Merge master into haskell-updates

2026-10-03 21:40:12 +00:00 · 2024-08-16 00:14:32 +00:00
parent 2546a4c70d 440bd67927
commit afc10f2c19
198 changed files with 4593 additions and 2409 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -15997,6 +15997,12 @@
    githubId = 43863;
    name = "Philip Taron";
  };
+  philipwilk = {
+    name = "Philip Wilk";
+    email = "p.wilk@student.reading.ac.uk";
+    github = "philipwilk";
+    githubId = 50517631;
+  };
  philtaken = {
    email = "philipp.herzog@protonmail.com";
    github = "philtaken";
--- a/nixos/modules/programs/chromium.nix
+++ b/nixos/modules/programs/chromium.nix
@@ -17,9 +17,7 @@ in

  options = {
    programs.chromium = {
-      enable = lib.mkEnableOption "the {command}`chromium` web browser";
-
-      package = lib.mkPackageOption pkgs "chromium" { };
+      enable = lib.mkEnableOption "{command}`chromium` policies";

      enablePlasmaBrowserIntegration = lib.mkEnableOption "Native Messaging Host for Plasma Browser Integration";

@@ -121,9 +119,8 @@ in

  ###### implementation

-  config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ cfg.package ];
-    environment.etc = {
+  config = {
+    environment.etc = lib.mkIf cfg.enable {
      # for chromium
      "chromium/native-messaging-hosts/org.kde.plasma.browser_integration.json" = lib.mkIf cfg.enablePlasmaBrowserIntegration
        { source = "${cfg.plasmaBrowserIntegrationPackage}/etc/chromium/native-messaging-hosts/org.kde.plasma.browser_integration.json"; };
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -866,7 +866,7 @@ let
          { name = "limits"; enable = cfg.limits != []; control = "required"; modulePath = "${package}/lib/security/pam_limits.so"; settings = {
            conf = "${makeLimitsConf cfg.limits}";
          }; }
-          { name = "motd"; enable = cfg.showMotd && (config.users.motd != null || config.users.motdFile != null); control = "optional"; modulePath = "${package}/lib/security/pam_motd.so"; settings = {
+          { name = "motd"; enable = cfg.showMotd && (config.users.motd != "" || config.users.motdFile != null); control = "optional"; modulePath = "${package}/lib/security/pam_motd.so"; settings = {
            inherit motd;
          }; }
          { name = "apparmor"; enable = cfg.enableAppArmor && config.security.apparmor.enable; control = "optional"; modulePath = "${pkgs.apparmor-pam}/lib/security/pam_apparmor.so"; settings = {
@@ -1478,9 +1478,9 @@ in
    '';

    users.motd = mkOption {
-      default = null;
+      default = "";
      example = "Today is Sweetmorn, the 4th day of The Aftermath in the YOLD 3178.";
-      type = types.nullOr types.lines;
+      type = types.lines;
      description = "Message of the day shown to users when they log in.";
    };

@@ -1498,7 +1498,7 @@ in
  config = {
    assertions = [
      {
-        assertion = config.users.motd == null || config.users.motdFile == null;
+        assertion = config.users.motd == "" || config.users.motdFile == null;
        message = ''
          Only one of users.motd and users.motdFile can be set.
        '';
--- a/nixos/tests/taskserver.nix
+++ b/nixos/tests/taskserver.nix
@@ -70,7 +70,7 @@ in {
        anotherOrganisation.users = [ "bob" ];
      };

-      specialisation.manual-config.configuration = {
+      specialisation.manual_config.configuration = {
        services.taskserver.pki.manual = {
          ca.cert = snakeOil.cacert;
          server.cert = snakeOil.cert;
@@ -95,7 +95,7 @@ in {
    cfg = nodes.server.config.services.taskserver;
    portStr = toString cfg.listenPort;
    specialisations = "${nodes.server.system.build.toplevel}/specialisation";
-    newServerSystem = "${specialisations}/manual-config";
+    newServerSystem = "${specialisations}/manual_config";
    switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test";
  in ''
    from shlex import quote
--- a/pkgs/applications/audio/eflite/default.nix
+++ b/pkgs/applications/audio/eflite/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
    '';
    license = lib.licenses.gpl2;
    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ jhhuh ];
+    maintainers = [ ];
    mainProgram = "eflite";
  };
 }
--- a/pkgs/applications/audio/quodlibet/default.nix
+++ b/pkgs/applications/audio/quodlibet/default.nix
@@ -1,7 +1,6 @@
 {
  lib,
  fetchFromGitHub,
-  fetchpatch,
  tag ? "",

  # build time
@@ -46,9 +45,9 @@
  xvfb-run,
 }:

-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication {
  pname = "quodlibet${tag}";
-  version = "4.6.0";
+  version = "4.6.0-unstable-2024-08-08";
  pyproject = true;

  outputs = [
@@ -59,24 +58,11 @@ python3.pkgs.buildPythonApplication rec {
  src = fetchFromGitHub {
    owner = "quodlibet";
    repo = "quodlibet";
-    rev = "refs/tags/release-${version}";
-    hash = "sha256-dkO/CFN7Dk72xhtmcSDcwUciOPMeEjQS2mch+jSfiII=";
+    rev = "3dcf31dfc8db9806d1f73a47fdabc950d35ded1d";
+    hash = "sha256-8qWuxTvMF6ksDkbZ6wRLPCJK1cSqgGMPac/ht6qVpnA=";
  };

-  patches = [
-    (fetchpatch {
-      name = "python-3.12-startup.patch";
-      url = "https://patch-diff.githubusercontent.com/raw/quodlibet/quodlibet/pull/4358.patch";
-      hash = "sha256-3IjtAX2mKO/Xi/iTwT5WBD5CMTRYFED7XMm/cx+29Zc=";
-    })
-    (fetchpatch {
-      name = "more-python-3.12-fixes.patch";
-      url = "https://patch-diff.githubusercontent.com/raw/quodlibet/quodlibet/pull/4364.patch";
-      hash = "sha256-VRIQ+4e+X0kjZYuxV2wEjrFr+x5biwBtIR50K6hSfCY=";
-      excludes = [ "poetry.lock" ];
-    })
-    ./fix-gdist-python-3.12.patch
-  ];
+  patches = [ ./fix-gdist-python-3.12.patch ];

  build-system = [ python3.pkgs.setuptools ];

--- a/pkgs/applications/audio/tageditor/default.nix
+++ b/pkgs/applications/audio/tageditor/default.nix
@@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "tageditor";
-  version = "3.9.1";
+  version = "3.9.2";

  src = fetchFromGitHub {
    owner = "martchus";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-FX0wb6GVTB/Y0m6qmoMbaeXPf8bA3+JqbGE8PPS6vAA=";
+    hash = "sha256-Bmi1U/SmYENlwsysAHsgFODU7R1RnU3xqbwhPEwsGcM=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/yasr/default.nix
+++ b/pkgs/applications/audio/yasr/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    longDescription = "Yasr is a general-purpose console screen reader for GNU/Linux and other Unix-like operating systems.";
    platforms = lib.platforms.linux;
    license = lib.licenses.gpl2;
-    maintainers = with lib.maintainers; [ jhhuh ];
+    maintainers = [ ];
    mainProgram = "yasr";
  };
 }
--- a/pkgs/applications/blockchains/ton/default.nix
+++ b/pkgs/applications/blockchains/ton/default.nix
@@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "ton";
-  version = "2024.06";
+  version = "2024.08";

  src = fetchFromGitHub {
    owner = "ton-blockchain";
    repo = "ton";
    rev = "v${version}";
-    hash = "sha256-5fuRdVayvmM+yK1WsdtWlCZpxz7KKBs+ZRfnueP0Ny0=";
+    hash = "sha256-OV/1//zIHebc3eLUxtUVV0TMuDdB25M7TT5y58x2Z68=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -252,7 +252,7 @@ let
          #   - https://github.com/vedang/pdf-tools/issues/109
          CXXFLAGS = "-std=c++17";

-          nativeBuildInputs = [
+          nativeBuildInputs = old.nativeBuildInputs ++ [
            pkgs.autoconf
            pkgs.automake
            pkgs.pkg-config
--- a/pkgs/applications/editors/kakoune/plugins/overrides.nix
+++ b/pkgs/applications/editors/kakoune/plugins/overrides.nix
@@ -194,4 +194,22 @@ declare-option -hidden str ansi_filter %{'"$out"'/bin/kak-ansi-filter}
      platforms = platforms.all;
    };
  };
+
+  kakoune-catppuccin = buildKakounePluginFrom2Nix {
+    pname = "kakoune-catppuccin";
+    version = "0-unstable-2024-03-29";
+    src = fetchFromGitHub {
+      owner = "catppuccin";
+      repo = "kakoune";
+      rev = "7f187d9da2867a7fda568b2135d29b9c00cfbb94";
+      hash = "sha256-acBOQuJ8MgsMKdvFV5B2CxuxvXIYsg11n1mHEGqd120=";
+    };
+    meta = with lib; {
+      description = "Soothing pastel theme for Kakoune";
+      homepage = "https://github.com/catppuccin/kakoune/";
+      license = licenses.mit;
+      platforms = platforms.all;
+      maintainers = with maintainers; [ philipwilk ];
+    };
+  };
 }
--- a/pkgs/applications/emulators/tinyemu/default.nix
+++ b/pkgs/applications/emulators/tinyemu/default.nix
@@ -1,46 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, SDL
-, curl
-, openssl
-}:
-
-stdenv.mkDerivation rec {
-  pname = "tinyemu";
-  version = "2019-12-21";
-
-  src = fetchurl {
-    url = "https://bellard.org/tinyemu/${pname}-${version}.tar.gz";
-    hash = "sha256-voNR8hIYGbMXL87c5csYJvoSyH2ht+2Y8mnT6AKgVVU=";
-  };
-
-  buildInputs = [
-    SDL
-    curl
-    openssl
-  ];
-
-  makeFlags = [
-    "CC:=$(CC)"
-    "STRIP:=$(STRIP)"
-    "DESTDIR=$(out)"
-    "bindir=/bin"
-  ];
-
-  preInstall = ''
-    mkdir -p "$out/bin"
-  '';
-
-  meta = with lib; {
-    homepage = "https://bellard.org/tinyemu/";
-    description = "System emulator for the RISC-V and x86 architectures";
-    longDescription = ''
-      TinyEMU is a system emulator for the RISC-V and x86 architectures. Its
-      purpose is to be small and simple while being complete.
-    '';
-    license = with licenses; [ mit bsd2 ];
-    maintainers = with maintainers; [ jhhuh AndersonTorres ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/graphics/xv/default.nix
+++ b/pkgs/applications/graphics/xv/default.nix
@@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "xv";
-  version = "5.2.0";
+  version = "6.0.0";

  src = fetchFromGitHub {
    owner = "jasper-software";
    repo = "xv";
    rev = "v${version}";
-    sha256 = "sha256-fqkGfK8Z6CxJIFhqS56fGF3PNACQRGEtTPcBDZpvUpE=";
+    sha256 = "sha256-KPX/HA9CUaRaIHkcFcM+oo3UasEQfZgmZwi6e/pbFuE=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/misc/pagefind/default.nix
+++ b/pkgs/applications/misc/pagefind/default.nix
@@ -9,6 +9,7 @@
 , rustc
 , wasm-bindgen-cli
 , wasm-pack
+, fetchpatch
 }:

 let
@@ -32,7 +33,15 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-pcgcu9zylSTjj5rxNff+afFBWVpN5sGtlpadG1wb93M=";
  };

-  cargoHash = "sha256-E4gjG5GrVWkMKgjQiAvEiSy2/tx/yHKe+5isveMZ9tU=";
+  cargoPatches = [
+    (fetchpatch { # https://github.com/CloudCannon/pagefind/pull/680
+      name = "cargo-update-time.patch";
+      url = "https://github.com/CloudCannon/pagefind/commit/e6778572d225316803180db822f5cc12a936acd2.patch";
+      hash = "sha256-XHpHA1hPIe+wjDQ6LE9hn2jn3eMBOK9Yoo920jfH9do=";
+    })
+  ];
+
+  cargoHash = "sha256-KWWln7QCRo02cOgHy5JNERGS0CvvgsPISwkTZeeNEkg=";

  env.npmDeps_web_js = fetchNpmDeps {
    name = "npm-deps-web-js";
--- a/pkgs/applications/misc/xmrig/moneroocean.nix
+++ b/pkgs/applications/misc/xmrig/moneroocean.nix
@@ -5,13 +5,13 @@

 xmrig.overrideAttrs (oldAttrs: rec {
  pname = "xmrig-mo";
-  version = "6.21.3-mo15";
+  version = "6.22.0-mo1";

  src = fetchFromGitHub {
    owner = "MoneroOcean";
    repo = "xmrig";
    rev = "v${version}";
-    hash = "sha256-eLI41O7SQUgNHFuMNT4W4pjAGDFe2plXuXmZH8QyCZ0=";
+    hash = "sha256-sojzyMC4+x6SyhcaWNzS+IFpqobrzpQB6Kwc2ybO5Dk=";
  };

  meta = with lib; {
--- a/pkgs/applications/networking/avalanchego/default.nix
+++ b/pkgs/applications/networking/avalanchego/default.nix
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "avalanchego";
-  version = "1.11.9";
+  version = "1.11.10";

  src = fetchFromGitHub {
    owner = "ava-labs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-n6uRXueDq4rsuNdGNe8mbaHXszeNd5Nygq43p7XI9mM=";
+    hash = "sha256-O+94hdRaPZYcU4ICiGGQ7CBKPMAT9qPCsMsHcurW+/4=";
  };

-  vendorHash = "sha256-uTMkUARs8XWDmpI7NHu+7BmEPnutkUSmcis+8uDLUH4=";
+  vendorHash = "sha256-jXtnPBlSeA1Q+2VY+It7XnORz6uW0ZLYX+csBTYolNE=";
  # go mod vendor has a bug, see: https://github.com/golang/go/issues/57529
  proxyVendor = true;

