Merge staging-next into staging

2026-07-22 08:30:57 +00:00 · 2024-05-15 18:01:24 +00:00
parent 3a4faefddf bb81a9932e
commit d85d40bf55
83 changed files with 3252 additions and 1326 deletions
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@@ -230,7 +230,7 @@ completely incompatible with packages from `haskellPackages`.

 Every haskell package set has its own haskell-aware `mkDerivation` which is used
 to build its packages. Generally you won't have to interact with this builder
-since [cabal2nix][cabal2nix] can generate packages
+since [cabal2nix](#haskell-cabal2nix) can generate packages
 using it for an arbitrary cabal package definition. Still it is useful to know
 the parameters it takes when you need to
 [override](#haskell-overriding-haskell-packages) a generated Nix expression.
@@ -1123,18 +1123,75 @@ for [this to work][optparse-applicative-completions].
 Note that this feature is automatically disabled when cross-compiling, since it
 requires executing the binaries in question.

+## Import-from-Derivation helpers {#haskell-import-from-derivation}
+
+### cabal2nix {#haskell-cabal2nix}
+
+[`cabal2nix`][cabal2nix] can generate Nix package definitions for arbitrary
+Haskell packages using [import from derivation][import-from-derivation].
+`cabal2nix` will generate Nix expressions that look like this:
+
+```nix
+# cabal get mtl-2.2.1 && cd mtl-2.2.1 && cabal2nix .
+{ mkDerivation, base, lib, transformers }:
+mkDerivation {
+  pname = "mtl";
+  version = "2.2.1";
+  src = ./.;
+  libraryHaskellDepends = [ base transformers ];
+  homepage = "http://github.com/ekmett/mtl";
+  description = "Monad classes, using functional dependencies";
+  license = lib.licenses.bsd3;
+}
+```
+
+This expression should be called with `haskellPackages.callPackage`, which will
+supply [`haskellPackages.mkDerivation`](#haskell-mkderivation) and the Haskell
+dependencies as arguments.
+
+`callCabal2nix name src args`
+: Create a package named `name` from the source derivation `src` using
+  `cabal2nix`.
+
+  `args` are extra arguments provided to `haskellPackages.callPackage`.
+
+`callCabal2nixWithOptions name src opts args`
+: Create a package named `name` from the source derivation `src` using
+  `cabal2nix`.
+
+  `opts` are extra options for calling `cabal2nix`. If `opts` is a string, it
+  will be used as extra command line arguments for `cabal2nix`, e.g. `--subpath
+  path/to/dir/containing/cabal-file`. Otherwise, `opts` should be an AttrSet
+  which can contain the following attributes:
+
+  `extraCabal2nixOptions`
+  : Extra command line arguments for `cabal2nix`.
+
+  `srcModifier`
+  : A function which is used to modify the given `src` instead of the default
+    filter.
+
+    The default source filter will remove all files from `src` except for
+    `.cabal` files and `package.yaml` files.
+
+<!--
+
+`callHackage`
+: TODO
+
+`callHackageDirect`
+: TODO
+
+`developPackage`
+: TODO
+
+-->
+
 <!--

 TODO(@NixOS/haskell): finish these planned sections
 ### Overriding the entire package set

-
-## Import-from-Derivation helpers
-
-* `callCabal2nix`
-* `callHackage`, `callHackageDirect`
-* `developPackage`
-
 ## Contributing {#haskell-contributing}

 ### Fixing a broken package {#haskell-fixing-a-broken-package}
@@ -1309,3 +1366,4 @@ relevant.
 [profiling]: https://downloads.haskell.org/~ghc/latest/docs/html/users_guide/profiling.html
 [search.nixos.org]: https://search.nixos.org
 [turtle]: https://hackage.haskell.org/package/turtle
+[import-from-derivation]: https://nixos.org/manual/nix/stable/language/import-from-derivation
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -15488,6 +15488,15 @@
    githubId = 69802930;
    name = "patka";
  };
+  patrickdag = {
+    email = "patrick-nixos@failmail.dev";
+    github = "PatrickDaG";
+    githubId = 58092422;
+    name = "Patrick";
+    keys = [{
+      fingerprint = "5E4C 3D74 80C2 35FE 2F0B  D23F 7DD6 A72E C899 617D";
+    }];
+  };
  patricksjackson = {
    email = "patrick@jackson.dev";
    github = "patricksjackson";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -187,6 +187,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - [xdg-terminal-exec](https://github.com/Vladimir-csp/xdg-terminal-exec), the proposed Default Terminal Execution Specification.

+- [your_spotify](https://github.com/Yooooomi/your_spotify), a self hosted Spotify tracking dashboard. Available as [services.your_spotify](#opt-services.your_spotify.enable)
+
 - [RustDesk](https://rustdesk.com), a full-featured open source remote control alternative for self-hosting and security with minimal configuration. Alternative to TeamViewer. Available as [services.rustdesk-server](#opt-services.rustdesk-server.enable).

 - [Scrutiny](https://github.com/AnalogJ/scrutiny), a S.M.A.R.T monitoring tool for hard disks with a web frontend. Available as [services.scrutiny](#opt-services.scrutiny.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1431,6 +1431,7 @@
  ./services/web-apps/windmill.nix
  ./services/web-apps/wordpress.nix
  ./services/web-apps/writefreely.nix
+  ./services/web-apps/your_spotify.nix
  ./services/web-apps/youtrack.nix
  ./services/web-apps/zabbix.nix
  ./services/web-apps/zitadel.nix
--- a/nixos/modules/services/mail/stalwart-mail.nix
+++ b/nixos/modules/services/mail/stalwart-mail.nix
@@ -38,6 +38,7 @@ in {
      store.blob.path = mkDefault "${dataDir}/data/blobs";
      storage.data = mkDefault "db";
      storage.fts = mkDefault "db";
+      storage.lookup = mkDefault "db";
      storage.blob = mkDefault "blob";
      resolver.type = mkDefault "system";
      resolver.public-suffix = mkDefault ["https://publicsuffix.org/list/public_suffix_list.dat"];
--- a/nixos/modules/services/networking/vsftpd.nix
+++ b/nixos/modules/services/networking/vsftpd.nix
@@ -278,7 +278,7 @@ in
      }
      {
        assertion = (cfg.enableVirtualUsers -> cfg.userDbPath != null)
-                 && (cfg.enableVirtualUsers -> cfg.localUsers != null);
+                 && (cfg.enableVirtualUsers -> cfg.localUsers);
        message = "vsftpd: If enableVirtualUsers is true, you need to setup both the userDbPath and localUsers options.";
      }];

--- a/nixos/modules/services/web-apps/your_spotify.nix
+++ b/nixos/modules/services/web-apps/your_spotify.nix
@@ -0,0 +1,191 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  inherit
+    (lib)
+    boolToString
+    concatMapAttrs
+    concatStrings
+    isBool
+    mapAttrsToList
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    optionalAttrs
+    types
+    mkDefault
+    ;
+  cfg = config.services.your_spotify;
+
+  configEnv = concatMapAttrs (name: value:
+    optionalAttrs (value != null) {
+      ${name} =
+        if isBool value
+        then boolToString value
+        else toString value;
+    })
+  cfg.settings;
+
+  configFile = pkgs.writeText "your_spotify.env" (concatStrings (mapAttrsToList (name: value: "${name}=${value}\n") configEnv));
+in {
+  options.services.your_spotify = let
+    inherit (types) nullOr port str path package;
+  in {
+    enable = mkEnableOption "your_spotify";
+
+    enableLocalDB = mkEnableOption "a local mongodb instance";
+    nginxVirtualHost = mkOption {
+      type = nullOr str;
+      default = null;
+      description = ''
+        If set creates an nginx virtual host for the client.
+        In most cases this should be the CLIENT_ENDPOINT without
+        protocol prefix.
+      '';
+    };
+
+    package = mkPackageOption pkgs "your_spotify" {};
+
+    clientPackage = mkOption {
+      type = package;
+      description = "Client package to use.";
+    };
+
+    spotifySecretFile = mkOption {
+      type = path;
+      description = ''
+        A file containing the secret key of your Spotify application.
+        Refer to: [Creating the Spotify Application](https://github.com/Yooooomi/your_spotify#creating-the-spotify-application).
+      '';
+    };
+
+    settings = mkOption {
+      description = ''
+        Your Spotify Configuration. Refer to [Your Spotify](https://github.com/Yooooomi/your_spotify) for definitions and values.
+      '';
+      example = lib.literalExpression ''
+        {
+          CLIENT_ENDPOINT = "https://example.com";
+          API_ENDPOINT = "https://api.example.com";
+          SPOTIFY_PUBLIC = "spotify_client_id";
+        }
+      '';
+      type = types.submodule {
+        freeformType = types.attrsOf types.str;
+        options = {
+          CLIENT_ENDPOINT = mkOption {
+            type = str;
+            description = ''
+              The endpoint of your web application.
+              Has to include a protocol Prefix (e.g. `http://`)
+            '';
+            example = "https://your_spotify.example.org";
+          };
+          API_ENDPOINT = mkOption {
+            type = str;
+            description = ''
+              The endpoint of your server
+              This api has to be reachable from the device you use the website from not from the server.
+              This means that for example you may need two nginx virtual hosts if you want to expose this on the
+              internet.
+              Has to include a protocol Prefix (e.g. `http://`)
+            '';
+            example = "https://localhost:3000";
+          };
+          SPOTIFY_PUBLIC = mkOption {
+            type = str;
+            description = ''
+              The public client ID of your Spotify application.
+              Refer to: [Creating the Spotify Application](https://github.com/Yooooomi/your_spotify#creating-the-spotify-application)
+            '';
+          };
+          MONGO_ENDPOINT = mkOption {
+            type = str;
+            description = ''The endpoint of the Mongo database.'';
+            default = "mongodb://localhost:27017/your_spotify";
+          };
+          PORT = mkOption {
+            type = port;
+            description = "The port of the api server";
+            default = 3000;
+          };
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.your_spotify.clientPackage = mkDefault (cfg.package.client.override {apiEndpoint = cfg.settings.API_ENDPOINT;});
+    systemd.services.your_spotify = {
+      after = ["network.target"];
+      script = ''
+        export SPOTIFY_SECRET=$(< "$CREDENTIALS_DIRECTORY/SPOTIFY_SECRET")
+        ${lib.getExe' cfg.package "your_spotify_migrate"}
+        exec ${lib.getExe cfg.package}
+      '';
+      serviceConfig = {
+        User = "your_spotify";
+        Group = "your_spotify";
+        DynamicUser = true;
+        EnvironmentFile = [configFile];
+        StateDirectory = "your_spotify";
+        LimitNOFILE = "1048576";
+        PrivateTmp = true;
+        PrivateDevices = true;
+        StateDirectoryMode = "0700";
+        Restart = "always";
+
+        LoadCredential = ["SPOTIFY_SECRET:${cfg.spotifySecretFile}"];
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        #MemoryDenyWriteExecute = true; # Leads to coredump because V8 does JIT
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectSystem = "strict";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "@pkey"
+        ];
+        UMask = "0077";
+      };
+      wantedBy = ["multi-user.target"];
+    };
+    services.nginx = mkIf (cfg.nginxVirtualHost != null) {
+      enable = true;
+      virtualHosts.${cfg.nginxVirtualHost} = {
+        root = cfg.clientPackage;
+        locations."/".extraConfig = ''
+          add_header Content-Security-Policy "frame-ancestors 'none';" ;
+          add_header X-Content-Type-Options "nosniff" ;
+          try_files = $uri $uri/ /index.html ;
+        '';
+      };
+    };
+    services.mongodb = mkIf cfg.enableLocalDB {
+      enable = true;
+    };
+  };
+  meta.maintainers = with lib.maintainers; [patrickdag];
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1042,6 +1042,7 @@ in {
  yabar = handleTest ./yabar.nix {};
  ydotool = handleTest ./ydotool.nix {};
  yggdrasil = handleTest ./yggdrasil.nix {};
+  your_spotify = handleTest ./your_spotify.nix {};
  zammad = handleTest ./zammad.nix {};
  zeronet-conservancy = handleTest ./zeronet-conservancy.nix {};
  zfs = handleTest ./zfs.nix {};
--- a/nixos/tests/stalwart-mail.nix
+++ b/nixos/tests/stalwart-mail.nix
@@ -40,12 +40,14 @@ in import ./make-test-python.nix ({ lib, ... }: {
          };
        };

-        session.auth.mechanisms = [ "PLAIN" ];
-        session.auth.directory = "in-memory";
-        storage.directory = "in-memory";  # shared with imap
+        resolver.public-suffix = [ ];  # do not fetch from web in sandbox

-        session.rcpt.directory = "in-memory";
-        queue.outbound.next-hop = [ "local" ];
+        session.auth.mechanisms = "[plain]";
+        session.auth.directory = "'in-memory'";
+        storage.directory = "in-memory";
+
+        session.rcpt.directory = "'in-memory'";
+        queue.outbound.next-hop = "'local'";

        directory."in-memory" = {
          type = "memory";
--- a/nixos/tests/your_spotify.nix
+++ b/nixos/tests/your_spotify.nix
@@ -0,0 +1,33 @@
+import ./make-test-python.nix ({pkgs, ...}: {
+  name = "your_spotify";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [patrickdag];
+  };
+
+  nodes.machine = {
+    services.your_spotify = {
+      enable = true;
+      spotifySecretFile = pkgs.writeText "spotifySecretFile" "deadbeef";
+      settings = {
+        CLIENT_ENDPOINT = "http://localhost";
+        API_ENDPOINT = "http://localhost:3000";
+        SPOTIFY_PUBLIC = "beefdead";
+      };
+      enableLocalDB = true;
+      nginxVirtualHost = "localhost";
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("your_spotify.service")
+
+    machine.wait_for_open_port(3000)
+    machine.wait_for_open_port(80)
+
+    out = machine.succeed("curl --fail -X GET 'http://localhost:3000/'")
+    assert "Hello !" in out
+
+    out = machine.succeed("curl --fail -X GET 'http://localhost:80/'")
+    assert "<title>Your Spotify</title>" in out
+  '';
+})
--- a/pkgs/applications/audio/eartag/default.nix
+++ b/pkgs/applications/audio/eartag/default.nix
@@ -15,11 +15,12 @@
 , gtk4
 , librsvg
 , python3Packages
+, blueprint-compiler
 }:

 python3Packages.buildPythonApplication rec {
  pname = "eartag";
-  version = "0.6.0";
+  version = "0.6.1";
  format = "other";

  src = fetchFromGitLab {
@@ -27,7 +28,7 @@ python3Packages.buildPythonApplication rec {
    owner = "World";
    repo = pname;
    rev = version;
-    hash = "sha256-MfffIqxfelwP+9wsFvQfEIMkav7j5LJEHjLPOsuYdtQ=";
+    hash = "sha256-CAJz9p1PJxq3VDxzZEHD860xINCQF722bPaf7psNztY=";
  };

  postPatch = ''
@@ -48,6 +49,7 @@ python3Packages.buildPythonApplication rec {
    gettext
    gobject-introspection
    wrapGAppsHook4
+    blueprint-compiler
  ] ++ lib.optional stdenv.isDarwin gtk4; # for gtk4-update-icon-cache

  buildInputs = [
--- a/pkgs/applications/editors/heh/default.nix
+++ b/pkgs/applications/editors/heh/default.nix
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "heh";
-  version = "0.4.1";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "ndd7xv";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-IIF/bkTLwR8pCs/hJ625T3NsiKf/6Zf1cW2i4lsiK4U=";
+    hash = "sha256-zkb+HogwioqxZ+BTl7bcDQx9i9uWhT2QdAIXpHqvDl0=";
  };

