  pname = "orca-slicer";
+bambu-studio.overrideAttrs (
+  finalAttrs: previousAttrs: {
+    version = "2.0.0";
+    pname = "orca-slicer";

-  # Don't inherit patches from bambu-studio
-  patches = [
-    ./0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch
-  ];
+    # Don't inherit patches from bambu-studio
+    patches = [ ./0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch ];

-  src = fetchFromGitHub {
-    owner = "SoftFever";
-    repo = "OrcaSlicer";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-YlLDUH3ODIfax5QwnsVJi1JjZ9WtxP3ssqRP1C4d4bw=";
-  };
+    src = fetchFromGitHub {
+      owner = "SoftFever";
+      repo = "OrcaSlicer";
+      rev = "v${finalAttrs.version}";
+      hash = "sha256-YlLDUH3ODIfax5QwnsVJi1JjZ9WtxP3ssqRP1C4d4bw=";
+    };

-  meta = with lib; {
-    description = "G-code generator for 3D printers (Bambu, Prusa, Voron, VzBot, RatRig, Creality, etc";
-    homepage = "https://github.com/SoftFever/OrcaSlicer";
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ zhaofengli ovlach pinpox ];
-    mainProgram = "orca-slicer";
-    platforms = platforms.linux;
-  };
-})
+    # needed to prevent collisions between the LICENSE.txt files of
+    # bambu-studio and orca-slicer.
+    postInstall = ''
+      mv $out/LICENSE.txt $out/share/OrcaSlicer/LICENSE.txt
+    '';
+
+    meta = with lib; {
+      description = "G-code generator for 3D printers (Bambu, Prusa, Voron, VzBot, RatRig, Creality, etc";
+      homepage = "https://github.com/SoftFever/OrcaSlicer";
+      license = licenses.agpl3Only;
+      maintainers = with maintainers; [
+        zhaofengli
+        ovlach
+        pinpox
+      ];
+      mainProgram = "orca-slicer";
+      platforms = platforms.linux;
+    };
+  }
+)
--- a/pkgs/applications/misc/wmenu/default.nix
+++ b/pkgs/applications/misc/wmenu/default.nix
@@ -9,6 +9,7 @@
 , pango
 , wayland
 , wayland-protocols
+, wayland-scanner
 , libxkbcommon
 , scdoc
 }:
@@ -34,7 +35,7 @@ stdenv.mkDerivation rec {
    })
  ];

-  nativeBuildInputs = [ pkg-config meson ninja ];
+  nativeBuildInputs = [ pkg-config meson ninja wayland-scanner ];
  buildInputs = [ cairo pango wayland libxkbcommon wayland-protocols scdoc ];

  meta = with lib; {
--- a/pkgs/applications/networking/cluster/kubecolor/default.nix
+++ b/pkgs/applications/networking/cluster/kubecolor/default.nix
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubecolor";
-  version = "0.2.2";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-zXglsfPsJi9DVxlRPniSBsdF1xEMYqqGr46ThpQj3gQ=";
+    sha256 = "sha256-1gEEmF9RRMwFAvmhLwidkVh+lnibs6x5ZHy/nJRum9E=";
  };

-  vendorHash = "sha256-uf7nBnS1wmbz4xcVA5qF82QMPsLdSucje1NNaPyheCw=";
+  vendorHash = "sha256-Gzz+mCEMQCcLwTiGMB8/nXk7HDAEGkEapC/VOyXrn/Q=";

  ldflags = [ "-s" "-w" "-X main.Version=${version}" ];

--- a/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatterino2/default.nix
@@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "chatterino2";
-  version = "2.4.6";
+  version = "2.5.0";
  src = fetchFromGitHub {
    owner = "Chatterino";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-CQviw5Fw6v5EwjCldAQoJfAIZMWKBfBzUIQZEgW34k0=";
+    sha256 = "sha256-uR2X0NNSLyOx5n3mZcp6+wW/7L7rHHH2MlOF+c0Uzm0=";
    fetchSubmodules = true;
  };
  nativeBuildInputs = [ cmake pkg-config qt6.wrapQtAppsHook ];
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix
@@ -120,6 +120,8 @@ in stdenv.mkDerivation rec {
    libappindicator-gtk3
    libnotify
    libdbusmenu
+    pipewire
+    stdenv.cc.cc
    xdg-utils
    wayland
  ];
@@ -158,7 +160,6 @@ in stdenv.mkDerivation rec {

  preFixup = ''
    gappsWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc pipewire ] }"
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
    )
--- a/pkgs/applications/office/paperwork/paperwork-backend.nix
+++ b/pkgs/applications/office/paperwork/paperwork-backend.nix
@@ -1,6 +1,7 @@
 { buildPythonPackage
 , lib
 , fetchFromGitLab
+, fetchpatch
 , pyenchant
 , scikit-learn
 , pypillowfight
@@ -33,6 +34,13 @@ buildPythonPackage rec {
  sourceRoot = "${src.name}/paperwork-backend";

  patches = [
+    # fixes building with recent scipy
+    # remove on next release
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/World/OpenPaperwork/paperwork/-/commit/abcebfe9714644d4e259e53b10e0e9417b5b864f.patch";
+      hash = "sha256-YjVpphThW5Livs+PZJZDSgJvhLSXhZ1bnlWMwfY4HTg=";
+    })
+
    # disables a flaky test https://gitlab.gnome.org/World/OpenPaperwork/paperwork/-/issues/1035#note_1493700
    ./flaky_test.patch
  ];
--- a/pkgs/by-name/al/alephone-durandal/package.nix
+++ b/pkgs/by-name/al/alephone-durandal/package.nix
@@ -3,13 +3,13 @@
 alephone.makeWrapper rec {
  pname = "durandal";
  desktopName = "Marathon-Durandal";
-  version = "20230119";
+  version = "20240119";
  icon = alephone.icons + "/marathon2.png";

  zip = fetchurl {
    url =
      "https://github.com/Aleph-One-Marathon/alephone/releases/download/release-${version}/Marathon2-${version}-Data.zip";
-    sha256 = "sha256-Vbfk5wLgvNEZW2BohMY5mPXaRbNlHxJdWLYTsE8CSwI=";
+    sha256 = "sha256-Tp9EWMIY0moK6RLIpxB7rMzLOQ7zPfV58oeAyQsTbnM=";
  };

  meta = {
--- a/pkgs/by-name/al/alephone-infinity/package.nix
+++ b/pkgs/by-name/al/alephone-infinity/package.nix
@@ -3,13 +3,13 @@
 alephone.makeWrapper rec {
  pname = "marathon-infinity";
  desktopName = "Marathon-Infinity";
-  version = "20230119";
+  version = "20240119";
  icon = alephone.icons + "/marathon-infinity.png";

  zip = fetchurl {
    url =
      "https://github.com/Aleph-One-Marathon/alephone/releases/download/release-${version}/MarathonInfinity-${version}-Data.zip";
-    sha256 = "sha256-0+xokhzWdXM+L4DBjWnfNVXZve4n1X/Aq6rxNGAFb3Q=";
+    sha256 = "sha256-KfFu+cboaZMfjnu3W84/Qbcrc9kbkIZ2Y0GM1fXeXh8=";
  };

  meta = {
--- a/pkgs/by-name/al/alephone-marathon/package.nix
+++ b/pkgs/by-name/al/alephone-marathon/package.nix
@@ -3,13 +3,13 @@
 alephone.makeWrapper rec {
  pname = "marathon";
  desktopName = "Marathon";
-  version = "20230119";
+  version = "20240119";
  icon = alephone.icons + "/marathon.png";

  zip = fetchurl {
    url =
      "https://github.com/Aleph-One-Marathon/alephone/releases/download/release-${version}/Marathon-${version}-Data.zip";
-    sha256 = "sha256-uz/1ZW9epd1HP/pzTNN3d2EEbOzjj0qpdMkrVoxb8Aw=";
+    sha256 = "sha256-60+dvXyzHe5PDepyKHcEIdWoRiGMvx5zYehubWKqaB0=";
  };

  meta = {
--- a/pkgs/by-name/at/atac/package.nix
+++ b/pkgs/by-name/at/atac/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "atac";
-  version = "0.12.0";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "Julien-cpsn";
    repo = "ATAC";
    rev = "v${version}";
-    hash = "sha256-yR+w6zrX7XHrK6XGWM7J74XPxGEmy8Gf6guOH/Du6rc=";
+    hash = "sha256-ChX2LMRbqoKzl+QKkeervrCHr3plAQ21RzC4RqEucCA=";
  };