--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -1,11 +1,11 @@
 {
  stable = {
    chromedriver = {
-      hash_darwin = "sha256-Evz39J4o3FJdJbYsFxmnLiZ9QiMeZttcbTtZ6wAVXoQ=";
+      hash_darwin = "sha256-z+08R1CYi53edNEDSvJ303+hc/pqiFvVhUkD+g4q6tE=";
      hash_darwin_aarch64 =
-        "sha256-4Dkdi5C6dcuEewYvy60F5m4ynzb5lGWrJFs1Q+4vapI=";
-      hash_linux = "sha256-Lls/gwyA28G8X41wXEIKlgNdmKWgWnPf6iHZGrU8e54=";
-      version = "127.0.6533.99";
+        "sha256-q60NWIka3QzLsWg3X/+qTWby6UTf7wvjCDdZWlUjzPA=";
+      hash_linux = "sha256-6E6LaQCx+2Xd/vjjaiQR3vJgkP7L4MRkA7Bb0jTrakc=";
+      version = "127.0.6533.119";
    };
    deps = {
      gn = {
@@ -15,8 +15,8 @@
        version = "2024-06-06";
      };
    };
-    hash = "sha256-VKPlcBfS6iw4E1nz0nYJLg273XmJ+RcGGktRbqQTTwQ=";
-    version = "127.0.6533.99";
+    hash = "sha256-LuUDEpYCJLR/X+zjsF26aum4/Wfu2MNowofPu8iRVxI=";
+    version = "127.0.6533.119";
  };
  ungoogled-chromium = {
    deps = {
@@ -27,11 +27,11 @@
        version = "2024-06-06";
      };
      ungoogled-patches = {
-        hash = "sha256-4iI+1mVMoI1xg2t+33PiYDsiuXw0v4oUbSbYX+I9Q7s=";
-        rev = "127.0.6533.99-1";
+        hash = "sha256-m1H/7JsSF7Akm5eBlPB/F4mAdFjUPtOQIUoXup09w40=";
+        rev = "127.0.6533.119-1";
      };
    };
-    hash = "sha256-VKPlcBfS6iw4E1nz0nYJLg273XmJ+RcGGktRbqQTTwQ=";
-    version = "127.0.6533.99";
+    hash = "sha256-LuUDEpYCJLR/X+zjsF26aum4/Wfu2MNowofPu8iRVxI=";
+    version = "127.0.6533.119";
  };
 }
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@@ -1,16 +1,23 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles, testers, kubernetes-helm }:
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  testers,
+  kubernetes-helm,
+}:

 buildGoModule rec {
  pname = "kubernetes-helm";
-  version = "3.15.3";
+  version = "3.15.4";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${version}";
-    sha256 = "sha256-m5k1MUncx9xSGu49Qjy1MByl3h6Qz7VCNrveqRVjtdQ=";
+    sha256 = "sha256-hFQX9v37cXJ4wv1aQnBOBlmVWUiZuKrjCJ/R4dzUa/4=";
  };
-  vendorHash = "sha256-2q5IziYSW2FFfRZvWKz6dVnJfauRlE9lRrb4/l2EGC0=";
+  vendorHash = "sha256-lR/6n+EH4Nhs1Q/BqEkMlugM74NtEtT+SKQQHc6+Zjk=";

  subPackages = [ "cmd/helm" ];
  ldflags = [
@@ -68,6 +75,13 @@ buildGoModule rec {
    description = "Package manager for kubernetes";
    mainProgram = "helm";
    license = licenses.asl20;
-    maintainers = with maintainers; [ rlupton20 edude03 saschagrunert Frostman Chili-Man techknowlogick ];
+    maintainers = with maintainers; [
+      rlupton20
+      edude03
+      saschagrunert
+      Frostman
+      Chili-Man
+      techknowlogick
+    ];
  };
 }
--- a/pkgs/applications/networking/cluster/kubectl-view-secret/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-view-secret/default.nix
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubectl-view-secret";
-  version = "0.12.1";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "elsesiy";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-0/gz3fquqZCRbHQrBBLXs2rwQPkyktEcBMQ46GfMauo=";
+    hash = "sha256-mdooeKlwoPxiAHaOuhMF+Zx1l0uZ1OYMgDADI7JbYDc=";
  };

-  vendorHash = "sha256-OJboCLa+ntKOhmQ9zs5aF/mio5OFsr/f/IS0PAwAi6U=";
+  vendorHash = "sha256-5mSS7UWfdk28oXk/ONnnjj4OMGJAtH26xGES4NGZuTc=";

  subPackages = [ "./cmd/" ];

--- a/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/pkgs/applications/networking/cluster/nomad/default.nix
@@ -87,9 +87,9 @@ rec {

  nomad_1_8 = generic {
    buildGoModule = buildGo122Module;
-    version = "1.8.2";
-    sha256 = "sha256-deVLC7yGgLHCauq+3h0Uu5ln5omoeV8/FkVtQM9CEXc=";
-    vendorHash = "sha256-Pr38tRzym8UFPZKs9367xOZJ9P5OHotwwClorcSgOys=";
+    version = "1.8.3";
+    sha256 = "sha256-u1R5lG9fpIbAePLlDy+kk2hQpFdT1VIY0sMskHJZ19w=";
+    vendorHash = "sha256-5Gn37hFVDkUlyv4MVZMH9PlpyWAyWE5RTFQyuMIA/Bc=";
    license = lib.licenses.bsl11;
    passthru.tests.nomad = nixosTests.nomad;
    preCheck = ''
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -45,14 +45,14 @@ let

  pname = "slack";

-  x86_64-darwin-version = "4.39.90";
-  x86_64-darwin-sha256 = "0wdvsw0m1jks1n97anzamssicl9jfx9js480q3kl9hd80viz97lq";
+  x86_64-darwin-version = "4.39.95";
+  x86_64-darwin-sha256 = "1bvafqnh60ps5dba473l6zpm6hw7qcmpj55mxm6amakvkp63d92s";

-  x86_64-linux-version = "4.39.90";
-  x86_64-linux-sha256 = "00ygbka304xnh99s17hh51lxjdkv2flh6nmn143dkj7qqabgrll8";
+  x86_64-linux-version = "4.39.95";
+  x86_64-linux-sha256 = "06d4mnvk3fj57laygf08nlh970wb4jvq1kycv27h1bq6bq365b6n";

-  aarch64-darwin-version = "4.39.90";
-  aarch64-darwin-sha256 = "0rm0khbf2bqxs2ddlmss7m3sb5yy05lb96kv0a065ifadzcf5zsb";
+  aarch64-darwin-version = "4.39.95";
+  aarch64-darwin-sha256 = "0kmbf9nd6ccng8a9qb02i2n2mcrjk45cqphx0k7drwd4nyn6zzmy";

  version = {
    x86_64-darwin = x86_64-darwin-version;
--- a/pkgs/applications/science/biology/kallisto/default.nix
+++ b/pkgs/applications/science/biology/kallisto/default.nix
@@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "kallisto";
-  version = "0.50.1";
+  version = "0.51.0";

  src = fetchFromGitHub {
    repo = "kallisto";
    owner = "pachterlab";
    rev = "v${version}";
-    sha256 = "sha256-JJZJOl4u6FzngrrMuC2AfD5ry2LBOT8tdz2piH+9LFE=";
+    sha256 = "sha256-+tnuka6uzoNr5pLuE2yV97KmqdThIG0IwiO+SCYiCk8=";
  };

  nativeBuildInputs = [ autoconf cmake ];
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -56,7 +56,7 @@

 stdenv.mkDerivation rec {
  pname = "root";
-  version = "6.32.02";
+  version = "6.32.04";

  passthru = {
    tests = import ./tests { inherit callPackage; };
@@ -64,15 +64,15 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    hash = "sha256-PQ92vwWFfhgHzPssngFPUlvLYl+UojcLRV9LFklhYC0=";
+    hash = "sha256-Ey8Saq59MO+8zX3NmRt62hiQrleYDvMAwWQh+dTQfqg=";
  };

  clad_src = fetchgit {
    url = "https://github.com/vgvassilev/clad";
    # Make sure that this is the same tag as in the ROOT build files!
    # https://github.com/root-project/root/blob/master/interpreter/cling/tools/plugins/clad/CMakeLists.txt#L76
-    rev = "refs/tags/v1.5";
-    hash = "sha256-s0DbHfLthv51ZICnTd30O4qG/DyZPk5tADeu3bBRoOw=";
+    rev = "refs/tags/v1.6";
+    hash = "sha256-Fv3i84lgoifxtyWKhQjj1c4bR9wSl5SPzUh0ZhZBxFI=";
  };

  nativeBuildInputs = [ makeWrapper cmake pkg-config git ];
@@ -165,6 +165,7 @@ stdenv.mkDerivation rec {
    "-Dfail-on-missing=ON"
    "-Dfitsio=OFF"
    "-Dgnuinstall=ON"
+    "-Dmathmore=ON"
    "-Dmysql=OFF"
    "-Dpgsql=OFF"
    "-Dsqlite=OFF"
--- a/pkgs/applications/terminal-emulators/wezterm/Cargo.lock
+++ b/pkgs/applications/terminal-emulators/wezterm/Cargo.lock
@@ -3648,6 +3648,12 @@ dependencies = [
 "num-traits",
 ]

+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-derive"
 version = "0.3.3"
@@ -5554,12 +5560,13 @@ dependencies = [

 [[package]]
 name = "time"
-version = "0.3.31"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f657ba42c3f86e7680e53c8cd3af8abbe56b5491790b46e22e19c0d57463583e"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
 "deranged",
 "itoa",
+ "num-conv",
 "powerfmt",
 "serde",
 "time-core",
@@ -5589,10 +5596,11 @@ dependencies = [

 [[package]]
 name = "time-macros"
-version = "0.2.16"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26197e33420244aeb70c3e8c78376ca46571bc4e701e4791c2cd9f57dcb3a43f"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
+ "num-conv",
 "time-core",
 ]

--- a/pkgs/applications/terminal-emulators/wezterm/default.nix
+++ b/pkgs/applications/terminal-emulators/wezterm/default.nix
@@ -43,6 +43,8 @@ rustPlatform.buildRustPackage rec {
  };

  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
+
    echo ${version} > .tag

    # tests are failing with: Unable to exchange encryption keys
--- a/pkgs/applications/version-management/delta/default.nix
+++ b/pkgs/applications/version-management/delta/default.nix
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "delta";
-  version = "0.17.0";
+  version = "0.17.0-unstable-2024-08-12";

  src = fetchFromGitHub {
    owner = "dandavison";
    repo = pname;
-    rev = version;
-    hash = "sha256-r0ED9o2UP91fe6Bng5ioJra5S1bg+UEXMLeSQPkMswI=";
+    rev = "a01141b72001f4c630d77cf5274267d7638851e4";
+    hash = "sha256-My51pQw5a2Y2VTu39MmnjGfmCavg8pFqOmOntUildS0=";
  };

-  cargoHash = "sha256-3CxRNhcjfDK/xUuM3w+GwqE0+X6WT92/LGj/qRp0TwA=";
+  cargoHash = "sha256-Rlc3Bc6Jh89KLLEWBWQB5GjoeIuHnwIVZN/MVFMjY24=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
@@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "advanced-scene-switcher";
-  version = "1.26.4";
+  version = "1.27.0";

  src = fetchFromGitHub {
    owner = "WarmUpTill";
    repo = "SceneSwitcher";
    rev = version;
-    hash = "sha256-qUKywOfUiGKBmyREns2LnWECGeFhdA4ecpgGJQAIKpU=";
+    hash = "sha256-RdXqiFMlpKTmedF+VBzROx0qTKDOdkQ3hO4Xj0vIq2A=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/virtualization/crosvm/default.nix
+++ b/pkgs/applications/virtualization/crosvm/default.nix
@@ -6,18 +6,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "crosvm";
-  version = "126.0";
+  version = "127.0";

  src = fetchgit {
    url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "5533201f3ff3230d121e06100557d369c055e6dc";
-    hash = "sha256-Ufi8dIhNgXvD53PWLG2uj7CD37UZIegrqAQz3wTKTvE=";
+    rev = "8fdfed12c960850e9d5e809cfd2a40ce3bdd98d6";
+    hash = "sha256-W0zLYM91xoq9vURgYs2noc9F9RtvoXztIIHMx0HVK5g=";
    fetchSubmodules = true;
  };

  separateDebugInfo = true;

-  cargoHash = "sha256-E2lyBgptQs+/5JS2WJc4ietguXdK16DFEVzqylmX+Pk=";
+  cargoHash = "sha256-nEJBRlwMqTahaIC9WdtoxGLVfc+U9sJ0ilzLhavcbD0=";

  nativeBuildInputs = [
    pkg-config protobuf python3 rustPlatform.bindgenHook wayland-scanner
--- a/pkgs/applications/virtualization/xen/4.16/default.nix
+++ b/pkgs/applications/virtualization/xen/4.16/default.nix
@@ -12,7 +12,11 @@ let
    inherit fetchpatch;
  };

-  upstreamPatchList = lib.lists.flatten [ upstreamPatches.XSA_458 ];
+  upstreamPatchList = lib.lists.flatten [
+    upstreamPatches.XSA_458
+    upstreamPatches.XSA_460
+    upstreamPatches.XSA_461
+  ];
 in

 callPackage (import ../generic.nix {
--- a/pkgs/applications/virtualization/xen/4.17/default.nix
+++ b/pkgs/applications/virtualization/xen/4.17/default.nix
@@ -15,6 +15,8 @@ let
  upstreamPatchList = lib.lists.flatten [
    upstreamPatches.QUBES_REPRODUCIBLE_BUILDS
    upstreamPatches.XSA_458
+    upstreamPatches.XSA_460
+    upstreamPatches.XSA_461
  ];
 in

--- a/pkgs/applications/virtualization/xen/4.18/default.nix
+++ b/pkgs/applications/virtualization/xen/4.18/default.nix
@@ -15,6 +15,8 @@ let
  upstreamPatchList = lib.lists.flatten [
    upstreamPatches.QUBES_REPRODUCIBLE_BUILDS
    upstreamPatches.XSA_458
+    upstreamPatches.XSA_460
+    upstreamPatches.XSA_461
  ];
 in