-  cargoHash = "sha256-tDvqaNVuzv1BlS/oNI1D/WV1b5uHreT3Ak/6ruqKXQc=";
+  cargoHash = "sha256-YcTaLq04NhmnJ1pdbiKMRIBSFvHNWNgoAS8Uz8uGGAw=";

  meta = with lib; {
    description = "A cross-platform terminal UI used for modifying file data in hex or ASCII.";
--- a/pkgs/applications/emulators/cdemu/analyzer.nix
+++ b/pkgs/applications/emulators/cdemu/analyzer.nix
@@ -1,6 +1,6 @@
-{ stdenv, cmake, pkg-config, callPackage, makeWrapper, gobject-introspection, wrapGAppsHook3
-, python3Packages, gtk3, glib, libxml2, gnuplot, gnome, gdk-pixbuf, librsvg, intltool, libmirage }:
-stdenv.mkDerivation {
+{ cmake, pkg-config, callPackage, gobject-introspection, wrapGAppsHook3
+, python3Packages, libxml2, gnuplot, gnome, gdk-pixbuf, intltool, libmirage }:
+python3Packages.buildPythonApplication {

  inherit (callPackage ./common-drv-attrs.nix {
    version = "3.2.6";
@@ -8,14 +8,14 @@ stdenv.mkDerivation {
    hash = "sha256-7I8RUgd+k3cEzskJGbziv1f0/eo5QQXn62wGh/Y5ozc=";
  }) pname version src meta;

-  buildInputs = [ libxml2 gnuplot libmirage gnome.adwaita-icon-theme gdk-pixbuf librsvg
-                  python3Packages.pygobject3 python3Packages.matplotlib ];
-  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook3 intltool ];
+  buildInputs = [ libxml2 gnuplot libmirage gnome.adwaita-icon-theme gdk-pixbuf ];
+  propagatedBuildInputs = with python3Packages; [ pygobject3 matplotlib ];
+  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook3 intltool gobject-introspection ];

+  pyproject = false;
  dontWrapGApps = true;
-  postFixup = ''
-    wrapProgram $out/bin/image-analyzer \
-      ''${gappsWrapperArgs[@]} \
-      --set PYTHONPATH "$PYTHONPATH"
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
  '';
+
 }
--- a/pkgs/applications/emulators/cdemu/client.nix
+++ b/pkgs/applications/emulators/cdemu/client.nix
@@ -1,5 +1,5 @@
-{ stdenv, callPackage, python3Packages, cmake, pkg-config, intltool, wrapGAppsNoGuiHook }:
-stdenv.mkDerivation {
+{ callPackage, python3Packages, cmake, pkg-config, intltool, wrapGAppsNoGuiHook, gobject-introspection }:
+python3Packages.buildPythonApplication {

  inherit (callPackage ./common-drv-attrs.nix {
    version = "3.2.5";
@@ -7,14 +7,13 @@ stdenv.mkDerivation {
    hash = "sha256-py2F61v8vO0BCM18GCflAiD48deZjbMM6wqoCDZsOd8=";
  }) pname version src meta;

-  nativeBuildInputs = [ cmake pkg-config intltool wrapGAppsNoGuiHook ];
-  buildInputs = with python3Packages; [ dbus-python pygobject3 ];
+  nativeBuildInputs = [ cmake pkg-config intltool wrapGAppsNoGuiHook gobject-introspection ];
+  propagatedBuildInputs = with python3Packages; [ dbus-python pygobject3 ];

+  pyproject = false;
  dontWrapGApps = true;
-  postFixup = ''
-    wrapProgram $out/bin/cdemu \
-      ''${gappsWrapperArgs[@]} \
-      --set PYTHONPATH "$PYTHONPATH"
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
  '';

 }
--- a/pkgs/applications/emulators/cdemu/gui.nix
+++ b/pkgs/applications/emulators/cdemu/gui.nix
@@ -1,6 +1,6 @@
-{ stdenv, callPackage, cmake, pkg-config, wrapGAppsHook3
-, python3Packages, libnotify, intltool, gnome, gdk-pixbuf, librsvg }:
-stdenv.mkDerivation {
+{ callPackage, cmake, pkg-config, wrapGAppsHook3, gobject-introspection
+, python3Packages, libnotify, intltool, gnome, gdk-pixbuf }:
+python3Packages.buildPythonApplication {

  inherit (callPackage ./common-drv-attrs.nix {
    version = "3.2.6";
@@ -8,14 +8,14 @@ stdenv.mkDerivation {
    hash = "sha256-w4vzKoSotL5Cjfr4Cu4YhNSWXJqS+n/vySrwvbhR1zA=";
  }) pname version src meta;

-  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook3 intltool ];
-  buildInputs = [ python3Packages.pygobject3 libnotify gnome.adwaita-icon-theme gdk-pixbuf librsvg ];
+  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook3 intltool gobject-introspection ];
+  buildInputs = [ libnotify gnome.adwaita-icon-theme gdk-pixbuf ];
+  propagatedBuildInputs = with python3Packages; [ pygobject3 ];

+  pyproject = false;
  dontWrapGApps = true;
-  postFixup = ''
-    wrapProgram $out/bin/gcdemu \
-      ''${gappsWrapperArgs[@]} \
-      --set PYTHONPATH "$PYTHONPATH"
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
  '';

 }
--- a/pkgs/applications/emulators/cdemu/libmirage.nix
+++ b/pkgs/applications/emulators/cdemu/libmirage.nix
@@ -1,4 +1,4 @@
-{ stdenv, callPackage, cmake, pkg-config
+{ stdenv, callPackage, cmake, pkg-config, gobject-introspection
 , glib, libsndfile, zlib, bzip2, xz, libsamplerate, intltool
 , pcre, util-linux, libselinux, libsepol }:

@@ -13,6 +13,7 @@ stdenv.mkDerivation {
  PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_GIRDIR = "${placeholder "out"}/share/gir-1.0";
  PKG_CONFIG_GOBJECT_INTROSPECTION_1_0_TYPELIBDIR = "${placeholder "out"}/lib/girepository-1.0";
  buildInputs = [ glib libsndfile zlib bzip2 xz libsamplerate ];
-  nativeBuildInputs = [ cmake pkg-config intltool ];
+  nativeBuildInputs = [ cmake pkg-config intltool gobject-introspection ];
  propagatedBuildInputs = [ pcre util-linux libselinux libsepol ];
+
 }
--- a/pkgs/applications/networking/cluster/civo/default.nix
+++ b/pkgs/applications/networking/cluster/civo/default.nix
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "civo";
-  version = "1.0.82";
+  version = "1.0.83";

  src = fetchFromGitHub {
    owner  = "civo";
    repo   = "cli";
    rev    = "v${version}";
-    sha256 = "sha256-pwi0Z0dO2z8Ovlt9gKyVNrh0ZZ2M9xnahBmbTNK2Bnw=";
+    sha256 = "sha256-jRs8RMdTq5xylcYBN59+JzXlJlTJRp7bJVMvEmvzSnc=";
  };

  vendorHash = "sha256-NYNp4KGcVma4ltkq2SJZJOaeKS0j/X2TlUrOnptxiYE=";
--- a/pkgs/applications/networking/cluster/clusterctl/default.nix
+++ b/pkgs/applications/networking/cluster/clusterctl/default.nix
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "clusterctl";
-  version = "1.7.1";
+  version = "1.7.2";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "cluster-api";
    rev = "v${version}";
-    hash = "sha256-e+Ut6xoNUY9cJjjJ43P0siEa+G1igllcb8veirk1UX0=";
+    hash = "sha256-ZZkDc5INjUoNc9zcwbOa9WRIkkLr9bm3mohsSe3tKI4=";
  };

  vendorHash = "sha256-ALRnccGjPGuAITtuz79Cao95NhvSczAzspSMXytlw+A=";
--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@@ -12,16 +12,16 @@

 buildGoModule rec {
  pname = "kubebuilder";
-  version = "3.14.2";
+  version = "3.15.0";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "kubebuilder";
    rev = "v${version}";
-    hash = "sha256-bs/16MEZZOv+5cfr35HDqhnJxza9mQfjd8ALjJifRf8=";
+    hash = "sha256-YaISsW+USP9M4Mblluo+SXSwGspiTiiPFA3VvLmhqaQ=";
  };

-  vendorHash = "sha256-eLLWzVQ9ANIWSdqjmggrboCwcUKVGdrJD2coCLmzAK4=";
+  vendorHash = "sha256-g9QjalRLc2NUsyd7Do1PWw9oD9ATuJGMRaqSaC6AcD0=";

  subPackages = ["cmd"];

--- a/pkgs/applications/networking/remote/wayvnc/default.nix
+++ b/pkgs/applications/networking/remote/wayvnc/default.nix
@@ -67,6 +67,7 @@ stdenv.mkDerivation rec {
      headless one, so it is also possible to run wayvnc without a physical
      display attached.
    '';
+    mainProgram = "wayvnc";
    inherit (src.meta) homepage;
    changelog = "https://github.com/any1/wayvnc/releases/tag/v${version}";
    license = licenses.isc;
--- a/pkgs/applications/science/math/polymake/default.nix
+++ b/pkgs/applications/science/math/polymake/default.nix
@@ -25,13 +25,13 @@

 stdenv.mkDerivation rec {
  pname = "polymake";
-  version = "4.11";
+  version = "4.12";

  src = fetchurl {
    # "The minimal version is a packager friendly version which omits
    # the bundled sources of cdd, lrs, libnormaliz, nauty and jReality."
    url = "https://polymake.org/lib/exe/fetch.php/download/polymake-${version}-minimal.tar.bz2";
-    sha256 = "sha256-XfbwrNcAEZvQxLV2Z2KFL/vYV3ZbXcyIgC/10hCK3SM=";
+    sha256 = "sha256-vVpmf/ykv3641RE0Awzj3zsW3Z0OgA+v2xzoNYZ2QNk=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -280,15 +280,15 @@ rec {
  # Get revisions from
  # https://github.com/moby/moby/tree/${version}/hack/dockerfile/install/*
  docker_24 = callPackage dockerGen rec {
-    version = "24.0.5";
+    version = "24.0.9";
    cliRev = "v${version}";
-    cliHash = "sha256-u1quVGTx/p8BDyRn33vYyyuE5BOhWMnGQ5uVX0PZ5mg=";
+    cliHash = "sha256-nXIZtE0X1OoQT908IGuRhVHb0tiLbqQLP0Md3YWt0/Q=";
    mobyRev = "v${version}";
-    mobyHash = "sha256-JQjRz1fHZlQRkNw/R8WWLV8caN3/U3mrKKQXbZt2crU=";
-    runcRev = "v1.1.8";
-    runcHash = "sha256-rDJYEc64KW4Qa3Eg2oUjJqIKrg6THb5hxQFFbvb9Zp4=";
-    containerdRev = "v1.7.1";
-    containerdHash = "sha256-WwedtcsrDQwMQcKFO5nnPiHyGJpl5hXZlmpbBe1/ftY=";
+    mobyHash = "sha256-KRS99heyMAPBnjjr7If8TOlJf6v6866S7J3YGkOhFiA=";
+    runcRev = "v1.1.12";
+    runcHash = "sha256-N77CU5XiGYIdwQNPFyluXjseTeaYuNJ//OsEUS0g/v0=";
+    containerdRev = "v1.7.13";
+    containerdHash = "sha256-y3CYDZbA2QjIn1vyq/p1F1pAVxQHi/0a6hGWZCRWzyk=";
    tiniRev = "v0.19.0";
    tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
  };
--- a/pkgs/by-name/bi/bitmagnet/package.nix
+++ b/pkgs/by-name/bi/bitmagnet/package.nix
@@ -6,18 +6,18 @@

 buildGoModule rec {
  pname = "bitmagnet";
-  version = "0.7.14";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "bitmagnet-io";
    repo = "bitmagnet";
    rev = "v${version}";
-    hash = "sha256-TaxoQdjdHw8h6w6wKBHL/CVxWFK/RG2tJ//MtUEOwfU=";
+    hash = "sha256-P5GfPRIrwLLMBRgoN6d092HiThMghEj1zcaf6BU+IWU=";
  };

-  vendorHash = "sha256-y9RfaAx9AQS117J3+p/Yy8Mn5In1jmZmW4IxKjeV8T8=";
+  vendorHash = "sha256-exKQTsyP7LL63WHZ8/WchLh4y0Oj9LC4lxiZTOfWARU=";

-  ldflags = [ "-s" "-w" ];
+  ldflags = [ "-s" "-w" "-X github.com/bitmagnet-io/bitmagnet/internal/version.GitTag=v${version}" ];

  passthru = {
    updateScript = nix-update-script { };
--- a/pkgs/by-name/ma/makima/package.nix
+++ b/pkgs/by-name/ma/makima/package.nix
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec{
  pname = "makima";
-  version = "0.6.6";
+  version = "0.7.2";

  src = fetchFromGitHub {
    owner = "cyber-sushi";
    repo = "makima";
    rev = "v${version}";
-    hash = "sha256-Orl79ETROaQzAraGGgYQSSreASanYQHkpEetIR8kJmo=";
+    hash = "sha256-pLEMKVi1CXp9Jqy+D0Wibhfq8PAH2bm3e1G7jShEKsU=";
  };

-  cargoHash = "sha256-npnAbzy2EN3tK1/pSJnnucMj5lLn30lrgKtcPDl0HQQ=";
+  cargoHash = "sha256-EiqmNu0GUE/zFrWkIqrcxZEpv26J39GeWa+tmTlJq4A=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ udev ];
--- a/pkgs/by-name/mi/misconfig-mapper/package.nix
+++ b/pkgs/by-name/mi/misconfig-mapper/package.nix
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "misconfig-mapper";
-  version = "1.1.0";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "intigriti";
    repo = "misconfig-mapper";
    rev = "refs/tags/v${version}";
-    hash = "sha256-5FzXtqC8C4iDC8xBalKHlNeSIJ0msMVC7jUXZxSLkLY=";
+    hash = "sha256-D9VQthfkWC+qmqIZKIVuFuf9ZDNtyRmjh7tT/QGhQig=";
  };