-  cargoHash = "sha256-Ez8d1tb0Xi91e3+U1/LDmj5u/oORQzelEQPFAC96yEI=";
+  cargoHash = "sha256-nYkXL3SIjG3REE+w2vIlB04FWs7e0d4iu0hRjAPz7aU=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/bi/bite/Cargo.lock
+++ b/pkgs/by-name/bi/bite/Cargo.lock
--- a/pkgs/by-name/bi/bite/package.nix
+++ b/pkgs/by-name/bi/bite/package.nix
@@ -0,0 +1,110 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  makeBinaryWrapper,
+  copyDesktopItems,
+  makeDesktopItem,
+  imagemagick,
+  atk,
+  cairo,
+  gdk-pixbuf,
+  glib,
+  gtk3,
+  libxkbcommon,
+  pango,
+  vulkan-loader,
+  stdenv,
+  darwin,
+  wayland,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "bite";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "WINSDK";
+    repo = "bite";
+    rev = "V${version}";
+    hash = "sha256-A5NII5pLnM4BBy2L+ylXU0anqw4DpKgXmc29fcTq2z8=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "libc-0.2.140" = "sha256-5cP25BDfkrybiZjmwmzeqd0nzdItFdNSZ4te7FdLpnk=";
+      "nix-0.26.1" = "sha256-AsOX8sLGHJNJhq0P9WDxWsNiRXgZJl15paTcGdPMQXA=";
+      "pdb-0.8.0" = "sha256-CEglHzBpS3rN7+05tS09FbBcOM0jjyvR+DWrEbvRYwE=";
+      "tree-sitter-c-0.21.0" = "sha256-7L3Ua6LBeX2492RTikKYeCNIG5e5XSrCu4UyXX1eQiI=";
+      "tree-sitter-cpp-0.21.0" = "sha256-WZy3S8+bRkpzUFpnLVp18rY5DxN70fdEPYIYx0UqJhs=";
+      "tree-sitter-rust-0.21.0" = "sha256-kZT4Hil7u4GFWImuQCt9nQJ+HL3B5yHD5wjalpDLlSE=";
+    };
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    makeBinaryWrapper
+    copyDesktopItems
+    imagemagick
+  ];
+
+  buildInputs =
+    [
+      atk
+      cairo
+      gdk-pixbuf
+      glib
+      gtk3
+      libxkbcommon
+      pango
+      vulkan-loader
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.AppKit
+      darwin.apple_sdk.frameworks.CoreGraphics
+      darwin.apple_sdk.frameworks.Foundation
+      darwin.apple_sdk.frameworks.Metal
+      darwin.apple_sdk.frameworks.QuartzCore
+    ]
+    ++ lib.optionals stdenv.isLinux [
+      wayland
+    ];
+
+  runtimeDependencies =
+    [
+      libxkbcommon
+      vulkan-loader
+    ]
+    ++ lib.optionals stdenv.isLinux [
+      wayland
+    ];
+
+  postInstall = ''
+    wrapProgram $out/bin/bite \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeDependencies}"
+
+    mkdir -p $out/share/icons/hicolor/64x64/apps
+    convert $src/assets/iconx64.png -background black -alpha remove -alpha off $out/share/icons/hicolor/64x64/apps/bite.png
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "BiTE";
+      exec = meta.mainProgram;
+      icon = "bite";
+      desktopName = "BiTE";
+      comment = meta.description;
+      categories = ["Development" "Utility"];
+    })
+  ];
+
+  meta = with lib; {
+    description = "Disassembler focused on comprehensive rust support";
+    homepage = "https://github.com/WINSDK/bite";
+    license = licenses.mit;
+    maintainers = with maintainers; [vinnymeller];
+    mainProgram = "bite";
+    broken = stdenv.isDarwin && stdenv.isx86_64;
+  };
+}
--- a/pkgs/by-name/bt/btrfs-assistant/package.nix
+++ b/pkgs/by-name/bt/btrfs-assistant/package.nix
--- a/pkgs/data/themes/catppuccin-sddm-corners/default.nix
+++ b/pkgs/data/themes/catppuccin-sddm-corners/default.nix
--- a/pkgs/data/themes/catppuccin/default.nix
+++ b/pkgs/data/themes/catppuccin/default.nix
--- a/pkgs/by-name/di/digikam/package.nix
+++ b/pkgs/by-name/di/digikam/package.nix
@@ -26,6 +26,7 @@
 , x265
 , jasper

+, bash
 # For panorama and focus stacking
 , enblend-enfuse
 , hugin
@@ -110,6 +111,13 @@ stdenv.mkDerivation rec {
    cuda_cudart
  ]);

+  postPatch = ''
+    substituteInPlace \
+      core/dplugins/bqm/custom/userscript/userscript.cpp \
+      core/utilities/import/backend/cameracontroller.cpp \
+      --replace-fail \"/bin/bash\" \"${lib.getExe bash}\"
+  '';
+
  cmakeFlags = [
    "-DENABLE_MYSQLSUPPORT=1"
    "-DENABLE_INTERNALMYSQL=1"
--- a/pkgs/by-name/do/dooit/package.nix
+++ b/pkgs/by-name/do/dooit/package.nix
--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@@ -21,6 +21,7 @@
 , nix-update-script
 , ocl-icd
 , opencl-headers
+, overrideSDK
 , pcre
 , pcre2
 , pkg-config
@@ -40,8 +41,10 @@
 , waylandSupport ? true
 , x11Support ? true
 }:
-
-stdenv.mkDerivation (finalAttrs: {
+let
+  stdenv' = if stdenv.isDarwin then overrideSDK stdenv "11.0" else stdenv;
+in
+stdenv'.mkDerivation (finalAttrs: {
  pname = "fastfetch";
  version = "2.9.2";

--- a/pkgs/by-name/fi/firefly-iii/package.nix
+++ b/pkgs/by-name/fi/firefly-iii/package.nix
@@ -8,24 +8,25 @@

 let
  pname = "firefly-iii";
-  version = "6.1.13";
+  version = "6.1.15";
  phpPackage = php83;

  src = fetchFromGitHub {
    owner = "firefly-iii";
    repo = "firefly-iii";
    rev = "v${version}";
-    hash = "sha256-85zI8uCyyoCflzxDkvba6FWa9B3kh179DJfQ2Um6MGM=";
+    hash = "sha256-9Od8tR8X2OZ2hu81tHWDpBX8snWCRvTnlY1AwjIcMug=";
  };

  assets = buildNpmPackage {
    pname = "${pname}-assets";
    inherit version src;
-    npmDepsHash = "sha256-wuPUE6XuzzgKjpxZVgwh2wGut15M61WSBFG+YIZwOFM=";
+    npmDepsHash = "sha256-UVySgcj1tQLQIxlsZuig4ixkfxfsYWYPKWLz5zHA+Dg=";
    dontNpmBuild = true;
    installPhase = ''
      runHook preInstall
-      npm run build
+      npm run prod --workspace=v1
+      npm run build --workspace=v2
      cp -r ./public $out/
      runHook postInstall
    '';
@@ -35,7 +36,7 @@ in
 phpPackage.buildComposerProject (finalAttrs: {
  inherit pname src version;

-  vendorHash = "sha256-CVGKyyLp5hjjpEulDNEYfljU4OgPBaFcYQQAUf6GeGs=";
+  vendorHash = "sha256-RDkAbTKj7M7lE8bVRxb+RR5CA6hJIMp61U0+aRtFE50=";

  passthru = {
    inherit phpPackage;
--- a/pkgs/by-name/fw/fwupd/package.nix
+++ b/pkgs/by-name/fw/fwupd/package.nix
@@ -120,7 +120,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "fwupd";
-  version = "1.9.16";
+  version = "1.9.18";

  # libfwupd goes to lib
  # daemon, plug-ins and libfwupdplugin go to out
@@ -131,7 +131,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "fwupd";
    repo = "fwupd";
    rev = finalAttrs.version;
-    hash = "sha256-mM8HSSQD5znjpl9q/f+u0RzZEkFA1tnh+BPB2qdcWvI=";
+    hash = "sha256-w2jqIPNV6OkPaHfy7bEFgr5IgzJYtMTrO5UWmnZ+2JI=";
  };

  patches = [
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@@ -16,14 +16,14 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "home-manager";
-  version = "unstable-2024-04-16";
+  version = "unstable-2024-04-23";

  src = fetchFromGitHub {
    name = "home-manager-source";
    owner = "nix-community";
    repo = "home-manager";
-    rev = "fa8c16e2452bf092ac76f09ee1fb1e9f7d0796e7";
-    hash = "sha256-LmaabaQZdx52MPGKPRt9Opoc9Gd9RbwvCdysUUYQoXI=";
+    rev = "33a20182e3164f451b6a4ac2ecadcab5c2c36703";
+    hash = "sha256-pHJYZIVFmzPAwyTfcMGJwlfz18nOsS4p0CuDnI1EDL4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/hy/hyprland-activewindow/package.nix
+++ b/pkgs/by-name/hy/hyprland-activewindow/package.nix
@@ -0,0 +1,24 @@
+{ lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "hyprland-activewindow";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "FieldOfClay";
+    repo = "hyprland-activewindow";
+    rev = "v${version}";
+    hash = "sha256-8pzm8uIyvlz4nHbxtmbMblFIj38M2VsenaKzJ9di1Do=";
+  };
+
+  cargoHash = "sha256-wIF0qa1dyZlcsLPL2TflFQFPm4Pe9TWHe1F2L1YccZ8=";
+
+  meta = with lib; {
+    description = "A multi-monitor-aware Hyprland workspace widget helper";
+    homepage = "https://github.com/FieldofClay/hyprland-activewindow";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ kiike donovanglover ];
+    mainProgram = "hyprland-activewindow";
+  };
+}
--- a/pkgs/by-name/hy/hyprland-workspaces/package.nix
+++ b/pkgs/by-name/hy/hyprland-workspaces/package.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "hyprland-workspaces";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "FieldofClay";
+    repo = "hyprland-workspaces";
+    rev = "v${version}";
+    hash = "sha256-4QGLTimIpx74gWUyHCheUZZT1WgVzBoJRY8OlUDdOh4=";
+  };
+
+  cargoHash = "sha256-9ndP0nyRBCdOGth4UWA263IvjbgnVW2x9PK8oTaMrxg=";
+
+  meta = with lib; {
+    description = "A multi-monitor aware Hyprland workspace widget";
+    homepage = "https://github.com/FieldofClay/hyprland-workspaces";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ kiike donovanglover ];
+    mainProgram = "hyprland-workspaces";
+  };
+}
--- a/pkgs/by-name/li/live555/package.nix
+++ b/pkgs/by-name/li/live555/package.nix
@@ -1,15 +1,16 @@
-{ lib
-, darwin
-, fetchurl
-, fetchpatch
-, openssl
-, stdenv
-, vlc
+{
+  lib,
+  darwin,
+  fetchpatch,
+  fetchurl,
+  openssl,
+  stdenv,
+  vlc,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "live555";
-  version = "2024.03.08";
+  version = "2024.04.14";

  src = fetchurl {
    urls = [
@@ -18,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
      "https://download.videolan.org/contrib/live555/live.${finalAttrs.version}.tar.gz"
      "mirror://sourceforge/slackbuildsdirectlinks/live.${finalAttrs.version}.tar.gz"
    ];
-    hash = "sha256-wWUC4EbxxfK+OxXiyNbNMGObVMZOqb+8jTG078pnDeU=";
+    hash = "sha256-mR5rKGKtTwMq3p+xAAGdo0DNNnIe4KHladLPlnhVhNY=";
  };

  patches = [
@@ -60,11 +61,13 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  configurePhase = let
-    platform = if stdenv.isLinux
-               then "linux"
-               else if stdenv.isDarwin
-               then "macosx-catalina"
-               else throw "Unsupported platform: ${stdenv.hostPlatform.system}";
+    platform =
+      if stdenv.isLinux then
+        "linux"
+      else if stdenv.isDarwin then
+        "macosx-catalina"
+      else
+        throw "Unsupported platform: ${stdenv.hostPlatform.system}";
  in ''
    runHook preConfigure

--- a/pkgs/by-name/ma/maa-cli/package.nix
+++ b/pkgs/by-name/ma/maa-cli/package.nix
@@ -13,13 +13,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "maa-cli";
-  version = "0.4.5";
+  version = "0.4.6";

  src = fetchFromGitHub {
    owner = "MaaAssistantArknights";
    repo = "maa-cli";
    rev = "v${version}";
-    hash = "sha256-LeEIbfDQ+GO3gNmdpWGTNkpbhSqLz4fYQ+MdcrcbDk0=";
+    hash = "sha256-fvMSYcYWYEVvDuAEjSmQJltl90EoLKkjYD2P3OsHS3c=";
  };

  nativeBuildInputs = [
@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage rec {
  buildNoDefaultFeatures = true;
  buildFeatures = [ "git2" "core_installer" ];