--- a/pkgs/applications/virtualization/xen/4.19/default.nix
+++ b/pkgs/applications/virtualization/xen/4.19/default.nix
@@ -12,7 +12,11 @@ let
    inherit fetchpatch;
  };

-  upstreamPatchList = lib.lists.flatten [ upstreamPatches.QUBES_REPRODUCIBLE_BUILDS ];
+  upstreamPatchList = lib.lists.flatten [
+    upstreamPatches.QUBES_REPRODUCIBLE_BUILDS
+    upstreamPatches.XSA_460
+    upstreamPatches.XSA_461
+  ];
 in

 callPackage (import ../generic.nix {
--- a/pkgs/applications/virtualization/xen/patches.nix
+++ b/pkgs/applications/virtualization/xen/patches.nix
@@ -99,7 +99,7 @@ in
    })
  ];

-  # Xen Security Advisory #458: (4.16 - 4.19-rc3)
+  # Xen Security Advisory #458: (4.16.6 - 4.19-rc3)
  "XSA_458" = xsaPatch {
    id = "458";
    title = "Double unlock in x86 guest IRQ handling";
@@ -114,4 +114,39 @@ in
    cve = [ "CVE-2024-31143" ];
    hash = "sha256-yHI9Sp/7Ed40iIYQ/HOOIULlfzAzL0c0MGqdF+GR+AQ=";
  };
+  # Xen Security Advisory #460: (4.16.6 - 4.19.0)
+  "XSA_460" = xsaPatch {
+    id = "460";
+    title = "Error handling in x86 IOMMU identity mapping";
+    description = ''
+      Certain PCI devices in a system might be assigned Reserved Memory
+      Regions (specified via Reserved Memory Region Reporting, "RMRR") for
+      Intel VT-d or Unity Mapping ranges for AMD-Vi.  These are typically used
+      for platform tasks such as legacy USB emulation.
+      Since the precise purpose of these regions is unknown, once a device
+      associated with such a region is active, the mappings of these regions
+      need to remain continuouly accessible by the device.  In the logic
+      establishing these mappings, error handling was flawed, resulting in
+      such mappings to potentially remain in place when they should have been
+      removed again.  Respective guests would then gain access to memory
+      regions which they aren't supposed to have access to.
+    '';
+    cve = [ "CVE-2024-31145" ];
+    hash = "sha256-3q4nAP2xGEptX6BIpSlALOt2r0kjj1up5pF3xCFp+l0=";
+  };
+  # Xen Security Advisory #461: (4.16.6 - 4.19.0)
+  "XSA_461" = xsaPatch {
+    id = "461";
+    title = "PCI device pass-through with shared resources";
+    description = ''
+      When multiple devices share resources and one of them is to be passed
+      through to a guest, security of the entire system and of respective
+      guests individually cannot really be guaranteed without knowing
+      internals of any of the involved guests.  Therefore such a configuration
+      cannot really be security-supported, yet making that explicit was so far
+      missing.
+    '';
+    cve = [ "CVE-2024-31146" ];
+    hash = "sha256-JQWoqf47hy9WXNkVC/LgmjUhkxN0SBF6w8PF4aFZxhM=";
+  };
 }
--- a/pkgs/applications/window-managers/e16/default.nix
+++ b/pkgs/applications/window-managers/e16/default.nix
@@ -22,11 +22,11 @@

 stdenv.mkDerivation rec {
  pname = "e16";
-  version = "1.0.29";
+  version = "1.0.30";

  src = fetchurl {
    url = "mirror://sourceforge/enlightenment/e16-${version}.tar.xz";
-    hash = "sha256-LvLiw6+hduAl8dNBTtBwqvgKBRwojBUd5tNm1hZl5Hs=";
+    hash = "sha256-JKBmBgC5cN4XO03r0NR78Ly9tpI733/sUEPL0GLU5B0=";
  };

  nativeBuildInputs = [
--- a/pkgs/build-support/setup-hooks/mpi-check-hook/mpi-check-hook.sh
+++ b/pkgs/build-support/setup-hooks/mpi-check-hook/mpi-check-hook.sh
@@ -33,10 +33,17 @@ setupMpiCheck() {

  case $mpiType in
    openmpi)
-      # make sure the test starts even if we have less than the requested amount of cores
+      # Note, that openmpi-5 switched to using PRRTE.
+      # Thus we need to set PRTE_MCA_* instead of OMPI_MCA_*.
+      # We keep the openmpi-4 parameters for backward compatability.
+
+      # Make sure the test starts even if we have less than the requested amount of cores
      export OMPI_MCA_rmaps_base_oversubscribe=1
+      export PRTE_MCA_rmaps_default_mapping_policy=node:oversubscribe
+
      # Disable CPU pinning
      export OMPI_MCA_hwloc_base_binding_policy=none
+      export PRTE_MCA_hwloc_default_binding_policy=none
      ;;
    MPICH)
      # Fix to make mpich run in a sandbox
--- a/pkgs/build-support/singularity-tools/default.nix
+++ b/pkgs/build-support/singularity-tools/default.nix
@@ -20,7 +20,7 @@
 let
  defaultSingularity = singularity;
 in
-rec {
+lib.makeExtensible (final: {
  # TODO(@ShamrockLee): Remove after Nixpkgs 24.11 branch-off.
  shellScript =
    lib.warn
@@ -82,20 +82,28 @@ rec {
              util-linux
            ];
            strictDeps = true;
-            layerClosure = writeClosure contents;
+            layerClosure = writeClosure (
+              [
+                bashInteractive
+                runScriptFile
+              ]
+              ++ contents
+            );
            preVM = vmTools.createEmptyImage {
              size = diskSize;
              fullName = "${projectName}-run-disk";
+              # Leaving "$out" for the Singularity/Container image
+              destination = "disk-image";
            };
            inherit memSize;
          }
          ''
-            rm -rf $out
-            mkdir disk
+            rmdir "$out"
+            mkdir workspace
            mkfs -t ext3 -b 4096 /dev/${vmTools.hd}
-            mount /dev/${vmTools.hd} disk
-            mkdir -p disk/img
-            cd disk/img
+            mount /dev/${vmTools.hd} workspace
+            mkdir -p workspace/img
+            cd workspace/img
            mkdir proc sys dev

            # Run root script
@@ -108,14 +116,20 @@ rec {

            # Build /bin and copy across closure
            mkdir -p bin ./${builtins.storeDir}
-            for f in $(cat $layerClosure) ; do
-              cp -ar $f ./$f
-            done
+            # Loop over the line-separated paths in $layerClosure
+            while IFS= read -r f; do
+              cp -r "$f" "./$f"
+            done < "$layerClosure"

-            for c in ${toString contents} ; do
-              for f in $c/bin/* ; do
-                if [ ! -e bin/$(basename $f) ] ; then
-                  ln -s $f bin/
+            # TODO(@ShamrockLee):
+            # Once vmTools.runInLinuxVMm works with `__structuredAttrs = true` (#334705),
+            # set __structuredAttrs = true and pass contents as an attribute
+            # so that we could loop with `for c in ''${contents[@]}`
+            # instead of expanding all the paths in contents into the Bash string.
+            for c in ${lib.escapeShellArgs contents} ; do
+              for f in "$c"/bin/* ; do
+                if [ ! -e "bin/$(basename "$f")" ] ; then
+                  ln -s "$f" bin/
                fi
              done
            done
@@ -135,10 +149,10 @@ rec {
            mkdir -p /var/lib/${projectName}/mnt/session
            echo "root:x:0:0:System administrator:/root:/bin/sh" > /etc/passwd
            echo > /etc/resolv.conf
-            TMPDIR=$(pwd -P) ${projectName} build $out ./img
+            TMPDIR="$(pwd -P)" ${projectName} build "$out" ./img
          ''
      );

    in
    result;
-}
+})
--- a/pkgs/build-support/writers/scripts.nix
+++ b/pkgs/build-support/writers/scripts.nix
@@ -767,7 +767,7 @@ rec {
  # writePython3 "test_python3" { libraries = [ pkgs.python3Packages.pyyaml ]; } ''
  #   import yaml
  #
-  #   y = yaml.load("""
+  #   y = yaml.safe_load("""
  #     - test: success
  #   """)
  #   print(y[0]['test'])
@@ -784,7 +784,7 @@ rec {
  # writePyPy3 "test_pypy3" { libraries = [ pkgs.pypy3Packages.pyyaml ]; } ''
  #   import yaml
  #
-  #   y = yaml.load("""
+  #   y = yaml.safe_load("""
  #     - test: success
  #   """)
  #   print(y[0]['test'])
--- a/pkgs/os-specific/darwin/aldente/default.nix
+++ b/pkgs/os-specific/darwin/aldente/default.nix
@@ -1,16 +1,18 @@
-{ lib
-, stdenvNoCC
-, fetchurl
-, _7zz
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  _7zz,
+  nix-update-script,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "aldente";
-  version = "1.24.1";
+  version = "1.27.3";

  src = fetchurl {
    url = "https://github.com/davidwernhart/aldente-charge-limiter/releases/download/${finalAttrs.version}/AlDente.dmg";
-    hash = "sha256-vOv52SrUki2f9vGzYy8dhVJVxna2ZvhtG6WbKjCv3gA=";
+    hash = "sha256-G6Kpfy1LE1VG/nTks4KU6doTKZeJT6gk6JtKmUEy6FI=";
  };

  dontBuild = true;
@@ -30,13 +32,18 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "macOS tool to limit maximum charging percentage";
    homepage = "https://apphousekitchen.com";
    changelog = "https://github.com/davidwernhart/aldente-charge-limiter/releases/tag/${finalAttrs.version}";
-    license = with lib.licenses; [ unfree ];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
    maintainers = with lib.maintainers; [ stepbrobd ];
-    platforms = [ "aarch64-darwin" "x86_64-darwin" ];
+    platforms = [
+      "aarch64-darwin"
+      "x86_64-darwin"
+    ];
  };
 })
--- a/pkgs/by-name/au/authentik/package.nix
+++ b/pkgs/by-name/au/authentik/package.nix
@@ -289,9 +289,9 @@ let
          celery
          channels
          channels-redis
+          codespell
          colorama
          dacite
-          daphne
          deepmerge
          defusedxml
          django
@@ -324,7 +324,6 @@ let
          packaging
          paramiko
          psycopg
-          pycryptodome
          pydantic
          pydantic-scim
          pyjwt
@@ -344,13 +343,15 @@ let
          uvicorn
          watchdog
          webauthn
-          websockets
          wsproto
          xmlsec
          zxcvbn
        ]
-        ++ uvicorn.optional-dependencies.standard
-        ++ [ codespell ];
+        ++ channels.optional-dependencies.daphne
+        ++ django-storages.optional-dependencies.s3
+        ++ opencontainers.optional-dependencies.reggie
+        ++ psycopg.optional-dependencies.c
+        ++ uvicorn.optional-dependencies.standard;

        postInstall = ''
          mkdir -p $out/web $out/website
--- a/pkgs/by-name/av/av1an-unwrapped/package.nix
+++ b/pkgs/by-name/av/av1an-unwrapped/package.nix
@@ -21,7 +21,14 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-A4/1UdM8N5CHP44PBNB+ZH2Gcl84rcpUBwQRSnubBGc=";
  };

-  cargoHash = "sha256-ahoiCAUREtXgXLNrWVQ2Gc65bWMo4pIJXP9xjnQAlaI=";
+  cargoPatches = [
+    # TODO: Remove next release
+    # Updates the `time` crate to work around
+    # https://github.com/NixOS/nixpkgs/issues/332957
+    ./rust-1.80.0.patch
+  ];
+
+  cargoHash = "sha256-Obq4oRXZ7IHDT+B9gKrVflq/FDzoN7ttZi8Aj2uOGxM=";

  nativeBuildInputs = [
    rustPlatform.bindgenHook
--- a/pkgs/by-name/av/av1an-unwrapped/rust-1.80.0.patch
+++ b/pkgs/by-name/av/av1an-unwrapped/rust-1.80.0.patch
@@ -0,0 +1,48 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index e5a1c65..b8cb96f 100644
+--- a/Cargo.lock
+++ b/Cargo.lock
+@@ -1008,6 +1008,12 @@ dependencies = [
+  "num-traits",
+ ]
+ 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+ [[package]]
+ name = "num-derive"
+ version = "0.3.3"
+@@ -1684,13 +1690,14 @@ dependencies = [
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.31"
+version = "0.3.36"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "f657ba42c3f86e7680e53c8cd3af8abbe56b5491790b46e22e19c0d57463583e"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
+  "deranged",
+  "itoa",
+  "libc",
+ "num-conv",
+  "num_threads",
+  "powerfmt",
+  "serde",
+@@ -1706,10 +1713,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.16"
+version = "0.2.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "26197e33420244aeb70c3e8c78376ca46571bc4e701e4791c2cd9f57dcb3a43f"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+ dependencies = [
+ "num-conv",
+  "time-core",
+ ]
+ 
--- a/pkgs/by-name/aw/awscli2/package.nix
+++ b/pkgs/by-name/aw/awscli2/package.nix
@@ -69,6 +69,14 @@ py.pkgs.buildPythonApplication rec {
    hash = "sha256-HxFtMFeGR6XAMsP5LM0tvJ/ECWVpveIhWRTKvf8uYA0=";
  };