-  vendorHash = "sha256-b2AVWjZXNQPV84sS2wu5xUadZEme/T96O4dGiV5G0dA=";
+  vendorHash = "sha256-lkVTgnWdk9eW6QtKScK8NckcXGzsHeIwjSoUx85AGU8=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/py/pyright/package.nix
+++ b/pkgs/by-name/py/pyright/package.nix
@@ -1,13 +1,13 @@
 { lib, buildNpmPackage, fetchFromGitHub, runCommand, jq }:

 let
-  version = "1.1.361";
+  version = "1.1.362";

  src = fetchFromGitHub {
    owner = "Microsoft";
    repo = "pyright";
    rev = "${version}";
-    hash = "sha256-Prp8LlkSxK2zuVi1lYtI4MdBTGrGhA52Cl5a016ttDY=";
+    hash = "sha256-sz+Om2bfsJJTe2W8l49pI+K9phCTwoczeG1Q7qlMIig=";
  };

  patchedPackageJSON = runCommand "package.json" { } ''
@@ -37,7 +37,7 @@ let
    pname = "pyright-internal";
    inherit version src;
    sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-kWDMbzLTDIyG9fUixEJ8Uap4wJmLiu0CQWKr9K5hAJQ=";
+    npmDepsHash = "sha256-xcr9j5/90gfV/r0yI9ifj6Nrr9WrawwvukuVkl387r4=";
    dontNpmBuild = true;
    installPhase = ''
      runHook preInstall
@@ -51,7 +51,7 @@ buildNpmPackage rec {
  inherit version src;

  sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-6Drw9H5eTxpZVrQZpUIarcu3a6UpU/8qX1MzM4q5IfY=";
+  npmDepsHash = "sha256-79tXMdOt1XH3KTT46bq35J4AcCVyoB2d4KEkr9EjqVY=";

  postPatch = ''
    chmod +w ../../
--- a/pkgs/by-name/ri/ripunzip/package.nix
+++ b/pkgs/by-name/ri/ripunzip/package.nix
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ripunzip";
-  version = "1.1.0";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "google";
    repo = "ripunzip";
    rev = "v${version}";
-    hash = "sha256-GyP4OPnPKhu9nXYXIfWCVLF/thwWiP0OqAQY/1D05LE=";
+    hash = "sha256-WcqN3Li0UiEhntKlQkGUrkP9N1I3NrjaGzIs9Q5i4y4=";
  };

-  cargoHash = "sha256-Jv9bCHT5xl/2CPnSuWd9HZuaGOttBC5iAbbpr3jaIhM=";
+  cargoHash = "sha256-CezigBDU632UVaeFNv+iM2dQQUabKhOP43etp6vjxTg=";

  buildInputs = [ openssl ]
    ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Security SystemConfiguration ]);
--- a/pkgs/by-name/sp/spade/Cargo.lock
+++ b/pkgs/by-name/sp/spade/Cargo.lock
@@ -980,7 +980,7 @@ checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a"

 [[package]]
 name = "spade"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "atty",
 "clap",
@@ -1014,7 +1014,7 @@ dependencies = [

 [[package]]
 name = "spade-ast"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "num",
 "spade-common",
@@ -1022,7 +1022,7 @@ dependencies = [

 [[package]]
 name = "spade-ast-lowering"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "itertools",
 "local-impl",
@@ -1040,7 +1040,7 @@ dependencies = [

 [[package]]
 name = "spade-common"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "codespan",
 "codespan-reporting 0.12.0",
@@ -1066,7 +1066,7 @@ dependencies = [

 [[package]]
 name = "spade-diagnostics"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "codespan",
 "codespan-reporting 0.12.0",
@@ -1084,7 +1084,7 @@ dependencies = [

 [[package]]
 name = "spade-hir"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "codespan-reporting 0.12.0",
 "colored",
@@ -1102,7 +1102,7 @@ dependencies = [

 [[package]]
 name = "spade-hir-lowering"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "codespan",
 "codespan-reporting 0.12.0",
@@ -1128,7 +1128,7 @@ dependencies = [

 [[package]]
 name = "spade-macros"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -1138,7 +1138,7 @@ dependencies = [

 [[package]]
 name = "spade-mir"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "codespan",
 "codespan-reporting 0.12.0",
@@ -1159,7 +1159,7 @@ dependencies = [

 [[package]]
 name = "spade-parser"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "codespan",
 "colored",
@@ -1177,7 +1177,7 @@ dependencies = [

 [[package]]
 name = "spade-python"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "codespan-reporting 0.12.0",
 "color-eyre",
@@ -1206,7 +1206,7 @@ dependencies = [

 [[package]]
 name = "spade-simulation-ext"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "codespan-reporting 0.12.0",
 "color-eyre",
@@ -1234,7 +1234,7 @@ dependencies = [

 [[package]]
 name = "spade-tests"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "codespan-reporting 0.12.0",
 "colored",
@@ -1262,7 +1262,7 @@ dependencies = [

 [[package]]
 name = "spade-typeinference"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "assert_matches",
 "codespan",
@@ -1285,7 +1285,7 @@ dependencies = [

 [[package]]
 name = "spade-types"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "num",
 "serde",
@@ -1294,7 +1294,7 @@ dependencies = [

 [[package]]
 name = "spade-wordlength-inference"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
 "codespan",
 "codespan-reporting 0.12.0",
--- a/pkgs/by-name/sp/spade/package.nix
+++ b/pkgs/by-name/sp/spade/package.nix
@@ -2,17 +2,20 @@
 , rustPlatform
 , fetchFromGitLab
 , stdenv
+, nix-update
+, writeScript
+, git
 }:

 rustPlatform.buildRustPackage rec {
  pname = "spade";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitLab {
    owner = "spade-lang";
    repo = "spade";
    rev = "v${version}";
-    hash = "sha256-oJfOgWobjt+DAVdP465E8iLMJCdqhs0vzJJFgRqVAP8=";
+    hash = "sha256-J3AdXuN1WLKFED9YeBly68umPlx05Wl+mhT2YbBsJVk=";
    # only needed for vatch, which contains test data
    fetchSubmodules = true;
  };
@@ -25,6 +28,18 @@ rustPlatform.buildRustPackage rec {
    };
  };

+  # rust + gitlab is a rare combo
+  passthru.updateScript = [
+    (writeScript "update-spade" ''
+      VERSION="$(
+        ${lib.getExe git} ls-remote --tags --sort -version:refname ${lib.escapeShellArg src.gitRepoUrl} \
+          | cut -f2 | grep ^refs/tags/v | cut -d/ -f3- | cut -c2- \
+          | sort --version-sort --reverse | head -n1
+      )"
+      exec ${lib.getExe nix-update} --version "$VERSION" "$@"
+    '')
+  ];
+
  meta = with lib; {
    description = "A better hardware description language";
    homepage = "https://gitlab.com/spade-lang/spade";
--- a/pkgs/by-name/te/tenv/package.nix
+++ b/pkgs/by-name/te/tenv/package.nix
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "tenv";
-  version = "1.10.1";
+  version = "1.11.0";

  src = fetchFromGitHub {
    owner = "tofuutils";
    repo = "tenv";
    rev = "v${version}";
-    hash = "sha256-c283egT5KOcR+PjwWnKkCI3RKr+Tqa6a+ORsjq4wuXs=";
+    hash = "sha256-LjgcI3E6K6b8fca9HdLyyIJJMHFxRtHdvWQb19jFHpA=";
  };

-  vendorHash = "sha256-GAUpQbZfaF3N2RaQO0ZDe8DywOZwIfXNImsZCk6iB+U=";
+  vendorHash = "sha256-teog4VJGDOYsABuE2/fvOtcWvC8mM36rJQI6KZb3eS8=";

  # Tests disabled for requiring network access to release.hashicorp.com
  doCheck = false;
--- a/pkgs/by-name/ti/tiny-dfr/package.nix
+++ b/pkgs/by-name/ti/tiny-dfr/package.nix
@@ -0,0 +1,40 @@
+{ lib, rustPlatform, fetchFromGitHub, pkg-config
+, cairo, gdk-pixbuf, glib, libinput, libxml2, pango, udev
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "tiny-dfr";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "WhatAmISupposedToPutHere";
+    repo = "tiny-dfr";
+    rev = "v${version}";
+    hash = "sha256-oawKYrfXAQ5RFMdUCG7F12wHcnFif++44s2KsX9ns6U=";
+  };
+
+  cargoHash = "sha256-QOkztErJLFXPxCb8MvaXi7jGXeI5A0q8LwZtYddzUZE=";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ cairo gdk-pixbuf glib libinput libxml2 pango udev ];
+
+  postConfigure = ''
+    substituteInPlace etc/systemd/system/tiny-dfr.service \
+        --replace-fail /usr/bin $out/bin
+    substituteInPlace src/*.rs --replace-quiet /usr/share $out/share
+  '';
+
+  postInstall = ''
+    cp -R etc $out/lib
+    cp -R share $out
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/WhatAmISupposedToPutHere/tiny-dfr";
+    description = "The most basic dynamic function row daemon possible";
+    license = [ licenses.asl20 licenses.mit ];
+    mainProgram = "tiny-dfr";
+    maintainers = [ maintainers.qyliss ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/up/upsun/package.nix
+++ b/pkgs/by-name/up/upsun/package.nix
@@ -1,43 +1,63 @@
-{ stdenvNoCC, lib, fetchurl }:
+{
+  stdenvNoCC,
+  lib,
+  fetchurl,
+  testers,
+  upsun
+}:

-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "upsun";
-  version = "5.0.12";
+  version = "5.0.13";

-  src = {
-    x86_64-darwin = (fetchurl {
-      url = "https://github.com/platformsh/cli/releases/download/${version}/upsun_${version}_darwin_all.tar.gz";
-      hash = "sha256-RwTMJwvkuX/okHSyxzpvaD6uD8fheVbr7bgBC2eMQOo=";
-    });
-    aarch64-darwin = (fetchurl {
-      url = "https://github.com/platformsh/cli/releases/download/${version}/upsun_${version}_darwin_all.tar.gz";
-      hash = "sha256-RwTMJwvkuX/okHSyxzpvaD6uD8fheVbr7bgBC2eMQOo=";
-    });
-    x86_64-linux = (fetchurl {
-      url = "https://github.com/platformsh/cli/releases/download/${version}/upsun_${version}_linux_amd64.tar.gz";
-      hash = "sha256-svEPMVY7r7pAoXwFIMYqCEduqR3Nkocaguf2nIGt+G8=";
-    });
-    aarch64-linux = (fetchurl {
-      url = "https://github.com/platformsh/cli/releases/download/${version}/upsun_${version}_linux_arm64.tar.gz";
-      hash = "sha256-ZraS/PqSPL/kcj5o6hzDdL70IV2IWXOma6OHCiXIDQc=";
-    });
-  }.${stdenvNoCC.system} or (throw "${pname}-${version}: ${stdenvNoCC.system} is unsupported.");
+  src =
+    {
+      x86_64-darwin = fetchurl {
+        url = "https://github.com/platformsh/cli/releases/download/${finalAttrs.version}/upsun_${finalAttrs.version}_darwin_all.tar.gz";
+        hash = "sha256-5JKXtAUnqrlufyNE05uZjEDfJv557auYPriTxvUbMJI=";
+      };
+      aarch64-darwin = fetchurl {
+        url = "https://github.com/platformsh/cli/releases/download/${finalAttrs.version}/upsun_${finalAttrs.version}_darwin_all.tar.gz";
+        hash = "sha256-5JKXtAUnqrlufyNE05uZjEDfJv557auYPriTxvUbMJI=";
+      };
+      x86_64-linux = fetchurl {
+        url = "https://github.com/platformsh/cli/releases/download/${finalAttrs.version}/upsun_${finalAttrs.version}_linux_amd64.tar.gz";
+        hash = "sha256-fjVL/sbO1wmaJ4qZpUMV/4Q4Jzf0p6qx0ElRdY5EUJU=";
+      };
+      aarch64-linux = fetchurl {
+        url = "https://github.com/platformsh/cli/releases/download/${finalAttrs.version}/upsun_${finalAttrs.version}_linux_arm64.tar.gz";
+        hash = "sha256-MNlQkwsg5SuIQJBDy7yVtcda1odpaUZezCgrat6OW2Q=";
+      };
+    }
+    .${stdenvNoCC.system}
+      or (throw "${finalAttrs.pname}-${finalAttrs.version}: ${stdenvNoCC.system} is unsupported.");

  dontConfigure = true;
  dontBuild = true;

  sourceRoot = ".";
  installPhase = ''
+    runHook preInstall
+
    install -Dm755 upsun $out/bin/upsun
+
+    runHook postInstall
  '';

