Merge master into haskell-updates

2026-10-01 20:45:12 +00:00 · 2024-06-11 00:13:52 +00:00
parent e160c2afdd a53f8b3cd0
commit 8a0c4944e5
300 changed files with 8815 additions and 2635 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6700,6 +6700,16 @@
    githubId = 9959940;
    name = "Andreas Fehn";
  };
+  felbinger = {
+    name = "Nico Felbinger";
+    email = "nico@felbinger.eu";
+    matrix = "@nico:felbinger.eu";
+    github = "felbinger";
+    githubId = 26925347;
+    keys = [{
+      fingerprint = "0797 D238 9769 CA1E 57B7 2ED9 2BA7 8116 87C9 0DE4";
+    }];
+  };
  felipeqq2 = {
    name = "Felipe Silva";
    email = "nixpkgs@felipeqq2.rocks";
@@ -12893,6 +12903,12 @@
    githubId = 427866;
    name = "Matthias Beyer";
  };
+  matthiasq = {
+    email = "matthias.queitsch@mailbox.org";
+    github = "matthias-Q";
+    githubId = 35303817;
+    name = "Matthias Queitsch";
+  };
  MatthieuBarthel = {
    email = "matthieu@imatt.ch";
    name = "Matthieu Barthel";
@@ -12926,6 +12942,16 @@
    githubId = 11810057;
    name = "Matt Snider";
  };
+  MattSturgeon = {
+    email = "matt@sturgeon.me.uk";
+    github = "MattSturgeon";
+    githubId = 5046562;
+    matrix = "@mattsturg:matrix.org";
+    name = "Matt Sturgeon";
+    keys = [{
+      fingerprint = "7082 22EA 1808 E39A 83AC  8B18 4F91 844C ED1A 8299";
+    }];
+  };
  matusf = {
    email = "matus.ferech@gmail.com";
    github = "matusf";
@@ -16937,6 +16963,12 @@
    githubId = 22085373;
    name = "Luis Hebendanz";
  };
+  qubitnano = {
+    name = "qubitnano";
+    email = "qubitnano@protonmail.com";
+    github = "qubitnano";
+    githubId = 146656568;
+  };
  queezle = {
    email = "git@queezle.net";
    github = "queezle42";
@@ -16976,6 +17008,12 @@
    githubId = 2141853;
    name = "Bang Lee";
  };
+  qwqawawow = {
+    email = "eihqnh@outlook.com";
+    github = "qwqawawow";
+    githubId = 40905037;
+    name = "qwqawawow";
+  };
  qyliss = {
    email = "hi@alyssa.is";
    github = "alyssais";
@@ -22755,6 +22793,11 @@
    githubId = 40352765;
    name = "Yoctocell";
  };
+  yomaq = {
+    name = "yomaq";
+    github = "yomaq";
+    githubId = 112864332;
+  };
  yorickvp = {
    email = "yorickvanpelt@gmail.com";
    matrix = "@yorickvp:matrix.org";
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -76,6 +76,7 @@ lualdap,,,,,,aanderse
 lualogging,,,,,,
 luaossl,,,,,5.1,
 luaposix,,,,34.1.1-1,,vyp lblasc
+luaprompt,,,,,,Freed-Wu
 luarepl,,,,,,
 luarocks,,,,,,mrcjkb teto
 luarocks-build-rust-mlua,,,,,,mrcjkb
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -206,6 +206,19 @@ in
        option is supported is used
      '';

+      prime.reverseSync.setupCommands.enable =
+        (lib.mkEnableOption ''
+          configure the display manager to be able to use the outputs
+          attached to the NVIDIA GPU.
+          Disable in order to configure the NVIDIA GPU outputs manually using xrandr.
+          Note that this configuration will only be successful when a display manager
+          for which the {option}`services.xserver.displayManager.setupCommands`
+          option is supported is used
+        '')
+        // {
+          default = true;
+        };
+
      nvidiaSettings =
        (lib.mkEnableOption ''
          nvidia-settings, NVIDIA's GUI configuration tool
@@ -275,7 +288,7 @@ in
              softdep nvidia post: nvidia-uvm
            '';
          };
-          systemd.tmpfiles.rules = lib.optional config.virtualisation.docker.enableNvidia "L+ /run/nvidia-docker/bin - - - - ${nvidia_x11.bin}/origBin";
+          systemd.tmpfiles.rules = lib.mkIf config.virtualisation.docker.enableNvidia "L+ /run/nvidia-docker/bin - - - - ${nvidia_x11.bin}/origBin";
          services.udev.extraRules = ''
            # Create /dev/nvidia-uvm when the nvidia-uvm module is loaded.
            KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidiactl c 195 255'"
@@ -290,6 +303,7 @@ in
          };
          environment.systemPackages = [ nvidia_x11.bin ];
        })
+
        # X11
        (lib.mkIf nvidiaEnabled {
          assertions = [
@@ -436,11 +450,13 @@ in
              providerCmdParams =
                if syncCfg.enable then "\"${gpuProviderName}\" NVIDIA-0" else "NVIDIA-G0 \"${gpuProviderName}\"";
            in
-            lib.optionalString (syncCfg.enable || reverseSyncCfg.enable) ''
-              # Added by nvidia configuration module for Optimus/PRIME.
-              ${lib.getExe pkgs.xorg.xrandr} --setprovideroutputsource ${providerCmdParams}
-              ${lib.getExe pkgs.xorg.xrandr} --auto
-            '';
+            lib.optionalString
+              (syncCfg.enable || (reverseSyncCfg.enable && reverseSyncCfg.setupCommands.enable))
+              ''
+                # Added by nvidia configuration module for Optimus/PRIME.
+                ${lib.getExe pkgs.xorg.xrandr} --setprovideroutputsource ${providerCmdParams}
+                ${lib.getExe pkgs.xorg.xrandr} --auto
+              '';

          environment.etc = {
            "nvidia/nvidia-application-profiles-rc" = lib.mkIf nvidia_x11.useProfiles {
@@ -455,6 +471,7 @@ in
            extraPackages = [ pkgs.nvidia-vaapi-driver ];
            extraPackages32 = [ pkgs.pkgsi686Linux.nvidia-vaapi-driver ];
          };
+
          environment.systemPackages =
            lib.optional cfg.nvidiaSettings nvidia_x11.settings
            ++ lib.optional cfg.nvidiaPersistenced nvidia_x11.persistenced
@@ -527,16 +544,12 @@ in
                };
              })
            ];
+
          services.acpid.enable = true;

          services.dbus.packages = lib.optional cfg.dynamicBoost.enable nvidia_x11.bin;

-          hardware.firmware =
-            let
-              isOpen = cfg.open;
-              isNewUnfree = lib.versionAtLeast nvidia_x11.version "555";
-            in
-            lib.optional (isOpen || isNewUnfree) nvidia_x11.firmware;
+          hardware.firmware = lib.optional (cfg.open || lib.versionAtLeast nvidia_x11.version "555") nvidia_x11.firmware;

          systemd.tmpfiles.rules =
            [
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -779,6 +779,7 @@
  ./services/misc/paperless.nix
  ./services/misc/parsoid.nix
  ./services/misc/persistent-evdev.nix
+  ./services/misc/pghero.nix
  ./services/misc/pinnwand.nix
  ./services/misc/plex.nix
  ./services/misc/plikd.nix
@@ -835,6 +836,7 @@
  ./services/misc/zoneminder.nix
  ./services/misc/zookeeper.nix
  ./services/monitoring/alerta.nix
+  ./services/monitoring/alloy.nix
  ./services/monitoring/apcupsd.nix
  ./services/monitoring/arbtt.nix
  ./services/monitoring/below.nix
--- a/nixos/modules/services/desktops/espanso.nix
+++ b/nixos/modules/services/desktops/espanso.nix
@@ -15,7 +15,6 @@ in {
  };

  config = mkIf cfg.enable {
-    services.espanso.package = mkIf cfg.wayland pkgs.espanso-wayland;
    systemd.user.services.espanso = {
      description = "Espanso daemon";
      serviceConfig = {
--- a/nixos/modules/services/logging/journalwatch.nix
+++ b/nixos/modules/services/logging/journalwatch.nix
@@ -56,6 +56,8 @@ in {
        '';
      };

+      package = mkPackageOption pkgs "journalwatch" { };
+
      priority = mkOption {
        type = types.int;
        default = 6;
@@ -240,7 +242,7 @@ in {
        # requires a relative directory name to create beneath /var/lib
        StateDirectory = user;
        StateDirectoryMode = "0750";
-        ExecStart = "${pkgs.python3Packages.journalwatch}/bin/journalwatch mail";
+        ExecStart = "${getExe cfg.package} mail";
        # lowest CPU and IO priority, but both still in best-effort class to prevent starvation
        Nice=19;
        IOSchedulingPriority=7;
--- a/nixos/modules/services/misc/mqtt2influxdb.nix
+++ b/nixos/modules/services/misc/mqtt2influxdb.nix
@@ -125,6 +125,7 @@ in {
  options = {
    services.mqtt2influxdb = {
      enable = mkEnableOption "BigClown MQTT to InfluxDB bridge.";
+      package = mkPackageOption pkgs ["python3Packages" "mqtt2influxdb"] {};
      environmentFiles = mkOption {
        type = types.listOf types.path;
        default = [];
@@ -245,7 +246,7 @@ in {
      '';
      serviceConfig = {
        EnvironmentFile = cfg.environmentFiles;
-        ExecStart = "${cfg.package}/bin/mqtt2influxdb -dc ${finalConfig}";
+        ExecStart = "${lib.getExe cfg.package} -dc ${finalConfig}";
        RuntimeDirectory = "mqtt2influxdb";
      };
    };
--- a/nixos/modules/services/misc/pghero.nix
+++ b/nixos/modules/services/misc/pghero.nix
@@ -0,0 +1,142 @@
+{ config, pkgs, lib, utils, ... }:
+let
+  cfg = config.services.pghero;
+  settingsFormat = pkgs.formats.yaml { };
+  settingsFile = settingsFormat.generate "pghero.yaml" cfg.settings;
+in
+{
+  options.services.pghero = {
+    enable = lib.mkEnableOption "PgHero service";
+    package = lib.mkPackageOption pkgs "pghero" { };
+
+    listenAddress = lib.mkOption {
+      type = lib.types.str;
+      example = "[::1]:3000";
+      description = ''
+        `hostname:port` to listen for HTTP traffic.
+
+        This is bound using the systemd socket activation.
+      '';
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        Additional command-line arguments for the systemd service.
+
+        Refer to the [Puma web server documentation] for available arguments.
+
+        [Puma web server documentation]: https://puma.io/puma#configuration
+      '';
+    };
+
+    settings = lib.mkOption {
+      type = settingsFormat.type;
+      default = { };
+      example = {
+        databases = {
+          primary = {
+            url = "<%= ENV['PRIMARY_DATABASE_URL'] %>";
+          };
+        };
+      };
+      description = ''
+        PgHero configuration. Refer to the [PgHero documentation] for more
+        details.
+
+        [PgHero documentation]: https://github.com/ankane/pghero/blob/master/guides/Linux.md#multiple-databases
+      '';
+    };
+
+    environment = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      description = ''
+        Environment variables to set for the service. Secrets should be
+        specified using {option}`environmentFile`.
+      '';
+    };
+
+    environmentFiles = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      description = ''
+        File to load environment variables from. Loaded variables override
+        values set in {option}`environment`.
+      '';
+    };
+
+    extraGroups = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ "tlskeys" ];
+      description = ''
+        Additional groups for the systemd service.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.sockets.pghero = {
+      unitConfig.Description = "PgHero HTTP socket";
+      wantedBy = [ "sockets.target" ];
+      listenStreams = [ cfg.listenAddress ];
+    };
+
+    systemd.services.pghero = {
+      description = "PgHero performance dashboard for PostgreSQL";
+      wantedBy = [ "multi-user.target" ];
+      requires = [ "pghero.socket" ];
+      after = [ "pghero.socket" "network.target" ];
+
+      environment = {
+        RAILS_ENV = "production";
+        PGHERO_CONFIG_PATH = settingsFile;
+      } // cfg.environment;
+
+      serviceConfig = {
+        Type = "notify";
+        WatchdogSec = "10";
+
+        ExecStart = utils.escapeSystemdExecArgs ([
+          (lib.getExe cfg.package)
+          "--bind-to-activated-sockets"
+          "only"
+        ] ++ cfg.extraArgs);
+        Restart = "always";
+
+        WorkingDirectory = "${cfg.package}/share/pghero";
+
+        EnvironmentFile = cfg.environmentFiles;
+        SupplementaryGroups = cfg.extraGroups;
+
+        DynamicUser = true;
+        UMask = "0077";
+
+        ProtectHome = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectControlGroups = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        PrivateUsers = true;
+        PrivateDevices = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        DeviceAllow = [ "" ];
+        DevicePolicy = "closed";
+        CapabilityBoundingSet = [ "" ];
+        MemoryDenyWriteExecute = true;
+        LockPersonality = true;
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [ "@system-service" ];
+      };
+    };
+  };
+}
--- a/nixos/modules/services/monitoring/alloy.nix
+++ b/nixos/modules/services/monitoring/alloy.nix
@@ -0,0 +1,80 @@
+{ lib, pkgs, config, ... }:
+with lib;
+let
+  cfg = config.services.alloy;
+in
+{
+  meta = {
+    maintainers = with maintainers; [ flokli hbjydev ];
+  };
+
+  options.services.alloy = {
+    enable = mkEnableOption "Grafana Alloy";
+
+    package = mkPackageOption pkgs "grafana-alloy" { };
+
+    configPath = mkOption {
+      type = lib.types.path;
+      default = "/etc/alloy";
+      description = ''
+        Alloy configuration file/directory path.
+
+        We default to `/etc/alloy` here, and expect the user to configure a
+        configuration file via `environment.etc."alloy/config.alloy"`.
+
+        This allows config reload, contrary to specifying a store path.
+        A `reloadTrigger` for `config.alloy` is configured.
+
+        Other `*.alloy` files in the same directory (ignoring subdirs) are also
+        honored, but it's necessary to manually extend
+        `systemd.services.alloy.reloadTriggers` to enable config reload
+        during nixos-rebuild switch.
+
+        This can also point to another directory containing `*.alloy` files, or
+        a single Alloy file in the Nix store (at the cost of reload).
+
+        Component names must be unique across all Alloy configuration files, and
+        configuration blocks must not be repeated.
+
+        Alloy will continue to run if subsequent reloads of the configuration
+        file fail, potentially marking components as unhealthy depending on
+        the nature of the failure. When this happens, Alloy will continue
+        functioning in the last valid state.
+      '';
+    };
+
+    extraFlags = mkOption {
+      type = with lib.types; listOf str;
+      default = [ ];
+      example = [ "--server.http.listen-addr=127.0.0.1:12346" "--disable-reporting" ];
+      description = ''
+        Extra command-line flags passed to {command}`alloy run`.
+
+        See <https://grafana.com/docs/alloy/latest/reference/cli/run/>
+      '';
+    };
+  };
+
+
+  config = mkIf cfg.enable {
+    systemd.services.alloy = {
+      wantedBy = [ "multi-user.target" ];
+      reloadTriggers = [ config.environment.etc."alloy/config.alloy".source or null ];
+      serviceConfig = {
+        Restart = "always";
+        DynamicUser = true;
+        RestartSec = 2;
+        SupplementaryGroups = [
+          # allow to read the systemd journal for loki log forwarding
+          "systemd-journal"
+        ];
+        ExecStart = "${lib.getExe cfg.package} run ${cfg.configPath} ${escapeShellArgs cfg.extraFlags}";
+        ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
+        ConfigurationDirectory = "alloy";
+        StateDirectory = "alloy";
+        WorkingDirectory = "%S/alloy";
+        Type = "simple";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/monitoring/loki.nix
+++ b/nixos/modules/services/monitoring/loki.nix
@@ -94,6 +94,7 @@ in {
    systemd.services.loki = {
      description = "Loki Service Daemon";
      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];