+  patches = [
+    # Temporary test fix until https://github.com/aws/aws-cli/pull/8838 is merged upstream
+    (fetchpatch {
+      url = "https://github.com/aws/aws-cli/commit/b5f19fe136ab0752cd5fcab21ff0ab59bddbea99.patch";
+      hash = "sha256-NM+nVlpxGAHVimrlV0m30d4rkFVb11tiH8Y6//2QhMI=";
+    })
+  ];
+
  postPatch = ''
    substituteInPlace pyproject.toml \
      --replace-fail 'awscrt>=0.19.18,<=0.20.11' 'awscrt>=0.19.18' \
--- a/pkgs/by-name/ba/bazecor/10-dygma.rules
+++ b/pkgs/by-name/ba/bazecor/10-dygma.rules
@@ -1,4 +0,0 @@
-SUBSYSTEMS=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="2201", MODE="0666"
-SUBSYSTEMS=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="2200", MODE="0666"
-SUBSYSTEMS=="usb", ATTRS{idVendor}=="35ef", MODE="0666"
-KERNEL=="hidraw*", ATTRS{idVendor}=="35ef", MODE="0666"
--- a/pkgs/by-name/ba/bazecor/60-dygma.rules
+++ b/pkgs/by-name/ba/bazecor/60-dygma.rules
@@ -0,0 +1,14 @@
+# Dygma Raise
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="2200", MODE="0660", TAG+="uaccess"
+# bootloader mode
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="2201", MODE="0660", TAG+="uaccess"
+
+# Dygma USB Keyboards Vendor ID
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="35ef", MODE="0660", TAG+="uaccess"
+# bootloader mode
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="35ef", MODE="0660", TAG+="uaccess"
+
+# Dygma HID Keyboards Vendor ID
+KERNEL=="hidraw*", ATTRS{idVendor}=="35ef", MODE="0660", TAG+="uaccess"
+# bootloader mode
+KERNEL=="hidraw*", ATTRS{idVendor}=="35ef", MODE="0660", TAG+="uaccess"
--- a/pkgs/by-name/ba/bazecor/package.nix
+++ b/pkgs/by-name/ba/bazecor/package.nix
@@ -6,12 +6,12 @@
 }:
 let
  pname = "bazecor";
-  version = "1.4.2";
+  version = "1.4.4";
  src = appimageTools.extract {
    inherit pname version;
    src = fetchurl {
      url = "https://github.com/Dygmalab/Bazecor/releases/download/v${version}/Bazecor-${version}-x64.AppImage";
-      hash = "sha256-2/GX2p+YhN6XLXl8ORn5Vy5GYjPS1ZkKmSymeUjExLU=";
+      hash = "sha256-ep+3lqWdktyvbTKxfLcPiVq9/5f0xBHwKG1+BxDDBQA=";
    };

    # Workaround for https://github.com/Dygmalab/Bazecor/issues/370
@@ -27,9 +27,9 @@ in
 appimageTools.wrapAppImage {
  inherit pname version src;

-  # also make sure to update the udev rules in ./10-dygma.rules; most recently
+  # also make sure to update the udev rules in ./60-dygma.rules; most recently
  # taken from
-  # https://github.com/Dygmalab/Bazecor/blob/v1.3.11/src/main/utils/udev.ts#L6
+  # https://github.com/Dygmalab/Bazecor/blob/v1.4.4/src/main/utils/udev.ts#L6

  extraPkgs = pkgs: [ pkgs.glib ];

@@ -46,7 +46,7 @@ appimageTools.wrapAppImage {
    install -m 444 -D ${src}/bazecor.png -t $out/share/pixmaps

    mkdir -p $out/lib/udev/rules.d
-    install -m 444 -D ${./10-dygma.rules} $out/lib/udev/rules.d/10-dygma.rules
+    install -m 444 -D ${./60-dygma.rules} $out/lib/udev/rules.d/60-dygma.rules

    substituteInPlace $out/share/applications/Bazecor.desktop \
      --replace-fail 'Exec=Bazecor' 'Exec=bazecor'
--- a/pkgs/by-name/bc/bcc/package.nix
+++ b/pkgs/by-name/bc/bcc/package.nix
@@ -20,15 +20,15 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "bcc";
-  version = "0.30.0";
+  version = "0.31.0";

  disabled = !stdenv.isLinux;

  src = fetchFromGitHub {
    owner = "iovisor";
    repo = "bcc";
-    rev = "v${version}";
-    hash = "sha256-ngGLGfLv2prnjhgaRPf8ea3oyy4129zGodR0Yz1QtCw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ludgmHFOyBu1CwUiaqczmNui0J8bUBAA5QGBiado8yw=";
  };
  format = "other";

--- a/pkgs/by-name/bu/bulloak/package.nix
+++ b/pkgs/by-name/bu/bulloak/package.nix
@@ -31,16 +31,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "bulloak";
-  version = "0.6.1";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "alexfertel";
    repo = "bulloak";
    rev = "v${version}";
-    hash = "sha256-0pzn0gXlhdndCpsrVRNxl1ylIE/S9A0l8VjNn5wDVvw=";
+    hash = "sha256-OAjy8SXaD+2/C5jLNIezv/KdrPHlwJC5L1LwGhqBWQs=";
  };

-  cargoHash = "sha256-IlDbys5uluLm418UkGf+FIM1AfR2IBAZQ4Atqlybajw=";
+  cargoHash = "sha256-lj/wmLu4cBjDjzMD8DlIz+6Rnag0h+zWiE7lfcTC7lY=";

  buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.SystemConfiguration ];

--- a/pkgs/by-name/co/cowsay/package.nix
+++ b/pkgs/by-name/co/cowsay/package.nix
@@ -1,39 +1,40 @@
-{ lib, stdenv, perl, fetchFromGitHub, fetchpatch, makeWrapper, nix-update-script, testers }:
+{
+  lib,
+  fetchFromGitHub,
+  makeWrapper,
+  nix-update-script,
+  perl,
+  stdenv,
+  testers,
+}:

 stdenv.mkDerivation (finalAttrs: {
  pname = "cowsay";
-  version = "3.7.0";
+  version = "3.8.1";

-  outputs = [ "out" "man" ];
+  outputs = [
+    "out"
+    "man"
+  ];

  src = fetchFromGitHub {
    owner = "cowsay-org";
    repo = "cowsay";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-t1grmCPQhRgwS64RjEwkK61F2qxxMBKuv0/DzBTnL3s=";
+    hash = "sha256-4y+k1CzgTFq48g9gCzPTHdQFf3zgGTBm6tZTEXb7uTU=";
  };

-  patches = [
-    # Install cowthink as a symlink, not a copy
-    # See https://github.com/cowsay-org/cowsay/pull/18
-    (fetchpatch {
-      url = "https://github.com/cowsay-org/cowsay/commit/9e129fa0933cf1837672c97f5ae5ad4a1a10ec11.patch";
-      hash = "sha256-zAYEUAM5MkyMONAl5BXj8hBHRalQVAOdpxgiM+Ewmlw=";
-    })
-  ];
-
  nativeBuildInputs = [ makeWrapper ];
+
  buildInputs = [ perl ];

+  makeFlags = [ "prefix=${placeholder "out"}" ];
+
  postInstall = ''
    wrapProgram $out/bin/cowsay \
      --suffix COWPATH : $out/share/cowsay/cows
  '';

-  makeFlags = [
-    "prefix=${placeholder "out"}"
-  ];
-
  passthru = {
    updateScript = nix-update-script { };
    tests.version = testers.testVersion {
@@ -48,7 +49,10 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://github.com/cowsay-org/cowsay/releases/tag/v${finalAttrs.version}";
    license = licenses.gpl3Only;
    platforms = platforms.all;
-    maintainers = with maintainers; [ rob anthonyroussel ];
+    maintainers = with maintainers; [
+      rob
+      anthonyroussel
+    ];
    mainProgram = "cowsay";
  };
 })
--- a/pkgs/by-name/cy/cyberpunk-neon/package.nix
+++ b/pkgs/by-name/cy/cyberpunk-neon/package.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  unzip,
+  unstableGitUpdater,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "cyberpunk-neon";
+  version = "0-unstable-2024-02-23";
+
+  src = fetchFromGitHub {
+    owner = "Roboron3042";
+    repo = "Cyberpunk-Neon";
+    rev = "258b3956a677d56df3027f3d08eabf07da936ec3";
+    hash = "sha256-00scMHUgesgEmE9naC/AJ9mCRz325jT5WN0uo+u2s6k=";
+  };
+
+  outputs = [
+    "out"
+    "gtk"
+    "kde"
+    "konsole"
+    "tilix"
+  ];
+
+  nativeBuildInputs = [ unzip ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dt $out/share/doc/cyberpunk-neon/ README.md
+
+    mkdir -p $gtk/share/themes
+    unzip gtk/materia-cyberpunk-neon.zip -d $gtk/share/themes/
+    unzip gtk/oomox-cyberpunk-neon.zip -d $gtk/share/themes/
+
+    install -Dt $kde/share/color-schemes kde/cyberpunk-neon.colors
+
+    install -Dt $konsole/share/konsole terminal/konsole/cyberpunk-neon.colorscheme
+
+    install -Dt $tilix/share/tilix/schemes terminal/tilix/cyberpunk-neon.json
+
+    runHook postInstall
+  '';
+
+  strictDeps = true;
+
+  passthru = {
+    updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
+  };
+
+  meta = {
+    homepage = "https://github.com/Roboron3042/Cyberpunk-Neon";
+    description = "Neon themes for many programs";
+    license = lib.licenses.cc-by-sa-40;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/by-name/da/dapr-cli/package.nix
+++ b/pkgs/by-name/da/dapr-cli/package.nix
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "dapr-cli";
-  version = "1.13.0";
+  version = "1.14.0";

  src = fetchFromGitHub {
    owner = "dapr";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-nR9+6glX0oUJZq32XxyV4aVjfjVlNycZvMNaVHy+Q1s=";
+    sha256 = "sha256-DIhedooEJTRdszl59V2lTkCBkj471ZEVEyqOFEQniSY=";
  };

-  vendorHash = "sha256-kFmoNd40YxUXVXk0F1Bf77KS5AM0jjOTwTjM5pYKkv4=";
+  vendorHash = "sha256-Ec1z8Wvq8gk8dYcm10ujy7zYWR7Mus1nl21Od3SUFrU=";

  proxyVendor = true;

--- a/pkgs/games/doom-ports/doomretro/default.nix
+++ b/pkgs/games/doom-ports/doomretro/default.nix
@@ -1,23 +1,27 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, pkg-config
-, SDL2
-, SDL2_image
-, SDL2_mixer
-, Cocoa
+{
+  lib,
+  SDL2,
+  SDL2_image,
+  SDL2_mixer,
+  cmake,
+  darwin,
+  fetchFromGitHub,
+  pkg-config,
+  stdenv,
 }:

+let
+  inherit (darwin.apple_sdk.frameworks) Cocoa;
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "doomretro";
-  version = "5.4";
+  version = "5.5.1";

  src = fetchFromGitHub {
    owner = "bradharding";
    repo = "doomretro";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-IOv58BmJvJtO7MMbrvf52MPYI0zjmPuRK7mcTwmBEY0=";
+    hash = "sha256-gAMMzHUo0uPXIRqT1NOMWpFNAtE1Pth5uXFa2Dps90E=";
  };

  nativeBuildInputs = [
@@ -29,14 +33,13 @@ stdenv.mkDerivation (finalAttrs: {
    SDL2
    SDL2_image
    SDL2_mixer
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    Cocoa
-  ];
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+
+  strictDeps = true;

  meta = {
    homepage = "https://www.doomretro.com/";
    description = "Classic, refined DOOM source port";
-    mainProgram = "doomretro";
    longDescription = ''
      DOOM Retro is the classic, refined DOOM source port for Windows PC. It
      represents how I like my DOOM to be today, in all its dark and gritty,
@@ -67,8 +70,8 @@ stdenv.mkDerivation (finalAttrs: {
      to no support is provided, DOOM Retro's source code may also be compiled
      and run under Linux and macOS.
    '';
-    changelog = "https://github.com/bradharding/doomretro/releases/tag/${finalAttrs.src.rev}";
    license = lib.licenses.gpl3Plus;
+    mainProgram = "doomretro";
    maintainers = with lib.maintainers; [ AndersonTorres ];
    platforms = lib.platforms.unix;
  };
--- a/pkgs/by-name/el/elvish/package.nix
+++ b/pkgs/by-name/el/elvish/package.nix
@@ -6,7 +6,7 @@

 let
  pname = "elvish";
-  version = "0.20.1";
+  version = "0.21.0";
 in
 buildGoModule {
  inherit pname version;
@@ -15,10 +15,10 @@ buildGoModule {
    owner = "elves";
    repo = "elvish";
    rev = "v${version}";
-    hash = "sha256-lKrX38gVUhYwwuNF25LcZ+TytP4vx/GO7ay6Au4BBZA=";
+    hash = "sha256-+qkr0ziHWs3MVhBoqAxrwwbsQVvmGHRKrlqiujqBKvs=";
  };

-  vendorHash = "sha256-sgVGqpncV7Ylok5FRcV01a3MCX6UdZvTt3nfVh5L2so=";
+  vendorHash = "sha256-UjX1P8v97Mi5cLWv3n7pmxgnw+wCr4aRTHDHHd/9+Lo=";

  subPackages = [ "cmd/elvish" ];