-  cargoHash = "sha256-tkUJH7oFY5eZ5A7J+qzeyHlqOUnTipf6o+leZz7KOiQ=";
+  cargoHash = "sha256-LQWjgMRxtSs2MX1R6YsxDAWUvoUJfOWmp/zj/hlTxyw=";

  # maa-cli would only seach libMaaCore.so and resources in itself's path
  # https://github.com/MaaAssistantArknights/maa-cli/issues/67
--- a/pkgs/by-name/mo/movim/package.nix
+++ b/pkgs/by-name/mo/movim/package.nix
@@ -39,13 +39,13 @@ let
 in
 php.buildComposerProject (finalAttrs: {
  pname = "movim";
-  version = "0.23.0.20240328";
+  version = "0.24";

  src = fetchFromGitHub {
    owner = "movim";
    repo = "movim";
-    rev = "c3a43cd7e3a1a3a6efd595470e6a85b2ec578cba";
-    hash = "sha256-x0C4w3SRP3NMOhGSZOQALk6PNWUre4MvFW5cESr8Wvk=";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-t63POjywZLk5ulppuCedFhhEhOsnB90vy3k/HhM3MGc=";
  };

  php = php.buildEnv ({
@@ -69,7 +69,7 @@ php.buildComposerProject (finalAttrs: {
  # pinned commonmark
  composerStrictValidation = false;

-  vendorHash = "sha256-RFIi1I+gcagRgkDpgQeR1oGJeBGA7z9q3DCfW+ZDr2Y=";
+  vendorHash = "sha256-SinS5ocf4kLMBR2HF3tcdmEomw9ICUqTg2IXPJFoujU=";

  postPatch = ''
    # Our modules are already wrapped, removes missing *.so warnings;
--- a/pkgs/by-name/na/nawk/package.nix
+++ b/pkgs/by-name/na/nawk/package.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "nawk";
-  version = "20240311";
+  version = "20240422";

  src = fetchFromGitHub {
    owner = "onetrueawk";
    repo = "awk";
    rev = finalAttrs.version;
-    hash = "sha256-4iAQR8djhhp5Yn4H1IdzotQLY0d/Gz/vNQPfAUNQV0A=";
+    hash = "sha256-wsRkSXCLtK2jk4gW/Lpg/14NiOUANfmCrYqeKZW6CLY=";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];
--- a/pkgs/by-name/pg/pgmoneta/package.nix
+++ b/pkgs/by-name/pg/pgmoneta/package.nix
@@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "pgmoneta";
-  version = "0.10.1";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "pgmoneta";
    repo = "pgmoneta";
    rev = version;
-    hash = "sha256-gViXbL54YGY2NFg0ScyiarMB4vYjpOrdkyTjWzwP2vo=";
+    hash = "sha256-sFH8sYTQ10bR+TDNbyIJiAIcp24CA9E5zrRjyV9mGBU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/po/polybar/package.nix
+++ b/pkgs/by-name/po/polybar/package.nix
@@ -111,6 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
    '';
    license = licenses.mit;
    maintainers = with maintainers; [ afldcr Br1ght0ne moni ckie ];
+    mainProgram = "polybar";
    platforms = platforms.linux;
  };
 })
--- a/pkgs/by-name/qr/qrtool/package.nix
+++ b/pkgs/by-name/qr/qrtool/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "qrtool";
-  version = "0.10.8";
+  version = "0.10.9";

  src = fetchFromGitHub {
    owner = "sorairolake";
    repo = "qrtool";
    rev = "v${version}";
-    sha256 = "sha256-YNA8LdqkgScBAoLyWsr4JIeFcU4KfNAYByXSvaccOoU=";
+    sha256 = "sha256-wLi2lb48+leH7AfpIj0/vDxPZhBjvuacVit8U8zArjs=";
  };

-  cargoHash = "sha256-6yQVH15oW8dCjNKwL2Gb6IQKilVYokBs2j+M4fWLm+4=";
+  cargoHash = "sha256-igbRsNWPtE/KcSLqzKIFEm3lmdkIxj/22yo/8Gye96k=";

  nativeBuildInputs = [ asciidoctor installShellFiles ];

--- a/pkgs/by-name/si/simplotask/package.nix
+++ b/pkgs/by-name/si/simplotask/package.nix
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "simplotask";
-  version = "1.15.0";
+  version = "1.15.1";

  src = fetchFromGitHub {
    owner = "umputun";
    repo = "spot";
    rev = "v${version}";
-    hash = "sha256-pd6bue/uo6+ZBaN7ZKf/byuPOKOLZdCQau7I7F+iZb0=";
+    hash = "sha256-XLkq8Oe3EsP0wf0sA7NSZWIsQQnOAGmvlVQad35+5Ws=";
  };

  vendorHash = null;
--- a/pkgs/by-name/sk/sketchybar-app-font/package.nix
+++ b/pkgs/by-name/sk/sketchybar-app-font/package.nix
--- a/pkgs/by-name/su/supersonic/package.nix
+++ b/pkgs/by-name/su/supersonic/package.nix
@@ -20,16 +20,16 @@ assert waylandSupport -> stdenv.isLinux;

 buildGoModule rec {
  pname = "supersonic" + lib.optionalString waylandSupport "-wayland";
-  version = "0.10.0";
+  version = "0.10.1";

  src = fetchFromGitHub {
    owner = "dweymouth";
    repo = "supersonic";
    rev = "v${version}";
-    hash = "sha256-sleXZnJ/JPlyCMf6Js+Yym1RhtfZT7Q+qYAWLCavZFA=";
+    hash = "sha256-0MbR6ah3UakLn/6Mfd156BlTZe7thNK6mAPLTuz298g=";
  };

-  vendorHash = "sha256-JKihU597ZBq1VygpWB73V2m9NN/GDrquX9hNzBdszSQ=";
+  vendorHash = "sha256-Ld1j/SFq5W+SKppAzk7UV74RD6/Dw+PWk0BhEGML5+k=";

  nativeBuildInputs = [
    copyDesktopItems
--- a/pkgs/applications/misc/waybar/default.nix
+++ b/pkgs/applications/misc/waybar/default.nix
--- a/pkgs/by-name/we/wechat-uos/package.nix
+++ b/pkgs/by-name/we/wechat-uos/package.nix
@@ -60,11 +60,7 @@
      └── uos
          └── .license.key
  */
-  uosLicense ? requireFile {
-    name = "license.tar.gz";
-    url = "https://www.uniontech.com";
-    sha256 = "53760079c1a5b58f2fa3d5effe1ed35239590b288841d812229ef4e55b2dbd69";
-  }
+  uosLicense ? null
 }:
 let
  wechat-uos-env = stdenvNoCC.mkDerivation {
@@ -87,6 +83,30 @@ let
    preferLocalBuild = true;
  };

+  uosLicenseUnzipped = stdenvNoCC.mkDerivation {
+    name = "uos-license-unzipped";
+    src =
+      if uosLicense == null then
+        requireFile
+          {
+            name = "license.tar.gz";
+            url = "https://www.uniontech.com";
+            sha256 = "53760079c1a5b58f2fa3d5effe1ed35239590b288841d812229ef4e55b2dbd69";
+          } else uosLicense;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp -r * $out/
+
+      runHook postInstall
+    '';
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+    outputHash = "sha256-pNftwtUZqBsKBSPQsEWlYLlb6h2Xd9j56ZRMi8I82ME=";
+  };
+
  wechat-uos-runtime = with xorg; [
    stdenv.cc.cc
    stdenv.cc.libc
@@ -195,11 +215,10 @@ let
        dpkg -x $src ./wechat-uos
        dpkg -x $uosSrc ./wechat-uos-old-source

-        tar -xvf $uosLicense
-
        runHook postUnpack
      '';

+      # Use ln for license to prevent being garbage collection
      installPhase = ''
        runHook preInstall
        mkdir -p $out
@@ -207,7 +226,7 @@ let
        cp -r wechat-uos/* $out

        mkdir -pv $out/usr/lib/wechat-uos/license
-        cp -r license/* $out/usr/lib/wechat-uos/license
+        ln -s ${uosLicenseUnzipped}/* $out/usr/lib/wechat-uos/license/
        cp -r wechat-uos-old-source/usr/lib/license/libuosdevicea.so $out/usr/lib/wechat-uos/license/

        runHook postInstall
--- a/pkgs/by-name/wo/workout-tracker/package.nix
+++ b/pkgs/by-name/wo/workout-tracker/package.nix
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "workout-tracker";
-  version = "0.13.4";
+  version = "0.14.1";

  src = fetchFromGitHub {
    owner = "jovandeginste";
    repo = "workout-tracker";
    rev = "refs/tags/v${version}";
-    hash = "sha256-wBDLf4UfE3YXH2naub9Z//z5HWaTBuz6MyCQovZcsFI=";
+    hash = "sha256-zmDY5KpKkq/9SYAm+v0QSnLLjxYQCzzXWLlCFkE8bA0=";
  };

  vendorHash = null;
--- a/pkgs/applications/misc/wttrbar/default.nix
+++ b/pkgs/applications/misc/wttrbar/default.nix
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@@ -5,6 +5,7 @@
 , installShellFiles
 , stdenv
 , Foundation
+, rust-jemalloc-sys