      serviceConfig = let
        conf = if cfg.configFile == null
--- a/nixos/modules/services/networking/adguardhome.nix
+++ b/nixos/modules/services/networking/adguardhome.nix
@@ -167,8 +167,13 @@ in {
      preStart = optionalString (settings != null) ''
        if    [ -e "$STATE_DIRECTORY/AdGuardHome.yaml" ] \
           && [ "${toString cfg.mutableSettings}" = "1" ]; then
+          # First run a schema_version update on the existing configuration
+          # This ensures that both the new config and the existing one have the same schema_version
+          # Note: --check-config has the side effect of modifying the file at rest!
+          ${lib.getExe cfg.package} -c "$STATE_DIRECTORY/AdGuardHome.yaml" --check-config
+
          # Writing directly to AdGuardHome.yaml results in empty file
-          ${pkgs.yaml-merge}/bin/yaml-merge "$STATE_DIRECTORY/AdGuardHome.yaml" "${configFile}" > "$STATE_DIRECTORY/AdGuardHome.yaml.tmp"
+          ${lib.getExe pkgs.yaml-merge} "$STATE_DIRECTORY/AdGuardHome.yaml" "${configFile}" > "$STATE_DIRECTORY/AdGuardHome.yaml.tmp"
          mv "$STATE_DIRECTORY/AdGuardHome.yaml.tmp" "$STATE_DIRECTORY/AdGuardHome.yaml"
        else
          cp --force "${configFile}" "$STATE_DIRECTORY/AdGuardHome.yaml"
@@ -178,7 +183,7 @@ in {

      serviceConfig = {
        DynamicUser = true;
-        ExecStart = "${cfg.package}/bin/adguardhome ${args}";
+        ExecStart = "${lib.getExe cfg.package} ${args}";
        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ]
          ++ optionals cfg.allowDHCP [ "CAP_NET_RAW" ];
        Restart = "always";
--- a/nixos/modules/services/networking/mihomo.nix
+++ b/nixos/modules/services/networking/mihomo.nix
@@ -25,6 +25,7 @@ in
    webui = lib.mkOption {
      default = null;
      type = lib.types.nullOr lib.types.path;
+      example = lib.literalExpression "pkgs.metacubexd";
      description = ''
        Local web interface to use.

--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@@ -61,12 +61,21 @@ in {
    };

    extraUpFlags = mkOption {
-      description = "Extra flags to pass to {command}`tailscale up`.";
+      description = ''
+        Extra flags to pass to {command}`tailscale up`. Only applied if `authKeyFile` is specified.";
+      '';
      type = types.listOf types.str;
      default = [];
      example = ["--ssh"];
    };

+    extraSetFlags = mkOption {
+      description = "Extra flags to pass to {command}`tailscale set`.";
+      type = types.listOf types.str;
+      default = [];
+      example = ["--advertise-exit-node"];
+    };
+
    extraDaemonFlags = mkOption {
      description = "Extra flags to pass to {command}`tailscaled`.";
      type = types.listOf types.str;
@@ -120,6 +129,18 @@ in {
      '';
    };

+    systemd.services.tailscaled-set = mkIf (cfg.extraSetFlags != []) {
+      after = ["tailscaled.service"];
+      wants = ["tailscaled.service"];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+      };
+      script = ''
+        ${cfg.package}/bin/tailscale set ${escapeShellArgs cfg.extraSetFlags}
+      '';
+    };
+
    boot.kernel.sysctl = mkIf (cfg.useRoutingFeatures == "server" || cfg.useRoutingFeatures == "both") {
      "net.ipv4.conf.all.forwarding" = mkOverride 97 true;
      "net.ipv6.conf.all.forwarding" = mkOverride 97 true;
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -115,6 +115,7 @@ in {
  akkoma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./akkoma.nix {};
  akkoma-confined = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./akkoma.nix { confined = true; };
  alice-lg = handleTest ./alice-lg.nix {};
+  alloy = handleTest ./alloy.nix {};
  allTerminfo = handleTest ./all-terminfo.nix {};
  alps = handleTest ./alps.nix {};
  amazon-init-shell = handleTest ./amazon-init-shell.nix {};
@@ -720,6 +721,7 @@ in {
  pg_anonymizer = handleTest ./pg_anonymizer.nix {};
  pgadmin4 = handleTest ./pgadmin4.nix {};
  pgbouncer = handleTest ./pgbouncer.nix {};
+  pghero = runTest ./pghero.nix;
  pgjwt = handleTest ./pgjwt.nix {};
  pgmanage = handleTest ./pgmanage.nix {};
  pgvecto-rs = handleTest ./pgvecto-rs.nix {};
--- a/nixos/tests/alloy.nix
+++ b/nixos/tests/alloy.nix
@@ -0,0 +1,32 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }:
+
+  let
+    nodes = {
+      machine = {
+        services.alloy = {
+          enable = true;
+        };
+        environment.etc."alloy/config.alloy".text = "";
+      };
+    };
+  in
+  {
+    name = "alloy";
+
+    meta = with lib.maintainers; {
+      maintainers = [ flokli hbjydev ];
+    };
+
+    inherit nodes;
+
+    testScript = ''
+      start_all()
+
+      machine.wait_for_unit("alloy.service")
+      machine.wait_for_open_port(12345)
+      machine.succeed(
+          "curl -sSfN http://127.0.0.1:12345/-/healthy"
+      )
+      machine.shutdown()
+    '';
+  })
--- a/nixos/tests/mpv.nix
+++ b/nixos/tests/mpv.nix
@@ -12,7 +12,7 @@ in
    {
      environment.systemPackages = [
        pkgs.curl
-        (pkgs.wrapMpv pkgs.mpv-unwrapped {
+        (pkgs.mpv.override {
          scripts = [ pkgs.mpvScripts.simple-mpv-webui ];
        })
      ];
--- a/nixos/tests/pghero.nix
+++ b/nixos/tests/pghero.nix
@@ -0,0 +1,63 @@
+let
+  pgheroPort = 1337;
+  pgheroUser = "pghero";
+  pgheroPass = "pghero";
+in
+{ lib, ... }: {
+  name = "pghero";
+  meta.maintainers = [ lib.maintainers.tie ];
+
+  nodes.machine = { config, ... }: {
+    services.postgresql = {
+      enable = true;
+      # This test uses default peer authentication (socket and its directory is
+      # world-readably by default), so we essentially test that we can connect
+      # with DynamicUser= set.
+      ensureUsers = [{
+        name = "pghero";
+        ensureClauses.superuser = true;
+      }];
+    };
+    services.pghero = {
+      enable = true;
+      listenAddress = "[::]:${toString pgheroPort}";
+      settings = {
+        databases = {
+          postgres.url = "<%= ENV['POSTGRES_DATABASE_URL'] %>";
+          nulldb.url = "nulldb:///";
+        };
+      };
+      environment = {
+        PGHERO_USERNAME = pgheroUser;
+        PGHERO_PASSWORD = pgheroPass;
+        POSTGRES_DATABASE_URL = "postgresql:///postgres?host=/run/postgresql";
+      };
+    };
+  };
+
+  testScript = ''
+    pgheroPort = ${toString pgheroPort}
+    pgheroUser = "${pgheroUser}"
+    pgheroPass = "${pgheroPass}"
+
+    pgheroUnauthorizedURL = f"http://localhost:{pgheroPort}"
+    pgheroBaseURL = f"http://{pgheroUser}:{pgheroPass}@localhost:{pgheroPort}"
+
+    def expect_http_code(node, code, url):
+        http_code = node.succeed(f"curl -s -o /dev/null -w '%{{http_code}}' '{url}'")
+        assert http_code.split("\n")[-1].strip() == code, \
+          f"expected HTTP status code {code} but got {http_code}"
+
+    machine.wait_for_unit("postgresql.service")
+    machine.wait_for_unit("pghero.service")
+
+    with subtest("requires HTTP Basic Auth credentials"):
+      expect_http_code(machine, "401", pgheroUnauthorizedURL)
+
+    with subtest("works with some databases being unavailable"):
+      expect_http_code(machine, "500", pgheroBaseURL + "/nulldb")
+
+    with subtest("connects to the PostgreSQL database"):
+      expect_http_code(machine, "200", pgheroBaseURL + "/postgres")
+  '';
+}
--- a/nixos/tests/systemd-machinectl.nix
+++ b/nixos/tests/systemd-machinectl.nix
@@ -76,10 +76,23 @@ in
      };
    };

+    systemd.nspawn.${containerName} = {
+      filesConfig = {
+        # workaround to fix kernel namespaces; needed for Nix sandbox
+        # https://github.com/systemd/systemd/issues/27994#issuecomment-1704005670
+        Bind = "/proc:/run/proc";
+      };
+    };
+
    systemd.services."systemd-nspawn@${containerName}" = {
      serviceConfig.Environment = [
        # Disable tmpfs for /tmp
        "SYSTEMD_NSPAWN_TMPFS_TMP=0"
+
+        # force unified cgroup delegation, which would be the default
+        # if systemd could check the capabilities of the installed systemd.
+        # see also: https://github.com/NixOS/nixpkgs/pull/198526
+        "SYSTEMD_NSPAWN_UNIFIED_HIERARCHY=1"
      ];
      overrideStrategy = "asDropin";
    };
@@ -121,6 +134,17 @@ in
    machine.succeed("machinectl start ${containerName}");
    machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");

+    # Test systemd-nspawn configured unified cgroup delegation
+    # see also:
+    # https://github.com/systemd/systemd/blob/main/docs/CGROUP_DELEGATION.md#three-different-tree-setups-
+    machine.succeed('systemd-run --pty --wait -M ${containerName} /run/current-system/sw/bin/stat --format="%T" --file-system /sys/fs/cgroup > fstype')
+    machine.succeed('test $(tr -d "\\r" < fstype) = cgroup2fs')
+
+    # Test if systemd-nspawn provides a working environment for nix to build derivations
+    # https://nixos.org/guides/nix-pills/07-working-derivation
+    machine.succeed('systemd-run --pty --wait -M ${containerName} /run/current-system/sw/bin/nix-instantiate --expr \'derivation { name = "myname"; builder = "/bin/sh"; args = [ "-c" "echo foo > $out" ]; system = "${pkgs.system}"; }\' --add-root /tmp/drv')
+    machine.succeed('systemd-run --pty --wait -M ${containerName} /run/current-system/sw/bin/nix-store --option substitute false --realize /tmp/drv')
+
    # Test nss_mymachines without nscd
    machine.succeed('LD_LIBRARY_PATH="/run/current-system/sw/lib" getent -s hosts:mymachines hosts ${containerName}');

--- a/pkgs/applications/audio/g4music/default.nix
+++ b/pkgs/applications/audio/g4music/default.nix
@@ -15,14 +15,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "g4music";
-  version = "3.6";
+  version = "3.6.2";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "neithern";
    repo = "g4music";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-RDz3QwjbzYS4JllxpSA59cs2S3dNTmNcOoxu4JFC8oM=";
+    hash = "sha256-yNKDTcLunTLhAtOBrjuycw0rrdCSwmhhVyBg3AfMUCQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/youtube-music/default.nix
+++ b/pkgs/applications/audio/youtube-music/default.nix
@@ -12,18 +12,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "youtube-music";
-  version = "3.3.6";
+  version = "3.3.12";

  src = fetchFromGitHub {
    owner = "th-ch";
    repo = "youtube-music";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-nxpctEG4XoxW6jOAxGdgTEYr6YnhFRR8+5HUQLxRJB0=";
+    hash = "sha256-kBGMp58086NQ77x1YGS5NewWfiDaXHOEbyflHPtdfIs=";
  };

  pnpmDeps = pnpm.fetchDeps {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-8oeloQYiwUy+GDG4R+XtiynT+8Fad4WYFWTO1KANZKQ=";
+    hash = "sha256-t5omzz6y8lVFGAuhtc+HF5gwu4Ntt/dxml+nWysEpVs=";
  };

  nativeBuildInputs = [ makeWrapper python3 nodejs pnpm.configHook ]
@@ -87,8 +87,9 @@ stdenv.mkDerivation (finalAttrs: {
  meta = with lib; {
    description = "Electron wrapper around YouTube Music";
    homepage = "https://th-ch.github.io/youtube-music/";
+    changelog = "https://github.com/th-ch/youtube-music/blob/master/changelog.md#${lib.replaceStrings ["."] [""] finalAttrs.src.rev}";
    license = licenses.mit;
-    maintainers = [ maintainers.aacebedo ];
+    maintainers = with maintainers; [ aacebedo SuperSandro2000 ];
    mainProgram = "youtube-music";
    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
  };
--- a/pkgs/applications/blockchains/erigon/default.nix
+++ b/pkgs/applications/blockchains/erigon/default.nix
@@ -2,7 +2,7 @@

 let
  pname = "erigon";
-  version = "2.60.0";
+  version = "2.60.1";
 in
 buildGoModule {
  inherit pname version;
@@ -11,7 +11,7 @@ buildGoModule {
    owner = "ledgerwatch";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-c0CArubKvdh9xcvBM15O4vGwAsSHzaINtoKd0XczJHU=";
+    hash = "sha256-VZzDG9qUjEBSNxQcmkqPTTDQjh7BZFqyRSaCfio8X2I=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
@@ -16,7 +16,7 @@
 }:

 let
-  rev = "f48de0896d3af80f5e15aef512b7485eb46df9f6";
+  rev = "e5cf0b704274d3deae8f4a3b6a3d0664a176bc8b";
  python = python3.withPackages (ps: with ps; [
    epc
    orjson
@@ -28,13 +28,13 @@ let
 in
 melpaBuild {
  pname = "lsp-bridge";
-  version = "20240601.1149";
+  version = "20240609.1553";

  src = fetchFromGitHub {
    owner = "manateelazycat";
    repo = "lsp-bridge";
    inherit rev;
-    hash = "sha256-ocKNRSt5RVKGnxd0odI43jdr27oYrRLdnABh6x63CfM=";
+    hash = "sha256-96GgMJPLFoabhlvjTMWKtEpGuctjlcRuChvzDziaq8g=";
  };

  commit = rev;
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@@ -103,7 +103,7 @@ let
      postBuild = lib.optionalString stdenv.isLinux ''
        rm $out/share/applications/nvim.desktop
        substitute ${neovim-unwrapped}/share/applications/nvim.desktop $out/share/applications/nvim.desktop \
-          --replace 'Name=Neovim' 'Name=Neovim wrapper'
+          --replace-warn 'Name=Neovim' 'Name=Neovim wrapper'
      ''
      + lib.optionalString finalAttrs.withPython3 ''
        makeWrapper ${python3Env.interpreter} $out/bin/nvim-python3 --unset PYTHONPATH --unset PYTHONSAFEPATH
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -505,8 +505,8 @@ let
        mktplcRef = {
          name = "vscode-bazel";
          publisher = "bazelbuild";
-          version = "0.7.0";
-          sha256 = "05wvih09184bsp4rv2m55z0sasra2qrvch5m3bkbrjq7rcqgibgx";
+          version = "0.10.0";
+          sha256 = "sha256-8SUOzsUmfgt9fAy037qLVNrGJPvTnIeMNz2tbN5psbs=";
        };
        meta = {
          description = "Bazel support for Visual Studio Code";
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@@ -85,10 +85,10 @@
        "src": {
            "owner": "libretro",
            "repo": "beetle-psx-libretro",
-            "rev": "f7d733b935be185da633be660c73d8f91d6c6883",
-            "hash": "sha256-hX56CqsWkxNlaSzOtaemIWEO0Ov9InmcLmRUJjtn4FQ="
+            "rev": "b8e10a3039391db6e4fbdc96720d3428a2dbd039",
+            "hash": "sha256-F38lUBhe9JR3dPwkLqhAAlvLtAeas8bnPuiK6eOpUuU="
        },
-        "version": "unstable-2024-05-24"
+        "version": "unstable-2024-06-07"
    },
    "beetle-saturn": {
        "fetcher": "fetchFromGitHub",
@@ -115,10 +115,10 @@
        "src": {
            "owner": "libretro",
            "repo": "beetle-supergrafx-libretro",
-            "rev": "c96c05c0b6e948df00da7e6253ff3e2874314baa",
-            "hash": "sha256-ruxp66E7D+r/9h7lzggIy9q9DKWKJikVzL5Oqsy9kQM="
+            "rev": "e3f68c1311d4684a5a59d3d1662d5c4f32662c02",
+            "hash": "sha256-jTO2SDOefpB+cfahiPkReYID0pjP437h53hZElSLsdY="
        },
-        "version": "unstable-2024-05-17"
+        "version": "unstable-2024-06-07"
    },
    "beetle-vb": {
        "fetcher": "fetchFromGitHub",
@@ -297,21 +297,21 @@
        "src": {
            "owner": "libretro",
            "repo": "libretro-fceumm",
-            "rev": "c970bcc2b527f2c9d072e3ad2a5e3b4143246e25",
-            "hash": "sha256-EOtUExsYIXyuX2bTzs9Ia0i9aIMdXVByhZ+S0bSPfJw="
+            "rev": "bc9d865f9427384e40084cb090d94d72d4970e78",
+            "hash": "sha256-/g7gRNWDbW5LFZ+uBkIf5DMELas0/ilqbmUbvq8YSsE="
        },
-        "version": "unstable-2024-05-29"
+        "version": "unstable-2024-06-09"
    },
    "flycast": {
        "fetcher": "fetchFromGitHub",
        "src": {
            "owner": "flyinghead",
            "repo": "flycast",
-            "rev": "021249c321826ecb6b0a0ed6e5d2af9044e973a3",
-            "hash": "sha256-/S/43/fKZrUjZTSq51NY3OU3oDpyoqNbHB2QGzqBOuk=",
+            "rev": "4cd62781043cd9193c6c5ec04f6a8084375bed0d",
+            "hash": "sha256-EKK9PNFHWm1Jakq0E6fIqmcDiiiOSgHEbixB3X/H77g=",
            "fetchSubmodules": true
        },
-        "version": "unstable-2024-06-02"
+        "version": "unstable-2024-06-08"
    },
    "fmsx": {
        "fetcher": "fetchFromGitHub",
@@ -348,20 +348,20 @@
        "src": {
            "owner": "libretro",
            "repo": "gambatte-libretro",
-            "rev": "f0d83f0eff4ad91471f90acd098d078eea0a67b3",
-            "hash": "sha256-zcqFVPotOu5gDwzgWzn0lpzhcTwQUm81UpA5FtCrz1M="
+            "rev": "e2031a4010463adcd00ce3f34acbbb6db2ad1266",
+            "hash": "sha256-yFj9ZkvDliaTO43l0fjg8FwD17MxjV4wszY7AVjTiNY="
        },
-        "version": "unstable-2024-06-02"
+        "version": "unstable-2024-06-07"
    },
    "genesis-plus-gx": {
        "fetcher": "fetchFromGitHub",
        "src": {
            "owner": "libretro",
            "repo": "Genesis-Plus-GX",
-            "rev": "d2f1241b8665b525f95506afb5f079167f2b1ab6",
-            "hash": "sha256-DtnPtXYdxQ5XB6Og+XYpN1uRHJR3B1EpVsdCN3V8YZg="
+            "rev": "60955a01f601ef73c02b07581dd7d5aa3b6a4788",
+            "hash": "sha256-h0T6i1kiN58TagFo5XHzXMLaEwkGGTyuZpyS1QGNrb8="
        },
-        "version": "unstable-2024-05-25"
+        "version": "unstable-2024-06-07"
    },
    "gpsp": {
        "fetcher": "fetchFromGitHub",
@@ -429,20 +429,20 @@
        "src": {
            "owner": "libretro",
            "repo": "mame2003-libretro",
-            "rev": "9ed9b3bdf4439d222b2b1a8c89e01fa3a6d2cc51",
-            "hash": "sha256-E6/NYG+Uw+At2iAziEsl95NOwVSOs2otye+MDl+SQA0="
+            "rev": "ce82eaa30932c988e9d9abc0ac5d6d637fb88cc6",
+            "hash": "sha256-vCqv2EhgYtJwNE2sRcs8KTg0cGlRSmhykRLkt8mUKlg="
        },
-        "version": "unstable-2024-06-01"
+        "version": "unstable-2024-06-07"
    },
    "mame2003-plus": {
        "fetcher": "fetchFromGitHub",
        "src": {
            "owner": "libretro",
            "repo": "mame2003-plus-libretro",
-            "rev": "b37ce123034084fa14709fb0f33c505737b3bfda",
-            "hash": "sha256-vrVuUgkwZDLdFLo+bhJwXEuNWcS9ncQbjOspx6LVqhQ="
+            "rev": "ecd00b18187c7fff75b6d9a70ac1b349e79652bb",
+            "hash": "sha256-1dVNNlDKDJwGHou/bY/grj/p9BJmfUwDxEiw2zQ7gSg="
        },
-        "version": "unstable-2024-05-29"
+        "version": "unstable-2024-06-08"
    },
    "mame2010": {
        "fetcher": "fetchFromGitHub",
@@ -489,10 +489,10 @@
        "src": {
            "owner": "libretro",
            "repo": "mesen",
-            "rev": "d6f2f1797694f87e698c737b068f621889e96fa9",
-            "hash": "sha256-iLX9UvrjYjGjyaLD4sC10gntWUvgZrwiUqTS7S7YDdc="
+            "rev": "91db6be681f70b2080525c267af6132555323ea1",
+            "hash": "sha256-rw/bwHaeglO/DPeOCFHAWF5Y5DXVKiteO4bWZjTB4rI="
        },
-        "version": "unstable-2024-01-30"
+        "version": "unstable-2024-06-09"
    },
    "mesen-s": {
        "fetcher": "fetchFromGitHub",
@@ -652,22 +652,22 @@
        "src": {
            "owner": "jpd002",
            "repo": "Play-",
-            "rev": "18c0a6b17d074c662bebea87684d025636862d64",
-            "hash": "sha256-UOH3f3HkN6ak4AMH7C6E5Lqrj/WF8bqSjv0JTj7HqFU=",
+            "rev": "2f3d8252a2ba398078538abfe8a633b667a858a4",
+            "hash": "sha256-Trr+xJWcWfQW5TnSTxqAsUK3HSMsoLaAkz7UIwp6L4c=",
            "fetchSubmodules": true
        },
-        "version": "unstable-2024-05-28"
+        "version": "unstable-2024-06-04"
    },
    "ppsspp": {
        "fetcher": "fetchFromGitHub",
        "src": {
            "owner": "hrydgard",
            "repo": "ppsspp",
-            "rev": "8600e81c62eaf9ea36c06d9e7d4a8b731947e255",
-            "hash": "sha256-qPmJMtaUzr9pepeIl+bOgOUrxSxy4Khiq3jtXwnIZSI=",
+            "rev": "5dec3ca2db10943dcdf5e483cc8c28e0524d1a43",
+            "hash": "sha256-B9/0uGpBrM+qndvO2BC9sQCNkSK3qR2fUtWx5Vx16xU=",
            "fetchSubmodules": true
        },
-        "version": "unstable-2024-06-03"
+        "version": "unstable-2024-06-09"
    },
    "prboom": {
        "fetcher": "fetchFromGitHub",
@@ -754,10 +754,10 @@
        "src": {
            "owner": "snes9xgit",
            "repo": "snes9x",
-            "rev": "a277d7f9e88fa377f9cc6f26c1f6008d0499d36e",
-            "hash": "sha256-8fdBgQeZAEyKnBInOeqsaIw20ztn5eeU34+CnoM+xng="
+            "rev": "c7b77d4a763e8fa3ee2c4ef63b3974527056b7ad",
+            "hash": "sha256-a9IKbuSrlzrhrRrLRFAnhHWBhaYIf58oRFYjWSqbNTU="
        },
-        "version": "unstable-2024-05-26"
+        "version": "unstable-2024-06-07"
    },
    "snes9x2002": {
        "fetcher": "fetchFromGitHub",
@@ -794,10 +794,10 @@
        "src": {
            "owner": "stella-emu",
            "repo": "stella",
-            "rev": "49166ca9949708c3bddaed5cc549194c4bfcfae5",
-            "hash": "sha256-Oszglo1BQYTkuSZ96RSIBa1A0v/4qLQSBzsSVmOq07I="
+            "rev": "1c2dceab2b74980effb8d6497ea64fc3bd6b0be3",
+            "hash": "sha256-UeuSHHAZV798sSws32PhcBq9q2bGfX758mR+mIEnX+I="
        },
-        "version": "unstable-2024-05-13"
+        "version": "unstable-2024-06-08"
    },
    "stella2014": {
        "fetcher": "fetchFromGitHub",
--- a/pkgs/applications/misc/neo4j-desktop/default.nix
+++ b/pkgs/applications/misc/neo4j-desktop/default.nix
@@ -1,11 +1,11 @@
 { appimageTools, lib, fetchurl }:
 let
  pname = "neo4j-desktop";
-  version = "1.5.8";
+  version = "1.5.9";

  src = fetchurl {
    url = "https://s3-eu-west-1.amazonaws.com/dist.neo4j.org/${pname}/linux-offline/${pname}-${version}-x86_64.AppImage";
-    hash = "sha256-RqzR4TuvDasbkj/wKvOOS7r46sXDxvw3B5ydFGZeHX8=";
+    hash = "sha256-04I1p5wtndIflHqS5qQVf3s8F9ORJ+oy4wi/5PQbnWk=";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
--- a/pkgs/applications/misc/obsidian/default.nix
+++ b/pkgs/applications/misc/obsidian/default.nix
@@ -25,7 +25,7 @@ let
  filename = if stdenv.isDarwin then "Obsidian-${version}-universal.dmg" else "obsidian-${version}.tar.gz";
  src = fetchurl {
    url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/${filename}";
-    hash = if stdenv.isDarwin then "sha256-o5ELpG82mJgcd9Pil6A99BPK6Hoa0OKJJkYpyfGJR9I=" else "sha256-Eq2cUXjp0XdVeR4t3oG2DUtsKOp3e3nPMMhznUc4BmE=";
+    hash = if stdenv.isDarwin then "sha256-o5ELpG82mJgcd9Pil6A99BPK6Hoa0OKJJkYpyfGJR9I=" else "sha256-ho8E2Iq+s/w8NjmxzZo/y5aj3MNgbyvIGjk3nSKPLDw=";
  };

  icon = fetchurl {
--- a/pkgs/applications/misc/qlcplus/default.nix
+++ b/pkgs/applications/misc/qlcplus/default.nix
@@ -5,13 +5,13 @@

 mkDerivation rec {
  pname = "qlcplus";
-  version = "4.13.0";
+  version = "4.13.1";

  src = fetchFromGitHub {
    owner = "mcallegari";
    repo = "qlcplus";
    rev = "QLC+_${version}";
-    sha256 = "11av9hg6l0pb1lmlw35v1v2q9mmqz65yfaq01454y5qlmsbxpgkp";
+    sha256 = "sha256-AKmPxHOlMtea3q0NDULp3XfJ0JnYeF/iFUJw0dDOiio=";
  };

  nativeBuildInputs = [ qmake pkg-config ];
--- a/pkgs/applications/misc/snowsql/default.nix
+++ b/pkgs/applications/misc/snowsql/default.nix
@@ -10,11 +10,11 @@

 stdenv.mkDerivation rec {
  pname = "snowsql";
-  version = "1.2.26";
+  version = "1.3.0";