+  passthru = {
+    tests.version = testers.testVersion {
+      inherit (finalAttrs) version;
+      package = upsun;
+    };
+  };
+
  meta = {
-    homepage = "https://github.com/platformsh/cli";
    description = "The unified tool for managing your Upsun services from the command line";
+    homepage = "https://github.com/platformsh/cli";
+    license = lib.licenses.mit;
    mainProgram = "upsun";
    maintainers = with lib.maintainers; [ spk ];
-    license = lib.licenses.mit;
    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
  };
-}
+})
--- a/pkgs/by-name/yo/your_spotify/client.nix
+++ b/pkgs/by-name/yo/your_spotify/client.nix
@@ -0,0 +1,58 @@
+{
+  apiEndpoint ? "http://localhost:3000",
+  fetchYarnDeps,
+  your_spotify,
+  mkYarnPackage,
+  fixup-yarn-lock,
+  src,
+  version,
+  yarn,
+}:
+mkYarnPackage rec {
+  inherit version src;
+  pname = "your_spotify_client";
+  name = "your_spotify_client-${version}";
+  packageJSON = ./package.json;
+  offlineCache = fetchYarnDeps {
+    yarnLock = src + "/yarn.lock";
+    hash = "sha256-5SgknaRVzgO2Dzc8MhAaM8UERWMv+PrItzevoWHbWnA=";
+  };
+  configurePhase = ''
+    runHook preConfigure
+
+    export HOME=$(mktemp -d)
+    yarn config --offline set yarn-offline-mirror $offlineCache
+    fixup-yarn-lock yarn.lock
+    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+    patchShebangs node_modules/
+
+    runHook postConfigure
+  '';
+  buildPhase = ''
+    runHook preBuild
+    pushd ./apps/client/
+    yarn --offline run build
+    export API_ENDPOINT="${apiEndpoint}"
+    substituteInPlace scripts/run/variables.sh --replace-quiet '/app/apps/client/' "./"
+
+    chmod +x ./scripts/run/variables.sh
+    patchShebangs --build ./scripts/run/variables.sh
+
+    ./scripts/run/variables.sh
+
+    popd
+    runHook postBuild
+  '';
+  nativeBuildInputs = [yarn fixup-yarn-lock];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -r ./apps/client/build/* $out
+    runHook postInstall
+  '';
+  doDist = false;
+  meta = {
+    inherit (your_spotify.meta) homepage changelog description license maintainers;
+  };
+}
--- a/pkgs/by-name/yo/your_spotify/package.json
+++ b/pkgs/by-name/yo/your_spotify/package.json
@@ -0,0 +1,10 @@
+{
+  "name": "@your_spotify/root",
+  "version": "1.10.1",
+  "repository": "git@github.com:Yooooomi/your_spotify.git",
+  "author": "Timothee <timothee.boussus@gmail.com>",
+  "private": true,
+  "workspaces": [
+    "apps/*"
+  ]
+}
--- a/pkgs/by-name/yo/your_spotify/package.nix
+++ b/pkgs/by-name/yo/your_spotify/package.nix
@@ -0,0 +1,85 @@
+{
+  callPackage,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  lib,
+  makeWrapper,
+  mkYarnPackage,
+  nodejs,
+  fixup-yarn-lock,
+  yarn,
+}: let
+  version = "1.10.1";
+  src = fetchFromGitHub {
+    owner = "Yooooomi";
+    repo = "your_spotify";
+    rev = "refs/tags/${version}";
+    hash = "sha256-e82j2blGxQLWAlBNuAnFvlD9vwMk4/mRI0Vf7vuaPA0=";
+  };
+  client = callPackage ./client.nix {inherit src version;};
+in
+  mkYarnPackage rec {
+    inherit version src;
+    pname = "your_spotify_server";
+    name = "your_spotify_server-${version}";
+    packageJSON = ./package.json;
+    offlineCache = fetchYarnDeps {
+      yarnLock = src + "/yarn.lock";
+      hash = "sha256-5SgknaRVzgO2Dzc8MhAaM8UERWMv+PrItzevoWHbWnA=";
+    };
+
+    configurePhase = ''
+      runHook preConfigure
+
+      export HOME=$(mktemp -d)
+      yarn config --offline set yarn-offline-mirror $offlineCache
+      fixup-yarn-lock yarn.lock
+
+      runHook postConfigure
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+
+      yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+      patchShebangs node_modules/
+
+      pushd ./apps/server/
+      yarn --offline run build
+      popd
+
+      rm -r node_modules
+      export NODE_ENV="production"
+      yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+      patchShebangs node_modules/
+
+      runHook postBuild
+    '';
+    nativeBuildInputs = [makeWrapper yarn fixup-yarn-lock];
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/share/your_spotify
+      cp -r node_modules $out/share/your_spotify/node_modules
+      cp -r ./apps/server/{lib,package.json} $out
+      mkdir -p $out/bin
+      makeWrapper ${lib.escapeShellArg (lib.getExe nodejs)} "$out/bin/your_spotify_migrate" \
+        --add-flags "$out/lib/migrations.js" --set NODE_PATH "$out/share/your_spotify/node_modules"
+      makeWrapper ${lib.escapeShellArg (lib.getExe nodejs)} "$out/bin/your_spotify_server" \
+        --add-flags "$out/lib/index.js" --set NODE_PATH "$out/share/your_spotify/node_modules"
+
+      runHook postInstall
+    '';
+    doDist = false;
+    passthru = {
+      inherit client;
+    };
+    meta = with lib; {
+      homepage = "https://github.com/Yooooomi/your_spotify";
+      changelog = "https://github.com/Yooooomi/your_spotify/releases/tag/${version}";
+      description = "Self-hosted application that tracks what you listen and offers you a dashboard to explore statistics about it";
+      license = licenses.gpl3Only;
+      maintainers = with maintainers; [patrickdag];
+      mainProgram = "your_spotify_server";
+    };
+  }
--- a/pkgs/data/fonts/cozette/default.nix
+++ b/pkgs/data/fonts/cozette/default.nix
@@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "cozette";
-  version = "1.24.0";
+  version = "1.24.1";

  src = fetchzip {
    url = "https://github.com/slavfox/Cozette/releases/download/v.${version}/CozetteFonts-v-${builtins.replaceStrings ["."] ["-"] version}.zip";
-    hash = "sha256-BA3pVcqZnakoYhF00OqDzo4GwRB5txGKN/ou2EvadWo=";
+    hash = "sha256-G3/m0g3pdPHUlSLnJhGIFem6UOyEf1VxjOvz/0E9Vr0=";
  };

  installPhase = ''
--- a/pkgs/data/misc/hackage/pin.json
+++ b/pkgs/data/misc/hackage/pin.json
@@ -1,6 +1,6 @@
 {
-  "commit": "4eb9a5fde06b5d7343665582243debaf1d77e0a9",
-  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/4eb9a5fde06b5d7343665582243debaf1d77e0a9.tar.gz",
-  "sha256": "0dzyfr1gv79riy2vh840b5hqly8rs10zhj01zi9nfn7jd9pzql28",
-  "msg": "Update from Hackage at 2024-04-16T17:36:35Z"
+  "commit": "9e419b038d7108160caf4efc41ebd5dfc4d51821",
+  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/9e419b038d7108160caf4efc41ebd5dfc4d51821.tar.gz",
+  "sha256": "1vqsxznsq6s1hfb3b7ghs0fqa1rapqccjcz5jy3h9w3dq4v3gfqz",
+  "msg": "Update from Hackage at 2024-04-27T10:57:54Z"
 }
--- a/pkgs/development/compilers/ghc/9.10.1.nix
+++ b/pkgs/development/compilers/ghc/9.10.1.nix
@@ -0,0 +1,4 @@
+import ./common-hadrian.nix rec {
+  version = "9.10.1";
+  sha256 = "bf386a302d4ee054791ffd51748900f15d71760fd199157922d120cc1f89e2f7";
+}
--- a/pkgs/development/compilers/ghc/common-hadrian.nix
+++ b/pkgs/development/compilers/ghc/common-hadrian.nix
@@ -29,6 +29,7 @@
 , xattr
 , autoSignDarwinBinariesHook
 , bash
+, srcOnly

 , libiconv ? null, ncurses
 , glibcLocales ? null
@@ -145,25 +146,60 @@
        return $ verbosity >= Verbose
  ''

-, ghcSrc ? (if rev != null then fetchgit else fetchurl) ({
-    inherit url sha256;
-  } // lib.optionalAttrs (rev != null) {
-    inherit rev;
-  } // lib.optionalAttrs (postFetch != null) {
-    inherit postFetch;
-  })
+, ghcSrc ?
+    srcOnly {
+      name = "ghc-${version}"; # -source appended by srcOnly
+      src =
+        (if rev != null then fetchgit else fetchurl) ({
+          inherit url sha256;
+        } // lib.optionalAttrs (rev != null) {
+          inherit rev;
+        } // lib.optionalAttrs (postFetch != null) {
+          inherit postFetch;
+        });
+
+      patches =
+        let
+          # Disable haddock generating pretty source listings to stay under 3GB on aarch64-linux
+          enableHyperlinkedSource =
+            lib.versionAtLeast version "9.8" ||
+            !(stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux);
+        in
+        [
+          # Fix docs build with Sphinx >= 7 https://gitlab.haskell.org/ghc/ghc/-/issues/24129
+          (if lib.versionAtLeast version "9.8"
+           then ./docs-sphinx-7-ghc98.patch
+           else ./docs-sphinx-7.patch )
+        ]
+        ++ lib.optionals (stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64) [
+          # Prevent the paths module from emitting symbols that we don't use
+          # when building with separate outputs.
+          #
+          # These cause problems as they're not eliminated by GHC's dead code
+          # elimination on aarch64-darwin. (see
+          # https://github.com/NixOS/nixpkgs/issues/140774 for details).
+          ./Cabal-at-least-3.6-paths-fix-cycle-aarch64-darwin.patch
+        ]
+        # Prevents passing --hyperlinked-source to haddock. This is a custom
+        # workaround as we wait for this to be configurable via userSettings or
+        # similar. https://gitlab.haskell.org/ghc/ghc/-/issues/23625
+        ++ lib.optionals (!enableHyperlinkedSource) [
+          # TODO(@sternenseemann): Doesn't apply for GHC >= 9.8
+          ../../tools/haskell/hadrian/disable-hyperlinked-source.patch
+        ]
+        # Incorrect bounds on Cabal in hadrian
+        # https://gitlab.haskell.org/ghc/ghc/-/issues/24100
+        ++ lib.optionals (lib.elem version [ "9.8.1" "9.8.2" ]) [
+          ../../tools/haskell/hadrian/hadrian-9.8.1-allow-Cabal-3.10.patch
+        ];
+    }

  # GHC's build system hadrian built from the GHC-to-build's source tree
  # using our bootstrap GHC.
 , hadrian ? import ../../tools/haskell/hadrian/make-hadrian.nix { inherit bootPkgs lib; } {
-    ghcSrc = ghcSrc;
+    inherit ghcSrc;
    ghcVersion = version;
    userSettings = hadrianUserSettings;
-    # Disable haddock generating pretty source listings to stay under 3GB on aarch64-linux
-    enableHyperlinkedSource =
-      # TODO(@sternenseemann): Disabling currently doesn't work with GHC >= 9.8
-      lib.versionAtLeast version "9.8" ||
-      !(stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux);
  }

 , #  Whether to build sphinx documentation.
@@ -269,21 +305,6 @@ stdenv.mkDerivation ({

  enableParallelBuilding = true;

-  patches = [
-    # Fix docs build with Sphinx >= 7 https://gitlab.haskell.org/ghc/ghc/-/issues/24129
-    (if lib.versionAtLeast version "9.8"
-      then ./docs-sphinx-7-ghc98.patch
-      else ./docs-sphinx-7.patch )
-  ] ++ lib.optionals (stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64) [
-    # Prevent the paths module from emitting symbols that we don't use
-    # when building with separate outputs.
-    #
-    # These cause problems as they're not eliminated by GHC's dead code
-    # elimination on aarch64-darwin. (see
-    # https://github.com/NixOS/nixpkgs/issues/140774 for details).
-    ./Cabal-at-least-3.6-paths-fix-cycle-aarch64-darwin.patch
-  ];
-
  postPatch = ''
    patchShebangs --build .
  '';
--- a/pkgs/development/compilers/zulu/22.nix
+++ b/pkgs/development/compilers/zulu/22.nix
@@ -11,7 +11,7 @@ callPackage ./common.nix ({
      zuluVersion = "22.28.91";
      jdkVersion = "22.0.0";
      hash =
-        if enableJavaFX then "sha256-HvMiODsz+puu1xtxG2RRXH/PWCk91PGNZ7UcOd9orqQ="
+        if enableJavaFX then "sha256-+qUrZ+GlspSP3RLTAbgEtFm0B0fzX/VD1WUl6mk2c/0="
        else "sha256-HvMiODsz+puu1xtxG2RRXH/PWCk91PGNZ7UcOd9orqQ=";
    };

@@ -27,7 +27,7 @@ callPackage ./common.nix ({
      zuluVersion = "22.28.91";
      jdkVersion = "22.0.0";
      hash =
-        if enableJavaFX then "sha256-Y6PSNQjHRXukwux2sVbvpTIqT+Cg+KeG1C0iSEwyKZw="
+        if enableJavaFX then "sha256-QkFwbc2YFEWb5rddhH4a+zmtsrXxUBSuS8yg9qUb728="
        else "sha256-Y6PSNQjHRXukwux2sVbvpTIqT+Cg+KeG1C0iSEwyKZw=";
    };

@@ -35,7 +35,7 @@ callPackage ./common.nix ({
      zuluVersion = "22.28.91";
      jdkVersion = "22.0.0";
      hash =
-        if enableJavaFX then "sha256-o0VkWB4+PzBmNNWy+FZlyjTgukBTe6owfydb3YNfEE0="
+        if enableJavaFX then "sha256-256UP6MtUReQYqCKVt0ThN9BVDyKLAMXQTdpcDB9t24="
        else "sha256-o0VkWB4+PzBmNNWy+FZlyjTgukBTe6owfydb3YNfEE0=";
    };
  };
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -732,7 +732,6 @@ self: super: {
  Rlang-QQ = dontCheck super.Rlang-QQ;
  safecopy = dontCheck super.safecopy;
  sai-shape-syb = dontCheck super.sai-shape-syb;
-  saltine = dontCheck super.saltine; # https://github.com/tel/saltine/pull/56
  scp-streams = dontCheck super.scp-streams;
  sdl2 = dontCheck super.sdl2; # the test suite needs an x server
  separated = dontCheck super.separated;
@@ -752,6 +751,7 @@ self: super: {
  translatable-intset = dontCheck super.translatable-intset;
  ua-parser = dontCheck super.ua-parser;
  unagi-chan = dontCheck super.unagi-chan;
+  universe-some = dontCheck super.universe-some;
  wai-logger = dontCheck super.wai-logger;
  WebBits = dontCheck super.WebBits;                    # http://hydra.cryp.to/build/499604/log/raw
  webdriver = dontCheck super.webdriver;
@@ -1304,9 +1304,6 @@ self: super: {
  # https://github.com/haskell/hoopl/issues/50
  hoopl = dontCheck super.hoopl;

-  # Generate shell completion for spago
-  spago = self.generateOptparseApplicativeCompletions [ "spago" ] super.spago;
-
  # https://github.com/DanielG/cabal-helper/pull/123
  cabal-helper = doJailbreak super.cabal-helper;

@@ -1345,11 +1342,21 @@ self: super: {
    (dontCheckIf (!pkgs.postgresql.doCheck))
  ];

+  # Requires pqueue <1.5 but it works fine with pqueue-1.5.0.0
+  # https://github.com/haskell-beam/beam/pull/705
+  beam-migrate = doJailbreak super.beam-migrate;
+
  users-postgresql-simple = addTestToolDepends [
    pkgs.postgresql
    pkgs.postgresqlTestHook
  ] super.users-postgresql-simple;

+  # Need https://github.com/obsidiansystems/gargoyle/pull/45
+  gargoyle = doJailbreak super.gargoyle;
+  gargoyle-postgresql = doJailbreak super.gargoyle-postgresql;
+  gargoyle-postgresql-nix = doJailbreak (addBuildTool [pkgs.postgresql] super.gargoyle-postgresql-nix);
+  gargoyle-postgresql-connect = doJailbreak super.gargoyle-postgresql-connect;
+
  # PortMidi needs an environment variable to have ALSA find its plugins:
  # https://github.com/NixOS/nixpkgs/issues/6860
  PortMidi = overrideCabal (drv: {
@@ -1379,8 +1386,6 @@ self: super: {
  # Fix build with attr-2.4.48 (see #53716)
  xattr = appendPatch ./patches/xattr-fix-build.patch super.xattr;

-  patch = dontCheck super.patch;
-
  esqueleto =
    overrideCabal
      (drv: {
@@ -1530,11 +1535,6 @@ self: super: {
  # 2021-12-26: Too strict bounds on doctest
  polysemy-plugin = doJailbreak super.polysemy-plugin;

-  # hasn’t bumped upper bounds
-  # upstream: https://github.com/obsidiansystems/which/pull/6
-  which = doJailbreak super.which;
-
-
  # 2024-02-28: The Hackage version dhall-lsp-server-1.1.3 requires
  # lsp-1.4.0.0 which is hard to build with this LTS. However, the latest
  # git version of dhall-lsp-server works with lsp-2.1.0.0, and only
@@ -1561,13 +1561,11 @@ self: super: {
      doJailbreak
    ];