 , nix-update-script
 }:
@@ -25,7 +26,7 @@ rustPlatform.buildRustPackage rec {
  env.YAZI_GEN_COMPLETIONS = true;

  nativeBuildInputs = [ installShellFiles ];
-  buildInputs = lib.optionals stdenv.isDarwin [ Foundation ];
+  buildInputs = [ rust-jemalloc-sys ] ++ lib.optionals stdenv.isDarwin [ Foundation ];

  postInstall = ''
    installShellCompletion --cmd yazi \
--- a/pkgs/by-name/yo/youtrack/package.nix
+++ b/pkgs/by-name/yo/youtrack/package.nix
@@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "youtrack";
-  version = "2024.1.27971";
+  version = "2024.1.28928";

  src = fetchzip {
    url = "https://download.jetbrains.com/charisma/youtrack-${finalAttrs.version}.zip";
-    hash = "sha256-DropdHT3ZA4kuxyE8xyHB079OMzYH4zKPt38oW7XoFY=";
+    hash = "sha256-8+dZ1YTpvOX0IEEbFzv4t8T/U/BZMeDCZL7Ju25WBpE=";
  };

  nativeBuildInputs = [ makeBinaryWrapper ];
--- a/pkgs/desktops/gnome/extensions/pop-shell/fix-gjs.patch
+++ b/pkgs/desktops/gnome/extensions/pop-shell/fix-gjs.patch
@@ -24,3 +24,15 @@ index fbcafbf..ef409ee 100644
         if (!resp) {
             return null;
         }
+diff --git a/src/color_dialog/src/main.ts b/src/color_dialog/src/main.ts
+index a9637e5..5cb86ce 100644
+--- a/src/color_dialog/src/main.ts
+++ b/src/color_dialog/src/main.ts
+@@ -6,6 +6,7 @@ import Gtk from 'gi://Gtk?version=3.0';
+ import Gdk from 'gi://Gdk';
+ 
+ const EXT_PATH_DEFAULTS = [
+    '/run/current-system/sw/share/gnome-shell/extensions/',
+     GLib.get_home_dir() + '/.local/share/gnome-shell/extensions/',
+     '/usr/share/gnome-shell/extensions/',
+ ];
--- a/pkgs/desktops/gnome/misc/gpaste/default.nix
+++ b/pkgs/desktops/gnome/misc/gpaste/default.nix
@@ -1,6 +1,6 @@
 { stdenv
 , lib
-, fetchFromGitHub
+, fetchurl
 , gjs
 , glib
 , gobject-introspection
@@ -17,15 +17,13 @@
 , wrapGAppsHook
 }:

-stdenv.mkDerivation rec {
-  version = "45";
+stdenv.mkDerivation (finalAttrs: {
+  version = "45.1";
  pname = "gpaste";

-  src = fetchFromGitHub {
-    owner = "Keruspe";
-    repo = "GPaste";
-    rev = "v${version}";
-    sha256 = "sha256-MpoeLXGdLfas/E3x5ojJW5Dd3H8XZORtFaBHgRGJXxg=";
+  src = fetchurl {
+    url = "https://www.imagination-land.org/files/gpaste/GPaste-${finalAttrs.version}.tar.xz";
+    hash = "sha256-yYLoHn3/2xlefBeErnydNfkvtJva8/9f9JHhfschBpQ=";
  };

  patches = [
@@ -36,7 +34,7 @@ stdenv.mkDerivation rec {
  # https://github.com/NixOS/nix/issues/1846
  postPatch = ''
    substituteInPlace src/libgpaste/gpaste/gpaste-settings.c \
-      --subst-var-by gschemasCompiled ${glib.makeSchemaPath (placeholder "out") "${pname}-${version}"}
+      --subst-var-by gschemasCompiled ${glib.makeSchemaPath (placeholder "out") "${finalAttrs.pname}-${finalAttrs.version}"}
  '';

  nativeBuildInputs = [
@@ -81,10 +79,10 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    homepage = "https://github.com/Keruspe/GPaste";
-    description = "Clipboard management system with GNOME 3 integration";
+    description = "Clipboard management system with GNOME integration";
    mainProgram = "gpaste-client";
-    license = licenses.gpl3;
+    license = licenses.bsd2;
    platforms = platforms.linux;
    maintainers = teams.gnome.members;
  };
-}
+})
--- a/pkgs/development/beam-modules/ex_doc/default.nix
+++ b/pkgs/development/beam-modules/ex_doc/default.nix
@@ -19,7 +19,7 @@ mixRelease {
  mixFodDeps = fetchMixDeps {
    pname = "mix-deps-${pname}";
    inherit src version elixir;
-    hash = "sha256-ZNHhWCZ3n2Y/XCsXVjbu4wbx/J95JdFP/2raACciAUU=";
+    hash = "sha256-e0lU4TXLY2geO6MI1h0kpdwsGbEyXjIRe0W43337mHk=";
  };

  configurePhase = ''
--- a/pkgs/development/compilers/dotnet/build-dotnet.nix
+++ b/pkgs/development/compilers/dotnet/build-dotnet.nix
@@ -25,6 +25,7 @@ assert if type == "sdk" then packages != null else true;
 , writeShellScript
 , mkNugetDeps
 , callPackage
+, dotnetCorePackages
 }:

 let
@@ -44,6 +45,8 @@ let

  mkCommon = callPackage ./common.nix {};

+  targetRid = dotnetCorePackages.systemToDotnetRid stdenv.targetPlatform.system;
+
 in
 mkCommon type rec {
  inherit pname version;
@@ -88,21 +91,21 @@ mkCommon type rec {

  # Tell autoPatchelf about runtime dependencies.
  # (postFixup phase is run before autoPatchelfHook.)
-  postFixup = lib.optionalString stdenv.isLinux ''
+  postFixup = lib.optionalString stdenv.targetPlatform.isLinux ''
    patchelf \
      --add-needed libicui18n.so \
      --add-needed libicuuc.so \
      $out/shared/Microsoft.NETCore.App/*/libcoreclr.so \
      $out/shared/Microsoft.NETCore.App/*/*System.Globalization.Native.so \
-      $out/packs/Microsoft.NETCore.App.Host.linux-x64/*/runtimes/linux-x64/native/singlefilehost
+      $out/packs/Microsoft.NETCore.App.Host.${targetRid}/*/runtimes/${targetRid}/native/*host
    patchelf \
      --add-needed libgssapi_krb5.so \
      $out/shared/Microsoft.NETCore.App/*/*System.Net.Security.Native.so \
-      $out/packs/Microsoft.NETCore.App.Host.linux-x64/*/runtimes/linux-x64/native/singlefilehost
+      $out/packs/Microsoft.NETCore.App.Host.${targetRid}/*/runtimes/${targetRid}/native/*host
    patchelf \
      --add-needed libssl.so \
      $out/shared/Microsoft.NETCore.App/*/*System.Security.Cryptography.Native.OpenSsl.so \
-      $out/packs/Microsoft.NETCore.App.Host.linux-x64/*/runtimes/linux-x64/native/singlefilehost
+      $out/packs/Microsoft.NETCore.App.Host.${targetRid}/*/runtimes/${targetRid}/native/*host
  '';

  passthru = {
--- a/pkgs/development/compilers/dotnet/common.nix
+++ b/pkgs/development/compilers/dotnet/common.nix
@@ -63,7 +63,7 @@
          '' + build);
        in
          if run == null
-            then build
+            then built
          else
            runCommand "${built.name}-run" { src = built; nativeBuildInputs = runInputs; } (
              lib.optionalString (runtime != null) ''
@@ -71,8 +71,10 @@
                export DOTNET_ROOT=${runtime}
              '' + run);

+      # Setting LANG to something other than 'C' forces the runtime to search
+      # for ICU, which will be required in most user environments.
      checkConsoleOutput = command: ''
-        output="$(${command})"
+        output="$(LANG=C.UTF-8 ${command})"
        # yes, older SDKs omit the comma
        [[ "$output" =~ Hello,?\ World! ]] && touch "$out"
      '';
@@ -98,6 +100,15 @@
        run = checkConsoleOutput "$src/test";
      };

+      self-contained = mkDotnetTest {
+        name = "self-contained";
+        template = "console";
+        usePackageSource = true;
+        build = "dotnet publish --use-current-runtime --sc -o $out";
+        runtime = null;
+        run = checkConsoleOutput "$src/test";
+      };
+
      single-file = mkDotnetTest {
        name = "single-file";
        template = "console";
--- a/pkgs/development/compilers/inklecate/default.nix
+++ b/pkgs/development/compilers/inklecate/default.nix
@@ -1,6 +1,5 @@
 { lib
 , stdenv
-, autoPatchelfHook
 , buildDotnetModule
 , dotnetCorePackages
 , fetchFromGitHub
@@ -17,7 +16,6 @@ buildDotnetModule rec {
    hash = "sha512-aUjjT5Qf64wrKRn1vkwJadMOBWMkvsXUjtZ7S3/ZWAh1CCDkQNO84mSbtbVc9ny0fKeJEqaDX2tJNwq7pYqAbA==";
  };

-  nativeBuildInputs = lib.optionals stdenv.isLinux [ autoPatchelfHook ];
  buildInputs = [ stdenv.cc.cc.lib ];

  projectFile = "inklecate/inklecate.csproj";
--- a/pkgs/development/compilers/openjdk/openjfx/11.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, writeText, gradle_7, pkg-config, perl, cmake
-, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4-headless, python3, ruby, icu68
+, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4-headless, python3, ruby, fetchurl, runCommand
 , openjdk11-bootstrap
 , withMedia ? true
 , withWebKit ? false
@@ -14,6 +14,16 @@ let
    java = openjdk11-bootstrap;
  });

+  icuVersionWithSep = s: "71${s}1";
+  icuPath = "download/release-${icuVersionWithSep "-"}/icu4c-${icuVersionWithSep "_"}-data-bin-l.zip";
+  icuData = fetchurl {
+    url = "https://github.com/unicode-org/icu/releases/${icuPath}";
+    hash = "sha256-pVWIy0BkICsthA5mxhR9SJQHleMNnaEcGl/AaLi5qZM=";
+  };
+  icuFakeRepository = runCommand "icu-data-repository" {} ''
+    install -Dm644 ${icuData} $out/${icuPath}
+  '';
+
  makePackage = args: stdenv.mkDerivation ({
    version = "${major}${update}-${build}";

@@ -24,7 +34,7 @@ let
      sha256 = "sha256-46DjIzcBHkmp5vnhYnLu78CG72bIBRM4A6mgk2OLOko=";
    };

-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu68 ];
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless ];
    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];

    dontUseCmakeConfigure = true;
@@ -32,6 +42,11 @@ let
    postPatch = ''
      substituteInPlace buildSrc/linux.gradle \
        --replace ', "-Werror=implicit-function-declaration"' ""
+
+      # Add missing includes for gcc-13 for webkit build:
+      sed -e '1i #include <cstdio>' \
+        -i modules/javafx.web/src/main/native/Source/bmalloc/bmalloc/Heap.cpp \
+           modules/javafx.web/src/main/native/Source/bmalloc/bmalloc/IsoSharedPageInlines.h
    '';

    config = writeText "gradle.properties" (''
@@ -46,7 +61,7 @@ let
      export GRADLE_USER_HOME=$(mktemp -d)
      ln -s $config gradle.properties
      export NIX_CFLAGS_COMPILE="$(pkg-config --cflags glib-2.0) $NIX_CFLAGS_COMPILE"
-      gradle --no-daemon $gradleFlags sdk
+      gradle --no-daemon --console=plain $gradleFlags sdk

      runHook postBuild
    '';
@@ -77,6 +92,7 @@ in makePackage {
  gradleProperties = ''
    COMPILE_MEDIA = ${lib.boolToString withMedia}
    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
+    ${lib.optionalString withWebKit "icuRepositoryURL = file://${icuFakeRepository}"}
  '';

  preBuild = ''
--- a/pkgs/development/compilers/openjdk/openjfx/17.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/17.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, writeText, openjdk17_headless, gradle_7
 , pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib
-, ffmpeg_4-headless, python3, ruby, icu71, fetchurl, runCommand
+, ffmpeg_4-headless, python3, ruby, fetchurl, runCommand
 , withMedia ? true
 , withWebKit ? false
 }:
@@ -14,16 +14,14 @@ let
    java = openjdk17_headless;
  });