  src = fetchurl {
    url = "https://sfc-repo.snowflakecomputing.com/snowsql/bootstrap/${lib.versions.majorMinor version}/linux_x86_64/snowflake-snowsql-${version}-1.x86_64.rpm";
-    sha256 = "sha256-V0TZebmhc463DczQuTDy0nZQX+io61z/m32/n/EKFJY=";
+    sha256 = "sha256-KKCCj+pIwWhuzOuxljQ8Y11mAwD/GONspbXuPAMBdhE=";
  };

  nativeBuildInputs = [ rpmextract makeWrapper ];
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -3,10 +3,10 @@
 {
  firefox = buildMozillaMach rec {
    pname = "firefox";
-    version = "126.0.1";
+    version = "127.0";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "249605c4891ee9271def187d161369bd3ccbd347f5f0e175d0239aced3cb9ae9655d3c134b7705bda80ea1e63c0a2ee8eb4e76db0840019683376c00f20fc7ac";
+      sha512 = "5a17bce357e7f445c37540115f2c131ad5a055c0cf04f20bc2eaca18f8d241a99ac76739d172b38f2ad2681633f901a0a15893801082ac5db9e20e31fc8b8291";
    };

    extraPatches = [
@@ -94,11 +94,11 @@

  firefox-esr-115 = buildMozillaMach rec {
    pname = "firefox-esr-115";
-    version = "115.11.0esr";
+    version = "115.12.0esr";
    applicationName = "Mozilla Firefox ESR";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "0f3a87c99fb008088afd509d9259f893fdd44ea6bf6a5e69806fefb8d355415e81b9e8832a392acb9d0c1c50e4add7f1362a4aaadc35e1d9c2e55baf7136aed8";
+      sha512 = "d98475061d870e0f3aa920b7c0b9b0c1cbdb3f4102f760f1d1c5ea3e45e216c673c8d3662501e7e78af4950a003a519e94b57e9b1eda8d615c159cdf62130e89";
    };

    meta = {
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,15 +1,15 @@
 {
-  "packageVersion": "126.0-1",
+  "packageVersion": "126.0.1-1",
  "source": {
-    "rev": "126.0-1",
-    "sha256": "1q8fjki6rgzrir84y7j2anra2w213bm0g74nw205gja9qsxlassc"
+    "rev": "126.0.1-1",
+    "sha256": "0cac80073vkzd85ai9rbnwixs1h9bpy4dj2ri6jxdlqsy5d663km"
  },
  "settings": {
-    "rev": "e439bde05b2980089b9c8a6f990562dcd9e9ca4a",
-    "sha256": "16fzdpjqz5ih2pjkj698hrqlw4wck4adys4cdfc2kflf6aydk39m"
+    "rev": "1debc2d30949baff2d1e7df23e87900f1987a8ae",
+    "sha256": "12xgjv40mihbyfsah26vvdyb4yirydc1a884v2chnca4f5q00lc2"
  },
  "firefox": {
-    "version": "126.0",
-    "sha512": "56025b051d544ca294911a1d6a66f09945f71012131881b64313dafb579730810a4b091950c90a21d4fd3f393ba23670d8409086e1677d80d0bbbe347c303527"
+    "version": "126.0.1",
+    "sha512": "249605c4891ee9271def187d161369bd3ccbd347f5f0e175d0239aced3cb9ae9655d3c134b7705bda80ea1e63c0a2ee8eb4e76db0840019683376c00f20fc7ac"
  }
 }
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@@ -51,11 +51,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "opera";
-  version = "110.0.5130.23";
+  version = "110.0.5130.49";

  src = fetchurl {
    url = "${mirror}/${version}/linux/${pname}-stable_${version}_amd64.deb";
-    hash = "sha256-Y1YmTUvXHOXBB5Mei8lX0DCoEkOmgVCPtT1GnTqNTtA=";
+    hash = "sha256-ge2ne11BrODlvbu17G6xaLd4w2mIEsErtIaqlLY4os8=";
  };

  unpackPhase = "dpkg-deb -x $src .";
--- a/pkgs/applications/networking/cluster/inframap/default.nix
+++ b/pkgs/applications/networking/cluster/inframap/default.nix
@@ -4,13 +4,13 @@
 }:
 buildGoModule rec {
  pname = "inframap";
-  version = "0.6.7";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "cycloidio";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Ol2FkCP7Wq7FcwOaDw9d20v4jkNIfewdMErz/kJR0/g=";
+    hash = "sha256-jV9mMJNSsRWdbvHr7OvF1cF2KVqxUEjlM9AaVMxNqBI=";
  };

  ldflags = [
@@ -19,7 +19,7 @@ buildGoModule rec {
    "-X github.com/cycloidio/inframap/cmd.Version=${version}"
  ];

-  vendorHash = "sha256-fD/u0gYfbhyYWjXtBDtL7zWRu7b7mzpLPEjB+ictP6o=";
+  vendorHash = "sha256-cEKrxuuksMEEVJEZ9/ZU2/MMxWZKlO05DkNX4n3ug/0=";

  meta = with lib; {
    description = "Read your tfstate or HCL to generate a graph specific for each provider, showing only the resources that are most important/relevant";
--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "istioctl";
-  version = "1.22.0";
+  version = "1.22.1";

  src = fetchFromGitHub {
    owner = "istio";
    repo = "istio";
    rev = version;
-    hash = "sha256-xiIuCwzERvy7HFx9CZHen1tz1nwsTMryq5hB0om2dyo=";
+    hash = "sha256-KU0AvGecEvbkQ6PSjCMxpisx5UsFr1gLYXL4GzJ6zrU=";
  };
-  vendorHash = "sha256-de9cPm2MuflsOhFZfZmvZpLYiwt3UBgW+MO1Z2QB4F4=";
+  vendorHash = "sha256-arY8RLlHCPgRWnk6LLXlORiLr7afJj4OhfPMA+9UQ0M=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/cluster/k0sctl/default.nix
+++ b/pkgs/applications/networking/cluster/k0sctl/default.nix
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "k0sctl";
-  version = "0.17.8";
+  version = "0.18.0";

  src = fetchFromGitHub {
    owner = "k0sproject";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-QHTVNrPglNDT9CUQWwc6oD7ttwEUBq8WIX49DiAXf8s=";
+    hash = "sha256-bFNlNNc5PGim2yCX8YmWzPp1EzMrsSF3d/E+mf9Pw20=";
  };

-  vendorHash = "sha256-6Kj1kHKXbbPMr9thkDTmGYbZvCSW7CvSzASpk6agEpI=";
+  vendorHash = "sha256-pKvb7pKuGfa8Y+FvLwyWcYuuSszLin2+jFCQ7cPkkwQ=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/cluster/kompose/default.nix
+++ b/pkgs/applications/networking/cluster/kompose/default.nix
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kompose";
-  version = "1.32.0";
+  version = "1.34.0";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kompose";
    rev = "v${version}";
-    hash = "sha256-W9KAjyMp8fbnZunH5hwj0uctNYxEN/vbEDGaFJpv5hM=";
+    hash = "sha256-lBNf/pNJulex3WNRx8ZQcGag2nUPqjPKU9X/xDNxQjc=";
  };

-  vendorHash = "sha256-nY0d3r3faowHa7ylqDkUrX6MrGW3g1jYjm1MLFW/jK8=";
+  vendorHash = "sha256-SakezUp2Gj1PxY1Gwf8tH2yShtB/MPIqGjM/scrGG4I=";

  nativeBuildInputs = [ installShellFiles git ];

--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@@ -12,13 +12,13 @@

 buildGoModule rec {
  pname = "kubebuilder";
-  version = "3.15.1";
+  version = "4.0.0";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "kubebuilder";
    rev = "v${version}";
-    hash = "sha256-Fc9EzzOULRfzQENHd/7aXWqLeoPjNsseqpZETNGvV6U=";
+    hash = "sha256-JG2Wrq6fCE1zJmM7kXcEHIQVxv9eKV0Zy3ev5eY7Dv4=";
  };

  vendorHash = "sha256-g9QjalRLc2NUsyd7Do1PWw9oD9ATuJGMRaqSaC6AcD0=";
--- a/pkgs/applications/networking/cluster/kubefirst/default.nix
+++ b/pkgs/applications/networking/cluster/kubefirst/default.nix
@@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "kubefirst";
-  version = "2.4.8";
+  version = "2.4.9";

  src = fetchFromGitHub {
    owner = "kubefirst";
    repo = "kubefirst";
    rev = "refs/tags/v${version}";
-    hash = "sha256-r5y1eWjcw0HP/E9AQodEdCgWgKikGrwV6TvZ2mVcuoE=";
+    hash = "sha256-BuGE+SVLklToKnH7pptfuHqwddncUQq523RZtfmtkLg=";
  };

  vendorHash = "sha256-ZcZl4knlyKAwTsiyZvlkN5e2ox30B5aNzutI/2UEE9U=";
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "talosctl";
-  version = "1.7.2";
+  version = "1.7.4";

  src = fetchFromGitHub {
    owner = "siderolabs";
    repo = "talos";
    rev = "v${version}";
-    hash = "sha256-hYfh/faOQtN1MTnaCHsdogzBU3Xf6BY4apK+VuVCh6E=";
+    hash = "sha256-TVRWcgBt6MmHOh3LYSjJtp5qf/+ar+LWDGfHKQhDFZ8=";
  };

-  vendorHash = "sha256-5Dxtwu+PM0TbznIPTl8QxgOvNsQZUDMGY2kf+PSfCqo=";
+  vendorHash = "sha256-30fMLczb4+BVSxZSbhQ2S1MrQ2+Ykyqf+Dio8n0LGE0=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/applications/networking/cluster/waagent/default.nix
+++ b/pkgs/applications/networking/cluster/waagent/default.nix
@@ -14,12 +14,12 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "waagent";
-  version = "2.10.0.8";
+  version = "2.11.1.4";
  src = fetchFromGitHub {
    owner = "Azure";
    repo = "WALinuxAgent";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-Ilm29z+BJToVxdJTUAZO3Lr2DyOIvK6GW79GxAmfeM4=";
+    sha256 = "sha256-5V9js9gGkIsdGYrQQK/V6tPfL9lh2Cht4llOKBVTyOM=";
  };
  patches = [
    # Suppress the following error when waagent tries to configure sshd:
--- a/pkgs/applications/networking/davmail/default.nix
+++ b/pkgs/applications/networking/davmail/default.nix
@@ -16,17 +16,17 @@
 }:

 let
-  rev = 3464;
+  rev = 3546;
  jre' = if preferZulu then zulu else jre;
  gtk' = if preferGtk3 then gtk3 else gtk2;
 in
 stdenv.mkDerivation rec {
  pname = "davmail";
-  version = "6.2.0";
+  version = "6.2.2";

  src = fetchurl {
    url = "mirror://sourceforge/${pname}/${version}/${pname}-${version}-${toString rev}.zip";
-    sha256 = "sha256-FatB0t/BhZRMofYE0KD5LDYGjDQ8hriIszKJP8qNvhw=";
+    hash = "sha256-45paGy6SfUFXK6vY8L4tHFYiio1/5ah9vTyGImdgwHI=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/gns3/default.nix
+++ b/pkgs/applications/networking/gns3/default.nix
@@ -12,25 +12,25 @@ in {

  guiStable = mkGui {
    channel = "stable";
-    version = "2.2.46";
-    hash = "sha256-i/Eq66dYDGR4RLJ76ZlKruhU0KC9KlMMf8Wb91ZoyY0=";
+    version = "2.2.47";
+    hash = "sha256-6UXQTPkRHbtNX6RzWMakCsO9YpkFlWliNnm+mZ4wuZA=";
  };

  guiPreview = mkGui {
    channel = "stable";
-    version = "2.2.46";
-    hash = "sha256-i/Eq66dYDGR4RLJ76ZlKruhU0KC9KlMMf8Wb91ZoyY0=";
+    version = "2.2.47";
+    hash = "sha256-6UXQTPkRHbtNX6RzWMakCsO9YpkFlWliNnm+mZ4wuZA=";
  };

  serverStable = mkServer {
    channel = "stable";
-    version = "2.2.46";
-    hash = "sha256-A6rAhc/EGvbqVdg1jXxNX3bKQLcGurqa7hKh9LvH+es=";
+    version = "2.2.47";
+    hash = "sha256-iZ/1qACPLe7r1cZMhJbFRjVt/FlVgadBgp9tJwvYSi0=";
  };

  serverPreview = mkServer {
    channel = "stable";
-    version = "2.2.46";
-    hash = "sha256-A6rAhc/EGvbqVdg1jXxNX3bKQLcGurqa7hKh9LvH+es=";
+    version = "2.2.47";
+    hash = "sha256-iZ/1qACPLe7r1cZMhJbFRjVt/FlVgadBgp9tJwvYSi0=";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/beeper/default.nix
+++ b/pkgs/applications/networking/instant-messengers/beeper/default.nix
@@ -10,11 +10,11 @@
 }:
 let
  pname = "beeper";
-  version = "3.105.2";
+  version = "3.106.2";
  name = "${pname}-${version}";
  src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.105.2-build-240521yxdjizhu0-x86_64.AppImage";
-    hash = "sha256-Ov2Kii4f4zg/9OyUfm/qhyiqK6C6CC3DgETTx1HqIZ4=";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.106.2-build-240604xwl5q01pr-x86_64.AppImage";
+    hash = "sha256-WbAWJJzk58UVmRN3RHmU/V6zPiLWAb7m7hns4gmP55M=";
  };
  appimage = appimageTools.wrapType2 {
    inherit version pname src;
--- a/pkgs/applications/networking/instant-messengers/qq/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qq/default.nix
@@ -3,6 +3,7 @@
 , dpkg
 , fetchurl
 , glib
+, libssh2
 , gtk3
 , lib
 , libayatana-appindicator
@@ -11,6 +12,7 @@
 , libkrb5
 , libnotify
 , mesa # for libgbm
+, libpulseaudio
 , libGL
 , nss
 , xorg
@@ -57,6 +59,7 @@ stdenv.mkDerivation {
    glib
    gtk3
    libdrm
+    libpulseaudio
    libgcrypt
    libkrb5
    mesa
@@ -82,6 +85,7 @@ stdenv.mkDerivation {
      --replace "/usr/share" "$out/share"
    makeShellWrapper $out/opt/QQ/qq $out/bin/qq \
      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
+      --prefix LD_PRELOAD : "${lib.makeLibraryPath [ libssh2 ]}/libssh2.so.1" \
      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL ]}" \
      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
      --add-flags ${lib.escapeShellArg commandLineArgs} \
--- a/pkgs/applications/networking/instant-messengers/qq/sources.nix
+++ b/pkgs/applications/networking/instant-messengers/qq/sources.nix
@@ -1,9 +1,9 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2024-05-21
+# Last updated: 2024-06-07
 {
-  version = "3.2.8";
-  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.8_240520_amd64_01.deb";
-  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.8_240520_arm64_01.deb";
-  arm64_hash = "sha256-qSv7GqnXvp8IFh3krcJlKheRn4sF4cr4+ZItd2y8JUg=";
-  amd64_hash = "sha256-0j4hLSbPgKQOPqtESZqnZYbq3j/CYNG58XEpT7UHOT8=";
+  version = "3.2.9";
+  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.9_240606_amd64_01.deb";
+  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.9_240606_arm64_01.deb";
+  arm64_hash = "sha256-wZyaIkJdGDvIw8PrRlOiKpo3rdeELlxYBPyS6llbL4w=";
+  amd64_hash = "sha256-DcQWwep4p4aWUAoBNQ9Ge1QBiCxk6BhcziTDSHmRpgY=";
 }
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@@ -5,11 +5,11 @@