-  # 2022-03-16: lens bound can be loosened https://github.com/ghcjs/jsaddle-dom/issues/19
  jsaddle-dom = overrideCabal (old: {
    postPatch = old.postPatch or "" + ''
-      sed -i 's/lens.*4.20/lens/' jsaddle-dom.cabal
      rm Setup.hs
    '';
-  }) (doJailbreak super.jsaddle-dom);
+  }) super.jsaddle-dom;
  jsaddle-hello = doJailbreak super.jsaddle-hello;
  ghcjs-dom-hello = doJailbreak super.ghcjs-dom-hello;

@@ -1833,9 +1831,6 @@ self: super: {
  # https://github.com/adnelson/semver-range/issues/15
  semver-range = dontCheck super.semver-range;

-  # https://github.com/obsidiansystems/dependent-sum/issues/55
-  dependent-sum = doJailbreak super.dependent-sum;
-
  # 2022-06-19: Disable checks because of https://github.com/reflex-frp/reflex/issues/475
  reflex = doJailbreak (dontCheck super.reflex);

@@ -2063,18 +2058,31 @@ self: super: {
  # Issue reported upstream, no bug tracker url yet.
  darcs = doJailbreak super.darcs;

-  # Too strict version bounds on cryptonite and github.
-  # PRs are merged, will be fixed next release or Hackage revision.
-  nix-thunk = appendPatches [
-    (fetchpatch {
-      url = "https://github.com/obsidiansystems/nix-thunk/commit/49d27a85dd39cd9413c99958c67e596756a502b5.patch";
-      sha256 = "1p1n0123yrbdqyfk4kx3gq6bdv65l1bxgbsg51ckcwclg54xp2p5";
-    })
-    (fetchpatch {
-      url = "https://github.com/obsidiansystems/nix-thunk/commit/512867c651977265d5d8f456b538f7a364ec8a8b.patch";
-      sha256 = "121yg26y4g28k8xv7y1j6c3pxm17vsjn3vi62kkc8g928c47yd02";
-    })
-  ] super.nix-thunk;
+  # Need https://github.com/obsidiansystems/cli-extras/pull/12 and more
+  cli-extras = doJailbreak super.cli-extras;
+
+  # https://github.com/obsidiansystems/cli-git/pull/7 turned into a flat patch
+  cli-git = lib.pipe super.cli-git [
+    (appendPatch (fetchpatch {
+      url = "https://github.com/obsidiansystems/cli-git/commit/be378a97e2f46522174231b77c952f759df3fad6.patch";
+      sha256 = "sha256-6RrhqkKpnb+FTHxccHNx6pdC7ClfqcJ2eoo+W7h+JUo=";
+      excludes = [ ".github/**" ];
+    }))
+    doJailbreak
+    (addBuildTool pkgs.git)
+  ];
+
+  # Need https://github.com/obsidiansystems/cli-nix/pull/5 and more
+  cli-nix = addBuildTools [
+    pkgs.nix
+    pkgs.nix-prefetch-git
+  ] (doJailbreak super.cli-nix);
+
+  # https://github.com/obsidiansystems/nix-thunk/pull/51/
+  nix-thunk = appendPatch (fetchpatch {
+    url = "https://github.com/obsidiansystems/nix-thunk/commit/c3dc3e799e8ce7756330f98b9f73f59c4b7a5502.patch";
+    sha256 = "sha256-C1ii1FXiCPFfw5NzyQZ0cEG6kIYGohVsnHycpYEJ24Q=";
+  }) (doJailbreak super.nix-thunk);

  # list `modbus` in librarySystemDepends, correct to `libmodbus`
  libmodbus = doJailbreak (addExtraLibrary pkgs.libmodbus super.libmodbus);
@@ -2087,9 +2095,14 @@ self: super: {

  ginger = doJailbreak super.ginger;

-  # Too strict version bounds on cryptonite
-  # https://github.com/obsidiansystems/haveibeenpwned/issues/7
-  haveibeenpwned = doJailbreak super.haveibeenpwned;
+  # 2024-05-05 syntax changes: https://github.com/obsidiansystems/haveibeenpwned/pull/9
+  haveibeenpwned = appendPatch
+    (fetchpatch {
+      url = "https://github.com/obsidiansystems/haveibeenpwned/pull/9/commits/14c134eec7de12f755b2d4667727762a8a1a6476.patch";
+      sha256 = "sha256-fau5+b6tufJ+MscrLgbYvvBsekPe8R6QAy/4H31dcQ4";
+    })
+    (doJailbreak super.haveibeenpwned);
+

  # Too strict version bounds on ghc-events
  # https://github.com/mpickering/hs-speedscope/issues/16
@@ -2172,11 +2185,6 @@ self: super: {
            compiler: ${self.ghc.haskellCompilerName}

            core-packages:
-              # Hack: The following package is a core package of GHCJS. If we don't declare
-              # it, then hackage2nix will generate a Hackage database where all dependants
-              # of this library are marked as "broken".
-              - ghcjs-base-0
-
            EOF

            ghc-pkg list \
@@ -2599,8 +2607,30 @@ self: super: {
  # 2022-03-16: Upstream stopped updating bounds https://github.com/haskell-hvr/base-noprelude/pull/15
  base-noprelude = doJailbreak super.base-noprelude;

-  # 2022-03-16: Bounds need to be loosened https://github.com/obsidiansystems/dependent-sum-aeson-orphans/issues/10
-  dependent-sum-aeson-orphans = doJailbreak super.dependent-sum-aeson-orphans;
+  # 2025-05-05: Bounds need to be loosened https://github.com/obsidiansystems/dependent-sum-aeson-orphans/pull/13
+  dependent-monoidal-map = appendPatch (fetchpatch {
+    url = "https://github.com/obsidiansystems/dependent-monoidal-map/commit/3f8be15fa9bd2796d1c917e9f0979b4d6c62cf91.patch";
+    hash = "sha256-QKDUh4jO8xZrThrkjTVNnkoVY+GejxOhpXOVA4+n1H8=";
+  }) super.dependent-monoidal-map;
+
+  # 2025-05-05: Bounds need to be loosened https://github.com/obsidiansystems/dependent-sum-aeson-orphans/pull/13
+  dependent-sum-aeson-orphans = appendPatch (fetchpatch {
+    url = "https://github.com/obsidiansystems/dependent-sum-aeson-orphans/commit/9b4698154303a9865d7d68a2f01d280a8a39f108.patch";
+    hash = "sha256-Pzjl2yp01XsYWcyhpLnsuccg7bOACgv+RpafauUox8c=";
+  }) super.dependent-sum-aeson-orphans;
+
+  # https://github.com/obsidiansystems/dependent-sum/pull/73
+  dependent-sum-template = appendPatch (fetchpatch {
+    url = "https://github.com/obsidiansystems/dependent-sum/commit/619727ba1792e39a68d23c62e75a923672e87a54.patch";
+    hash = "sha256-SyD1/KrX1KUjrR82fvI+BRcqLC2Q3AbvSeKNrdGstjg=";
+    relative = "dependent-sum-template";
+  }) super.dependent-sum-template;
+
+  aeson-gadt-th = appendPatch (fetchpatch {
+    url = "https://github.com/obsidiansystems/aeson-gadt-th/commit/8f6922a6440019dece637d73d70766c473bcd6c0.patch";
+    hash = "sha256-564DhfiubwNV8nAj8L5DzsWn4MdzqqaYYNmOSPUa7ys=";
+    excludes = [ ".github/**" ];
+  }) super.aeson-gadt-th;

  # Too strict bounds on chell: https://github.com/fpco/haskell-filesystem/issues/24
  system-fileio = doJailbreak super.system-fileio;
@@ -2617,12 +2647,27 @@ self: super: {
  # https://github.com/ngless-toolkit/ngless/issues/152
  NGLess = dontCheck super.NGLess;

-  # Raise version bounds for hspec
+  # Raise version bounds: https://github.com/well-typed/lens-sop/pull/4
+  lens-sop = appendPatches [
+    (fetchpatch {
+      url = "https://github.com/well-typed/lens-sop/commit/d8657f27c12191a7c0a91701c0fcd9a590e0090e.patch";
+      sha256 = "sha256-9ODfbOb6Bs3EVTY9b7cUvkNmqzzZPWUmgmlAneaN3Tw=";
+    })
+    (fetchpatch {
+      url = "https://github.com/well-typed/lens-sop/commit/b7ecffdeb836d19373871659e2f8cd24da6f7312.patch";
+      sha256 = "sha256-hDUQ2fW9Qyom65YvtW9bsbz7XtueRmdsAbAB42D+gu4=";
+    })
+  ] super.lens-sop;
+
+  # Raise version bounds: https://github.com/kosmikus/records-sop/pull/15
  records-sop = appendPatch (fetchpatch {
-    url = "https://github.com/kosmikus/records-sop/pull/11/commits/d88831388ab3041190130fec3cdd679a4217b3c7.patch";
-    sha256 = "sha256-O+v/OxvqnlWX3HaDvDIBZnJ+Og3xs/SJqI3gaouU3ZI=";
+    url = "https://github.com/kosmikus/records-sop/commit/fb149f453a816ff14d0cb20b3ea56b80ff49d9f1.patch";
+    sha256 = "sha256-iHiF4EWL/GjJFnr/6aR+yMZKLMLAZK+gsgSxG8YaeDI=";
  }) super.records-sop;

+  # Need https://github.com/well-typed/large-records/pull/151
+  large-generics = doJailbreak super.large-generics;
+
  # Fix build failures for ghc 9 (https://github.com/mokus0/polynomial/pull/20)
  polynomial = appendPatch (fetchpatch {
    name = "haskell-polynomial.20.patch";
@@ -2935,7 +2980,7 @@ self: super: {

  # Requires a newer zlib version than stackage provides
  futhark = super.futhark.override {
-    zlib = self.zlib_0_7_0_0;
+    zlib = self.zlib_0_7_1_0;
  };

  # Tests rely on (missing) submodule
@@ -2989,6 +3034,14 @@ self: super: {
  # 2024-03-25: HSH broken because of the unix-2.8.0.0 breaking change
  HSH = appendPatches [./patches/HSH-unix-openFd.patch] super.HSH;

+  # Support unix < 2.8 to build in older ghc than 9.6
+  linux-namespaces = appendPatch
+    (fetchpatch {
+      url = "https://github.com/redneb/hs-linux-namespaces/commit/f4a3546541bb6c7172fdd03e177a961da60e3951.patch";
+      sha256 = "sha256-6Qv7NWIbzR3ktMGFogw5597bIqPH7Z4hoFvvBQAoquY=";
+    })
+    super.linux-namespaces;
+
  inherit
    (let
      unbreakRepa = packageName: drv: lib.pipe drv [
@@ -3047,4 +3100,11 @@ self: super: {

  # Too strict bounds on text. Can be removed after https://github.com/alx741/currencies/pull/3 is merged
  currencies = doJailbreak super.currencies;
+
+  # https://github.com/awakesecurity/proto3-wire/pull/104
+  proto3-wire = appendPatch (pkgs.fetchpatch {
+    url = "https://github.com/awakesecurity/proto3-wire/commit/c1cadeb5fca2e82c5b28e2811c01f5b37eb21ed8.patch";
+    hash = "sha256-tFOWpjGmZANC7H82QapZ36raaNWuZ6F3BgjxnfTXpMs=";
+  }) super.proto3-wire;
+
 } // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super
--- a/pkgs/development/haskell-modules/configuration-darwin.nix
+++ b/pkgs/development/haskell-modules/configuration-darwin.nix
@@ -316,6 +316,13 @@ self: super: ({

  # Tests fail on macOS https://github.com/mrkkrp/zip/issues/112
  zip = dontCheck super.zip;
+
+  # cabal lib set as unbuildable in linux so callCabal2nix generates a dummy derivation
+  jsaddle-wkwebview = overrideCabal (drv: {
+    libraryFrameworkDepends = with pkgs.buildPackages.darwin.apple_sdk.frameworks; [ Cocoa WebKit ];
+    libraryHaskellDepends = with self; [ aeson data-default jsaddle ];
+  }) super.jsaddle-wkwebview;
+
 } // lib.optionalAttrs pkgs.stdenv.isAarch64 {  # aarch64-darwin

  # https://github.com/fpco/unliftio/issues/87
--- a/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
@@ -82,9 +82,6 @@ self: super: {
  base-noprelude = doJailbreak super.base-noprelude;
  unliftio-core = doJailbreak super.unliftio-core;

-  # Jailbreaking because monoidal-containers hasn’t bumped it's base dependency for 8.10.
-  monoidal-containers = doJailbreak super.monoidal-containers;
-
  # Jailbreak to fix the build.
  brick = doJailbreak super.brick;
  exact-pi = doJailbreak super.exact-pi;
--- a/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-9.6.x.nix
@@ -180,6 +180,16 @@ self: super: {
      sha256 = "sha256-b7u9GiIAd2xpOrM0MfILHNb6Nt7070lNRIadn2l3DfQ=";
    })];
  }) super.ConfigFile;
+
+  # This runs into the following GHC bug currently affecting 9.6.* and 9.8.* as
+  # well as 9.10.1: https://gitlab.haskell.org/ghc/ghc/-/issues/24432
+  inherit (lib.mapAttrs (_: overrideCabal (drv: {
+      badPlatforms = drv.badPlatforms or [ ] ++ [ "aarch64-linux" ];
+    })) super)
+    mueval
+    lambdabot
+    lambdabot-haskell-plugins
+    ;
 }
 # super.ghc is required to break infinite recursion as Nix is strict in the attrNames
 // lib.optionalAttrs (pkgs.stdenv.hostPlatform.isAarch64 && lib.versionOlder super.ghc.version "9.6.4") {
--- a/pkgs/development/haskell-modules/configuration-ghc-9.8.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-9.8.x.nix
@@ -88,10 +88,14 @@ self: super: {
  #
  blaze-svg = doJailbreak super.blaze-svg; # base <4.19
  commutative-semigroups = doJailbreak super.commutative-semigroups; # base < 4.19
+  dependent-sum-template = doJailbreak super.dependent-sum-template_0_2_0_1; # template-haskell < 2.21
  diagrams-lib = doJailbreak super.diagrams-lib; # base <4.19, text <2.1
  diagrams-postscript = doJailbreak super.diagrams-postscript;  # base <4.19, bytestring <0.12
  diagrams-svg = doJailbreak super.diagrams-svg;  # base <4.19, text <2.1
+  generics-sop = doJailbreak super.generics-sop_0_5_1_4; # th-abstraction >=0.6 && <0.7
  ghc-trace-events = doJailbreak super.ghc-trace-events; # text < 2.1, bytestring < 0.12, base < 4.19
+  hashing = doJailbreak super.hashing; # bytestring <0.12
+  json-sop = doJailbreak super.json-sop; # aeson <2.2, base <4.19, text <2.1
  primitive-unlifted = doJailbreak super.primitive-unlifted; # bytestring < 0.12
  statestack = doJailbreak super.statestack; # base < 4.19
  newtype-generics = doJailbreak super.newtype-generics; # base < 4.19
@@ -102,10 +106,12 @@ self: super: {
  terminfo_0_4_1_6 = doJailbreak super.terminfo_0_4_1_6;
  HaskellNet-SSL = doJailbreak super.HaskellNet-SSL; # bytestring >=0.9 && <0.12
  raven-haskell = doJailbreak super.raven-haskell; # aeson <2.2
+  saltine = doJailbreak super.saltine; # bytestring  && <0.12, deepseq <1.5, text > 1.2 && <1.3 || >=2.0 && <2.1
  stripe-concepts = doJailbreak super.stripe-concepts; # text >=1.2.5 && <1.3 || >=2.0 && <2.1
  stripe-signature = doJailbreak super.stripe-signature; # text >=1.2.5 && <1.3 || >=2.0 && <2.1
  string-random = doJailbreak super.string-random; # text >=1.2.2.1 && <2.1
  inflections = doJailbreak super.inflections; # text >=0.2 && <2.1
+  universe-some = doJailbreak super.universe-some; # th-abstraction < 0.7