-  dashed-icu-version = lib.concatStringsSep "-" (lib.splitVersion (lib.getVersion icu71));
-  underscored-icu-version = lib.concatStringsSep "_" (lib.splitVersion (lib.getVersion icu71));
-  icu-data = fetchurl {
-    url = "https://github.com/unicode-org/icu/releases/download/release-${dashed-icu-version}/icu4c-${underscored-icu-version}-data-bin-l.zip";
+  icuVersionWithSep = s: "71${s}1";
+  icuPath = "download/release-${icuVersionWithSep "-"}/icu4c-${icuVersionWithSep "_"}-data-bin-l.zip";
+  icuData = fetchurl {
+    url = "https://github.com/unicode-org/icu/releases/${icuPath}";
    hash = "sha256-pVWIy0BkICsthA5mxhR9SJQHleMNnaEcGl/AaLi5qZM=";
  };
-
-  fakeRepository = runCommand "icu-data-repository" {} ''
-    mkdir -p $out/download/release-${dashed-icu-version}
-    cp ${icu-data} $out/download/release-${dashed-icu-version}/icu4c-${underscored-icu-version}-data-bin-l.zip
+  icuFakeRepository = runCommand "icu-data-repository" {} ''
+    install -Dm644 ${icuData} $out/${icuPath}
  '';

  makePackage = args: stdenv.mkDerivation ({
@@ -36,7 +34,7 @@ let
      sha256 = "sha256-9VfXk2EfMebMyVKPohPRP2QXRFf8XemUtfY0JtBCHyw=";
    };

-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless icu71 ];
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4-headless ];
    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];

    dontUseCmakeConfigure = true;
@@ -60,7 +58,7 @@ let
      export GRADLE_USER_HOME=$(mktemp -d)
      ln -s $config gradle.properties
      export NIX_CFLAGS_COMPILE="$(pkg-config --cflags glib-2.0) $NIX_CFLAGS_COMPILE"
-      gradle --no-daemon $gradleFlags sdk
+      gradle --no-daemon --console=plain $gradleFlags sdk

      runHook postBuild
    '';
@@ -91,7 +89,7 @@ in makePackage {
  gradleProperties = ''
    COMPILE_MEDIA = ${lib.boolToString withMedia}
    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
-    ${lib.optionalString withWebKit "icuRepositoryURL = file://${fakeRepository}"}
+    ${lib.optionalString withWebKit "icuRepositoryURL = file://${icuFakeRepository}"}
  '';

  preBuild = ''
--- a/pkgs/development/compilers/openjdk/openjfx/19.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/19.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch, writeText, openjdk17_headless
 , openjdk19_headless, gradle_7, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst
-, libXxf86vm, glib, alsa-lib, ffmpeg_4, python3, ruby, icu68
+, libXxf86vm, glib, alsa-lib, ffmpeg_4, python3, ruby, fetchurl, runCommand
 , withMedia ? true
 , withWebKit ? false
 }:
@@ -15,6 +15,16 @@ let
    java = openjdk17_headless;
  });

+  icuVersionWithSep = s: "68${s}2";
+  icuPath = "download/release-${icuVersionWithSep "-"}/icu4c-${icuVersionWithSep "."}-data-bin-l.zip";
+  icuData = fetchurl {
+    url = "https://github.com/unicode-org/icu/releases/${icuPath}";
+    hash = "sha256-ieQCLBTNrskuf8j3IUQS3QLIAQzLom/O58muMP363Lw=";
+  };
+  icuFakeRepository = runCommand "icu-data-repository" {} ''
+    install -Dm644 ${icuData} $out/${icuPath}
+  '';
+
  makePackage = args: stdenv.mkDerivation ({
    version = "${major}${update}${build}";

@@ -38,7 +48,14 @@ let
      })
    ];

-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 icu68 ];
+    postPatch = ''
+      # Add missing includes for gcc-13 for webkit build:
+      sed -e '1i #include <cstdio>' \
+        -i modules/javafx.web/src/main/native/Source/bmalloc/bmalloc/Heap.cpp \
+           modules/javafx.web/src/main/native/Source/bmalloc/bmalloc/IsoSharedPageInlines.h
+    '';
+
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 ];
    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];

    dontUseCmakeConfigure = true;
@@ -55,7 +72,7 @@ let
      export GRADLE_USER_HOME=$(mktemp -d)
      ln -s $config gradle.properties
      export NIX_CFLAGS_COMPILE="$(pkg-config --cflags glib-2.0) $NIX_CFLAGS_COMPILE"
-      gradle --no-daemon $gradleFlags sdk
+      gradle --no-daemon --console=plain $gradleFlags sdk

      runHook postBuild
    '';
@@ -89,6 +106,7 @@ in makePackage {
  gradleProperties = ''
    COMPILE_MEDIA = ${lib.boolToString withMedia}
    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
+    ${lib.optionalString withWebKit "icuRepositoryURL = file://${icuFakeRepository}"}
  '';

  preBuild = ''
--- a/pkgs/development/compilers/openjdk/openjfx/20.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/20.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch, writeText, openjdk17_headless
 , openjdk19_headless, gradle_7, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst
-, libXxf86vm, glib, alsa-lib, ffmpeg_4, python3, ruby, icu68
+, libXxf86vm, glib, alsa-lib, ffmpeg_4, python3, ruby, fetchurl, runCommand
 , withMedia ? true
 , withWebKit ? false
 }:
@@ -15,6 +15,16 @@ let
    java = openjdk17_headless;
  });

+  icuVersionWithSep = s: "71${s}1";
+  icuPath = "download/release-${icuVersionWithSep "-"}/icu4c-${icuVersionWithSep "_"}-data-bin-l.zip";
+  icuData = fetchurl {
+    url = "https://github.com/unicode-org/icu/releases/${icuPath}";
+    hash = "sha256-pVWIy0BkICsthA5mxhR9SJQHleMNnaEcGl/AaLi5qZM=";
+  };
+  icuFakeRepository = runCommand "icu-data-repository" {} ''
+    install -Dm644 ${icuData} $out/${icuPath}
+  '';
+
  makePackage = args: stdenv.mkDerivation ({
    version = "${major}${update}${build}";

@@ -25,11 +35,18 @@ let
      hash = "sha256-QPPJyl6+XU+m5xqYOFtQKJNNrovqy7ngNE/e7kiEJVU=";
    };

-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 icu68 ];
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 ];
    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];

    dontUseCmakeConfigure = true;

+    postPatch = ''
+      # Add missing includes for gcc-13 for webkit build:
+      sed -e '1i #include <cstdio>' \
+        -i modules/javafx.web/src/main/native/Source/bmalloc/bmalloc/Heap.cpp \
+           modules/javafx.web/src/main/native/Source/bmalloc/bmalloc/IsoSharedPageInlines.h
+    '';
+
    config = writeText "gradle.properties" (''
      CONF = Release
      JDK_HOME = ${openjdk19_headless.home}
@@ -42,7 +59,7 @@ let
      export GRADLE_USER_HOME=$(mktemp -d)
      ln -s $config gradle.properties
      export NIX_CFLAGS_COMPILE="$(pkg-config --cflags glib-2.0) $NIX_CFLAGS_COMPILE"
-      gradle --no-daemon $gradleFlags sdk
+      gradle --no-daemon --console=plain $gradleFlags sdk

      runHook postBuild
    '';
@@ -76,6 +93,7 @@ in makePackage {
  gradleProperties = ''
    COMPILE_MEDIA = ${lib.boolToString withMedia}
    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
+    ${lib.optionalString withWebKit "icuRepositoryURL = file://${icuFakeRepository}"}
  '';

  preBuild = ''
--- a/pkgs/development/compilers/openjdk/openjfx/21.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/21.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch, writeText, openjdk17_headless
 , openjdk19_headless, gradle_7, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst
-, libXxf86vm, glib, alsa-lib, ffmpeg_4, python3, ruby, icu68
+, libXxf86vm, glib, alsa-lib, ffmpeg_4, python3, ruby, fetchurl, runCommand
 , withMedia ? true
 , withWebKit ? false
 }:
@@ -15,6 +15,16 @@ let
    java = openjdk17_headless;
  });

+  icuVersionWithSep = s: "73${s}1";
+  icuPath = "download/release-${icuVersionWithSep "-"}/icu4c-${icuVersionWithSep "_"}-data-bin-l.zip";
+  icuData = fetchurl {
+    url = "https://github.com/unicode-org/icu/releases/${icuPath}";
+    hash = "sha256-QDgpjuAqDDiRcYXvj/Tr3pyLVSx3f9A+TfbGtLGCXiA=";
+  };
+  icuFakeRepository = runCommand "icu-data-repository" {} ''
+    install -Dm644 ${icuData} $out/${icuPath}
+  '';
+
  makePackage = args: stdenv.mkDerivation ({
    version = "${major}${update}${build}";

@@ -25,11 +35,18 @@ let
      hash = "sha256-deNAGfnA6gwcAa64l0AWdkX+vJd3ZOfIgAifSl+/m+s=";
    };

-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 icu68 ];
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 ];
    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];

    dontUseCmakeConfigure = true;