 appimageTools.wrapType2 rec {
  pname = "tutanota-desktop";
-  version = "229.240514.1";
+  version = "229.240517.0";

  src = fetchurl {
    url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
-    hash = "sha256-wUxg6Gu8jjV+EEvD9nt38BU5J3qoByvj+sUkilk4voc=";
+    hash = "sha256-NVr9OOq5YdqvCkrtjTRIfWWquxJ/sN8MhSlw3RvZVFs=";
  };

  extraPkgs = pkgs: [ pkgs.libsecret ];
--- a/pkgs/applications/networking/p2p/gnunet/default.nix
+++ b/pkgs/applications/networking/p2p/gnunet/default.nix
@@ -7,11 +7,11 @@

 stdenv.mkDerivation rec {
  pname = "gnunet";
-  version = "0.21.1";
+  version = "0.21.2";

  src = fetchurl {
    url = "mirror://gnu/gnunet/gnunet-${version}.tar.gz";
-    hash = "sha256-k+aLPqynCHJz49doX+auOLLoBV5MnnANNg3UBVJJeFw=";
+    hash = "sha256-jCNRJo6bi6KtKIuLM3zjmfecGOP/2WCAP07V3n3an6E=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/networking/remote/dayon/default.nix
+++ b/pkgs/applications/networking/remote/dayon/default.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dayon";
-  version = "14.0.1";
+  version = "14.0.2";

  src = fetchFromGitHub {
    owner = "RetGal";
    repo = "dayon";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-7XrgPrYKhaUvmXxiZLsduzrbyZRHjPSo+fg4BvlatHQ=";
+    hash = "sha256-nRNqubR44ydZwwuQG3q6TRm+MHTRgRbeLI9dsk83wq4=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/seafile-client/default.nix
+++ b/pkgs/applications/networking/seafile-client/default.nix
@@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "seafile-client";
-  version = "9.0.5";
+  version = "9.0.6";

  src = fetchFromGitHub {
    owner = "haiwen";
    repo = "seafile-client";
    rev = "v${version}";
-    sha256 = "sha256-fAPEtULab3Ug4gRCS+Eigp48JkORi7tvic2vp5jaw44=";
+    sha256 = "sha256-JjicVgDqiuIuVn7swbVekqQ+3Ly64Nd7qKu5UymTEYE=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/xpipe/default.nix
+++ b/pkgs/applications/networking/xpipe/default.nix
@@ -33,14 +33,14 @@ let
  }.${system} or throwSystem;

  hash = {
-    x86_64-linux = "sha256-E28OeidntQV5Zx6BQjlYxgTXSuQM0ZLCLdb+bIYz8fY=";
+    x86_64-linux = "sha256-nZg0Ha457zrBgYpKIHgGkDxTVQSRthQCCxtT2xWtAlQ=";
  }.${system} or throwSystem;

  displayname = "XPipe";

 in stdenvNoCC.mkDerivation rec {
  pname = "xpipe";
-  version = "9.4";
+  version = "9.4.1";

  src = fetchzip {
    url = "https://github.com/xpipe-io/xpipe/releases/download/${version}/xpipe-portable-linux-${arch}.tar.gz";
--- a/pkgs/applications/office/super-productivity/default.nix
+++ b/pkgs/applications/office/super-productivity/default.nix
@@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "super-productivity";
-  version = "8.0.5";
+  version = "8.0.7";

  src = fetchurl {
    url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-${version}.AppImage";
-    sha256 = "sha256-nH7dCrXBhkAYbvb9CPc4zhslFiYtA1ChuYPoHMdBBwQ=";
+    sha256 = "sha256-IBx7P7H2wO6VtqupAvwAwvuDzkm+e2DwWD4UjoDz9KQ=";
    name = "${pname}-${version}.AppImage";
  };

--- a/pkgs/applications/office/wpsoffice/default.nix
+++ b/pkgs/applications/office/wpsoffice/default.nix
@@ -19,6 +19,7 @@
 , curl
 , coreutils
 , cacert
+, libjpeg
 , useChineseVersion ? false
 }:
 let
@@ -72,6 +73,7 @@ stdenv.mkDerivation rec {
    alsa-lib
    at-spi2-core
    libtool
+    libjpeg
    libxkbcommon
    nspr
    mesa
@@ -120,6 +122,9 @@ stdenv.mkDerivation rec {
  preFixup = ''
    # The following libraries need libtiff.so.5, but nixpkgs provides libtiff.so.6
    patchelf --replace-needed libtiff.so.5 libtiff.so $out/opt/kingsoft/wps-office/office6/{libpdfmain.so,libqpdfpaint.so,qt/plugins/imageformats/libqtiff.so,addons/pdfbatchcompression/libpdfbatchcompressionapp.so}
+    patchelf --add-needed libtiff.so $out/opt/kingsoft/wps-office/office6/libwpsmain.so
+    # Fix: Wrong JPEG library version: library is 62, caller expects 80
+    patchelf --add-needed libjpeg.so $out/opt/kingsoft/wps-office/office6/libwpsmain.so
    # dlopen dependency
    patchelf --add-needed libudev.so.1 $out/opt/kingsoft/wps-office/office6/addons/cef/libcef.so
  '';
--- a/pkgs/applications/science/biology/ants/default.nix
+++ b/pkgs/applications/science/biology/ants/default.nix
@@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ANTs";
-  version = "2.5.1";
+  version = "2.5.2";

  src = fetchFromGitHub {
    owner = "ANTsX";
    repo = "ANTs";
    rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-q252KC6SKUN5JaQWAcsVmDprVkLXDvkYzNhC7yHJNpk=";
+    hash = "sha256-crvLxUP/uM0u1oakxcpsiULAKUo+86hGATs/kHNseaw=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/biology/jbrowse/default.nix
+++ b/pkgs/applications/science/biology/jbrowse/default.nix
@@ -2,11 +2,11 @@

 let
  pname = "jbrowse";
-  version = "2.11.1";
+  version = "2.11.2";

  src = fetchurl {
    url = "https://github.com/GMOD/jbrowse-components/releases/download/v${version}/jbrowse-desktop-v${version}-linux.AppImage";
-    sha256 = "sha256-/1QNpoJy4u2sSw6907UQpdYX9aFWp31BxsYVTQoDpi4=";
+    sha256 = "sha256-7kZsK3vYgxubgtoIG1dByHgEBOlh9GUq+i3u/1eo0/o=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/science/chemistry/gwyddion/default.nix
+++ b/pkgs/applications/science/chemistry/gwyddion/default.nix
@@ -16,10 +16,10 @@

 stdenv.mkDerivation rec {
  pname = "gwyddion";
-   version = "2.65";
+   version = "2.66";
  src = fetchurl {
    url = "mirror://sourceforge/gwyddion/gwyddion-${version}.tar.xz";
-    sha256 = "sha256-kRX7CoPJY8YkYNode5g0OCyWmL+5sM8puCmk9ZE2nqM=";
+    sha256 = "sha256-N3vtzSsNjRM6MpaG2p9fkYB/8dR5N/mZEZXx6GN5LVI=";
  };

  nativeBuildInputs = [ pkg-config file ];
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@@ -25,14 +25,14 @@ let
  };
 in
 stdenv.mkDerivation rec {
-  version = "16.2.15";
+  version = "16.2.17";
  pname = "jmol";

  src = let
    baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
  in fetchurl {
    url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    hash = "sha256-zPHh5IFdttliPc0SCgkM/3UQmS4eT2rfi5HqpFjY5hA=";
+    hash = "sha256-1iBLLfaoztbphhrG3NVWH+PVSbCZd+HQqvCYF3H9S/E=";
  };

  patchPhase = ''
--- a/pkgs/applications/version-management/gitmux/default.nix
+++ b/pkgs/applications/version-management/gitmux/default.nix
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gitmux";
-  version = "0.10.4";
+  version = "0.11.2";

  src = fetchFromGitHub {
    owner = "arl";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-toEKWkyCmeoG6eVK19RKipCqHM7OhZrkWRHNAclFgoI=";
+    sha256 = "sha256-0Cw98hTg8qPu7BUTBDEgFBOpoCxstPW9HeNXQUUjgGA=";
  };

  vendorHash = "sha256-PHY020MIuLlC1LqNGyBJRNd7J+SzoHbNMPAil7CKP/M=";
--- a/pkgs/applications/video/hypnotix/default.nix
+++ b/pkgs/applications/video/hypnotix/default.nix
@@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "hypnotix";
-  version = "4.3";
+  version = "4.4";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "hypnotix";
    rev = version;
-    hash = "sha256-nmldOziye+bSi8CA9TL0f3EKEKTeXRk3HFzf4ksE9oE=";
+    hash = "sha256-SGKa3yo3iEDAjsvfa6dBfM7sAnBVr0pB6zLKQb6e4Ys=";
  };

  patches = [
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -50,6 +50,7 @@
  meson,
  mujs,
  ninja,
+  nixosTests,
  nv-codec-headers-11,
  openalSoft,
  pipewire,
@@ -60,6 +61,7 @@
  speex,
  stdenv,
  swift,
+  testers,
  vapoursynth,
  vulkan-headers,
  vulkan-loader,
@@ -351,6 +353,18 @@ stdenv'.mkDerivation (finalAttrs: {

    wrapper = callPackage ./wrapper.nix { };
    scripts = callPackage ./scripts { };
+
+    tests = {
+      inherit (nixosTests) mpv;
+
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+      };
+      pkg-config = testers.hasPkgConfigModules {
+        package = finalAttrs.finalPackage;
+        moduleNames = [ "mpv" ];
+      };
+    };
  };

  meta = {
--- a/pkgs/applications/video/subtitleedit/default.nix
+++ b/pkgs/applications/video/subtitleedit/default.nix
@@ -18,11 +18,11 @@

 stdenv.mkDerivation rec {
  pname = "subtitleedit";
-  version = "4.0.5";
+  version = "4.0.6";

  src = fetchzip {
    url = "https://github.com/SubtitleEdit/subtitleedit/releases/download/${version}/SE${lib.replaceStrings [ "." ] [ "" ] version}.zip";
-    hash = "sha256-qYDLUqC5adzpmlQIq/EKmrkN8D8/EHZmP8QUGAaYf+s=";
+    hash = "sha256-ipAqnF7rpSXccWkyTysUBrD0/mnv5AEA5GuxMJjW9Dg=";
    stripRoot = false;
  };

--- a/pkgs/applications/video/vdr/softhddevice/default.nix
+++ b/pkgs/applications/video/vdr/softhddevice/default.nix
@@ -14,12 +14,12 @@
 }:
 stdenv.mkDerivation rec {
  pname = "vdr-softhddevice";
-  version = "2.3.2";
+  version = "2.3.3";

  src = fetchFromGitHub {
    owner = "ua0lnj";
    repo = "vdr-plugin-softhddevice";
-    sha256 = "sha256-nPIEj4DzHUOkwbwUk06Yv4lIGGn6d/C3kmK7EoaL6kE=";
+    sha256 = "sha256-PvSo5qiDMVrL6ylts5leR/3YAqIpIZcmnAqnGopPG94=";
    rev = "v${version}";
  };