--- a/pkgs/by-name/fa/fanbox-dl/package.nix
+++ b/pkgs/by-name/fa/fanbox-dl/package.nix
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "fanbox-dl";
-  version = "0.23.0";
+  version = "0.23.1";

  src = fetchFromGitHub {
    owner = "hareku";
    repo = "fanbox-dl";
    rev = "v${version}";
-    hash = "sha256-hR6aO9Mdm3lxRqt1l3Qryp4ggO5B+poYBcq9k1XNrvs=";
+    hash = "sha256-EO1J90uH2J8EI51qGzIQyl4BbSwijkEi5ZQENgSMEm8=";
  };

  vendorHash = "sha256-GD5uxa5XWhlHHBztTpDKCTSym2pdkr/or6aGl9qF29U=";
--- a/pkgs/by-name/fa/fast-float/package.nix
+++ b/pkgs/by-name/fa/fast-float/package.nix
@@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fast-float";
-  version = "6.1.3";
+  version = "6.1.4";

  src = fetchFromGitHub {
    owner = "fastfloat";
    repo = "fast_float";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-CMPk2RNbfPT+Pe2L9nS/i1JNXM0giuX+lOuF1g9tn9s=";
+    hash = "sha256-0eVovauN7SnO3nSIWBRWAJ4dR7q5beZrIGUZ18M2pao=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/fa/fastjar/package.nix
+++ b/pkgs/by-name/fa/fastjar/package.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  callPackage,
+  fetchzip,
+  stdenv,
+  zlib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "fastjar";
+  version = "0.98";
+
+  src = fetchzip {
+    pname = "fastjar-source";
+    inherit (finalAttrs) version;
+    url = "https://download.savannah.gnu.org/releases/fastjar/fastjar-${finalAttrs.version}.tar.gz";
+    hash = "sha256-8VyKNQaPLrXAy/UEm2QkBx56SSSoLdU/7w4IwrxbsQc=";
+  };
+
+  outputs = [
+    "out"
+    "info"
+    "man"
+  ];
+
+  buildInputs = [ zlib ];
+
+  strictDeps = true;
+
+  doCheck = true;
+
+  passthru = {
+    tests = lib.packagesFromDirectoryRecursive {
+      inherit callPackage;
+      directory = ./tests;
+    };
+  };
+
+  meta = {
+    homepage = "https://savannah.nongnu.org/projects/fastjar/";
+    description = "Fast Java archiver written in C";
+    longDescription = ''
+      FastJar is an attempt at creating a feature-for-feature copy of Sun's
+      JDK's 'jar' command.  Sun's jar (or Blackdown's for that matter) is
+      written entirely in Java which makes it dog slow.  Since FastJar is
+      written in C, it can create the same .jar file as Sun's tool in a fraction
+      of the time.
+    '';
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "fastjar";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/fa/fastjar/tests/version-fastjar.nix
+++ b/pkgs/by-name/fa/fastjar/tests/version-fastjar.nix
@@ -0,0 +1,6 @@
+{ fastjar, testers }:
+
+testers.testVersion {
+  package = fastjar;
+  command = "fastjar --version";
+}
--- a/pkgs/by-name/fa/fastjar/tests/version-grepjar.nix
+++ b/pkgs/by-name/fa/fastjar/tests/version-grepjar.nix
@@ -0,0 +1,6 @@
+{ fastjar, testers }:
+
+testers.testVersion {
+  package = fastjar;
+  command = "grepjar --version";
+}
--- a/pkgs/by-name/fl/flatpak/package.nix
+++ b/pkgs/by-name/fl/flatpak/package.nix
@@ -58,7 +58,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "flatpak";
-  version = "1.14.8";
+  version = "1.14.10";

  # TODO: split out lib once we figure out what to do with triggerdir
  outputs = [
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://github.com/flatpak/flatpak/releases/download/${finalAttrs.version}/flatpak-${finalAttrs.version}.tar.xz";
-    hash = "sha256-EBa3Mn96+HiW+VRl9+WBN1DTtwSaN0ChpN3LX6jFNI4=";
+    hash = "sha256-a73HkIEnNQrYWkpH1wKSyi9MRul3sysf0jHCpxnYIc0=";
  };

  patches = [
--- a/pkgs/by-name/go/go-ethereum/package.nix
+++ b/pkgs/by-name/go/go-ethereum/package.nix
@@ -9,17 +9,17 @@ let

 in buildGoModule rec {
  pname = "go-ethereum";
-  version = "1.14.6";
+  version = "1.14.8";

  src = fetchFromGitHub {
    owner = "ethereum";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-X9XwVZpRnkp7oVKwyvQbs8ZaWwLkuLEEHNfV5BvfVvI=";
+    sha256 = "sha256-y831v6ar1RdDvGQMZf2lZKgq2IQzAAQrNwDCL0xbj24=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-UP+bQM8ydfbILlVhuNPVIKLyXZFTzGmHizn2hYgNE4Y=";
+  vendorHash = "sha256-CLGf64Fftu4u8Vaj66Q4xuRKBEMNZmpltUyaUMVyVJk=";

  doCheck = false;

@@ -41,7 +41,6 @@ in buildGoModule rec {
    "cmd/ethkey"
    "cmd/evm"
    "cmd/geth"
-    "cmd/p2psim"
    "cmd/rlpdump"
    "cmd/utils"
  ];
--- a/pkgs/by-name/gp/gptscript/package.nix
+++ b/pkgs/by-name/gp/gptscript/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
  pname = "gptscript";
-  version = "0.9.2";
+  version = "0.9.4";

  src = fetchFromGitHub {
    owner = "gptscript-ai";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-jNscG3tET7Keg5tTkRKnnaDwXeB9xNqi3ggOnN3OI7E=";
+    hash = "sha256-s7AKpoIFRcZfAM6K1MMovzOqgXdAWtnnFR3m+84L3rQ=";
  };

-  vendorHash = "sha256-KOgCYN3whi8gI7cF62uHXkJfLKA5QzfwlFjYh2Q7PlI=";
+  vendorHash = "sha256-Kf/ckUuG+SA8WQN2MKL+Xrz91RGPuA7X2/MjryRXsts=";

  propagatedBuildInputs = with darwin;
    lib.optionals stdenv.isDarwin [Security];
--- a/pkgs/by-name/jn/jnv/package.nix
+++ b/pkgs/by-name/jn/jnv/package.nix
@@ -1,6 +1,9 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  stdenv,
+  darwin,
 }:
 rustPlatform.buildRustPackage rec {
  pname = "jnv";
@@ -15,11 +18,22 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-xF0sxoSo7z7lxrF3wFAmU7edREoWKBFBnZ6Xq22c8q0=";

+  buildInputs = lib.optional stdenv.isDarwin (
+    with darwin.apple_sdk.frameworks;
+    [
+      CoreGraphics
+      AppKit
+    ]
+  );
+
  meta = with lib; {
    description = "Interactive JSON filter using jq";
    mainProgram = "jnv";
    homepage = "https://github.com/ynqa/jnv";
    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ nealfennimore nshalman ];
+    maintainers = with maintainers; [
+      nealfennimore
+      nshalman
+    ];
  };
 }
--- a/pkgs/by-name/me/mealie/package.nix
+++ b/pkgs/by-name/me/mealie/package.nix
@@ -2,6 +2,7 @@
 , stdenv
 , callPackage
 , fetchFromGitHub
+, fetchpatch
 , makeWrapper
 , nixosTests
 , python3Packages
@@ -46,6 +47,16 @@ pythonpkgs.buildPythonApplication rec {
  inherit version src;
  pyproject = true;

+  patches = [
+    # Pull in https://github.com/mealie-recipes/mealie/pull/4002 manually until
+    # it lands in an upstream mealie release.
+    # See https://github.com/NixOS/nixpkgs/issues/321623.
+    ( fetchpatch {
+        url = "https://github.com/mealie-recipes/mealie/commit/65ece35966120479db903785b22e9f2645f72aa4.patch";
+        hash = "sha256-4Nc0dFJrZ7ElN9rrq+CFpayKsrRjRd24fYraUFTzcH8=";
+    })
+  ];
+
  build-system = with pythonpkgs; [ poetry-core ];

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/tools/package-management/microdnf/default.nix
+++ b/pkgs/tools/package-management/microdnf/default.nix
@@ -1,4 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, cmake, gettext, libdnf, pkg-config, glib, libpeas, libsmartcols, help2man }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  gettext,
+  libdnf,
+  pkg-config,
+  glib,
+  libpeas,
+  libsmartcols,
+  help2man,
+  zchunk,
+  pcre2,
+}:

 stdenv.mkDerivation rec {
  pname = "microdnf";
@@ -11,15 +25,28 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-R7jOeH6pw/THLXxLezp2AmE8lUBagKMRJ0XfXgdLi2E=";
  };

-  nativeBuildInputs = [ pkg-config cmake gettext help2man ];
-  buildInputs = [ libdnf glib libpeas libsmartcols ];
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    gettext
+    help2man
+  ];

-  meta = with lib; {
+  buildInputs = [
+    libdnf
+    glib
+    libpeas
+    libsmartcols
+    zchunk
+    pcre2.dev
+  ];
+
+  meta = {
    description = "Lightweight implementation of dnf in C";
    homepage = "https://github.com/rpm-software-management/microdnf";
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ rb2k ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
    mainProgram = "microdnf";
  };
 }
--- a/pkgs/by-name/mo/mosdns/package.nix
+++ b/pkgs/by-name/mo/mosdns/package.nix
@@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "mosdns";
-  version = "5.3.1";
+  version = "5.3.3";

  src = fetchFromGitHub {
    owner = "IrineSistiana";
    repo = "mosdns";
    rev = "refs/tags/v${version}";
-    hash = "sha256-QujkDx899GAImEtQE28ru7H0Zym5SYXJbJEfSBkJYjo=";
+    hash = "sha256-nSqSfbpi91W28DaLjCsWlPiLe1gLVHeZnstktc/CLag=";
  };

-  vendorHash = "sha256-0J5hXb1W8UruNG0KFaJBOQwHl2XiWg794A6Ktgv+ObM=";
+  vendorHash = "sha256-RpvWkIDhHSNbdkpBCcXYbbvbmGiG15qyB5aEJRmg9s4=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/no/nova-password/package.nix
+++ b/pkgs/by-name/no/nova-password/package.nix
@@ -5,17 +5,16 @@

 buildGoModule rec {
  pname = "nova-password";
-  version = "0.5.6";
+  version = "0.5.7";

  src = fetchFromGitHub {
    owner = "sapcc";
    repo = "nova-password";
    rev = "refs/tags/v${version}";
-    hash = "sha256-pBew5c+wlXwMLDjgwwdOSUyTxPGpa9AwbhZni8FfTsQ=";
+    hash = "sha256-tjjP+LmYaqpzmTk3tgFqZlG1KEeAkfI7RxzSm97jWVU=";
  };

-  # The repo contains vendored dependencies
-  vendorHash = null;
+  vendorHash = "sha256-MwemuOaXGl0eF+lVtMCgbBeJGILmaeEHcbu+xp8Lm70=";

  meta = {
    description = "Decrypt the admin password generated for the VM in OpenStack";
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -7,19 +7,19 @@
 }:
 let
  pname = "open-webui";
-  version = "0.3.12";
+  version = "0.3.13";

  src = fetchFromGitHub {
    owner = "open-webui";
    repo = "open-webui";
    rev = "v${version}";
-    hash = "sha256-Ot8QsRgRbe0l37C9KGlREDCjq5nTTvcJ1TJaeBe2oxw=";
+    hash = "sha256-7OGUlyBvxX/wra4GYnhmSni/7xloCXUKEu0xa2bbn2A=";
  };

  frontend = buildNpmPackage {
    inherit pname version src;

-    npmDepsHash = "sha256-fr+IA6I1pE+vJ+uGE1sf2++s65rPzK//ZL+xT3QoLOA=";
+    npmDepsHash = "sha256-hQOpkbw8RDATnORh8Z1ziUhBcXb5xVplVOvueC/3RwA=";

    # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
    # Until this is solved, running python packages from the browser will not work.
--- a/pkgs/by-name/op/openfga/package.nix
+++ b/pkgs/by-name/op/openfga/package.nix
@@ -7,7 +7,7 @@

 let
  pname = "openfga";
-  version = "1.5.6";
+  version = "1.5.8";
 in

 buildGoModule {
@@ -17,10 +17,10 @@ buildGoModule {
    owner = "openfga";
    repo = "openfga";
    rev = "v${version}";
-    hash = "sha256-R5BqaKiW2jhglJ6zPPQF2Ld97YCttocjhfbo0dDGvCI=";
+    hash = "sha256-cogfwd2rFYl/UKjw1pnsL9D77IHn+5ulvMU+7WU2670=";
  };

-  vendorHash = "sha256-zrhLG5msji6t4VPKG85jD8c2XQCRdQkF9UfRMqnzSFM=";
+  vendorHash = "sha256-rU45E9yEh7a1MrbnzFFuNeMpfbODO2O7tqEaiv7CA9Y=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/pa/paper-age/package.nix
+++ b/pkgs/by-name/pa/paper-age/package.nix
@@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "paper-age";
-  version = "1.3.2";
+  version = "1.3.3";

  src = fetchFromGitHub {
    owner = "matiaskorhonen";
    repo = "paper-age";
    rev = "v${version}";
-    hash = "sha256-OnCE277CeU9k7NGO0fEF2wI9S1wxOw4lK7iSNp1D+KQ=";
+    hash = "sha256-XnJSsxWe4/NLOqBjU7++bwLtVfIR9n8hpBxL3K8Bmho=";
  };