  #
  # Test suite issues
@@ -131,4 +137,14 @@ self: super: {
      })
    super.libmpd;

+  # Loosen bounds
+  patch = appendPatch (pkgs.fetchpatch {
+    url = "https://github.com/reflex-frp/patch/commit/91fed138483a7bf2b098d45b9e5cc36191776320.patch";
+    sha256 = "sha256-/KLfIshia88lU5G/hA7ild7+a2mqc7qgSa9AEBqEqkQ=";
+  }) super.patch;
+  reflex = appendPatch (pkgs.fetchpatch {
+    url = "https://github.com/reflex-frp/reflex/commit/0ac53ca3eab2649dd3f3edc585e10af8d13b28cd.patch";
+    sha256 = "sha256-umjwgdSKebJdRrXjwHhsi8HBqotx1vFibY9ttLkyT/0=";
+  }) super.reflex;
+
 }
--- a/pkgs/development/haskell-modules/configuration-ghcjs.nix
+++ b/pkgs/development/haskell-modules/configuration-ghcjs.nix
@@ -26,7 +26,7 @@ self: super:

  # GHCJS does not ship with the same core packages as GHC.
  # https://github.com/ghcjs/ghcjs/issues/676
-  stm = doJailbreak self.stm_2_5_3_0;
+  stm = doJailbreak self.stm_2_5_3_1;
  exceptions = dontCheck self.exceptions_0_10_7;

 ## OTHER PACKAGES
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml
@@ -38,6 +38,7 @@ broken-packages:
  - acme-memorandom # failure in job https://hydra.nixos.org/build/233222926 at 2023-09-02
  - acme-miscorder # failure in job https://hydra.nixos.org/build/233209957 at 2023-09-02
  - acme-mutable-package # failure in job https://hydra.nixos.org/build/233213349 at 2023-09-02
+  - acme-not-a-joke # failure in job https://hydra.nixos.org/build/259604911 at 2024-05-15
  - acme-now # failure in job https://hydra.nixos.org/build/233243289 at 2023-09-02
  - acme-numbersystem # failure in job https://hydra.nixos.org/build/233208106 at 2023-09-02
  - acme-operators # failure in job https://hydra.nixos.org/build/233248282 at 2023-09-02
@@ -83,7 +84,6 @@ broken-packages:
  - aeson-flat # failure in job https://hydra.nixos.org/build/233220787 at 2023-09-02
  - aeson-flatten # failure in job https://hydra.nixos.org/build/233242954 at 2023-09-02
  - aeson-flowtyped # failure in job https://hydra.nixos.org/build/233245878 at 2023-09-02
-  - aeson-gadt-th # failure in job https://hydra.nixos.org/build/233247060 at 2023-09-02
  - aeson-generics-typescript # failure in job https://hydra.nixos.org/build/245703304 at 2024-01-07
  - aeson-injector # failure in job https://hydra.nixos.org/build/233200351 at 2023-09-02
  - aeson-json-ast # failure in job https://hydra.nixos.org/build/233249406 at 2023-09-02
@@ -369,7 +369,6 @@ broken-packages:
  - bash # failure in job https://hydra.nixos.org/build/252719390 at 2024-03-16
  - basic-gps # failure in job https://hydra.nixos.org/build/252718385 at 2024-03-16
  - basics # failure in job https://hydra.nixos.org/build/236678238 at 2023-10-04
-  - basic-sop # failure in job https://hydra.nixos.org/build/233253357 at 2023-09-02
  - baskell # failure in job https://hydra.nixos.org/build/233246705 at 2023-09-02
  - battlenet # failure in job https://hydra.nixos.org/build/233260076 at 2023-09-02
  - battleplace # failure in job https://hydra.nixos.org/build/233230199 at 2023-09-02
@@ -381,7 +380,6 @@ broken-packages:
  - bdo # failure in job https://hydra.nixos.org/build/233216486 at 2023-09-02
  - beamable # failure in job https://hydra.nixos.org/build/233211619 at 2023-09-02
  - beam # failure in job https://hydra.nixos.org/build/233213313 at 2023-09-02
-  - beam-migrate # failure in job https://hydra.nixos.org/build/252730758 at 2024-03-16
  - beam-mysql # failure in job https://hydra.nixos.org/build/233253237 at 2023-09-02
  - beam-newtype-field # failure in job https://hydra.nixos.org/build/233206317 at 2023-09-02
  - bech32 # failure in job https://hydra.nixos.org/build/233194823 at 2023-09-02
@@ -707,7 +705,6 @@ broken-packages:
  - cayene-lpp # failure in job https://hydra.nixos.org/build/233228959 at 2023-09-02
  - cayley-client # failure in job https://hydra.nixos.org/build/233260112 at 2023-09-02
  - cblrepo # failure in job https://hydra.nixos.org/build/233251926 at 2023-09-02
-  - cbor-tool # failure in job https://hydra.nixos.org/build/233198797 at 2023-09-02
  - CCA # failure in job https://hydra.nixos.org/build/233206723 at 2023-09-02
  - ccast # failure in job https://hydra.nixos.org/build/233254517 at 2023-09-02
  - CC-delcont-cxe # failure in job https://hydra.nixos.org/build/233190865 at 2023-09-02
@@ -740,6 +737,7 @@ broken-packages:
  - changelog-d # failure in job https://hydra.nixos.org/build/253689337 at 2024-03-31
  - changelog-d # failure in job https://hydra.nixos.org/build/255671571 at 2024-04-16
  - changelog-d # failure in job https://hydra.nixos.org/build/257082502 at 2024-04-27
+  - changelog-d # failure in job https://hydra.nixos.org/build/259607598 at 2024-05-15
  - changelogged # failure in job https://hydra.nixos.org/build/233211675 at 2023-09-02
  - character-cases # failure in job https://hydra.nixos.org/build/233197636 at 2023-09-02
  - charter # failure in job https://hydra.nixos.org/build/233237264 at 2023-09-02
@@ -805,7 +803,6 @@ broken-packages:
  - clevercss # failure in job https://hydra.nixos.org/build/233206298 at 2023-09-02
  - clexer # failure in job https://hydra.nixos.org/build/233229804 at 2023-09-02
  - cli-builder # failure in job https://hydra.nixos.org/build/233209961 at 2023-09-02
-  - cli-extras # failure in job https://hydra.nixos.org/build/233226908 at 2023-09-02
  - CLI # failure in job https://hydra.nixos.org/build/233191087 at 2023-09-02
  - clif # failure in job https://hydra.nixos.org/build/233197110 at 2023-09-02
  - clifm # failure in job https://hydra.nixos.org/build/233227426 at 2023-09-02
@@ -1006,6 +1003,7 @@ broken-packages:
  - core-haskell # failure in job https://hydra.nixos.org/build/233222588 at 2023-09-02
  - corenlp-types # failure in job https://hydra.nixos.org/build/243808366 at 2024-01-01
  - core-warn # failure in job https://hydra.nixos.org/build/233204404 at 2023-09-02
+  - cornelis # failure in job https://hydra.nixos.org/build/259604220 at 2024-05-15
  - Coroutine # failure in job https://hydra.nixos.org/build/233211213 at 2023-09-02
  - coroutine-object # failure in job https://hydra.nixos.org/build/233220413 at 2023-09-02
  - couchdb-conduit # failure in job https://hydra.nixos.org/build/233227244 at 2023-09-02
@@ -1233,7 +1231,6 @@ broken-packages:
  - dense-int-set # failure in job https://hydra.nixos.org/build/233214797 at 2023-09-02
  - dependency # failure in job https://hydra.nixos.org/build/252727325 at 2024-03-16
  - dependent-hashmap # failure in job https://hydra.nixos.org/build/233202881 at 2023-09-02
-  - dependent-monoidal-map # failure in job https://hydra.nixos.org/build/233212829 at 2023-09-02
  - dep-t # failure in job https://hydra.nixos.org/build/233217847 at 2023-09-02
  - deptrack-core # failure in job https://hydra.nixos.org/build/233239143 at 2023-09-02
  - derangement # failure in job https://hydra.nixos.org/build/233209660 at 2023-09-02
@@ -1305,6 +1302,7 @@ broken-packages:
  - dijkstra-simple # failure in job https://hydra.nixos.org/build/233218373 at 2023-09-02
  - DimensionalHash # failure in job https://hydra.nixos.org/build/233230945 at 2023-09-02
  - dino # failure in job https://hydra.nixos.org/build/252725815 at 2024-03-16
+  - diohsc # failure in job https://hydra.nixos.org/build/259625302 at 2024-05-15
  - diophantine # failure in job https://hydra.nixos.org/build/233229215 at 2023-09-02
  - diplomacy # failure in job https://hydra.nixos.org/build/233207895 at 2023-09-02
  - direct-binary-files # failure in job https://hydra.nixos.org/build/233246387 at 2023-09-02
@@ -1548,6 +1546,7 @@ broken-packages:
  - erlang # failure in job https://hydra.nixos.org/build/233195837 at 2023-09-02
  - erlang-ffi # failure in job https://hydra.nixos.org/build/233233314 at 2023-09-02
  - eros # failure in job https://hydra.nixos.org/build/233247983 at 2023-09-02
+  - errata # failure in job https://hydra.nixos.org/build/259627186 at 2024-05-15
  - errno # failure in job https://hydra.nixos.org/build/252725782 at 2024-03-16
  - error-context # failure in job https://hydra.nixos.org/build/233245027 at 2023-09-02
  - error-continuations # failure in job https://hydra.nixos.org/build/233232357 at 2023-09-02
@@ -1900,7 +1899,6 @@ broken-packages:
  - gang-of-threads # failure in job https://hydra.nixos.org/build/252716251 at 2024-03-16
  - Ganymede # failure in job https://hydra.nixos.org/build/233248892 at 2023-09-02
  - garepinoh # failure in job https://hydra.nixos.org/build/233238111 at 2023-09-02
-  - gargoyle # failure in job https://hydra.nixos.org/build/233196445 at 2023-09-02
  - gas # failure in job https://hydra.nixos.org/build/233233966 at 2023-09-02
  - gasp # failure in job https://hydra.nixos.org/build/252731457 at 2024-03-16
  - gather # failure in job https://hydra.nixos.org/build/233208848 at 2023-09-02
@@ -2410,7 +2408,6 @@ broken-packages:
  - hat # failure in job https://hydra.nixos.org/build/233243655 at 2023-09-02
  - hats # failure in job https://hydra.nixos.org/build/233256724 at 2023-09-02
  - hatt # failure in job https://hydra.nixos.org/build/233195039 at 2023-09-02
-  - haveibeenpwned # failure in job https://hydra.nixos.org/build/233253058 at 2023-09-02
  - haven # failure in job https://hydra.nixos.org/build/233216806 at 2023-09-02
  - haverer # failure in job https://hydra.nixos.org/build/233210491 at 2023-09-02
  - hax # failure in job https://hydra.nixos.org/build/233212147 at 2023-09-02
@@ -3208,8 +3205,6 @@ broken-packages:
  - jort # failure in job https://hydra.nixos.org/build/233195250 at 2023-09-02
  - joy-rewrite # failure in job https://hydra.nixos.org/build/233201002 at 2023-09-02
  - jpeg # failure in job https://hydra.nixos.org/build/233204056 at 2023-09-02
-  - jsaddle-clib # failure in job https://hydra.nixos.org/build/233203899 at 2023-09-02
-  - jsaddle-wkwebview # failure in job https://hydra.nixos.org/build/233242986 at 2023-09-02
  - js-good-parts # failure in job https://hydra.nixos.org/build/233198958 at 2023-09-02
  - json2 # failure in job https://hydra.nixos.org/build/233242447 at 2023-09-02
  - json-alt # failure in job https://hydra.nixos.org/build/233242230 at 2023-09-02
@@ -3392,7 +3387,7 @@ broken-packages:
  - language-webidl # failure in job https://hydra.nixos.org/build/233194656 at 2023-09-02
  - laop # failure in job https://hydra.nixos.org/build/233204106 at 2023-09-02
  - LargeCardinalHierarchy # failure in job https://hydra.nixos.org/build/233250339 at 2023-09-02
-  - large-generics # failure in job https://hydra.nixos.org/build/233210324 at 2023-09-02
+  - large-records
  - Lastik # failure in job https://hydra.nixos.org/build/233194460 at 2023-09-02
  - latest-npm-version # failure in job https://hydra.nixos.org/build/233239108 at 2023-09-02
  - latex-formulae-image # failure in job https://hydra.nixos.org/build/233251243 at 2023-09-02
@@ -3435,7 +3430,6 @@ broken-packages:
  - lens-process # failure in job https://hydra.nixos.org/build/233242948 at 2023-09-02
  - lensref # failure in job https://hydra.nixos.org/build/233205479 at 2023-09-02
  - lens-simple # failure in job https://hydra.nixos.org/build/233245452 at 2023-09-02
-  - lens-sop # failure in job https://hydra.nixos.org/build/252721754 at 2024-03-16
  - lens-tell # failure in job https://hydra.nixos.org/build/233234619 at 2023-09-02
  - lens-text-encoding # failure in job https://hydra.nixos.org/build/233222713 at 2023-09-02
  - lens-th-rewrite # failure in job https://hydra.nixos.org/build/233201025 at 2023-09-02
@@ -4198,6 +4192,7 @@ broken-packages:
  - op2 # failure in job https://hydra.nixos.org/build/255683846 at 2024-04-16
  - opaleye-classy # failure in job https://hydra.nixos.org/build/233214120 at 2023-09-02
  - opaleye-sqlite # failure in job https://hydra.nixos.org/build/233191474 at 2023-09-02
+  - opaleye-textsearch # failure in job https://hydra.nixos.org/build/259602432 at 2024-05-15
  - opaleye-trans # failure in job https://hydra.nixos.org/build/233210536 at 2023-09-02
  - open-adt # failure in job https://hydra.nixos.org/build/233201191 at 2023-09-02
  - OpenAFP # failure in job https://hydra.nixos.org/build/233249295 at 2023-09-02
@@ -4737,6 +4732,7 @@ broken-packages:
  - process-sequential # failure in job https://hydra.nixos.org/build/233221064 at 2023-09-02
  - procrastinating-variable # failure in job https://hydra.nixos.org/build/233229350 at 2023-09-02
  - procstat # failure in job https://hydra.nixos.org/build/233256320 at 2023-09-02
+  - prodapi # failure in job https://hydra.nixos.org/build/259624456 at 2024-05-15
  - product-isomorphic # failure in job https://hydra.nixos.org/build/233230736 at 2023-09-02
  - prof2pretty # failure in job https://hydra.nixos.org/build/233240665 at 2023-09-02
  - prof-flamegraph # failure in job https://hydra.nixos.org/build/233254675 at 2023-09-02
@@ -4766,11 +4762,9 @@ broken-packages:
  - pro-source # failure in job https://hydra.nixos.org/build/233226793 at 2023-09-02
  - prosper # failure in job https://hydra.nixos.org/build/233244079 at 2023-09-02
  - proteaaudio # failure in job https://hydra.nixos.org/build/233225498 at 2023-09-02
-  - proto3-wire # failure in job https://hydra.nixos.org/build/233208217 at 2023-09-02
  - protocol-buffers # failure in job https://hydra.nixos.org/build/233220653 at 2023-09-02
  - protocol-buffers-fork # failure in job https://hydra.nixos.org/build/233228361 at 2023-09-02
  - protocol # failure in job https://hydra.nixos.org/build/233224436 at 2023-09-02
-  - proto-lens-arbitrary # failure in job https://hydra.nixos.org/build/233239393 at 2023-09-02
  - proto-lens-combinators # failure in job https://hydra.nixos.org/build/252726979 at 2024-03-16
  - protolude-lifted # failure in job https://hydra.nixos.org/build/233196312 at 2023-09-02
  - proton-haskell # failure in job https://hydra.nixos.org/build/233214383 at 2023-09-02
@@ -4937,7 +4931,6 @@ broken-packages:
  - record-encode # failure in job https://hydra.nixos.org/build/233216156 at 2023-09-02
  - record # failure in job https://hydra.nixos.org/build/233242406 at 2023-09-02
  - records # failure in job https://hydra.nixos.org/build/233254822 at 2023-09-02
-  - records-sop # failure in job https://hydra.nixos.org/build/233251652 at 2023-09-02
  - record-wrangler # failure in job https://hydra.nixos.org/build/233212838 at 2023-09-02
  - rec-smallarray # failure in job https://hydra.nixos.org/build/233258592 at 2023-09-02
  - recursive-line-count # failure in job https://hydra.nixos.org/build/252736942 at 2024-03-16
@@ -5684,6 +5677,7 @@ broken-packages:
  - stm-firehose # failure in job https://hydra.nixos.org/build/233220943 at 2023-09-02
  - stm-lifted # failure in job https://hydra.nixos.org/build/252726872 at 2024-03-16
  - stm-promise # failure in job https://hydra.nixos.org/build/233204293 at 2023-09-02
+  - stm-queue # failure in job https://hydra.nixos.org/build/259624889 at 2024-05-15
  - stm-stats # failure in job https://hydra.nixos.org/build/233214914 at 2023-09-02
  - stochastic # failure in job https://hydra.nixos.org/build/233242019 at 2023-09-02
  - Stomp # failure in job https://hydra.nixos.org/build/233252583 at 2023-09-02
@@ -6290,7 +6284,6 @@ broken-packages:
  - universal-binary # failure in job https://hydra.nixos.org/build/233240583 at 2023-09-02
  - universe-instances-base # failure in job https://hydra.nixos.org/build/233197845 at 2023-09-02
  - universe-instances-trans # failure in job https://hydra.nixos.org/build/233235623 at 2023-09-02
-  - universe-some # failure in job https://hydra.nixos.org/build/233254356 at 2023-09-02
  - unix-handle # failure in job https://hydra.nixos.org/build/233233273 at 2023-09-02
  - unix-memory # failure in job https://hydra.nixos.org/build/252735802 at 2024-03-16
  - unix-process-conduit # failure in job https://hydra.nixos.org/build/233191509 at 2023-09-02
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@@ -28,13 +28,17 @@ default-package-overrides:
  - gi-gdkx11 < 4
  # 2021-11-09: ghc-bignum is bundled starting with 9.0.1; only 1.0 builds with GHCs prior to 9.2.1
  - ghc-bignum == 1.0
+  - hie-bios == 0.13.1
+  # 2024-05-10: need to match hlegder from stackage
+  - hledger-ui < 1.33