+    postPatch = ''
+      # Add missing includes for gcc-13 for webkit build:
+      sed -e '1i #include <cstdio>' \
+        -i modules/javafx.web/src/main/native/Source/bmalloc/bmalloc/Heap.cpp \
+           modules/javafx.web/src/main/native/Source/bmalloc/bmalloc/IsoSharedPageInlines.h
+    '';
+
    config = writeText "gradle.properties" (''
      CONF = Release
      JDK_HOME = ${openjdk19_headless.home}
@@ -42,7 +59,7 @@ let
      export GRADLE_USER_HOME=$(mktemp -d)
      ln -s $config gradle.properties
      export NIX_CFLAGS_COMPILE="$(pkg-config --cflags glib-2.0) $NIX_CFLAGS_COMPILE"
-      gradle --no-daemon $gradleFlags sdk
+      gradle --no-daemon --console=plain $gradleFlags sdk

      runHook postBuild
    '';
@@ -76,6 +93,7 @@ in makePackage {
  gradleProperties = ''
    COMPILE_MEDIA = ${lib.boolToString withMedia}
    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
+    ${lib.optionalString withWebKit "icuRepositoryURL = file://${icuFakeRepository}"}
  '';

  preBuild = ''
--- a/pkgs/development/compilers/openjdk/openjfx/22.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/22.nix
@@ -2,6 +2,8 @@
 , lib
 , fetchFromGitHub
 , fetchpatch
+, fetchurl
+, runCommand
 , writeText
 , openjdk21_headless
 , gradle
@@ -18,7 +20,6 @@
 , ffmpeg_4
 , python3
 , ruby
-, icu68
 , withMedia ? true
 , withWebKit ? false
 }:
@@ -29,6 +30,16 @@ let
  build = "+30";
  repover = "${major}${update}${build}";

+  icuVersionWithSep = s: "73${s}1";
+  icuPath = "download/release-${icuVersionWithSep "-"}/icu4c-${icuVersionWithSep "_"}-data-bin-l.zip";
+  icuData = fetchurl {
+    url = "https://github.com/unicode-org/icu/releases/${icuPath}";
+    hash = "sha256-QDgpjuAqDDiRcYXvj/Tr3pyLVSx3f9A+TfbGtLGCXiA=";
+  };
+  icuFakeRepository = runCommand "icu-data-repository" {} ''
+    install -Dm644 ${icuData} $out/${icuPath}
+  '';
+
  makePackage = args: stdenv.mkDerivation ({
    version = "${major}${update}${build}";

@@ -39,7 +50,7 @@ let
      hash = "sha256-sZF7ZPC0kgTTxWgtkxmGtOlfroGPGVZcMw0/wSTJUxQ=";
    };

-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 icu68 ];
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 ];
    nativeBuildInputs = [ gradle perl pkg-config cmake gperf python3 ruby ];

    dontUseCmakeConfigure = true;
@@ -56,7 +67,7 @@ let
      export GRADLE_USER_HOME=$(mktemp -d)
      ln -s $config gradle.properties
      export NIX_CFLAGS_COMPILE="$(pkg-config --cflags glib-2.0) $NIX_CFLAGS_COMPILE"
-      gradle --no-daemon $gradleFlags sdk
+      gradle --no-daemon --console=plain $gradleFlags sdk

      runHook postBuild
    '';
@@ -88,6 +99,7 @@ makePackage {
  gradleProperties = ''
    COMPILE_MEDIA = ${lib.boolToString withMedia}
    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
+    ${lib.optionalString withWebKit "icuRepositoryURL = file://${icuFakeRepository}"}
  '';

  preBuild = ''
--- a/pkgs/development/interpreters/erlang/27-rc2.nix
+++ b/pkgs/development/interpreters/erlang/27-rc2.nix
@@ -1,6 +0,0 @@
-{ mkDerivation }:
-
-mkDerivation {
-  version = "27.0-rc2";
-  sha256 = "sha256-o+uqQMlrh7wJQbiecMnn3/tv6nqSJh7unOj0A95mMb0=";
-}
--- a/pkgs/development/interpreters/erlang/27-rc3.nix
+++ b/pkgs/development/interpreters/erlang/27-rc3.nix
@@ -0,0 +1,6 @@
+{ mkDerivation }:
+
+mkDerivation {
+  version = "27.0-rc3";
+  sha256 = "sha256-c2DTIqBd7UxpSv84F1cCB9K+MkJb5OwnWSghtewnw/4=";
+}
--- a/pkgs/development/interpreters/wamr/default.nix
+++ b/pkgs/development/interpreters/wamr/default.nix
@@ -6,13 +6,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "wamr";
-  version = "1.3.2";
+  version = "2.0.0";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = "wasm-micro-runtime";
    rev = "WAMR-${finalAttrs.version}";
-    hash = "sha256-4iH1PC0fEPehlez8YWgqPBxWnePFcMBzbGfd2CQjvd4=";
+    hash = "sha256-7k7FRe1mBH/+r9M19pYGAHX5rt54AomeWDBW4lwCfu4=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -2,19 +2,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "wasmtime";
-  version = "19.0.2";
+  version = "20.0.0";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-t+2bkJ1SFN7Bi1Mj74CKGhnL2vWpruQKf8lYJWLOqB8=";
+    hash = "sha256-Q2CsIwYQsLnAlGyMRxNTxjZsezxhjSptBF540NtgkCc=";
    fetchSubmodules = true;
  };

  # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
  auditable = false;
-  cargoHash = "sha256-Jr02AQWz4ILYZWlGtcVYWTcBojHWZk871bWuEyG5QxE=";
+  cargoHash = "sha256-d956DuVtLbZ/u3sAA4cQlw55CuYC7XyzeQarwyQ/hpY=";
  cargoBuildFlags = [ "--package" "wasmtime-cli" "--package" "wasmtime-c-api" ];

  outputs = [ "out" "dev" ];
@@ -36,7 +36,6 @@ rustPlatform.buildRustPackage rec {
    install -d -m0755 $dev/include/wasmtime
    install -m0644 $src/crates/c-api/include/*.h $dev/include
    install -m0644 $src/crates/c-api/include/wasmtime/*.h $dev/include/wasmtime
-    install -m0644 $src/crates/c-api/wasm-c-api/include/* $dev/include
  '' + lib.optionalString stdenv.isDarwin ''
    install_name_tool -id \
      $dev/lib/libwasmtime.dylib \
--- a/pkgs/development/libraries/gusb/default.nix
+++ b/pkgs/development/libraries/gusb/default.nix
@@ -23,7 +23,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "gusb";
-  version = "0.4.8";
+  version = "0.4.9";

  outputs = [ "bin" "out" "dev" "devdoc" ];

@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
    owner = "hughsie";
    repo = "libgusb";
    rev = "refs/tags/${version}";
-    hash = "sha256-xhWx45uOh8Yokd3/32CQ6tsdkgGaYUOvaylrq/jmoP0=";
+    hash = "sha256-piIPNLc3deToyQaajXFvM+CKh9ni8mb0P3kb+2RoJOs=";
  };

  patches = [
--- a/pkgs/development/libraries/nng/default.nix
+++ b/pkgs/development/libraries/nng/default.nix
@@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "nng";
-  version = "1.7.3";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "nanomsg";
    repo = "nng";
    rev = "v${version}";
-    hash = "sha256-oP7hO3wCXNPW7877wK+HpGsw7j+U0q4i8aTRVi1v0r0=";
+    hash = "sha256-E2uosZrmxO3fqwlLuu5e36P70iGj5xUlvhEb+1aSvOA=";
  };

  nativeBuildInputs = [ cmake ninja ]
--- a/pkgs/development/libraries/ucx/default.nix
+++ b/pkgs/development/libraries/ucx/default.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "ucx";
-  version = "1.15.0";
+  version = "1.16.0";

  src = fetchFromGitHub {
    owner = "openucx";
    repo = "ucx";
    rev = "v${version}";
-    sha256 = "sha256-VxIxrk9qKM6Ncfczl4p2EhXiLNgPaYTmjhqi6/w2ZNY=";
+    sha256 = "sha256-dihWwGlQclfa2ke+1V5c6coqfFjjuMyI8QRzNdx33zQ=";
  };

  outputs = [ "out" "doc" "dev" ];
--- a/pkgs/development/ocaml-modules/ocaml-protoc-plugin/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-protoc-plugin/default.nix
@@ -49,9 +49,5 @@ buildDunePackage rec {
      and de-serialization function from a .proto file.
    '';
    maintainers = [ lib.maintainers.GirardR1006 ];
-    # Broken with Dune 3.15.1:
-    #   Error: Dependency cycle between:
-    #      %{read:config/support_proto3_optional.conf} at test/dune:16
-    broken = true;
  };
 }
--- a/pkgs/development/python-modules/awkward/default.nix
+++ b/pkgs/development/python-modules/awkward/default.nix
@@ -75,6 +75,9 @@ buildPythonPackage rec {
  # The following tests have been disabled because they need to be run on a GPU platform.
  disabledTestPaths = [
    "tests-cuda"
+  # Disable tests dependending on jax on darwin
+  ] ++ lib.optionals stdenv.isDarwin [
+    "tests/test_2603_custom_behaviors_with_jax.py"
  ];

  meta = with lib; {
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -366,7 +366,7 @@

 buildPythonPackage rec {
  pname = "boto3-stubs";
-  version = "1.34.88";
+  version = "1.34.89";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -374,7 +374,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "boto3_stubs";
    inherit version;
-    hash = "sha256-I8qeDNDT53AtZjGh6UpCCKJrOfprEsc0Qn5op/pklHc=";
+    hash = "sha256-LGZI40McFYE28MHyHkQtPt4/taUkpacOo4AffpUUoQc=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "botocore-stubs";
-  version = "1.34.88";
+  version = "1.34.89";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "botocore_stubs";
    inherit version;
-    hash = "sha256-ZW6WbqFSpPKCiJKqepZzvJF5mZj1qO/Y6P45D2HC9PE=";
+    hash = "sha256-stdBa1JLznMlql/gm7XgtryVMdQTb0QH+jm2vFhQfzQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/coffea/default.nix
+++ b/pkgs/development/python-modules/coffea/default.nix
@@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "coffea";
-  version = "2024.2.2";
+  version = "2024.4.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
    owner = "CoffeaTeam";
    repo = "coffea";
    rev = "refs/tags/v${version}";
-    hash = "sha256-GdoVb9YtlUlrSx7TWWrdHOqOJJ4M+kJspOllv6HgFXk=";
+    hash = "sha256-Iu1GHnLUqdhYO7hoHaf+O/S6KO0P+dvl0wgfRA5vtGI=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/dask-expr/default.nix
+++ b/pkgs/development/python-modules/dask-expr/default.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildPythonPackage,
+  pythonOlder,
+  fetchFromGitHub,
+  setuptools,
+  versioneer,
+  wheel,
+  dask,
+  pandas,
+  pyarrow,
+  distributed,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "dask-expr";
+  version = "1.0.12";
+  pyproject = true;
+
+  disabled = pythonOlder "3.9";
+
+  src = fetchFromGitHub {
+    owner = "dask";
+    repo = "dask-expr";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-B/BkLOZhvUyjinaFKp0ecUfzvLb5S90q+YHmJwS6WSQ=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "versioneer[toml]==0.28" "versioneer[toml]"
+  '';
+
+  nativeBuildInputs = [
+    setuptools
+    versioneer
+    wheel
+  ];
+
+  propagatedBuildInputs = [
+    dask
+    pandas
+    pyarrow
+  ];
+
+  pythonImportsCheck = [ "dask_expr" ];
+
+  nativeCheckInputs = [
+    distributed
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "";
+    homepage = "https://github.com/dask/dask-expr";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ GaetanLepage ];
+  };
+}
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -2,7 +2,6 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch

 # build-system
 , setuptools
@@ -29,6 +28,7 @@

 # tests
 , arrow-cpp
+, dask-expr
 , hypothesis
 , pytest-asyncio
 , pytest-rerunfailures
@@ -37,9 +37,9 @@
 , pythonOlder
 }:

-buildPythonPackage rec {
+let self = buildPythonPackage rec {
  pname = "dask";
-  version = "2024.2.1";
+  version = "2024.4.2";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -48,22 +48,9 @@ buildPythonPackage rec {
    owner = "dask";
    repo = "dask";
    rev = "refs/tags/${version}";
-    hash = "sha256-8VFtKPaF0PqCjqFB+plFe1GjUno5j7j86+wxKhzByyw=";
+    hash = "sha256-iD+diwctXaQlOpL0fjOiFoWVONtlMq7AonbC0vCmXc0=";
  };

-  patches = [
-    # A pair of fixes with python 3.11.9, merged upstream;
-    # see https://github.com/dask/dask/issues/11038
-    (fetchpatch {
-      url = "https://github.com/dask/dask/pull/11035.diff";
-      hash = "sha256-aQTzas8gn7pCyp7L6VV3NpSYgqC1Ov7YN7YGnX0Vwmo=";
-    })
-    (fetchpatch {
-      url = "https://github.com/dask/dask/pull/11039.diff";
-      hash = "sha256-gvEEvnyhFlhiFvVaB6jwMy4auUOvECf49FbFJyjqQm4=";
-    })
-  ];
-
  nativeBuildInputs = [
    setuptools
    wheel
@@ -93,6 +80,7 @@ buildPythonPackage rec {
    ++ self.distributed
    ++ self.diagnostics;
    dataframe = [
+      # dask-expr -> circular dependency with dask-expr
      numpy
      pandas
    ];
@@ -106,6 +94,7 @@ buildPythonPackage rec {
  });

  nativeCheckInputs = [
+    dask-expr
    pytestCheckHook
    pytest-rerunfailures
    pytest-xdist
@@ -113,6 +102,7 @@ buildPythonPackage rec {
    hypothesis
    pytest-asyncio
  ]
+  ++ passthru.optional-dependencies.array
  ++ passthru.optional-dependencies.dataframe
  ++ lib.optionals (!arrow-cpp.meta.broken) [ # support is sparse on aarch64
    pyarrow
@@ -172,15 +162,29 @@ buildPythonPackage rec {

  pythonImportsCheck = [
    "dask"
-    "dask.array"
    "dask.bag"
    "dask.bytes"
-    "dask.dataframe"
-    "dask.dataframe.io"
-    "dask.dataframe.tseries"
    "dask.diagnostics"
  ];

+  doCheck = false;
+
+  # Enable tests via passthru to avoid cyclic dependency with dask-expr.
+  passthru.tests = {
+    check = self.overridePythonAttrs (old: {
+      doCheck = true;
+      pythonImportsCheck = [
+        # Requires the `dask.optional-dependencies.array` that are only in `nativeCheckInputs`
+        "dask.array"
+        # Requires the `dask.optional-dependencies.dataframe` that are only in `nativeCheckInputs`
+        "dask.dataframe"
+        "dask.dataframe.io"
+        "dask.dataframe.tseries"
+      ] ++ old.pythonImportsCheck;
+    });
+  };
+
+
  meta = with lib; {
    description = "Minimal task scheduling abstraction";
    mainProgram = "dask";
@@ -189,4 +193,4 @@ buildPythonPackage rec {
    license = licenses.bsd3;
    maintainers = with maintainers; [ fridh ];
  };
-}
+}; in self
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@@ -25,7 +25,7 @@

 buildPythonPackage rec {
  pname = "distributed";
-  version = "2023.12.0";
+  version = "2024.4.2";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -34,7 +34,7 @@ buildPythonPackage rec {
    owner = "dask";
    repo = "distributed";
    rev = "refs/tags/${version}";
-    hash = "sha256-Zv31BTzY31eXkU7wqa+h33qGrH+OTzKEj6L7Ei/aizk=";
+    hash = "sha256-xoQ+b7qzstZl9gRNs4jssNOsGQHDdvTXU7pTjBSuyWs=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/graphviz/default.nix
+++ b/pkgs/development/python-modules/graphviz/default.nix
@@ -3,7 +3,6 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, fetchpatch
 , substituteAll
 , graphviz-nox
 , xdg-utils
@@ -18,17 +17,17 @@

 buildPythonPackage rec {
  pname = "graphviz";
-  version = "0.20.1";
+  version = "0.20.2";
  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  # patch does not apply to PyPI tarball due to different line endings
  src = fetchFromGitHub {
    owner = "xflr6";
    repo = "graphviz";
    rev = version;
-    hash = "sha256-plhWG9mE9DoTMg7mWCvFLAgtBx01LAgJ0gQ/mqBU3yc=";
+    hash = "sha256-q5y4QPBCtA1kMhxbOECodSeubj2bULnnNDrZZfxiry4=";
  };

  patches = [
@@ -37,12 +36,6 @@ buildPythonPackage rec {
      graphviz = graphviz-nox;
      xdgutils = xdg-utils;
    })
-    # https://github.com/xflr6/graphviz/issues/209
-    (fetchpatch {
-      name = "fix-tests-with-python312.patch";
-      url = "https://github.com/xflr6/graphviz/commit/5ce9fc5de4f2284baa27d7a8d68ab0885d032868.patch";
-      hash = "sha256-jREPACSc4aoHY3G+39e8Axqajw4eeKkAeVu2s40v1nI=";
-    })
  ];

  postPatch = ''
--- a/pkgs/development/python-modules/graphviz/paths.patch
+++ b/pkgs/development/python-modules/graphviz/paths.patch
@@ -1,5 +1,5 @@
 diff --git a/graphviz/backend/dot_command.py b/graphviz/backend/dot_command.py
-index 60654bd..2c62b47 100644
+index 3a62a85..a38bb9b 100644
 --- a/graphviz/backend/dot_command.py
 +++ b/graphviz/backend/dot_command.py
@@ -9,7 +9,7 @@ from .. import parameters
@@ -38,20 +38,20 @@ index fde74a6..6f29b68 100644
     kwargs = {'stderr': subprocess.DEVNULL} if quiet else {}
     subprocess.Popen(cmd, **kwargs)
 diff --git a/tests/_common.py b/tests/_common.py
-index 87b4cbd..4188beb 100644
+index edc1309..42d730c 100644
 --- a/tests/_common.py
 +++ b/tests/_common.py
-@@ -14,9 +14,9 @@ __all__ = ['EXPECTED_DOT_BINARY', 'EXPECTED_UNFLATTEN_BINARY',
+@@ -14,9 +14,9 @@ __all__ = ['EXPECTED_DOT_BINARY',
            'as_cwd',
            'check_startupinfo', 'StartupinfoMatcher']
 
-EXPECTED_DOT_BINARY = _compat.make_subprocess_arg(pathlib.Path('dot'))
-+EXPECTED_DOT_BINARY = _compat.make_subprocess_arg(pathlib.Path('@graphviz@/bin/dot'))
+-EXPECTED_DOT_BINARY = pathlib.Path('dot')
+EXPECTED_DOT_BINARY = pathlib.Path('@graphviz@/bin/dot')
 
-EXPECTED_UNFLATTEN_BINARY = _compat.make_subprocess_arg(pathlib.Path('unflatten'))
-+EXPECTED_UNFLATTEN_BINARY = _compat.make_subprocess_arg(pathlib.Path('@graphviz@/bin/unflatten'))
+-EXPECTED_UNFLATTEN_BINARY = pathlib.Path('unflatten')
+EXPECTED_UNFLATTEN_BINARY = pathlib.Path('@graphviz@/bin/unflatten')
 
- EXPECTED_DEFAULT_ENCODING = 'utf-8'
+ EXPECTED_DEFAULT_ENGINE = 'dot'
 
 diff --git a/tests/backend/test_execute.py b/tests/backend/test_execute.py
 index 2cb853a..8093dfe 100644
--- a/pkgs/development/python-modules/ical/default.nix
+++ b/pkgs/development/python-modules/ical/default.nix
@@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "ical";
-  version = "7.0.3";
+  version = "8.0.0";
  pyproject = true;

  disabled = pythonOlder "3.10";
@@ -25,14 +25,14 @@ buildPythonPackage rec {
    owner = "allenporter";
    repo = "ical";
    rev = "refs/tags/${version}";
-    hash = "sha256-RiwWnRSe0HdeGVo592A+Rk+IvA1Lfp6mY+/ZEyqJBDU=";
+    hash = "sha256-nwF6iInQzHdOtmcC1fi6CS2LnYRCxc/DS9bg8IxTlFg=";
  };

-  nativeBuildInputs = [
+  build-system = [
    setuptools
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    python-dateutil
    tzdata
    pydantic
--- a/pkgs/development/python-modules/mailchecker/default.nix
+++ b/pkgs/development/python-modules/mailchecker/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "mailchecker";
-  version = "6.0.3";
+  version = "6.0.4";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-QRysmtKo5KXXAVcyQx2WwuwySUP8vAN/gqXWmgoOPmo=";
+    hash = "sha256-XtZOk3KgIzu9vwI0HnoklGQVZ42KVOPQBXxJ1fpfJjA=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/model-bakery/default.nix
+++ b/pkgs/development/python-modules/model-bakery/default.nix
@@ -1,17 +1,18 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, hatchling
-, django
-, pytestCheckHook
-, pythonOlder
-, pytest-django
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  django,
+  pytestCheckHook,
+  pythonOlder,
+  pytest-django,
 }:

 buildPythonPackage rec {
  pname = "model-bakery";
-  version = "1.17.0";
-  format = "pyproject";
+  version = "1.18.0";
+  pyproject = true;

  disabled = pythonOlder "3.8";

@@ -19,25 +20,19 @@ buildPythonPackage rec {
    owner = "model-bakers";
    repo = "model_bakery";
    rev = "refs/tags/${version}";
-    hash = "sha256-o3BI2lMwctR9tiGmY07dAOQUfv9K4rWkc/xI6uHnVfs=";
+    hash = "sha256-mf6NV7r/9kDCRlszx/QGtfEsC1O/SATd6+EX+w7ptEQ=";
  };