-  cargoHash = "sha256-2WhzXr5ugPu56BS++MiTNOzcJxSL9F17IM/+yfjkL8k=";
+  cargoHash = "sha256-808+lQxjE9dxgNZm/FuZwFuBFJgx/7kCpNn+FrMvuoY=";

  meta = with lib; {
    description = "Easy and secure paper backups of secrets";
--- a/pkgs/by-name/pd/pdf-sign/package.nix
+++ b/pkgs/by-name/pd/pdf-sign/package.nix
@@ -38,8 +38,11 @@ stdenv.mkDerivation {
    runHook preInstall

    for exe in "pdf-sign" "pdf-create-empty" "pdf-from-text"; do
-      install -Dm755 $exe -t $out/bin
-      wrapProgram $out/bin/$exe --prefix PATH : ${binPath}
+      # Install wrapped programs into $out/lib so that they are not renamed.
+      # Renaming them, like wrapProgram does, would produce the wrong output
+      # from `--help`.
+      install -Dm755 $exe -t $out/lib
+      makeWrapper $out/lib/$exe $out/bin/$exe --prefix PATH : ${binPath}
    done

    runHook postInstall
--- a/pkgs/by-name/pg/pgmoneta/package.nix
+++ b/pkgs/by-name/pg/pgmoneta/package.nix
@@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "pgmoneta";
-  version = "0.12.0";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "pgmoneta";
    repo = "pgmoneta";
    rev = version;
-    hash = "sha256-366UdWw2lJ30LhPR4Q0Iym1BTcgauEwwsGzn6Wew9gk=";
+    hash = "sha256-HDFvU7TjOENFvBorn11ludy8QQb4/IC6hEyyzvrJ2lU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pr/protonmail-desktop/update.sh
+++ b/pkgs/by-name/pr/protonmail-desktop/update.sh
@@ -9,8 +9,7 @@ latestVersion=$(curl https://api.github.com/repos/ProtonMail/inbox-desktop/relea

 declare -A platforms
 platforms[x86_64-linux]="amd64"
-platforms[x86_64-darwin]="x64"
-platforms[aarch64-darwin]="arm64"
+platforms[x86_64-darwin]="universal"

 for platform in "${!platforms[@]}"
 do
--- a/pkgs/by-name/py/pyright/package.nix
+++ b/pkgs/by-name/py/pyright/package.nix
@@ -1,13 +1,13 @@
 { lib, buildNpmPackage, fetchFromGitHub, runCommand, jq }:

 let
-  version = "1.1.375";
+  version = "1.1.376";

  src = fetchFromGitHub {
    owner = "Microsoft";
    repo = "pyright";
    rev = "${version}";
-    hash = "sha256-9GiwWCbo6z9/x9qBEsRoTh9WYNJ0XnlMq1BD7vrIHfA=";
+    hash = "sha256-OxLZF2ZqAHdiXRAO+bC9e9gU05di+NufZhmN/wesm3I=";
  };

  patchedPackageJSON = runCommand "package.json" { } ''
@@ -37,7 +37,7 @@ let
    pname = "pyright-internal";
    inherit version src;
    sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-4roH83gyZg6g6HjqassEAcn36bgqd1lwrq/ArST2+18=";
+    npmDepsHash = "sha256-j7+uigtOnYFqHKxcnOJWaQcvGoHJ5FM3BkW6folfkuw=";
    dontNpmBuild = true;
    installPhase = ''
      runHook preInstall
@@ -51,7 +51,7 @@ buildNpmPackage rec {
  inherit version src;

  sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-BJgdf7rDxs4NvXDJ4Y8z+DEAX77CXrB7FXzGEqH+YwI=";
+  npmDepsHash = "sha256-m66enEsj5G0jq3xTnJySIc9bS9SW6YagO00H37lIEIU=";

  postPatch = ''
    chmod +w ../../
--- a/pkgs/by-name/qd/qdrant-web-ui/package.nix
+++ b/pkgs/by-name/qd/qdrant-web-ui/package.nix
@@ -5,16 +5,16 @@
 }:
 buildNpmPackage rec {
  pname = "qdrant-web-ui";
-  version = "0.1.29";
+  version = "0.1.30";

  src = fetchFromGitHub {
    owner = "qdrant";
    repo = "qdrant-web-ui";
    rev = "refs/tags/v${version}";
-    hash = "sha256-ni+78odD4PnkqlIzTpHsu16Lk6m9ql/Bq8Bm2qWxHj0=";
+    hash = "sha256-bHE/ZBc1PvjnIXhkh9BFS0x3Urnh4LOHH4MoKgqVVJ4=";
  };

-  npmDepsHash = "sha256-Lg4nNw6wKb5tBUPCIUbriExQs3LKsF0bCCY3S136Epk=";
+  npmDepsHash = "sha256-3w3imfe9XbK3eSh6kOd2G/ei75+Ub08L/hBej1iy9R4=";

  npmBuildScript = "build-qdrant";

--- a/pkgs/by-name/rc/rcu/package.nix
+++ b/pkgs/by-name/rc/rcu/package.nix
@@ -27,6 +27,7 @@ python3Packages.buildPythonApplication rec {
  in runCommand "${src-tarball.name}-unpacked" {} ''
    gunzip -ck ${src-tarball} | tar -xvf-
    mv rcu $out
+    ln -s ${src-tarball} $out/src
  '';

  patches = [
--- a/pkgs/development/tools/ruff/Cargo.lock
+++ b/pkgs/development/tools/ruff/Cargo.lock
@@ -95,9 +95,9 @@ dependencies = [

 [[package]]
 name = "anstyle"
-version = "1.0.6"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
+checksum = "1bec1de6f59aedf83baf9ff929c98f2ad654b97c9510f4e70cf6f661d49fd5b1"

 [[package]]
 name = "anstyle-parse"
@@ -288,7 +288,7 @@ dependencies = [
 "android-tzdata",
 "iana-time-zone",
 "num-traits",
- "windows-targets 0.52.5",
+ "windows-targets 0.52.6",
 ]

 [[package]]
@@ -320,9 +320,9 @@ dependencies = [

 [[package]]
 name = "clap"
-version = "4.5.13"
+version = "4.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fbb260a053428790f3de475e304ff84cdbc4face759ea7a3e64c1edd938a7fc"
+checksum = "11d8838454fda655dafd3accb2b6e2bea645b9e4078abe84a22ceb947235c5cc"
 dependencies = [
 "clap_builder",
 "clap_derive",
@@ -330,9 +330,9 @@ dependencies = [

 [[package]]
 name = "clap_builder"
-version = "4.5.13"
+version = "4.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64b17d7ea74e9f833c7dbf2cbe4fb12ff26783eda4782a8975b72f895c9b4d99"
+checksum = "216aec2b177652e3846684cbfe25c9964d18ec45234f0f5da5157b207ed1aab6"
 dependencies = [
 "anstream",
 "anstyle",
@@ -820,14 +820,14 @@ dependencies = [

 [[package]]
 name = "filetime"
-version = "0.2.23"
+version = "0.2.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ee447700ac8aa0b2f2bd7bc4462ad686ba06baa6727ac149a2d6277f0d240fd"
+checksum = "bf401df4a4e3872c4fe8151134cf483738e74b67fc934d6532c882b3d24a4550"
 dependencies = [
 "cfg-if",
 "libc",
- "redox_syscall",
- "windows-sys 0.52.0",
+ "libredox",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@@ -1143,9 +1143,9 @@ dependencies = [

 [[package]]
 name = "is-macro"
-version = "0.3.5"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59a85abdc13717906baccb5a1e435556ce0df215f242892f721dff62bf25288f"
+checksum = "2069faacbe981460232f880d26bf3c7634e322d49053aa48c27e3ae642f728f1"
 dependencies = [
 "Inflector",
 "proc-macro2",
@@ -1297,6 +1297,7 @@ checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
 dependencies = [
 "bitflags 2.6.0",
 "libc",
+ "redox_syscall 0.5.3",
 ]

 [[package]]
@@ -1564,7 +1565,7 @@ checksum = "4c42a9226546d68acdd9c0a280d17ce19bfe27a46bf68784e4066115788d008e"
 dependencies = [
 "cfg-if",
 "libc",
- "redox_syscall",
+ "redox_syscall 0.4.1",
 "smallvec",
 "windows-targets 0.48.5",
 ]
@@ -1899,6 +1900,7 @@ dependencies = [
 "ruff_python_ast",
 "ruff_python_parser",
 "ruff_python_stdlib",
+ "ruff_source_file",
 "ruff_text_size",
 "rustc-hash 2.0.0",
 "salsa",
@@ -1918,6 +1920,7 @@ dependencies = [
 "libc",
 "lsp-server",
 "lsp-types",
+ "red_knot_python_semantic",
 "red_knot_workspace",
 "ruff_db",
 "ruff_linter",
@@ -1941,6 +1944,7 @@ dependencies = [
 "console_log",
 "js-sys",
 "log",
+ "red_knot_python_semantic",
 "red_knot_workspace",
 "ruff_db",
 "ruff_notebook",
@@ -1959,6 +1963,7 @@ dependencies = [
 "ruff_cache",
 "ruff_db",
 "ruff_python_ast",
+ "ruff_text_size",
 "rustc-hash 2.0.0",
 "salsa",
 "thiserror",
@@ -1974,6 +1979,15 @@ dependencies = [
 "bitflags 1.3.2",
 ]

+[[package]]
+name = "redox_syscall"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a908a6e00f1fdd0dfd9c0eb08ce85126f6d8bbda50017e74bc4a4b7d4a926a4"
+dependencies = [
+ "bitflags 2.6.0",
+]
+
 [[package]]
 name = "redox_users"
 version = "0.4.5"
@@ -2046,7 +2060,7 @@ dependencies = [

 [[package]]
 name = "ruff"
-version = "0.5.7"
+version = "0.6.0"
 dependencies = [
 "anyhow",
 "argfile",
@@ -2104,6 +2118,7 @@ dependencies = [
 "criterion",
 "mimalloc",
 "once_cell",
+ "red_knot_python_semantic",
 "red_knot_workspace",
 "ruff_db",
 "ruff_linter",
@@ -2153,7 +2168,10 @@ dependencies = [
 "rustc-hash 2.0.0",
 "salsa",
 "tempfile",
+ "thiserror",
 "tracing",
+ "tracing-subscriber",
+ "tracing-tree",
 "web-time",
 "zip",
 ]
@@ -2234,7 +2252,7 @@ dependencies = [

 [[package]]
 name = "ruff_linter"
-version = "0.5.7"
+version = "0.6.0"
 dependencies = [
 "aho-corasick",
 "annotate-snippets 0.9.2",
@@ -2554,7 +2572,7 @@ dependencies = [

 [[package]]
 name = "ruff_wasm"
-version = "0.5.7"
+version = "0.6.0"
 dependencies = [
 "console_error_panic_hook",
 "console_log",
@@ -2781,9 +2799,9 @@ checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"

 [[package]]
 name = "serde"
-version = "1.0.204"
+version = "1.0.206"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc76f558e0cbb2a839d37354c575f1dc3fdc6546b5be373ba43d95f231bf7c12"
+checksum = "5b3e4cd94123dd520a128bcd11e34d9e9e423e7e3e50425cb1b4b1e3549d0284"
 dependencies = [
 "serde_derive",
 ]
@@ -2801,9 +2819,9 @@ dependencies = [

 [[package]]
 name = "serde_derive"
-version = "1.0.204"
+version = "1.0.206"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0cd7e117be63d3c3678776753929474f3b04a43a080c744d6b0ae2a8c28e222"
+checksum = "fabfb6138d2383ea8208cf98ccf69cdfb1aff4088460681d84189aa259762f97"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -2823,9 +2841,9 @@ dependencies = [

 [[package]]
 name = "serde_json"
-version = "1.0.122"
+version = "1.0.124"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "784b6203951c57ff748476b126ccb5e8e2959a5c19e5c617ab1956be3dbc68da"
+checksum = "66ad62847a56b3dba58cc891acd13884b9c61138d330c0d7b6181713d4fce38d"
 dependencies = [
 "itoa",
 "memchr",
@@ -2855,9 +2873,9 @@ dependencies = [

 [[package]]
 name = "serde_test"
-version = "1.0.176"
+version = "1.0.177"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a2f49ace1498612d14f7e0b8245519584db8299541dfe31a06374a828d620ab"
+checksum = "7f901ee573cab6b3060453d2d5f0bae4e6d628c23c0a962ff9b5f1d7c8d4f1ed"
 dependencies = [
 "serde",
 ]
@@ -2984,9 +3002,9 @@ checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"

 [[package]]
 name = "syn"
-version = "2.0.72"
+version = "2.0.74"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc4b9b9bf2add8093d3f2c0204471e951b2285580335de42f9d2534f3ae7a8af"
+checksum = "1fceb41e3d546d0bd83421d3409b1460cc7444cd389341a4c880fe7a042cb3d7"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -3006,15 +3024,15 @@ dependencies = [

 [[package]]
 name = "tempfile"
-version = "3.11.0"
+version = "3.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8fcd239983515c23a32fb82099f97d0b11b8c72f654ed659363a95c3dad7a53"
+checksum = "04cbcdd0c794ebb0d4cf35e88edd2f7d2c4c3e9a5a6dab322839b321c6a87a64"
 dependencies = [
 "cfg-if",
 "fastrand",
 "once_cell",
 "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@@ -3390,9 +3408,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"

 [[package]]
 name = "ureq"
-version = "2.10.0"
+version = "2.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72139d247e5f97a3eff96229a7ae85ead5328a39efe76f8bf5a06313d505b6ea"
+checksum = "b74fc6b57825be3373f7054754755f03ac3a8f5d70015ccad699ba2029956f4a"
 dependencies = [
 "base64",
 "flate2",
@@ -3684,7 +3702,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
 dependencies = [
- "windows-targets 0.52.5",
+ "windows-targets 0.52.6",
 ]

 [[package]]
@@ -3702,7 +3720,16 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.5",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
 ]

 [[package]]
@@ -3722,18 +3749,18 @@ dependencies = [

 [[package]]
 name = "windows-targets"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.5",
- "windows_aarch64_msvc 0.52.5",
- "windows_i686_gnu 0.52.5",
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
 "windows_i686_gnullvm",
- "windows_i686_msvc 0.52.5",
- "windows_x86_64_gnu 0.52.5",
- "windows_x86_64_gnullvm 0.52.5",
- "windows_x86_64_msvc 0.52.5",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
 ]

 [[package]]
@@ -3744,9 +3771,9 @@ checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"

 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"

 [[package]]
 name = "windows_aarch64_msvc"
@@ -3756,9 +3783,9 @@ checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"

 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"

 [[package]]
 name = "windows_i686_gnu"
@@ -3768,15 +3795,15 @@ checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"

 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"

 [[package]]
 name = "windows_i686_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"

 [[package]]
 name = "windows_i686_msvc"
@@ -3786,9 +3813,9 @@ checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"

 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"

 [[package]]
 name = "windows_x86_64_gnu"
@@ -3798,9 +3825,9 @@ checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"

 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"

 [[package]]
 name = "windows_x86_64_gnullvm"
@@ -3810,9 +3837,9 @@ checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"

 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"

 [[package]]
 name = "windows_x86_64_msvc"
@@ -3822,9 +3849,9 @@ checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"

 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"