 extra-packages:
  - Cabal-syntax == 3.6.*               # Dummy package that ensures packages depending on Cabal-syntax can work for Cabal < 3.8
  - Cabal == 3.2.*                      # Used for packages needing newer Cabal on ghc 8.6 and 8.8
  - Cabal == 3.6.*                      # used for packages needing newer Cabal on ghc 8.10 and 9.0
  - Cabal-syntax == 3.8.*               # version required for ormolu and fourmolu on ghc 9.2 and 9.0
-  - Cabal-syntax == 3.10.*              # newest version required for cabal-install and other packages
+  - Cabal-syntax == 3.10.*              # version required for cabal-install and other packages
+  - Cabal == 3.10.*                     # version required for cabal-install and other packages
  - directory == 1.3.7.*                # required to build cabal-install 3.10.* with GHC 9.2
  - Diff < 0.4                          # required by liquidhaskell-0.8.10.2: https://github.com/ucsd-progsys/liquidhaskell/issues/1729
  - aeson < 2                           # required by pantry-0.5.2
@@ -43,7 +47,6 @@ extra-packages:
  - attoparsec == 0.13.*                # 2022-02-23: Needed to compile elm for now
  - base16-bytestring < 1               # required for cabal-install etc.
  - basement < 0.0.15                   # 2022-08-30: last version to support GHC < 8.10
-  - bower-json == 1.0.0.1               # 2022-05-21: Needed for spago 0.20.9
  - brick == 0.70.*                     # 2022-08-13: needed by taskell
  - brittany == 0.13.1.2                # 2022-09-20: needed for hls on ghc 8.8
  - crackNum < 3.0                      # 2021-05-21: 3.0 removed the lib which sbv 7.13 uses
@@ -110,6 +113,8 @@ extra-packages:
  - algebraic-graphs < 0.7              # 2023-08-14: Needed for building weeder < 2.6.0
  - fuzzyset == 0.2.4                   # 2023-12-20: Needed for building postgrest > 10
  - ShellCheck == 0.9.0                 # 2024-03-21: pinned by haskell-ci
+  - versions < 6                        # 2024-04-22: required by spago-0.21
+  - fsnotify < 0.4                      # 2024-04-22: required by spago-0.21

 package-maintainers:
  abbradar:
@@ -648,7 +653,6 @@ unsupported-platforms:
  monomer:                                      [ platforms.darwin ] # depends on mesa
  monomer-hagrid:                               [ platforms.darwin ] # depends on mesa
  mptcp-pm:                                     [ platforms.darwin ]
-  mueval:                                       [ aarch64-linux ] # https://hydra.nixos.org/build/257076117/nixlog/2 https://gitlab.haskell.org/ghc/ghc/-/issues/24432
  nanovg:                                       [ platforms.darwin ] # depends on mesa
  netlink:                                      [ platforms.darwin ]
  notifications-tray-icon:                      [ platforms.darwin ] # depends on gi-dbusmenu
@@ -734,6 +738,7 @@ supported-platforms:
  htune:                                        [ platforms.linux ] # depends on alsa-pcm
  hw-prim-bits:                                 [ platforms.x86 ] # x86 assembler
  inline-asm:                                   [ platforms.x86 ] # x86 assembler
+  jsaddle-wkwebview:                            [ platforms.darwin ]
  keid-core:                                    [ x86_64-linux ] # geomancy (only x86), vulkan (no i686, no darwin, …)
  keid-frp-banana:                              [ x86_64-linux ] # geomancy (only x86), vulkan (no i686, no darwin, …)
  keid-geometry:                                [ x86_64-linux ] # geomancy (only x86), vulkan (no i686, no darwin, …)
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml
@@ -1,4 +1,4 @@
-# Stackage LTS 22.17
+# Stackage LTS 22.18
 # This file is auto-generated by
 # maintainers/scripts/haskell/update-stackage.sh
 default-package-overrides:
@@ -394,7 +394,7 @@ default-package-overrides:
  - atom-basic ==0.2.5
  - atom-conduit ==0.9.0.1
  - atomic-counter ==0.1.2.1
-  - atomic-primops ==0.8.5
+  - atomic-primops ==0.8.7
  - atomic-write ==0.2.0.7
  - attoparsec ==0.14.4
  - attoparsec-aeson ==2.1.0.0
@@ -929,7 +929,7 @@ default-package-overrides:
  - doctest-exitcode-stdio ==0.0
  - doctest-extract ==0.1.2
  - doctest-lib ==0.1.1
-  - doctest-parallel ==0.3.1
+  - doctest-parallel ==0.3.1.1
  - doldol ==0.4.1.2
  - do-list ==1.0.1
  - domain ==0.1.1.5
@@ -1345,7 +1345,7 @@ default-package-overrides:
  - haskoin-node ==1.0.1
  - haskoin-store-data ==1.2.5
  - hasktags ==0.73.0
-  - hasql ==1.6.4.3
+  - hasql ==1.6.4.4
  - hasql-dynamic-statements ==0.3.1.5
  - hasql-implicits ==0.1.1.2
  - hasql-interpolate ==0.2.1.0
@@ -1457,7 +1457,7 @@ default-package-overrides:
  - hsini ==0.5.2.2
  - hsinstall ==2.8
  - HSlippyMap ==3.0.1
-  - hslogger ==1.3.1.0
+  - hslogger ==1.3.1.1
  - hslua ==2.3.1
  - hslua-aeson ==2.3.1
  - hslua-classes ==2.3.1
@@ -1881,10 +1881,10 @@ default-package-overrides:
  - microlens ==0.4.13.1
  - microlens-aeson ==2.5.2
  - microlens-contra ==0.1.0.3
-  - microlens-ghc ==0.4.14.2
+  - microlens-ghc ==0.4.14.3
  - microlens-mtl ==0.2.0.3
  - microlens-platform ==0.4.3.5
-  - microlens-th ==0.4.3.14
+  - microlens-th ==0.4.3.15
  - microspec ==0.2.1.3
  - microstache ==1.0.2.3
  - midair ==0.2.0.1
@@ -2031,7 +2031,7 @@ default-package-overrides:
  - network-messagepack-rpc ==0.1.2.0
  - network-messagepack-rpc-websocket ==0.1.1.1
  - network-multicast ==0.3.2
-  - network-run ==0.2.7
+  - network-run ==0.2.8
  - network-simple ==0.4.5
  - network-transport ==0.5.7
  - network-uri ==2.6.4.2
@@ -2323,7 +2323,7 @@ default-package-overrides:
  - proto-lens-optparse ==0.1.1.12
  - proto-lens-runtime ==0.7.0.6
  - protolude ==0.3.4
-  - proxied ==0.3.1
+  - proxied ==0.3.2
  - psql-helpers ==0.1.0.0
  - PSQueue ==1.2.0
  - psqueues ==0.2.8.0
@@ -2539,7 +2539,7 @@ default-package-overrides:
  - secp256k1-haskell ==1.1.0
  - securemem ==0.1.10
  - selections ==0.3.0.0
-  - selective ==0.7
+  - selective ==0.7.0.1
  - semialign ==1.3
  - semigroupoids ==6.0.0.1
  - semigroups ==0.20
@@ -2804,7 +2804,7 @@ default-package-overrides:
  - symengine ==0.1.2.0
  - symmetry-operations-symbols ==0.0.2.1
  - synthesizer-alsa ==0.5.0.6
-  - synthesizer-core ==0.8.3
+  - synthesizer-core ==0.8.4
  - synthesizer-dimensional ==0.8.1.1
  - synthesizer-midi ==0.6.1.2
  - sysinfo ==0.1.1
@@ -2904,8 +2904,8 @@ default-package-overrides:
  - text-regex-replace ==0.1.1.5
  - text-rope ==0.2
  - text-short ==0.1.5
-  - text-show ==3.10.4
-  - text-show-instances ==3.9.7
+  - text-show ==3.10.5
+  - text-show-instances ==3.9.8
  - text-zipper ==0.13
  - tfp ==1.0.2
  - tf-random ==0.5
@@ -3179,7 +3179,7 @@ default-package-overrides:
  - wai-websockets ==3.0.1.2
  - wakame ==0.1.0.0
  - warp ==3.3.31
-  - warp-tls ==3.4.4
+  - warp-tls ==3.4.5
  - wave ==0.2.1
  - wcwidth ==0.0.2
  - webdriver ==0.12.0.0
@@ -3218,7 +3218,7 @@ default-package-overrides:
  - writer-cps-transformers ==0.5.6.1
  - ws ==0.0.6
  - wss-client ==0.3.0.0
-  - wuss ==2.0.1.7
+  - wuss ==2.0.1.8
  - X11 ==1.10.3
  - X11-xft ==0.3.4
  - x11-xim ==0.0.9.0
@@ -3292,7 +3292,7 @@ default-package-overrides:
  - zeromq4-patterns ==0.3.1.0
  - zigzag ==0.0.1.0
  - zim-parser ==0.2.1.0
-  - zip ==2.0.0
+  - zip ==2.0.1
  - zip-archive ==0.4.3.2
  - zippers ==0.3.2
  - zip-stream ==0.2.2.0
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
@@ -633,12 +633,11 @@ dont-distribute-packages:
 - bdcs-api
 - beam-automigrate
 - beam-postgres
- - beam-sqlite
 - beam-th
 - bearriver
 - beautifHOL
 - bech32-th
- - beeminder-api
+ - bech32-th_1_1_6
 - bein
 - belka
 - bff
@@ -875,8 +874,6 @@ dont-distribute-packages:
 - cleff-plugin
 - cless
 - cleveland
- - cli-git
- - cli-nix
 - click-clack
 - clickhouse-haskell
 - clifford
@@ -1476,7 +1473,6 @@ dont-distribute-packages:
 - funion
 - funnyprint
 - funsat
- - fused-effects-squeal
 - fwgl-glfw
 - fwgl-javascript
 - fxpak
@@ -1487,9 +1483,6 @@ dont-distribute-packages:
 - galois-fft
 - galois-field
 - gamma
- - gargoyle-postgresql
- - gargoyle-postgresql-connect
- - gargoyle-postgresql-nix
 - gbs-downloader
 - gbu
 - gdax
@@ -1918,7 +1911,6 @@ dont-distribute-packages:
 - haskanoid
 - haskdeep
 - haskeem
- - haskell-abci
 - haskell-admin
 - haskell-admin-health
 - haskell-admin-managed-functions
@@ -2430,7 +2422,6 @@ dont-distribute-packages:
 - json-query
 - json-rpc-client
 - json-schema
- - json-sop
 - json-spec-elm
 - json-spec-elm-servant
 - json-spec-openapi
@@ -2539,7 +2530,6 @@ dont-distribute-packages:
 - language-qux
 - language-spelling
 - large-anon
- - large-records
 - lat
 - latex-formulae-hakyll
 - latex-formulae-pandoc
@@ -2661,6 +2651,7 @@ dont-distribute-packages:
 - lol-typing
 - loli
 - longshot
+ - looksee
 - looksee-trip
 - loop-effin
 - lorentz
@@ -2751,6 +2742,7 @@ dont-distribute-packages:
 - metar-http
 - metronome
 - micro-gateway
+ - microdns
 - microformats2-types
 - midimory
 - mighttpd
@@ -2940,7 +2932,6 @@ dont-distribute-packages:
 - ngx-export-tools-extra
 - nikepub
 - nirum
- - nix-thunk
 - nkjp
 - nlp-scores-scripts
 - nom
@@ -3229,6 +3220,8 @@ dont-distribute-packages:
 - process-qq
 - process-streaming
 - procrastinating-structure
+ - prodapi-proxy
+ - prodapi-userauth
 - producer
 - product
 - prof2dot
@@ -3372,7 +3365,6 @@ dont-distribute-packages:
 - reflex-backend-wai
 - reflex-dom-colonnade
 - reflex-dynamic-containers
- - reflex-gadt-api
 - reflex-gloss-scene
 - reflex-libtelnet
 - reflex-localize
@@ -3671,7 +3663,6 @@ dont-distribute-packages:
 - si-clock
 - sibe
 - sigma-ij
- - signable
 - signals
 - signature
 - silvi
@@ -3781,6 +3772,7 @@ dont-distribute-packages:
 - sproxy
 - sproxy-web
 - sproxy2
+ - sq
 - sql-simple-mysql
 - sql-simple-pool
 - sql-simple-postgresql
@@ -3788,9 +3780,6 @@ dont-distribute-packages:
 - sqlcli-odbc
 - sqlite-simple-interpolate
 - sqlite-simple-typed
- - squeal-postgresql
- - squeal-postgresql-ltree
- - squeal-postgresql-uuid-ossp
 - squeeze
 - sr-extra
 - srt-dhall
@@ -4100,8 +4089,6 @@ dont-distribute-packages:
 - unitym-servant
 - unitym-yesod
 - universal
- - universe
- - universe-dependent-sum
 - universe-th
 - unix-fcntl
 - unpacked-these
@@ -4164,14 +4151,12 @@ dont-distribute-packages:
 - verifiable-expressions
 - verismith
 - versioning-servant
- - vessel
 - vflow-types
 - vformat-aeson
 - vformat-time
 - vfr-waypoints
 - vigilance
 - vimeta
- - vinyl-generics
 - vinyl-operational
 - vision
 - visual-graphrewrite
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -849,8 +849,12 @@ self: super: builtins.intersectAttrs super {
        url = "https://github.com/purescript/purescript-docs-search/releases/download/v0.0.11/purescript-docs-search";
        sha256 = "1hjdprm990vyxz86fgq14ajn0lkams7i00h8k2i2g1a0hjdwppq6";
      };
-
-      spagoDocs = overrideCabal (drv: {
+    in
+    lib.pipe (super.spago.override {
+      versions = self.versions_5_0_5;
+      fsnotify = self.fsnotify_0_3_0_1;
+    }) [
+      (overrideCabal (drv: {
        postUnpack = (drv.postUnpack or "") + ''
          # Spago includes the following two files directly into the binary
          # with Template Haskell.  They are fetched at build-time from the
@@ -875,21 +879,17 @@ self: super: builtins.intersectAttrs super {
            "$sourceRoot/templates/docs-search-app-0.0.11.js" \
            "$sourceRoot/templates/purescript-docs-search-0.0.11"
        '';
-      }) super.spago;
-
-      spagoOldAeson = spagoDocs.overrideScope (hfinal: hprev: {
-        # spago is not yet updated for aeson 2.0
-        aeson = hfinal.aeson_1_5_6_0;
-        # bower-json 1.1.0.0 only supports aeson 2.0, so we pull in the older version here.
-        bower-json = hprev.bower-json_1_0_0_1;
-      });
+      }))