--- a/pkgs/by-name/_2/_2ship2harkinian/0001-deps.patch
+++ b/pkgs/by-name/_2/_2ship2harkinian/0001-deps.patch
@@ -0,0 +1,16 @@
+Submodule libultraship contains modified content
+diff --git a/libultraship/cmake/dependencies/common.cmake b/libultraship/cmake/dependencies/common.cmake
+index 596158c..c62d7b2 100644
+--- a/libultraship/cmake/dependencies/common.cmake
+++ b/libultraship/cmake/dependencies/common.cmake
+@@ -47,10 +47,6 @@ set(stormlib_optimizations_patch git apply ${CMAKE_CURRENT_SOURCE_DIR}/cmake/dep
+ endif()
+ 
+ #=================== STB ===================
+-set(STB_DIR ${CMAKE_BINARY_DIR}/_deps/stb)
+-file(DOWNLOAD "https://github.com/nothings/stb/raw/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h" "${STB_DIR}/stb_image.h")
+-file(WRITE "${STB_DIR}/stb_impl.c" "#define STB_IMAGE_IMPLEMENTATION\n#include \"stb_image.h\"")
+-
+ add_library(stb STATIC)
+ 
+ target_sources(stb PRIVATE
--- a/pkgs/by-name/_2/_2ship2harkinian/package.nix
+++ b/pkgs/by-name/_2/_2ship2harkinian/package.nix
@@ -0,0 +1,216 @@
+{
+  stdenv,
+  cmake,
+  lsb-release,
+  ninja,
+  lib,
+  fetchFromGitHub,
+  fetchurl,
+  copyDesktopItems,
+  makeDesktopItem,
+  python3,
+  boost,
+  SDL2,
+  pkg-config,
+  libpulseaudio,
+  libpng,
+  imagemagick,
+  gnome,
+  makeWrapper,
+  imgui,
+  stormlib,
+  libzip,
+  nlohmann_json,
+  tinyxml-2,
+  spdlog,
+  fetchpatch,
+  writeTextFile,
+}:
+
+let
+
+  # 2ship needs a specific imgui version
+  imgui' = imgui.overrideAttrs rec {
+    version = "1.90.6";
+    src = fetchFromGitHub {
+      owner = "ocornut";
+      repo = "imgui";
+      rev = "v${version}-docking";
+      hash = "sha256-Y8lZb1cLJF48sbuxQ3vXq6GLru/WThR78pq7LlORIzc=";
+    };
+  };
+
+  # Apply 2ship's patch for stormlib
+  stormlib' = stormlib.overrideAttrs (prev: rec {
+    version = "9.25";
+    src = fetchFromGitHub {
+      owner = "ladislav-zezula";
+      repo = "StormLib";
+      rev = "v${version}";
+      hash = "sha256-HTi2FKzKCbRaP13XERUmHkJgw8IfKaRJvsK3+YxFFdc=";
+    };
+    buildInputs = prev.buildInputs ++ [ pkg-config ];
+    patches = (prev.patches or [ ]) ++ [
+      (fetchpatch {
+        name = "stormlib-optimizations.patch";
+        url = "https://github.com/briaguya-ai/StormLib/commit/ff338b230544f8b2bb68d2fbe075175ed2fd758c.patch";
+        hash = "sha256-Jbnsu5E6PkBifcx/yULMVC//ab7tszYgktS09Azs5+4=";
+      })
+    ];
+  });
+
+  # This would get fetched at build time otherwise, see:
+  # https://github.com/HarbourMasters/Shipwright/blob/e46c60a7a1396374e23f7a1f7122ddf9efcadff7/soh/CMakeLists.txt#L736
+  gamecontrollerdb = fetchurl {
+    name = "gamecontrollerdb.txt";
+    url = "https://raw.githubusercontent.com/gabomdq/SDL_GameControllerDB/30cb02c07001234f021eadf64035ef07753c1263/gamecontrollerdb.txt";
+    hash = "sha256-Q/OUrvoLY4fF/EJBmQC57y5b3D0Rmlyd9zAmB7U8SUU=";
+  };
+
+  thread_pool = fetchFromGitHub {
+    owner = "bshoshany";
+    repo = "thread-pool";
+    rev = "v4.1.0";
+    hash = "sha256-zhRFEmPYNFLqQCfvdAaG5VBNle9Qm8FepIIIrT9sh88=";
+  };
+
+  libgfxd = fetchFromGitHub {
+    owner = "glankk";
+    repo = "libgfxd";
+    rev = "008f73dca8ebc9151b205959b17773a19c5bd0da";
+    hash = "sha256-AmHAa3/cQdh7KAMFOtz5TQpcM6FqO9SppmDpKPTjTt8=";
+  };
+
+  stb_impl = writeTextFile {
+    name = "stb_impl.c";
+    text = ''
+      #define STB_IMAGE_IMPLEMENTATION
+      #include "stb_image.h"
+    '';
+  };
+
+  stb' = fetchurl {
+    name = "stb_image.h";
+    url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
+    hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "2ship2harkinian";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "HarbourMasters";
+    repo = "2ship2harkinian";
+    rev = finalAttrs.version;
+    hash = "sha256-czPAmqlXfhOjOYYssDuKt2YDlMlkruNx8EDXo1ksb14=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+    lsb-release
+    python3
+    imagemagick
+    copyDesktopItems
+    makeWrapper
+  ];
+
+  buildInputs = [
+    SDL2
+    libpulseaudio
+    libpng
+    gnome.zenity
+    imgui'
+    stormlib'
+    libzip
+    nlohmann_json
+    tinyxml-2
+    spdlog
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}/2s2h"
+    "-DFETCHCONTENT_SOURCE_DIR_IMGUI=${imgui'.src}"
+    "-DFETCHCONTENT_SOURCE_DIR_STORMLIB=${stormlib'}"
+    "-DFETCHCONTENT_SOURCE_DIR_LIBGFXD=${libgfxd}"
+    "-DFETCHCONTENT_SOURCE_DIR_THREADPOOL=${thread_pool}"
+    (lib.cmakeFeature "CMAKE_BUILD_TYPE" "Release")
+    (lib.cmakeBool "NON_PORTABLE" true)
+  ];
+
+  dontAddPrefix = true;
+
+  # Linking fails without this
+  hardeningDisable = [ "format" ];
+
+  # Pie needs to be enabled or else it segfaults
+  hardeningEnable = [ "pie" ];
+
+  preConfigure = ''
+    # mirror 2ship's stb
+    mkdir stb
+    cp ${stb'} ./stb/${stb'.name}
+    cp ${stb_impl} ./stb/${stb_impl.name}
+
+    substituteInPlace libultraship/cmake/dependencies/common.cmake \
+      --replace-fail "\''${STB_DIR}" "/build/source/stb"
+  '';
+
+  patches = [
+    # remove fetching stb as we will patch our own
+    ./0001-deps.patch
+  ];
+
+  postBuild = ''
+    cp ${gamecontrollerdb} ${gamecontrollerdb.name}
+    pushd ../OTRExporter
+    python3 ./extract_assets.py -z ../build/ZAPD/ZAPD.out --norom --xml-root ../mm/assets/xml --custom-assets-path ../mm/assets/custom --custom-otr-file 2ship.o2r --port-ver ${finalAttrs.version}
+    popd
+  '';
+
+  preInstall = ''
+    # Cmake likes it here for its install paths
+    cp ../OTRExporter/2ship.o2r mm/
+  '';
+
+  postInstall = ''
+    mkdir -p $out/bin
+    ln -s $out/2s2h/2s2h.elf $out/bin/2s2h
+    install -Dm644 ../mm/linux/2s2hIcon.png $out/share/pixmaps/2s2h.png
+  '';
+
+  fixupPhase = ''
+    wrapProgram $out/2s2h/2s2h.elf --prefix PATH ":" ${lib.makeBinPath [ gnome.zenity ]}
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "2s2h";
+      icon = "2s2h";
+      exec = "2s2h";
+      comment = finalAttrs.meta.description;
+      genericName = "2 Ship 2 Harkinian";
+      desktopName = "2s2h";
+      categories = [ "Game" ];
+    })
+  ];
+
+  meta = {
+    homepage = "https://github.com/HarbourMasters/2ship2harkinian";
+    description = "A PC port of Majora's Mask with modern controls, widescreen, high-resolution, and more";
+    mainProgram = "2s2h";
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [ qubitnano ];
+    license = with lib.licenses; [
+      # OTRExporter, OTRGui, ZAPDTR, libultraship
+      mit
+      # 2 Ship 2 Harkinian
+      cc0
+      # Reverse engineering
+      unfree
+    ];
+  };
+})
--- a/pkgs/by-name/_6/_64gram/package.nix
+++ b/pkgs/by-name/_6/_64gram/package.nix
@@ -7,7 +7,7 @@

 telegram-desktop.overrideAttrs (old: rec {
  pname = "64gram";
-  version = "1.1.24";
+  version = "1.1.27";

  src = fetchFromGitHub {
    owner = "TDesktop-x64";
@@ -15,7 +15,7 @@ telegram-desktop.overrideAttrs (old: rec {
    rev = "v${version}";

    fetchSubmodules = true;
-    hash = "sha256-pAtV/uKWCh9sODCYXf6gM8B0i2o5OiVH7z2iLjIZKP0=";
+    hash = "sha256-5Q2VxjiT1IpqCC9oXgHbKxcEfV/gPah0ovOpQ9TZJZs=";
  };

  passthru.updateScript = nix-update-script {};
--- a/pkgs/by-name/ai/airlift/package.nix
+++ b/pkgs/by-name/ai/airlift/package.nix
@@ -21,8 +21,13 @@ python3.pkgs.buildPythonApplication rec {
    sed -i '/argparse/d' pyproject.toml
  '';

-   nativeBuildInputs = [
+  pythonRelaxDeps = [
+    "hiyapyco"
+  ];
+
+  nativeBuildInputs = [
    python3.pkgs.poetry-core
+    python3.pkgs.pythonRelaxDepsHook
  ];

  buildInputs = [
--- a/pkgs/by-name/al/allmark/package.nix
+++ b/pkgs/by-name/al/allmark/package.nix
@@ -1,6 +1,10 @@
-{ buildGoPackage, fetchFromGitHub, lib }:
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:

-buildGoPackage rec {
+buildGoModule rec {
  pname = "allmark";
  version = "0.10.0";

@@ -11,18 +15,25 @@ buildGoPackage rec {
    hash = "sha256-JfNn/e+cSq1pkeXs7A2dMsyhwOnh7x2bwm6dv6NOjLU=";
  };

-  goPackagePath = "github.com/andreaskoch/allmark";
+  postPatch = ''
+    go mod init github.com/andreaskoch/allmark
+  '';
+
+  vendorHash = null;

  postInstall = ''
    mv $out/bin/{cli,allmark}
  '';

-  meta = with lib; {
+  meta = {
    description = "Cross-platform markdown web server";
    homepage = "https://github.com/andreaskoch/allmark";
    changelog = "https://github.com/andreaskoch/allmark/-/releases/v${version}";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ urandom ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
+      luftmensch-luftmensch
+      urandom
+    ];
    mainProgram = "allmark";
  };
 }
--- a/pkgs/by-name/ap/apl386/package.nix
+++ b/pkgs/by-name/ap/apl386/package.nix
@@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation {
  pname = "apl386";
-  version = "unstable-2022-03-07";
+  version = "0-unstable-2024-01-10";

  src = fetchFromGitHub {
    owner = "abrudz";
    repo = "APL386";
-    rev = "6332c9dbb588946a0e8c9d7984dd0c003eeea266";
-    hash = "sha256-oHk4e7NRgAjGtZzQmZToYz7wCZETaj7/yRwZMeeYF2M=";
+    rev = "43ebc6349506b0e7ab5c49f6b08f8afe66c4d9c5";
+    hash = "sha256-MLHSYHFyI9eKdrE/yM7u4vu4Dz6riEk7XQTUuAXPfzM=";
  };

  installPhase = ''
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ast-grep";
-  version = "0.22.5";
+  version = "0.22.6";

  src = fetchFromGitHub {
    owner = "ast-grep";
    repo = "ast-grep";
    rev = version;
-    hash = "sha256-BBF4gnsZmQ36NDX7X/CTGb9+N79S5lLmBaq5keGeNfA=";
+    hash = "sha256-QE8bTFlKlaxUeYJoaZyiuv/7zk+Pi3s64Er5YNTUh7I=";
  };

-  cargoHash = "sha256-bpwZ1yDeevjMlrLLBPQa9H5NIN99o39kicsOnp+kj9M=";
+  cargoHash = "sha256-tTEZUGC4RHjnAK+fMNkVqgsngBSdVAtoZ5ij3VbzKb4=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/at/athens/package.nix
+++ b/pkgs/by-name/at/athens/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
  pname = "athens";
-  version = "0.14.0";
+  version = "0.14.1";

  src = fetchFromGitHub {
    owner = "gomods";
    repo = "athens";
    rev = "v${version}";
-    hash = "sha256-5E9jBV+m19AUtSTpTlkCx8JUHwlcM2pgSGfo4zPqDNk=";
+    hash = "sha256-vpg5EcQSxVFjDFKa4oHwF5fNHhLWtj3ZMi2wbMZNn/8=";
  };

  vendorHash = "sha256-LajNPzGbWqW+9aqiquk2LvSUjKwi1gbDY4cKXmn3PWk=";
--- a/pkgs/by-name/at/attic-server/package.nix
+++ b/pkgs/by-name/at/attic-server/package.nix
@@ -1,7 +1,4 @@
-{ attic-client
-}:
-(attic-client.override {
-  crates = [ "attic-server" ];
-}).overrideAttrs {
-  meta.mainProgram = "atticd";
-}
+{ lib, attic-client }:
+lib.addMetaAttrs { mainProgram = "atticd"; } (
+  attic-client.override { crates = [ "attic-server" ]; }
+)
--- a/pkgs/by-name/ay/ayatana-indicator-power/package.nix
+++ b/pkgs/by-name/ay/ayatana-indicator-power/package.nix
@@ -21,13 +21,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ayatana-indicator-power";
-  version = "24.5.0";
+  version = "24.5.1";

  src = fetchFromGitHub {
    owner = "AyatanaIndicators";
    repo = "ayatana-indicator-power";
    rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-LS50YJ5MA1enBk2nxm0BFu2cuC53CZCvtZRE+PWjs+M=";
+    hash = "sha256-M7BzyQRPKyXMEY0FTMBXsCemC3+w8upjTHApWkRf71I=";
  };

  postPatch = ''
--- a/pkgs/by-name/ba/basedpyright/package.nix
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@@ -1,6 +1,5 @@
 {
  lib,
-  nix-update-script,
  buildNpmPackage,
  fetchFromGitHub,
  runCommand,
@@ -8,13 +7,13 @@
 }:

 let
-  version = "1.12.4";
+  version = "1.12.5";

  src = fetchFromGitHub {
    owner = "detachhead";
    repo = "basedpyright";
    rev = "v${version}";
-    hash = "sha256-ZcFCK6KKX10w5KgsUQIDMMBIzU+8pw0t9/pn1tzCnMg=";
+    hash = "sha256-fiaIkZoW0eOzVLOv9vhEk32kgKorNSG1vtNw0bIOtNU=";
  };

  patchedPackageJSON = runCommand "package.json" { } ''
@@ -44,7 +43,7 @@ let
    pname = "pyright-internal";
    inherit version src;
    sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-90IGWvXvUpvIQdpukm8njwcNj7La6rWwoENh4kiBayI=";
+    npmDepsHash = "sha256-bdlcGrYLnX318+MByYIzjnchl9n4+EcZKCZJgSMKyHo=";
    dontNpmBuild = true;
    # FIXME: Remove this flag when TypeScript 5.5 is released
    npmFlags = [ "--legacy-peer-deps" ];
@@ -60,7 +59,7 @@ buildNpmPackage rec {
  inherit version src;

  sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-HI3ehtJ29kFSv0XyrXcp5JGs9HGYb9ub2oOSQ6uEn8Q=";
+  npmDepsHash = "sha256-JDGNpyOBK3EwbHIHp4Zoo376MqU5u97Zj46vtuWY488=";

  postPatch = ''
    chmod +w ../../
@@ -76,7 +75,7 @@ buildNpmPackage rec {

  dontNpmBuild = true;