-  nativeBuildInputs = [
-    hatchling
-  ];
+  build-system = [ hatchling ];

-  propagatedBuildInputs = [
-    django
-  ];
+  dependencies = [ django ];

  nativeCheckInputs = [
    pytest-django
    pytestCheckHook
  ];

-  pythonImportsCheck = [
-    "model_bakery"
-  ];
+  pythonImportsCheck = [ "model_bakery" ];

  meta = with lib; {
    description = "Object factory for Django";
--- a/pkgs/development/python-modules/nanobind/default.nix
+++ b/pkgs/development/python-modules/nanobind/default.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  buildPythonPackage,
+  pythonOlder,
+  fetchFromGitHub,
+  cmake,
+  eigen,
+  ninja,
+  scikit-build,
+  pytestCheckHook,
+  numpy,
+  scipy,
+  torch,
+  jax,
+  jaxlib,
+  tensorflow,
+  setuptools,
+}:
+buildPythonPackage rec {
+  pname = "nanobind";
+  version = "1.9.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "wjakob";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-6swDqw7sEYOawQbNWD8VfSQoi+9wjhOhOOwPPkahDas=";
+    fetchSubmodules = true;
+  };
+
+  disabled = pythonOlder "3.8";
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    scikit-build
+    setuptools
+  ];
+  buildInputs = [ eigen ];
+  dontUseCmakeBuildDir = true;
+
+  preCheck = ''
+    # build tests
+    make -j $NIX_BUILD_CORES
+  '';
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    numpy
+    scipy
+    torch
+    tensorflow
+    jax
+    jaxlib
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/wjakob/nanobind";
+    changelog = "https://github.com/wjakob/nanobind/blob/${src.rev}/docs/changelog.rst";
+    description = "Tiny and efficient C++/Python bindings";
+    longDescription = ''
+      nanobind is a small binding library that exposes C++ types in Python and
+      vice versa. It is reminiscent of Boost.Python and pybind11 and uses
+      near-identical syntax. In contrast to these existing tools, nanobind is
+      more efficient: bindings compile in a shorter amount of time, produce
+      smaller binaries, and have better runtime performance.
+    '';
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ parras ];
+  };
+}
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -9,6 +9,7 @@
 , jbig2enc
 , packaging
 , pdfminer-six
+, pillow-heif
 , pikepdf
 , pillow
 , pluggy
@@ -18,19 +19,17 @@
 , pythonOlder
 , rich
 , reportlab
-, setuptools
 , setuptools-scm
 , substituteAll
 , tesseract
 , tqdm
-, typing-extensions
 , unpaper
 , installShellFiles
 }:

 buildPythonPackage rec {
  pname = "ocrmypdf";
-  version = "16.1.2";
+  version = "16.2.0";

  disabled = pythonOlder "3.10";

@@ -46,10 +45,11 @@ buildPythonPackage rec {
    postFetch = ''
      rm "$out/.git_archival.txt"
    '';
-    hash = "sha256-nZvfkfO5u3iuN0g/KITWbhYCRAJngEOKCW48z6IEPMI=";
+    hash = "sha256-sqhuQ+no6UymxbVtDtWiYQK8kKpO1y37NxLDmRT1LEQ=";
  };

  patches = [
+    ./use-pillow-heif.patch
    (substituteAll {
      src = ./paths.patch;
      gs = lib.getExe ghostscript;
@@ -60,30 +60,31 @@ buildPythonPackage rec {
    })
  ];

-  nativeBuildInputs = [
-    setuptools
+  build-system = [
    setuptools-scm
+  ];
+
+  nativeBuildInputs = [
    installShellFiles
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    deprecation
    img2pdf
    packaging
    pdfminer-six
+    pillow-heif
    pikepdf
    pillow
    pluggy
-    reportlab
    rich
-  ] ++ lib.optionals (pythonOlder "3.10") [
-    typing-extensions
  ];

  nativeCheckInputs = [
    hypothesis
    pytest-xdist
    pytestCheckHook
+    reportlab
  ];

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/ocrmypdf/use-pillow-heif.patch
+++ b/pkgs/development/python-modules/ocrmypdf/use-pillow-heif.patch
@@ -0,0 +1,26 @@
+diff --git a/pyproject.toml b/pyproject.toml
+index d045458f..efa9161d 100644
+--- a/pyproject.toml
+++ b/pyproject.toml
+@@ -16,7 +16,7 @@ dependencies = [
+   "img2pdf>=0.5",
+   "packaging>=20",
+   "pdfminer.six>=20220319",
+-  "pi-heif",                # Heif image format - maintainers: if this is removed, it will NOT break
+  "pillow-heif",                # Heif image format - maintainers: if this is removed, it will NOT break
+   "pikepdf>=8.10.1",
+   "Pillow>=10.0.1",
+   "pluggy>=1",
+diff --git a/src/ocrmypdf/_pipeline.py b/src/ocrmypdf/_pipeline.py
+index 043a78a0..522197b1 100644
+--- a/src/ocrmypdf/_pipeline.py
+++ b/src/ocrmypdf/_pipeline.py
+@@ -42,7 +42,7 @@ from ocrmypdf.pdfinfo import Colorspace, Encoding, PageInfo, PdfInfo
+ from ocrmypdf.pluginspec import OrientationConfidence
+ 
+ try:
+-    from pi_heif import register_heif_opener
+    from pillow_heif import register_heif_opener
+ except ImportError:
+ 
+     def register_heif_opener():
--- a/pkgs/development/python-modules/pillow-heif/default.nix
+++ b/pkgs/development/python-modules/pillow-heif/default.nix
@@ -57,8 +57,12 @@ buildPythonPackage rec {
    x265
  ];

-  # clang-16: error: argument unused during compilation: '-fno-strict-overflow' [-Werror,-Wunused-command-line-argument]
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
+  env = {
+    # clang-16: error: argument unused during compilation: '-fno-strict-overflow'
+    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
+
+    RELEASE_FULL_FLAG = 1;
+  };

  propagatedBuildInputs = [
    pillow
--- a/pkgs/development/python-modules/psrpcore/default.nix
+++ b/pkgs/development/python-modules/psrpcore/default.nix
@@ -1,38 +1,40 @@
-{ lib
-, buildPythonPackage
-, cryptography
-, fetchFromGitHub
-, pytestCheckHook
-, pythonOlder
-, xmldiff
+{
+  lib,
+  buildPythonPackage,
+  cryptography,
+  fetchFromGitHub,
+  powershell,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  xmldiff,
 }:

 buildPythonPackage rec {
  pname = "psrpcore";
-  version = "0.2.2";
-  format = "pyproject";
+  version = "0.3.0";
+  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "jborean93";
-    repo = pname;
+    repo = "psrpcore";
    rev = "refs/tags/v${version}";
-    hash = "sha256-6d5HQJEH/x+V0rpmQkprMlH1n151KyUF6d4tM9W5TFs=";
+    hash = "sha256-YThumRHMOTyhP6/EmNEew47v/X4Y1aYg1nvgZJz2XUg=";
  };

-  propagatedBuildInputs = [
-    cryptography
-  ];
+  build-system = [ setuptools ];
+
+  dependencies = [ cryptography ];

  nativeCheckInputs = [
+    powershell
    pytestCheckHook
    xmldiff
  ];

-  pythonImportsCheck = [
-    "psrpcore"
-  ];
+  pythonImportsCheck = [ "psrpcore" ];

  meta = with lib; {
    description = "Library for the PowerShell Remoting Protocol (PSRP)";
--- a/pkgs/development/python-modules/pyaml/default.nix
+++ b/pkgs/development/python-modules/pyaml/default.nix
@@ -8,12 +8,12 @@

 buildPythonPackage rec {
  pname = "pyaml";
-  version = "23.12.0";
+  version = "24.4.0";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-zm9kjv37GzpVefjO2wT6zw+h6PZIRrY5MJtYW7MitOU=";
+    hash = "sha256-Dkg9kokBDnR6Ml3EMXG8w51lYt0d1HGejMfnyWyZ/OY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pydantic-yaml-0/default.nix
+++ b/pkgs/development/python-modules/pydantic-yaml-0/default.nix
@@ -15,6 +15,7 @@

 buildPythonPackage rec {
  pname = "pydantic_yaml-0";
+  # nixpkgs-update: no auto update
  version = "0.11.2";

  pyproject = true;
--- a/pkgs/development/python-modules/python-novaclient/default.nix
+++ b/pkgs/development/python-modules/python-novaclient/default.nix
@@ -46,6 +46,8 @@ buildPythonPackage rec {

  checkPhase = ''
    stestr run -e <(echo "
+    novaclient.tests.unit.test_shell.ParserTest.test_ambiguous_option
+    novaclient.tests.unit.test_shell.ParserTest.test_not_really_ambiguous_option
    novaclient.tests.unit.test_shell.ShellTest.test_osprofiler
    novaclient.tests.unit.test_shell.ShellTestKeystoneV3.test_osprofiler
    ")
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "tencentcloud-sdk-python";
-  version = "3.0.1133";
+  version = "3.0.1135";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    rev = "refs/tags/${version}";
-    hash = "sha256-RQudhUn4BfsdwQOCt9CUuKVVlXbHLMEohg6C2srZ9pk=";
+    hash = "sha256-qrD33e9mOmgi/y9YArxjuV+wbkx9+/Jy0mJBYdVG4Ws=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -54,7 +54,7 @@

 buildPythonPackage rec {
  pname = "transformers";
-  version = "4.40.0";
+  version = "4.40.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -63,7 +63,7 @@ buildPythonPackage rec {
    owner = "huggingface";
    repo = "transformers";
    rev = "refs/tags/v${version}";
-    hash = "sha256-k0AloOG7fRQhTW8IF6uQSfav8p1KC5633SaLNYZrZ2M=";
+    hash = "sha256-w9BVJwYS2QV58UTOpcoQwdC+dxZuhLS2h8PqN5W2Yjc=";
  };

  build-system = [
--- a/pkgs/development/python-modules/units/default.nix
+++ b/pkgs/development/python-modules/units/default.nix
@@ -1,22 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-}:
-
-buildPythonPackage rec {
-  pname = "units";
-  version = "0.07";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "43eb3e073e1b11289df7b1c3f184b5b917ccad178b717b03933298716f200e14";
-  };
-
-  meta = with lib; {
-    description = "Python support for quantities with units";
-    homepage = "https://bitbucket.org/adonohue/units/";
-    license = licenses.psfl;
-    maintainers = [ ];
-  };
-}
--- a/Show More
+++ b/Show More