 [[package]]
 name = "winnow"
--- a/pkgs/development/tools/ruff/default.nix
+++ b/pkgs/development/tools/ruff/default.nix
@@ -13,13 +13,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "ruff";
-  version = "0.5.7";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "ruff";
    rev = "refs/tags/${version}";
-    hash = "sha256-swnh2bfmwPP1BHlnKbOtRdskMMArZgP/ErtrnXKRiC8=";
+    hash = "sha256-s4JIqeOIxJ3NQ61fuBYYF0kSovEMcVHRExLB7kpICeg=";
  };

  cargoLock = {
--- a/pkgs/by-name/ya/yazi-unwrapped/Cargo.lock
+++ b/pkgs/by-name/ya/yazi-unwrapped/Cargo.lock
--- a/pkgs/by-name/ru/rustic/package.nix
+++ b/pkgs/by-name/ru/rustic/package.nix
@@ -1,36 +1,51 @@
-{ lib
-, fetchFromGitHub
-, rustPlatform
-, stdenv
-, Security
-, SystemConfiguration
-, installShellFiles
-, nix-update-script
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  stdenv,
+  Security,
+  SystemConfiguration,
+  installShellFiles,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage rec {
  pname = "rustic";
-  version = "0.7.0";
+  version = "0.7.0-unstable-2024-08-10";

  src = fetchFromGitHub {
    owner = "rustic-rs";
    repo = "rustic";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-jUAmboJTzX4oJZy9rFiPRbm94bVpZGa0SaqotoCU/Ss=";
+    # rev = "refs/tags/v${version}";
+    rev = "1c9969c";
+    hash = "sha256-+YVF59xHb82TOn7Gl0BbX2Yx6Owsp0LiOBgEXHN9QVI=";
  };

-  cargoHash = "sha256-8YGvxnwD9Vshah2jZ+XxOW0qB4nvWsOyLY1W8k+xQzU=";
+  # With the next release please go back to `cargoHash` and remove the vendored
+  # `Cargo.lock` if possible.
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "rustic_backend-0.1.1" = "sha256-6VC0DKqV9NPzwKs6SOI3dQMKrGZd2azUBMbU9dejHKs=";
+    };
+  };

-  # At the time of writing, upstream defaults to "self-update" and "webdav".
+  # At the time of writing, upstream defaults to "self-update", "tui", and "webdav".
  # "self-update" is a self-updater, which we don't want in nixpkgs.
+  # With each update we should therefore ensure that we mimic the default features
+  # as closely as possible.
  buildNoDefaultFeatures = true;
  buildFeatures = [
+    "tui"
    "webdav"
  ];

  nativeBuildInputs = [ installShellFiles ];

-  buildInputs = lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
+  buildInputs = lib.optionals stdenv.isDarwin [
+    Security
+    SystemConfiguration
+  ];

  postInstall = ''
    for shell in {ba,fi,z}sh; do
@@ -48,7 +63,10 @@ rustPlatform.buildRustPackage rec {
    description = "fast, encrypted, deduplicated backups powered by pure Rust";
    mainProgram = "rustic";
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    license = [ lib.licenses.mit lib.licenses.asl20 ];
+    license = [
+      lib.licenses.mit
+      lib.licenses.asl20
+    ];
    maintainers = [ lib.maintainers.nobbz ];
  };
 }
--- a/pkgs/development/libraries/shapelib/default.nix
+++ b/pkgs/development/libraries/shapelib/default.nix
@@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "shapelib";
-  version = "1.6.0";
+  version = "1.6.1";

  src = fetchurl {
    url = "https://download.osgeo.org/shapelib/shapelib-${version}.tar.gz";
-    sha256 = "sha256-GVKLJDdyQXBWNzIMNnlDAxrVCIZl0fsOHqpSpxJkpsQ=";
+    sha256 = "sha256-XakKYOJUQPEI9OjpVzK/qD7eE8jgwrz4CuQQBsyOvCA=";
  };

  doCheck = true;
@@ -22,5 +22,6 @@ stdenv.mkDerivation rec {
    homepage = "http://shapelib.maptools.org/";
    license = licenses.gpl2;
    maintainers = with maintainers; teams.geospatial.members ++ [ ehmry ];
+    changelog = "http://shapelib.maptools.org/release.html";
  };
 }
--- a/pkgs/applications/video/shotcut/fix-mlt-ffmpeg-path.patch
+++ b/pkgs/applications/video/shotcut/fix-mlt-ffmpeg-path.patch
--- a/pkgs/applications/video/shotcut/default.nix
+++ b/pkgs/applications/video/shotcut/default.nix
@@ -1,23 +1,20 @@
-{ lib
-, fetchFromGitHub
-, stdenv
-, wrapQtAppsHook
-, substituteAll
-, SDL2
-, frei0r
-, ladspaPlugins
-, gettext
-, mlt
-, jack1
-, pkg-config
-, fftw
-, qtbase
-, qttools
-, qtmultimedia
-, qtcharts
-, cmake
-, Cocoa
-, gitUpdater
+{
+  lib,
+  fetchFromGitHub,
+  stdenv,
+  substituteAll,
+  SDL2,
+  frei0r,
+  ladspaPlugins,
+  gettext,
+  mlt,
+  jack1,
+  pkg-config,
+  fftw,
+  qt6,
+  cmake,
+  darwin,
+  gitUpdater,
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "shotcut";
@@ -30,7 +27,12 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-9eQF3s4BAUK81/94z7cMkd2NWdNLVMraP08qsDmuAI8=";
  };

-  nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook ];
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    qt6.wrapQtAppsHook
+  ];
+
  buildInputs = [
    SDL2
    frei0r
@@ -38,27 +40,29 @@ stdenv.mkDerivation (finalAttrs: {
    gettext
    mlt
    fftw
-    qtbase
-    qttools
-    qtmultimedia
-    qtcharts
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    Cocoa
-  ];
+    qt6.qtbase
+    qt6.qttools
+    qt6.qtmultimedia
+    qt6.qtcharts
+    qt6.qtwayland
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ];

  env.NIX_CFLAGS_COMPILE = "-DSHOTCUT_NOUPGRADE";
-  cmakeFlags = [
-    "-DSHOTCUT_VERSION=${finalAttrs.version}"
-  ];
+  cmakeFlags = [ "-DSHOTCUT_VERSION=${finalAttrs.version}" ];

  patches = [
-    (substituteAll { inherit mlt; src = ./fix-mlt-ffmpeg-path.patch; })
+    (substituteAll {
+      inherit mlt;
+      src = ./fix-mlt-ffmpeg-path.patch;
+    })
  ];

  qtWrapperArgs = [
    "--set FREI0R_PATH ${frei0r}/lib/frei0r-1"
    "--set LADSPA_PATH ${ladspaPlugins}/lib/ladspa"
-    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath ([SDL2] ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [jack1])}"
+    "--prefix LD_LIBRARY_PATH : ${
+      lib.makeLibraryPath ([ SDL2 ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ jack1 ])
+    }"
  ];

  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
@@ -67,9 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
    ln -s $out/Applications/Shotcut.app/Contents/MacOS/Shotcut $out/bin/shotcut
  '';

-  passthru.updateScript = gitUpdater {
-    rev-prefix = "v";
-  };
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };

  meta = with lib; {
    description = "Free, open source, cross-platform video editor";
@@ -84,7 +86,10 @@ stdenv.mkDerivation (finalAttrs: {
    '';
    homepage = "https://shotcut.org";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ woffs peti ];
+    maintainers = with maintainers; [
+      woffs
+      peti
+    ];
    platforms = platforms.unix;
    mainProgram = "shotcut";
  };
--- a/pkgs/by-name/st/stalwart-mail/package.nix
+++ b/pkgs/by-name/st/stalwart-mail/package.nix
@@ -25,7 +25,7 @@ let
  # See upstream issue for rocksdb 9.X support
  # https://github.com/stalwartlabs/mail-server/issues/407
  rocksdb = rocksdb_8_11;
-  version = "0.9.0";
+  version = "0.9.1";
 in
 rustPlatform.buildRustPackage {
  pname = "stalwart-mail";
@@ -34,14 +34,12 @@ rustPlatform.buildRustPackage {
  src = fetchFromGitHub {
    owner = "stalwartlabs";
    repo = "mail-server";
-    # XXX: We need to use a revisoin two commits after v0.9.0, which includes fixes for test cases.
-    # Can be reverted to "v${version}" next release.
-    rev = "2a12e251f2591b7785d7a921364f125d2e9c1e6e";
-    hash = "sha256-qoU09tLpOlsy5lKv2GdCV23bd70hnNZ0r/O5APGVDyw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-7a2Vrrjo4Qd62dneQr3Xl2+HVUIfLa9AnGXEt2RWWZY=";
    fetchSubmodules = true;
  };

-  cargoHash = "sha256-rGCu3J+hTxiIENDIQM/jPz1wUNJr0ouoa1IkwWKfOWM=";
+  cargoHash = "sha256-sAma3T9X9N8UjJ4leePIa6gvqpKW2QkpzYaIAFWLeVc=";

  patches = [
    # Remove "PermissionsStartOnly" from systemd service files,
@@ -130,6 +128,12 @@ rustPlatform.buildRustPackage {
    #   left: 0
    #  right: 12
    "--skip=smtp::reporting::analyze::report_analyze"
+    # thread 'smtp::inbound::dmarc::dmarc' panicked at tests/src/smtp/inbound/mod.rs:59:26:
+    # Expected empty queue but got Reload
+    "--skip=smtp::inbound::dmarc::dmarc"
+    # thread 'smtp::queue::concurrent::concurrent_queue' panicked at tests/src/smtp/inbound/mod.rs:65:9:
+    # assertion `left == right` failed
+    "--skip=smtp::queue::concurrent::concurrent_queue"
  ];

  doCheck = !(stdenv.isLinux && stdenv.isAarch64);
--- a/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix
+++ b/pkgs/by-name/te/tetrio-desktop/tetrio-plus.nix
@@ -9,7 +9,7 @@

 , fetchYarnDeps
 , yarn
-, fixup_yarn_lock
+, fixup-yarn-lock
 , nodejs
 , asar

@@ -93,7 +93,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    yarn
-    fixup_yarn_lock
+    fixup-yarn-lock
    nodejs
    asar
  ];
@@ -113,7 +113,7 @@ stdenv.mkDerivation (finalAttrs: {

    export HOME=$(mktemp -d)
    yarn config --offline set yarn-offline-mirror ${offlineCache}
-    fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
    patchShebangs node_modules/

--- a/pkgs/by-name/ti/tinyemu/package.nix
+++ b/pkgs/by-name/ti/tinyemu/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  SDL,
+  curl,
+  openssl,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tinyemu";
+  version = "2019-12-21";
+
+  src = fetchurl {
+    url = "https://bellard.org/tinyemu/tinyemu-${finalAttrs.version}.tar.gz";
+    hash = "sha256-voNR8hIYGbMXL87c5csYJvoSyH2ht+2Y8mnT6AKgVVU=";
+  };
+
+  nativeBuildInputs = [ SDL ];
+
+  buildInputs = [
+    SDL
+    curl
+    openssl
+  ];
+
+  strictDeps = true;
+
+  makeFlags = [
+    "CC:=$(CC)"
+    "STRIP:=$(STRIP)"
+    "bindir=$(out)/bin"
+  ];
+
+  preInstall = ''
+    mkdir -p "$out/bin"
+  '';
+
+  meta = {
+    homepage = "https://bellard.org/tinyemu/";
+    description = "System emulator for the RISC-V and x86 architectures";
+    longDescription = ''
+      TinyEMU is a system emulator for the RISC-V and x86 architectures. Its
+      purpose is to be small and simple while being complete.
+
+      Main features:
+
+      - RISC-V system emulator supporting the RV128IMAFDQC base ISA (user level
+        ISA version 2.2, priviledged architecture version 1.10) including:
+        - 32/64/128 bit integer registers
+        - 32/64/128 bit floating point instructions (using the SoftFP Library)
+        - Compressed instructions
+        - Dynamic XLEN change
+      - x86 system emulator based on KVM
+      - VirtIO console, network, block device, input and 9P filesystem
+      - Graphical display with SDL
+      - JSON configuration file
+      - Remote HTTP block device and filesystem
+      - Small code, easy to modify, few external dependancies
+      - Javascript version running Linux and Windows 2000.
+    '';
+    license = with lib.licenses; [
+      mit
+      bsd2
+    ];
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/ue/ueberzugpp/package.nix
+++ b/pkgs/by-name/ue/ueberzugpp/package.nix
@@ -24,6 +24,7 @@
 , extra-cmake-modules
 , wayland
 , wayland-protocols
+, wayland-scanner
 , enableX11 ? stdenv.isLinux
 , xorg
 }:
@@ -44,6 +45,8 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    cmake
    pkg-config
+  ] ++ lib.optionals enableWayland [
+    wayland-scanner
  ];

  buildInputs = [
--- a/pkgs/by-name/up/upbound/package.nix
+++ b/pkgs/by-name/up/upbound/package.nix
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "upbound";
-  version = "0.31.0";
+  version = "0.32.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = "up";
    rev = "v${version}";
-    sha256 = "sha256-nXP97J0DdcXPAD/gB3py5UXhe48Kaec7CRTHmalo+RQ=";
+    sha256 = "sha256-E+9Goj2YppZ5Ka84vICmnjDeWcaW7kcxSsKyqZZoDs8=";
  };

-  vendorHash = "sha256-9HnKpofJPxCieG5thNcLC7diA51ohzy7xgtniL7FEgo=";
+  vendorHash = "sha256-WLRXj4G49JEbQc2aFAjLLCpQrDhN94jazWxfM70hHqs=";

  subPackages = [ "cmd/docker-credential-up" "cmd/up" ];

--- a/pkgs/by-name/ux/uxplay/package.nix
+++ b/pkgs/by-name/ux/uxplay/package.nix
@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "uxplay";
-  version = "1.68.3";
+  version = "1.69";

  src = fetchFromGitHub {
    owner = "FDH2";
    repo = "UxPlay";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Ev+VXI37zLRQ3yqllJVo1JZK/U82HeB65Hi9+c0O8Ks=";
+    hash = "sha256-4QNuM/yMb5wSTSjTbqrTgU+FHFMIyIH8pRBwuGhAJU4=";
  };

  postPatch = ''
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@@ -11,25 +11,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "yazi";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "sxyazi";
    repo = "yazi";
    rev = "v${version}";
-    hash = "sha256-vK8P+6hn7NiympkQE8Bp45ZPqTO24VTSu0QwnXHfdXw=";
+    hash = "sha256-tK2dm+WIEJGSq/PbRyagt7x43nd/o1HxP8HMj23HfnQ=";
  };