-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = ./update.sh;

  meta = {
    changelog = "https://github.com/detachhead/basedpyright/releases/tag/${version}";
--- a/pkgs/by-name/ba/basedpyright/update.sh
+++ b/pkgs/by-name/ba/basedpyright/update.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused common-updater-scripts jq prefetch-npm-deps
+set -euo pipefail
+
+version=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} -v -s https://api.github.com/repos/detachhead/basedpyright/releases/latest | jq -r '.tag_name | sub("^v"; "")')
+
+update-source-version basedpyright "$version"
+
+root="$(dirname "$(readlink -f "$0")")"
+FILE_PATH="$root/package.nix"
+REPO_URL_PREFIX="https://github.com/detachhead/basedpyright/raw"
+TEMP_DIR=$(mktemp -d)
+
+trap 'rm -rf "$TEMP_DIR"' EXIT
+
+# Function to download `package-lock.json` for a given source path and update hash
+update_hash() {
+    local source_root_path="$1"
+    local existing_hash="$2"
+
+    # Formulate download URL
+    local download_url="${REPO_URL_PREFIX}/v${version}${source_root_path}/package-lock.json"
+
+    # Download package-lock.json to temporary directory
+    curl -fsSL -v -o "${TEMP_DIR}/package-lock.json" "$download_url"
+
+    # Calculate the new hash
+    local new_hash
+    new_hash=$(prefetch-npm-deps "${TEMP_DIR}/package-lock.json")
+
+    # Update npmDepsHash in the original file
+    sed -i "s|$existing_hash|${new_hash}|" "$FILE_PATH"
+}
+
+while IFS= read -r source_root_line; do
+    [[ "$source_root_line" =~ sourceRoot ]] || continue
+    source_root_path=$(echo "$source_root_line" | sed -e 's/^.*"${src.name}\(.*\)";.*$/\1/')
+
+    # Extract the current npmDepsHash for this sourceRoot
+    existing_hash=$(grep -A1 "$source_root_line" "$FILE_PATH" | grep 'npmDepsHash' | sed -e 's/^.*npmDepsHash = "\(.*\)";$/\1/')
+
+    # Call the function to download and update the hash
+    update_hash "$source_root_path" "$existing_hash"
+done < "$FILE_PATH"
--- a/pkgs/by-name/bd/bdt/package.nix
+++ b/pkgs/by-name/bd/bdt/package.nix
@@ -0,0 +1,25 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "bdt";
+  version = "0.18.0";
+
+  src = fetchFromGitHub {
+    owner = "datafusion-contrib";
+    repo = "bdt";
+    rev = "5c6730a8e3cd43c7847aef76b499197730cded58";
+    hash = "sha256-gUKsJwbpMPSO+KPqyJRodrRLjUpTh/y6C2xhrgvJFKk=";
+  };
+
+  cargoHash = "sha256-4KrFhchoIB2N89m7HrL0xj2Z+u/6/6Onxa2wIAX18Io=";
+
+  meta = with lib; {
+    description = "boring data tool. A CLI tool to query parquet, json and avro files";
+    homepage = "https://github.com/datafusion-contrib/bdt";
+    license = licenses.asl20;
+    mainProgram = "bdt";
+    maintainers = with maintainers; [ matthiasq ];
+  };
+}
--- a/pkgs/by-name/be/betula/package.nix
+++ b/pkgs/by-name/be/betula/package.nix
@@ -3,15 +3,15 @@
 , buildGoModule
 }: buildGoModule rec {
  pname = "betula";
-  version = "1.2.0";
+  version = "1.3.1";

  src = fetchFromSourcehut {
    owner = "~bouncepaw";
    repo = "betula";
    rev = "v${version}";
-    hash = "sha256-oxwOGpf305VDlY3Mwl0dRJRRhe0yolaMMlpNspZdKQk=";
+    hash = "sha256-20sA2Hnnppr2RXqu2Qx2bkU/u9FUkH6INUUGx2zKfao=";
  };
-  vendorHash = "sha256-DjL2h6YKCJOWgmR/Gb0Eja38yJ4DymqW/SzmPG3+q9w=";
+  vendorHash = "sha256-SWcQYF8LP6lw5kWlAVFt3qiwDnvpSOXenmdm6TSfJSc=";

  CGO_ENABLED = 1;
  # These tests use internet, so are failing in Nix build.
--- a/pkgs/by-name/bm/bmake/001-bootstrap-fix.diff
+++ b/pkgs/by-name/bm/bmake/001-bootstrap-fix.diff
@@ -1,10 +0,0 @@
--- bmake/make-bootstrap.sh.in.orig     2019-02-19 10:55:21.733606117 -0800
-+++ bmake/make-bootstrap.sh.in  2019-02-19 10:56:02.150771541 -0800
-@@ -4,6 +4,7 @@
- 
- srcdir=@srcdir@
- 
-+prefix="@prefix@"
- DEFAULT_SYS_PATH="@default_sys_path@"
- 
- case "@use_meta@" in
--- a/pkgs/by-name/bm/bmake/002-dont-test-while-installing.diff
+++ b/pkgs/by-name/bm/bmake/002-dont-test-while-installing.diff
@@ -1,17 +1,17 @@
 diff -Naur bmake-old/boot-strap bmake-new/boot-strap
--- bmake-old/boot-strap	2023-06-27 18:02:19.000000000 -0300
-+++ bmake-new/boot-strap	2023-07-23 22:31:02.334720661 -0300
-@@ -413,9 +413,6 @@
+--- bmake-old/boot-strap	2024-03-10 14:51:10.000000000 -0300
+++ bmake-new/boot-strap	2024-05-30 21:49:13.689803511 -0300
+@@ -435,9 +435,6 @@
 	[ -s make-bootstrap.sh ] || op_configure
 	chmod 755 make-bootstrap.sh || exit 1
 	./make-bootstrap.sh || exit 1
 -	case "$op" in
-	build) op_test;;
+-	build) rm -f tested; op_test;;
 -	esac
 }
 
 op_test() {
-@@ -434,7 +431,6 @@
+@@ -461,7 +458,6 @@
 }
 
 op_install() {
--- a/pkgs/by-name/bm/bmake/package.nix
+++ b/pkgs/by-name/bm/bmake/package.nix
@@ -1,25 +1,24 @@
-{ lib
-, stdenv
-, fetchurl
-, getopt
-, ksh
-, bc
-, tzdata
-, pkgsMusl # for passthru.tests
+{
+  lib,
+  bc,
+  fetchurl,
+  getopt,
+  ksh,
+  pkgsMusl,
+  stdenv,
+  tzdata,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "bmake";
-  version = "20240301";
+  version = "20240520";

  src = fetchurl {
-    url = "http://www.crufty.net/ftp/pub/sjg/bmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-JM4L46z8i5PHWgeWxi7swWN246fAVXCzAtIEgOOOn1k=";
+    url = "https://www.crufty.net/ftp/pub/sjg/bmake-${finalAttrs.version}.tar.gz";
+    hash = "sha256-IhDM1FWwCN95Ufbb00e/zBg3xGRzAU5LjdX/MJGuKJQ=";
  };

  patches = [
-    # make bootstrap script aware of the prefix in /nix/store
-    ./001-bootstrap-fix.diff
    # decouple tests from build phase
    ./002-dont-test-while-installing.diff
    # preserve PATH from build env in unit tests
@@ -28,6 +27,41 @@ stdenv.mkDerivation (finalAttrs: {
    ./004-unconditional-ksh-test.diff
  ];

+  outputs = [ "out" "man" ];
+
+  nativeBuildInputs = [ getopt ];
+
+  nativeCheckInputs = [
+    bc
+    tzdata
+  ] ++ lib.optionals (stdenv.hostPlatform.libc != "musl") [
+    ksh
+  ];
+
+  # The generated makefile is a small wrapper for calling ./boot-strap with a
+  # given op. On a case-insensitive filesystem this generated makefile clobbers
+  # a distinct, shipped Makefile and causes infinite recursion during tests
+  # which eventually fail with "fork: Resource temporarily unavailable"
+  configureFlags = [
+    "--without-makefile"
+  ];
+
+  # Disabled tests:
+  # * directive-export{,-gmake}: another failure related to TZ variables
+  # * opt-keep-going-indirect: not yet known
+  # * varmod-localtime: musl doesn't support TZDIR and this test relies on
+  #   impure, implicit paths
+  env.BROKEN_TESTS = builtins.concatStringsSep " " [
+    "directive-export"
+    "directive-export-gmake"
+    "opt-keep-going-indirect"
+    "varmod-localtime"
+  ];
+
+  strictDeps = true;
+
+  doCheck = true;
+
  # Make tests work with musl
  # * Disable deptgt-delete_on_error test (alpine does this too)
  # * Disable shell-ksh test (ksh doesn't compile with musl)
@@ -39,16 +73,6 @@ stdenv.mkDerivation (finalAttrs: {
    substituteInPlace unit-tests/opt-chdir.exp --replace "File name" "Filename"
  '';

-  nativeBuildInputs = [ getopt ];
-
-  # The generated makefile is a small wrapper for calling ./boot-strap with a
-  # given op. On a case-insensitive filesystem this generated makefile clobbers
-  # a distinct, shipped, Makefile and causes infinite recursion during tests
-  # which eventually fail with "fork: Resource temporarily unavailable"
-  configureFlags = [
-    "--without-makefile"
-  ];
-
  buildPhase = ''
    runHook preBuild

@@ -65,29 +89,6 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

-  doCheck = true;
-
-  nativeCheckInputs = [
-    bc
-    tzdata
-  ] ++ lib.optionals (stdenv.hostPlatform.libc != "musl") [
-    ksh
-  ];
-
-  # Disabled tests:
-  # directive-export{,-gmake}: another failure related to TZ variables
-  # opt-chdir: ofborg complains about it somehow
-  # opt-keep-going-indirect: not yet known
-  # varmod-localtime: musl doesn't support TZDIR and this test relies on impure,
-  # implicit paths
-  env.BROKEN_TESTS = builtins.concatStringsSep " " [
-    "directive-export"
-    "directive-export-gmake"
-    "opt-chdir" # works on my machine -- AndersonTorres
-    "opt-keep-going-indirect"
-    "varmod-localtime"
-  ];
-
  checkPhase = ''
    runHook preCheck

@@ -96,22 +97,24 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postCheck
  '';

-  strictDeps = true;
-
  setupHook = ./setup-hook.sh;

-  passthru.tests.bmakeMusl = pkgsMusl.bmake;
+  passthru = {
+    tests = {
+      bmakeMusl = pkgsMusl.bmake;
+    };
+  };

  meta = {
-    homepage = "http://www.crufty.net/help/sjg/bmake.html";
+    homepage = "https://www.crufty.net/help/sjg/bmake.html";
    description = "Portable version of NetBSD 'make'";
    license = lib.licenses.bsd3;
    mainProgram = "bmake";
    maintainers = with lib.maintainers; [ thoughtpolice AndersonTorres ];
    platforms = lib.platforms.unix;
-    # ofborg: x86_64-linux builds the musl package, aarch64-linux doesn't
-    broken = stdenv.hostPlatform.isMusl && stdenv.buildPlatform.isAarch64;
+    # requires strip
+    badPlatforms = [ lib.systems.inspect.platformPatterns.isStatic ];
  };
 })
 # TODO: report the quirks and patches to bmake devteam (especially the Musl one)
-# TODO: investigate Musl support
+# TODO: investigate static support
--- a/pkgs/by-name/bn/bngblaster/package.nix
+++ b/pkgs/by-name/bn/bngblaster/package.nix
@@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bngblaster";
-  version = "0.8.51";
+  version = "0.9.2";

  src = fetchFromGitHub {
    owner = "rtbrick";
    repo = "bngblaster";
    rev = finalAttrs.version;
-    hash = "sha256-7AwLedYPOZAKQpWWuEasI9ytN66MZYKFO9SgXi7NjIo=";
+    hash = "sha256-ugfimJmyAHxgLypgEwzOK0VLmIYod5YzW7oO/omcl1I=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/ca/catppuccin-catwalk/package.nix
+++ b/pkgs/by-name/ca/catppuccin-catwalk/package.nix
@@ -8,7 +8,7 @@
  libwebp,
 }:
 let
-  version = "1.3.1";
+  version = "1.3.2";
 in
 rustPlatform.buildRustPackage {
  pname = "catppuccin-catwalk";
@@ -16,13 +16,12 @@ rustPlatform.buildRustPackage {

  src = fetchFromGitHub {
    owner = "catppuccin";
-    repo = "toolbox";
-    rev = "refs/tags/catwalk-v${version}";
-    hash = "sha256-Mk4Kv1EfaDiqLUa+aOPeoM4jFlKoUau+VuqmnazRgGI=";
+    repo = "catwalk";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Yj9xTQJ0eu3Ymi2R9fgYwBJO0V+4bN4MOxXCJGQ8NjU=";
  };

-  buildAndTestSubdir = "catwalk";
-  cargoHash = "sha256-qxY8CUOl7fF4afJyFjGeOVk7GX/cewC/hAaJf6m5tfA=";
+  cargoHash = "sha256-bx7AvzPoMJqPa+zcn139lH2zyF09EIz7FNHnh1g8wis=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/ch/challenger/package.nix
+++ b/pkgs/by-name/ch/challenger/package.nix
@@ -21,12 +21,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "challenger";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchgit {
    url = "https://git.taler.net/challenger.git";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-fjT3igPQ9dQtOezwZVfK5fBaL22FKOCbjUF0U1urK0g=";
+    hash = "sha256-utME8ywCf4hjgOZWp4j2+dNPPLbAqHd80A62waVvONE=";
  };

  # https://git.taler.net/challenger.git/tree/bootstrap
--- a/pkgs/by-name/cl/clash-verge-rev/package.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/package.nix
@@ -5,11 +5,11 @@

 clash-verge.overrideAttrs (old: rec {
  pname = "clash-verge-rev";
-  version = "1.6.4";
+  version = "1.6.5";

  src = fetchurl {
    url = "https://github.com/clash-verge-rev/clash-verge-rev/releases/download/v${version}/clash-verge_${version}_amd64.deb";
-    hash = "sha256-OhrC0trcl/zSCZSc4Tx9BDgqBxYiINF69LGVJQ0QGsw=";
+    hash = "sha256-pL6BWfRkyOzi7TnMAEcHyrUDVpK9IOeqcfRKfkHtWmw=";
  };

  meta = old.meta // (with lib; {
--- a/pkgs/by-name/cm/cmake-lint/package.nix
+++ b/pkgs/by-name/cm/cmake-lint/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  testers,
+  cmake-lint,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "cmake-lint";
+  version = "1.4.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "cmake-lint";
+    repo = "cmake-lint";
+    rev = "refs/tags/${version}";
+    hash = "sha256-/OuWwerBlJynEibaYo+jkLpHt4x9GZrqMRJNxgrDBlM=";
+  };
+
+  nativeBuildInputs = [ python3Packages.setuptools ];
+
+  pythonImportsCheck = [ "cmakelint" ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytestCheckHook
+    nose
+  ];
+
+  checkPhase = ''
+    nosetests
+  '';
+
+  passthru.tests = {
+    version = testers.testVersion { package = cmake-lint; };
+  };
+
+  meta = {
+    description = "Static code checker for CMake files";
+    homepage = "https://github.com/cmake-lint/cmake-lint";
+    changelog = "https://github.com/cmake-lint/cmake-lint/releases/tag/${version}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.luftmensch-luftmensch ];
+    mainProgram = "cmakelint";
+  };
+}
--- a/pkgs/by-name/cr/crawley/package.nix
+++ b/pkgs/by-name/cr/crawley/package.nix
@@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "crawley";
-  version = "1.7.5";
+  version = "1.7.6";

  src = fetchFromGitHub {
    owner = "s0rg";
    repo = "crawley";
    rev = "v${version}";
-    hash = "sha256-Ai+Y4WoU0REmo9ECsrV/i0PnPY+gO2+22np+nVH3Xsc=";
+    hash = "sha256-chnnWFE+teq3cjWmwwZ/Ql3KoY2b4wsLL8/5TWxX1fM=";
  };

  nativeBuildInputs = [ installShellFiles ];