-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "notify-6.1.1" = "sha256-5Ft2yvRPi2EaErcGBkF/3Xv6K7ijFGbdjmSqI4go/h4=";
-    };
-  };
+  cargoHash = "sha256-Lb9gu4/i+vPH3dhdzIn9V2s6fKooxEefcN2T/oDqVmg=";

  env.YAZI_GEN_COMPLETIONS = true;
  env.VERGEN_GIT_SHA = "Nixpkgs";
-  env.VERGEN_BUILD_DATE = "2024-08-01";
+  env.VERGEN_BUILD_DATE = "2024-08-15";

  nativeBuildInputs = [ installShellFiles ];
  buildInputs = [ rust-jemalloc-sys ] ++ lib.optionals stdenv.isDarwin [ Foundation ];
@@ -55,6 +50,7 @@ rustPlatform.buildRustPackage rec {
      matthiasbeyer
      linsui
      eljamm
+      uncenter
    ];
    mainProgram = "yazi";
  };
--- a/pkgs/by-name/zc/zchunk/package.nix
+++ b/pkgs/by-name/zc/zchunk/package.nix
@@ -0,0 +1,70 @@
+{
+  lib,
+  argp-standalone,
+  callPackage,
+  curl,
+  fetchFromGitHub,
+  gitUpdater,
+  meson,
+  ninja,
+  pkg-config,
+  stdenv,
+  zstd,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "zchunk";
+  version = "1.5.1";
+
+  src = fetchFromGitHub {
+    owner = "zchunk";
+    repo = "zchunk";
+    rev = finalAttrs.version;
+    hash = "sha256-X8qywx55TUVEOfYJMV5ARwyUdMjmN4hTmJQ6Upq5zyI=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    curl
+    zstd
+  ] ++ lib.optionals stdenv.isDarwin [ argp-standalone ];
+
+  outputs = [
+    "out"
+    "dev"
+    "lib"
+    "man"
+  ];
+
+  strictDeps = true;
+
+  passthru = {
+    updateScript = gitUpdater { };
+    tests = lib.packagesFromDirectoryRecursive {
+      inherit callPackage;
+      directory = ./tests;
+    };
+  };
+
+  meta = {
+    homepage = "https://github.com/zchunk/zchunk";
+    description = "File format designed for highly efficient deltas while maintaining good compression";
+    longDescription = ''
+      zchunk is a compressed file format that splits the file into independent
+      chunks. This allows you to only download changed chunks when downloading a
+      new version of the file, and also makes zchunk files efficient over rsync.
+
+      zchunk files are protected with strong checksums to verify that the file
+      you downloaded is, in fact, the file you wanted.
+    '';
+    license = lib.licenses.bsd2;
+    mainProgram = "zck";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/zc/zchunk/tests/version.nix
+++ b/pkgs/by-name/zc/zchunk/tests/version.nix
@@ -0,0 +1,6 @@
+{ testers, zchunk }:
+
+testers.testVersion {
+  package = zchunk;
+  command = "zck --version";
+}
--- a/pkgs/by-name/ze/zed-editor/Cargo.lock
+++ b/pkgs/by-name/ze/zed-editor/Cargo.lock
@@ -13775,7 +13775,7 @@ dependencies = [

 [[package]]
 name = "zed"
-version = "0.148.0"
+version = "0.148.1"
 dependencies = [
 "activity_indicator",
 "anyhow",
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -35,13 +35,13 @@ assert withGLES -> stdenv.isLinux;

 rustPlatform.buildRustPackage rec {
  pname = "zed";
-  version = "0.148.0";
+  version = "0.148.1";

  src = fetchFromGitHub {
    owner = "zed-industries";
    repo = "zed";
    rev = "refs/tags/v${version}";
-    hash = "sha256-fwxKzd2YKGAMbDDJPj4A0MHBRLg8oBc6JZzrbr7BaHM=";
+    hash = "sha256-ed6/QQObmclSA36g+civhii1aFKTBSjqB+LOyp2LUPg=";
    fetchSubmodules = true;
  };

@@ -135,6 +135,10 @@ rustPlatform.buildRustPackage rec {
    patchelf --add-rpath ${wayland}/lib $out/libexec/*
  '';

+  preCheck = ''
+    export HOME=$(mktemp -d);
+  '';
+
  checkFlags = lib.optionals stdenv.hostPlatform.isLinux [
    # Fails on certain hosts (including Hydra) for unclear reason
    "--skip=test_open_paths_action"
--- a/pkgs/data/misc/clash-geoip/default.nix
+++ b/pkgs/data/misc/clash-geoip/default.nix
@@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "clash-geoip";
-  version = "20240712";
+  version = "20240812";

  src = fetchurl {
    url = "https://github.com/Dreamacro/maxmind-geoip/releases/download/${version}/Country.mmdb";
-    sha256 = "sha256-qCa1Udu3qcXggDcVRYqTs7Jvisudh0ZMb48oKVYCG+k=";
+    sha256 = "sha256-wX5qBZIwdGFzOlk42SDs8T4QhDovEJ6twyghX/JRgjY=";
  };

  dontUnpack = true;
--- a/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix
+++ b/pkgs/desktops/deepin/apps/deepin-system-monitor/default.nix
@@ -15,6 +15,7 @@
 , dde-qt-dbus-factory
 , dde-dock
 , gsettings-qt
+, polkit-qt
 , procps
 , libpcap
 , libnl
@@ -27,13 +28,13 @@

 stdenv.mkDerivation rec {
  pname = "deepin-system-monitor";
-  version = "6.0.13";
+  version = "6.0.23";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-QwZPvEOYypSmbe3deqLRsI3VL/CgVc+Ql3JlsMZ9MqY=";
+    hash = "sha256-LcXc8yI81YslVjof74TvOm6eWiN4UaHgUFU+HSCNZxQ=";
  };

  postPatch = ''
@@ -73,6 +74,7 @@ stdenv.mkDerivation rec {
    dde-qt-dbus-factory
    dde-dock
    gsettings-qt
+    polkit-qt
    procps
    libpcap
    libnl
--- a/pkgs/desktops/deepin/core/dde-appearance/default.nix
+++ b/pkgs/desktops/deepin/core/dde-appearance/default.nix
@@ -17,23 +17,20 @@

 stdenv.mkDerivation rec {
  pname = "dde-appearance";
-  version = "1.1.25";
+  version = "1.1.29";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-H9TvWF6Q0lX4GF4mQ71E3SUqWbhH7dzHIlScovbN7lM=";
+    hash = "sha256-M39EugV0uGCIaXK4isTQpHd6Rh2Vl6sg3Jp8JIEFEE4=";
  };

-  patches = [
-    ./fix-custom-wallpapers-path.diff
-  ];
-
  postPatch = ''
    substituteInPlace src/service/impl/appearancemanager.cpp \
-      src/service/modules/api/compatibleengine.cpp \
-      src/service/modules/subthemes/customtheme.cpp \
+      src/service/modules/{api/compatibleengine.cpp,subthemes/customtheme.cpp,background/backgrounds.cpp} \
+      misc/dconfig/org.deepin.dde.appearance.json \
+      fakewm/dbus/deepinwmfaker.cpp \
      --replace "/usr/share" "/run/current-system/sw/share"

    for file in $(grep -rl "/usr/bin/dde-appearance"); do
--- a/pkgs/desktops/deepin/core/dde-appearance/fix-custom-wallpapers-path.diff
+++ b/pkgs/desktops/deepin/core/dde-appearance/fix-custom-wallpapers-path.diff
@@ -1,68 +0,0 @@
-diff --git a/misc/dconfig/org.deepin.dde.appearance.json b/misc/dconfig/org.deepin.dde.appearance.json
-index b612e6e..371f966 100644
--- a/misc/dconfig/org.deepin.dde.appearance.json
-+++ b/misc/dconfig/org.deepin.dde.appearance.json
-@@ -143,7 +143,7 @@
-             "visibility": "private"
-         },
-         "Background_Uris": {
-            "value": ["file:///usr/share/backgrounds/default_background.jpg"],
-+            "value": ["file:///run/current-system/sw/share/backgrounds/default_background.jpg"],
-             "serial": 0,
-             "flags": [],
-             "name": "Background_Uris",
-diff --git a/fakewm/dbus/deepinwmfaker.cpp b/fakewm/dbus/deepinwmfaker.cpp
-index 5d455fa..40ec608 100644
--- a/fakewm/dbus/deepinwmfaker.cpp
-+++ b/fakewm/dbus/deepinwmfaker.cpp
-@@ -54,13 +54,13 @@ Q_GLOBAL_STATIC_WITH_ARGS(QGSettings, _gsettings_dde_zone, ("com.deepin.dde.zone
- 
- #define KWinDBusCompositorInterface "org.kde.kwin.Compositing"
- #define KWinDBusCompositorPath "/Compositor"
-const char defaultFirstBackgroundUri[] = "file:///usr/share/wallpapers/deepin/desktop.jpg";
-+const char defaultFirstBackgroundUri[] = "file:///run/current-system/sw/share/wallpapers/deepin/desktop.jpg";
- const char defaultSecondBackgroundUri[] = "francesco-ungaro-1fzbUyzsHV8-unsplash";
- 
- //default cursor size :24
- #define DEFAULTCURSORSIZE 24
- 
-const char fallback_background_name[] = "file:///usr/share/backgrounds/default_background.jpg";
-+const char fallback_background_name[] = "file:///run/current-system/sw/share/backgrounds/default_background.jpg";
- 
- //using org::kde::KWin;
- 
-diff --git a/src/service/impl/appearancemanager.cpp b/src/service/impl/appearancemanager.cpp
-index 360ca6f..6db93ab 100644
--- a/src/service/impl/appearancemanager.cpp
-+++ b/src/service/impl/appearancemanager.cpp
-@@ -821,7 +821,7 @@ void AppearanceManager::doUpdateWallpaperURIs()
-     }
- 
-     // 如果是用户自己设置的桌面壁纸, 需要将主题更新为自定义
-    if (!monitorWallpaperUris.first().startsWith("/usr/share/wallpapers/deepin")) {
-+    if (!monitorWallpaperUris.first().startsWith("/run/current-system/sw/share/wallpapers/deepin")) {
-         updateCustomTheme(TYPEWALLPAPER, monitorWallpaperUris.first());
-     }
- }
-@@ -1689,7 +1689,7 @@ QString AppearanceManager::getWallpaperUri(const QString &index, const QString &
-             const Background &bg = backgroudlist.at(QRandomGenerator::global()->generate() % backgroudlist.size());
-             wallpaper = bg.getId();
-         } else {
-            wallpaper = "file:///usr/share/wallpapers/deepin/desktop.jpg";
-+            wallpaper = "file:///run/current-system/sw/share/wallpapers/deepin/desktop.jpg";
-         }
- 
-         PhaseWallPaper::setWallpaperUri(index, monitorName, wallpaper);
-diff --git a/src/service/modules/background/backgrounds.cpp b/src/service/modules/background/backgrounds.cpp
-index bf739a5..1076d59 100644
--- a/src/service/modules/background/backgrounds.cpp
-+++ b/src/service/modules/background/backgrounds.cpp
-@@ -11,7 +11,7 @@
- #include <pwd.h>
- #include <QDBusReply>
- 
-QStringList Backgrounds::systemWallpapersDir = { "/usr/share/wallpapers/deepin" };
-+QStringList Backgrounds::systemWallpapersDir = { "/run/current-system/sw/share/wallpapers/deepin" };
- QStringList Backgrounds::uiSupportedFormats = { "jpeg", "png", "bmp", "tiff", "gif" };
- 
- Backgrounds::Backgrounds(QObject *parent)
--- a/pkgs/desktops/deepin/core/dde-application-manager/default.nix
+++ b/pkgs/desktops/deepin/core/dde-application-manager/default.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "dde-application-manager";
-  version = "1.2.13";
+  version = "1.2.15";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-nyT5bp37gOWKbpPBmLULJmeL9oZyBwIC5vYwPyBLcAc=";
+    hash = "sha256-9WKKM3SAMgW+UL0DnzDFqA+HHi7euF/yyTyKSbrIgV4=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/deepin/core/dde-calendar/default.nix
+++ b/pkgs/desktops/deepin/core/dde-calendar/default.nix
@@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "dde-calendar";
-  version = "5.13.1";
+  version = "5.14.1";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-Hn759Cxtzv+HBllA2vdZcH6P8EWZkjawpgkmLiE2+uA=";
+    hash = "sha256-08xkdiP0/haHY3jdHSoA1zXRxMi2t+qxLxbcRc7EO6Q=";
  };

  patches = [
--- a/pkgs/desktops/deepin/core/dde-clipboard/default.nix
+++ b/pkgs/desktops/deepin/core/dde-clipboard/default.nix
@@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "dde-clipboard";
-  version = "6.0.9";
+  version = "6.0.11";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-9sBAurO3v/9HOc5k1RrtdNHusImTHLklpxetLMuQuW4=";
+    hash = "sha256-VSwip3WgpOYvqGw7/A8bqsYrVSACrVgoIp/pjXSAKcU=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/deepin/core/dde-control-center/default.nix
+++ b/pkgs/desktops/deepin/core/dde-control-center/default.nix
@@ -24,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "dde-control-center";
-  version = "6.0.55";
+  version = "6.0.59";

  src = fetchFromGitHub {
    owner = "linuxdeepin";
    repo = pname;
    rev = version;
-    hash = "sha256-dCUtCS7Vmd7LX34JA70P3dgsmSdRefgO//NERhKlRlE=";
+    hash = "sha256-OniY/B/9319AYYFFPnsUMNrnc0yVGG3rfCLPjgNFyag=";
  };

  postPatch = ''
--- a/Show More
+++ b/Show More