-  vendorHash = "sha256-bI7PdUl+/kBx4F9T+tvF7QHNQ2pSvRjT31O/nIUvUAE=";
+  vendorHash = "sha256-byEb5CKi/zBjdvdkUdJeLbuZKf6o3z08r+XRkcGxvDs=";

  ldflags = [ "-w" "-s" ];

--- a/pkgs/by-name/de/decker/package.nix
+++ b/pkgs/by-name/de/decker/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "decker";
-  version = "1.41";
+  version = "1.43";

  src = fetchFromGitHub {
    owner = "JohnEarnest";
    repo = "Decker";
    rev = "v${version}";
-    hash = "sha256-AnWFAa96/lO5to7mVzHGkyzJ8U+2A9u9N1w91vHDsFo=";
+    hash = "sha256-8P8P5hakIMR+9ug61hkXyt6q1DrcwylKbDCvgFmQPdA=";
  };

  buildInputs = [
--- a/pkgs/by-name/de/deltachat-rpc-server/package.nix
+++ b/pkgs/by-name/de/deltachat-rpc-server/package.nix
@@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, libdeltachat
+, perl
+, pkg-config
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "deltachat-rpc-server";
+
+  inherit (libdeltachat) version src cargoLock buildInputs;
+
+  nativeBuildInputs = [
+    perl
+    pkg-config
+  ];
+
+  cargoBuildFlags = [ "--package" "deltachat-rpc-server" ];
+
+  doCheck = false;
+
+  meta = libdeltachat.meta // {
+    description = "Delta Chat RPC server exposing JSON-RPC core API over standard I/O";
+    mainProgram = "deltachat-rpc-server";
+  };
+}
--- a/pkgs/by-name/do/docopts/package.nix
+++ b/pkgs/by-name/do/docopts/package.nix
@@ -0,0 +1,34 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, fetchpatch
+}:
+buildGoModule rec {
+  pname = "docopts";
+  version = "0.6.4-with-no-mangle-double-dash";
+
+  src = fetchFromGitHub {
+    owner = "docopt";
+    repo = "docopts";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-GIBrJ5qexeJ6ul5ek9LJZC4J3cNExsTrnxdzRCfoqn8=";
+  };
+
+  patches = [
+    # Migrate project to Go modules.
+    (fetchpatch {
+      url = "https://github.com/docopt/docopts/pull/74/commits/2c516165e72b35516a64c4529dbc938c0aaa9442.patch";
+      sha256 = "sha256-Tp05B3tmctnSYIQzCxCc/fhcAWWuEz2ifu/CQZt0XPU=";
+    })
+  ];
+
+  vendorHash = "sha256-+pMgaHB69itbQ+BDM7/oaJg3HrT1UN+joJL7BO/2vxE=";
+
+  meta = {
+    homepage = "https://github.com/docopt/docopts";
+    description = "Shell interpreter for docopt, the command-line interface description language";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.confus ];
+    platforms = lib.platforms.unix;
+  };
+}
--- a/pkgs/by-name/e1/e1s/package.nix
+++ b/pkgs/by-name/e1/e1s/package.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, buildGoModule, fetchFromGitHub }:
 let
  pname = "e1s";
-  version = "1.0.36";
+  version = "1.0.37";
 in
 buildGoModule {
  inherit pname version;
@@ -10,10 +10,10 @@ buildGoModule {
    owner = "keidarcy";
    repo = "e1s";
    rev = "refs/tags/v${version}";
-    hash = "sha256-i2XCys/fXNS7aXxpAPVqFpuQGempcsBEbVuphXPpBIc=";
+    hash = "sha256-lqaLfGEllyRlVPkUfLUzPO2o+Ruzp1lFD6/RY4o1L14=";
  };

-  vendorHash = "sha256-fTrKqhfUg+/4xid9YWkTNkXm3HGaoeeJU0RIMW2mtq8=";
+  vendorHash = "sha256-oQVZ1SNXaXOngZazUVeWLvtZu17XvtIcrx+XC6PvGH0=";

  meta = with lib; {
    description = "Easily Manage AWS ECS Resources in Terminal 🐱";
--- a/pkgs/by-name/ej/ejsonkms/package.nix
+++ b/pkgs/by-name/ej/ejsonkms/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  testers,
+  ejsonkms,
+}:
+
+buildGoModule rec {
+  pname = "ejsonkms";
+  version = "0.2.2";
+
+  src = fetchFromGitHub {
+    owner = "envato";
+    repo = "ejsonkms";
+    rev = "v${version}";
+    hash = "sha256-aHnxdEADrzaRld7G2owSHO/0xYXIa8EBBR+phdA4eRM=";
+  };
+
+  vendorHash = "sha256-aLcSCDgd3IGiUg/JAPNIV30tAh6tDYZnFnqzaLELXw0=";
+
+  ldflags = [
+    "-X main.version=v${version}" "-s" "-w"
+  ];
+
+  doCheck = false;
+
+  passthru.tests = {
+    version = testers.testVersion {
+      package = ejsonkms;
+      version = "v${version}";
+    };
+  };
+
+  meta = with lib; {
+    description = "Integrates EJSON with AWS KMS";
+    homepage = "https://github.com/envato/ejsonkms";
+    license = licenses.mit;
+    maintainers = with maintainers; [ viraptor ];
+  };
+}
--- a/pkgs/by-name/et/ethercat/package.nix
+++ b/pkgs/by-name/et/ethercat/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "ethercat";
-  version = "1.6-alpha";
+  version = "1.6.0";

  src = fetchFromGitLab {
    owner = "etherlab.org";
    repo = "ethercat";
    rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-kzyA6h0rZFEROLcFZoU+2fIQ/Y0NwtdPuliKDbwkHrE=";
+    hash = "sha256-w1aoznLjCHh+dN2fyfpKpzq68B4D/rert2XFpTxk/F4=";
  };

  separateDebugInfo = true;
--- a/pkgs/by-name/ev/evebox/Cargo.lock
+++ b/pkgs/by-name/ev/evebox/Cargo.lock
--- a/pkgs/by-name/ev/evebox/package.nix
+++ b/pkgs/by-name/ev/evebox/package.nix
@@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "evebox";
+  version = "0.17.2";
+
+  src = fetchFromGitHub {
+    owner = "jasonish";
+    repo = "evebox";
+    rev = version;
+    hash = "sha256-djL5cdudJNPAWLMQPS2Dkcc9H/gouOuu8evcBDdY9wA=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "libsqlite3-sys-0.25.2" = "sha256-+c7ong6ca4WkEHl7ynCNn3WW68jF3pSYbllRsaNFGLc=";
+      "suricatax-rule-parser-0.1.0" = "sha256-upWgOKSAuj0pYGTeYKANzwutoF/m4AQ7MkzGYXmPbEo=";
+    };
+  };
+
+  meta = {
+    description = "Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search";
+    homepage = "https://evebox.org/";
+    changelog = "https://github.com/jasonish/evebox/releases/tag/${src.rev}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ felbinger ];
+    broken = stdenv.isDarwin;
+  };
+}
--- a/pkgs/by-name/fj/fjo/package.nix
+++ b/pkgs/by-name/fj/fjo/package.nix
@@ -0,0 +1,28 @@
+{ lib, stdenv, fetchFromGitea, rustPlatform, openssl, pkg-config }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "fjo";
+  version = "0.3.5";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "VoiDD";
+    repo = "fjo";
+    rev = "v${version}";
+    hash = "sha256-KjH78yqfZoN24TBYyFZuxf7z9poRov0uFYQ8+eq9p/o=";
+  };
+
+  cargoHash = "sha256-2G/TdajAqKiSoTL5FnukfS/eHkTNaGOj9EFpKsdb02k=";
+
+  buildInputs = [ openssl ];
+  nativeBuildInputs = [ pkg-config ];
+
+  meta = {
+    description = "CLI Tool for Codeberg similar to gh and glab";
+    homepage = "https://codeberg.org/VoiDD/fjo";
+    license = lib.licenses.agpl3Only;
+    mainProgram = "berg";
+    maintainers = with lib.maintainers; [ ehmry ];
+    broken = stdenv.isDarwin;
+  };
+}
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -8,14 +8,14 @@

 buildGoModule rec {
  pname = "forgejo-runner";
-  version = "3.4.1";
+  version = "3.5.0";

  src = fetchFromGitea {
    domain = "code.forgejo.org";
    owner = "forgejo";
    repo = "runner";
    rev = "v${version}";
-    hash = "sha256-c8heIHt+EJ6LnZT4/6TTWd7v85VRHjH72bdje12un4M=";
+    hash = "sha256-omp62KJVPSl3DqZxB1WJFd5secYIAc/6n6Ke5xzICQo=";
  };

  vendorHash = "sha256-FCCQZdAYRtJR3DGQIEvUzv+1kqvxVTGkwJwZSohq28s=";
--- a/pkgs/by-name/ga/gate/package.nix
+++ b/pkgs/by-name/ga/gate/package.nix
@@ -5,7 +5,7 @@

 let
  pname = "gate";
-  version = "0.37.0";
+  version = "0.37.1";
 in
 buildGoModule {
  inherit pname version;
@@ -14,10 +14,10 @@ buildGoModule {
    owner = "minekube";
    repo = "gate";
    rev = "refs/tags/v${version}";
-    hash = "sha256-TsyiAPhSjz7xzvxx6EJswwUasMr/GCf+QXcSFgaG1Ko=";
+    hash = "sha256-2oWC6l6SFrulk0EPLVtFfMKfVPHZFOngKjvOLprg/Yk=";
  };

-  vendorHash = "sha256-Ls99x08erFM6iP0UlMteafD4FCiq6HMF2ME89jyOEdE=";
+  vendorHash = "sha256-JaBcGcqFqp9Il3FyU/QwThuggzPg8HWScvFHEAgtgBU=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/by-name/gi/gitlab-ci-local/package.nix
+++ b/pkgs/by-name/gi/gitlab-ci-local/package.nix
@@ -6,16 +6,16 @@

 buildNpmPackage rec {
  pname = "gitlab-ci-local";
-  version = "4.49.0";
+  version = "4.50.1";

  src = fetchFromGitHub {
    owner = "firecow";
    repo = "gitlab-ci-local";
    rev = version;
-    hash = "sha256-hhzkC9wnPNwQwky2FegTMRIbcyCMzrZ/hoQlfZwk3sk=";
+    hash = "sha256-nlxYZY8SntMffmKiDpp/m8GfsB4lp+T8UoUPOLQlcC8=";
  };

-  npmDepsHash = "sha256-mnnP1YvKSm/CgZYQWF8VU+cuQ0SUV5tW1dCRrGRBrmg=";
+  npmDepsHash = "sha256-uDhot9kGmF717itia6hyx0xZkyMYDpH7BmGl12xSJyI=";

  postPatch = ''
    # remove cleanup which runs git commands
--- a/pkgs/by-name/gm/gmid/package.nix
+++ b/pkgs/by-name/gm/gmid/package.nix
@@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "gmid";
-  version = "2.0.3";
+  version = "2.0.4";

  src = fetchFromGitHub {
    owner = "omar-polo";
    repo = pname;
    rev = version;
-    hash = "sha256-izugxV+fSYBf193ilu70M3OkT6gnkXrTP45gEkEImuA=";
+    hash = "sha256-ioyQS5jjOICAWtZG8no+WUmLybEVLvum6TFFFdnMdfY=";
  };

  nativeBuildInputs = [ bison ];
--- a/pkgs/by-name/go/govers/package.nix
+++ b/pkgs/by-name/go/govers/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule {
+  pname = "govers";
+  version = "0-unstable-2016-06-23";
+
+  src = fetchFromGitHub {
+    owner = "rogpeppe";
+    repo = "govers";
+    rev = "77fd787551fc5e7ae30696e009e334d52d2d3a43";
+    sha256 = "sha256-lpc8wFKAB+A8mBm9q3qNzTM8ktFS1MYdIvZVFP0eiIs=";
+  };
+
+  vendorHash = null;
+
+  postPatch = ''
+    go mod init github.com/rogpeppe/govers
+  '';
+
+  dontRenameImports = true;
+
+  doCheck = false; # fails, silently
+
+  meta = {
+    description = "Tool for rewriting Go import paths";
+    homepage = "https://github.com/rogpeppe/govers";
+    license = lib.licenses.bsd3;
+    mainProgram = "govers";
+    maintainers = with lib.maintainers; [
+      luftmensch-luftmensch
+      urandom
+    ];
+  };
+}
--- a/pkgs/by-name/gr/grafana-alloy/package.nix
+++ b/pkgs/by-name/gr/grafana-alloy/package.nix
@@ -8,6 +8,7 @@
 , fixup-yarn-lock
 , nodejs
 , grafana-alloy
+, nixosTests
 , nix-update-script
 , installShellFiles
 , testers
@@ -103,6 +104,7 @@ buildGoModule rec {

  passthru = {
    tests = {
+      inherit (nixosTests) alloy;
      version = testers.testVersion {
        version = "v${version}";
        command = "${lib.getExe grafana-alloy} --version";
@@ -119,7 +121,7 @@ buildGoModule rec {
    mainProgram = "alloy";
    license = licenses.asl20;
    homepage = "https://grafana.com/oss/alloy";
-    maintainers = with maintainers; [ flokli emilylange ];
+    maintainers = with maintainers; [ flokli emilylange hbjydev ];
    platforms = lib.platforms.unix;
  };
 }
--- a/Show More
+++ b/Show More