      # Tests require network access.
-      spagoWithoutChecks = dontCheck spagoOldAeson;
-    in
-    # spago doesn't currently build with ghc92.  Top-level spago is pulled from
-    # ghc90 and explicitly marked unbroken.
-    markBroken spagoWithoutChecks;
+      dontCheck
+
+      # Overly strict upper bound on text
+      doJailbreak
+
+      # Generate shell completion for spago
+      (self.generateOptparseApplicativeCompletions [ "spago" ])
+    ];

  # checks SQL statements at compile time, and so requires a running PostgreSQL
  # database to run it's test suite
@@ -1377,4 +1377,6 @@ self: super: builtins.intersectAttrs super {
  pvar = dontCheck super.pvar;

  kmonad = enableSeparateBinOutput super.kmonad;
+
+  xmobar = enableSeparateBinOutput super.xmobar;
 }
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
--- a/pkgs/development/haskell-modules/make-package-set.nix
+++ b/pkgs/development/haskell-modules/make-package-set.nix
@@ -211,15 +211,21 @@ in package-set { inherit pkgs lib callPackage; } self // {
      }) firstRevision;

    # Creates a Haskell package from a source package by calling cabal2nix on the source.
-    callCabal2nixWithOptions = name: src: extraCabal2nixOptions: args:
+    callCabal2nixWithOptions = name: src: opts: args:
      let
-        filter = path: type:
+        extraCabal2nixOptions = if builtins.isString opts
+                                then opts
+                                else opts.extraCabal2nixOptions or "";
+        srcModifier = opts.srcModifier or null;
+        defaultFilter = path: type:
                   pkgs.lib.hasSuffix ".cabal" path ||
                   baseNameOf path == "package.yaml";
        expr = self.haskellSrc2nix {
          inherit name extraCabal2nixOptions;
-          src = if pkgs.lib.canCleanSource src
-                  then pkgs.lib.cleanSourceWith { inherit src filter; }
+          src = if srcModifier != null
+                then srcModifier src
+                else if pkgs.lib.canCleanSource src
+                then pkgs.lib.cleanSourceWith { inherit src; filter = defaultFilter; }
                else src;
        };
      in overrideCabal (orig: {
--- a/pkgs/development/interpreters/octave/build-env.nix
+++ b/pkgs/development/interpreters/octave/build-env.nix
@@ -63,6 +63,14 @@ in buildEnv {
      addPkgLocalList $out ${octave}

      wrapOctavePrograms "${lib.concatStringsSep " " packages}"
+      # We also need to modify the Exec= line of the desktop file, so it will point
+      # to the wrapper we generated above.
+      rm $out/share/applications # should be a symlink to ${octave}/share/applications
+      mkdir $out/share/applications
+      substitute \
+        ${octave}/share/applications/org.octave.Octave.desktop \
+        $out/share/applications/org.octave.Octave.desktop \
+        --replace-fail ${octave}/bin/octave $out/bin/octave
     '' + postBuild;

  inherit (octave) meta;
--- a/pkgs/development/libraries/libaom/default.nix
+++ b/pkgs/development/libraries/libaom/default.nix
@@ -47,9 +47,6 @@ stdenv.mkDerivation rec {
    "-DENABLE_TESTS=OFF"
  ] ++ lib.optionals enableVmaf [
    "-DCONFIG_TUNE_VMAF=1"
-  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
-    # CPU detection isn't supported on Darwin and breaks the aarch64-darwin build:
-    "-DCONFIG_RUNTIME_CPU_DETECT=0"
  ] ++ lib.optionals (isCross && !stdenv.hostPlatform.isx86) [
    "-DCMAKE_ASM_COMPILER=${stdenv.cc.targetPrefix}as"
  ] ++ lib.optionals stdenv.isAarch32 [
--- a/pkgs/development/libraries/libdatachannel/default.nix
+++ b/pkgs/development/libraries/libdatachannel/default.nix
@@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "libdatachannel";
-  version = "0.21.0";
+  version = "0.21.1";

  src = fetchFromGitHub {
    owner = "paullouisageneau";
    repo = "libdatachannel";
    rev = "v${version}";
-    hash = "sha256-hxXDovJAmuh15jFaxY9aESoTVVJ3u2twsX31U3txans=";
+    hash = "sha256-sTdA4kCIdY3l/YUNKbXzRDS1O0AFx90k94W3cJpfLIY=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/libraries/libgpiod/default.nix
+++ b/pkgs/development/libraries/libgpiod/default.nix
@@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "libgpiod";
-  version = "2.1.1";
+  version = "2.1.2";

  src = fetchurl {
    url = "https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/snapshot/libgpiod-${version}.tar.gz";
-    hash = "sha256-CvQ6YInWn50HXPZ8oq5ZcrkIHjjms9Rs6jfWfi32+5s=";
+    hash = "sha256-sb3x4/dSOGlfk+RCBiuvwGkXDyv08M1LjgScpnExofA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/science/astronomy/wcslib/default.nix
+++ b/pkgs/development/libraries/science/astronomy/wcslib/default.nix
@@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "wcslib";
-  version = "8.2.2";
+  version = "8.3";

  src = fetchurl {
    url = "ftp://ftp.atnf.csiro.au/pub/software/wcslib/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-YpgiCugX9OVSJkOsTD2iYjvnCjSEsaTzcGC+4+S9eDM=";
+    sha256 = "sha256-Qx6jQXknu8Arib+jQV3AtGaLDyGjtG+4o1JeL89hRQg=";
  };

  nativeBuildInputs = [ flex ];
--- a/pkgs/development/ocaml-modules/uring/default.nix
+++ b/pkgs/development/ocaml-modules/uring/default.nix
@@ -11,23 +11,15 @@

 buildDunePackage rec {
  pname = "uring";
-  version = "0.8";
+  version = "0.9";

  minimalOCamlVersion = "4.12";

  src = fetchurl {
    url = "https://github.com/ocaml-multicore/ocaml-${pname}/releases/download/v${version}/${pname}-${version}.tbz";
-    hash = "sha256-4OGst19vqEzuNVxO5xxtzS+mEilEBFoEc7lC3j3sTk4=";
+    hash = "sha256-eXWIxfL9UsKKf4sanBjKfr6Od4fPDctVnkU+wjIXW0M=";
  };

-  patches = [
-    (fetchpatch {
-      name = "musl-1.2.5.patch";
-      url = "https://github.com/ocaml-multicore/ocaml-uring/commit/abe340086574c124061434054937d1f19ee6bb71.patch";
-      hash = "sha256-J4ZQAdQZ9fhT3/vAh5FYMyvMllTowe4GyHJy5RGUTv0=";
-    })
-  ];
-
  propagatedBuildInputs = [
    cstruct
    fmt
--- a/pkgs/development/python-modules/filedate/default.nix
+++ b/pkgs/development/python-modules/filedate/default.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  python-dateutil,
+  setuptools,
+}:
+buildPythonPackage rec {
+  pname = "filedate";
+  version = "3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "kubinka0505";
+    repo = "filedate";
+    rev = version;
+    hash = "sha256-HvuGP+QlUlfAUfFmaVVvtPHGdrbWVxghQipnqTTvAQc=";
+  };
+
+  sourceRoot = "${src.name}/Files";
+
+  # The repo stores everything in "src" and uses setup.py to move "src" ->
+  # "filedate" before calling setup() and then tries to rename "filedate" back
+  # to "src" after.
+  postPatch = ''
+    mv src filedate
+    substituteInPlace setup.py \
+      --replace-fail "__title__ = os.path.basename(os.path.dirname(os.path.dirname(__file__)))" '__title__ = "filedate"'
+    substituteInPlace setup.py \
+      --replace-fail "cleanup = True" "cleanup = False"
+
+    # Disable renaming "filedate" dir back to "src"
+    substituteInPlace setup.py \
+      --replace-fail "if os.path.exists(__title__):" ""
+    substituteInPlace setup.py \
+      --replace-fail "	os.rename(__title__, directory)" ""
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [ python-dateutil ];
+
+  pythonImportsCheck = [ "filedate" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pytestFlagsArray = [ "tests/unit.py" ];
+
+  disabledTests = [ "test_created" ];
+
+  meta = {
+    description = "Simple, convenient and cross-platform file date changing library";
+    homepage = "https://github.com/kubinka0505/filedate";
+    changelog = "https://github.com/kubinka0505/filedate/blob/${src.rev}/Documents/ChangeLog.md";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ thornycrackers ];
+  };
+}
--- a/pkgs/development/tools/gosec/default.nix
+++ b/pkgs/development/tools/gosec/default.nix
@@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "gosec";
-  version = "2.19.0";
+  version = "2.20.0";

  src = fetchFromGitHub {
    owner = "securego";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Yb0NEvGx0Ds3t2VjhSWw4oILmN1kR9Dlqe45/VRbu0A=";
+    hash = "sha256-QQD24Z755AurBFXZj/wlRBJegQ74kTvWVy2cN5PnblY=";
  };

-  vendorHash = "sha256-yphsGkubJyXDrlCAKh9tdKI5cDldNXvJ22fs3rY5I4Y=";
+  vendorHash = "sha256-VWbsSS3j8zgsZQzsO/ZyKoOUqhNhmMmDICImUZHmC9Y=";

  subPackages = [
    "cmd/gosec"
--- a/pkgs/development/tools/haskell/hadrian/disable-hyperlinked-source.patch
+++ b/pkgs/development/tools/haskell/hadrian/disable-hyperlinked-source.patch
@@ -1,7 +1,7 @@
 diff --git a/hadrian/src/Settings/Builders/Haddock.hs b/hadrian/src/Settings/Builders/Haddock.hs
 index 902b2f85e2..429a441c3b 100644
--- a/src/Settings/Builders/Haddock.hs
-+++ b/src/Settings/Builders/Haddock.hs
+--- a/hadrian/src/Settings/Builders/Haddock.hs
+++ b/hadrian/src/Settings/Builders/Haddock.hs
@@ -57,7 +57,6 @@ haddockBuilderArgs = mconcat
             , arg $ "--odir=" ++ takeDirectory output
             , arg $ "--dump-interface=" ++ output
--- a/pkgs/development/tools/haskell/hadrian/hadrian-9.8.1-allow-Cabal-3.10.patch
+++ b/pkgs/development/tools/haskell/hadrian/hadrian-9.8.1-allow-Cabal-3.10.patch
@@ -1,7 +1,7 @@
 diff --git a/hadrian.cabal b/hadrian.cabal
 index 70fded11aa..3893537f05 100644
--- a/hadrian.cabal
-+++ b/hadrian.cabal
+--- a/hadrian/hadrian.cabal
+++ b/hadrian/hadrian.cabal
@@ -150,7 +150,7 @@ executable hadrian
                        , TypeOperators
     other-extensions:    MultiParamTypeClasses
--- a/pkgs/development/tools/haskell/hadrian/hadrian.nix
+++ b/pkgs/development/tools/haskell/hadrian/hadrian.nix
@@ -11,7 +11,6 @@
 , ghcVersion
  # Customization
 , userSettings ? null
-, enableHyperlinkedSource
 }:

 mkDerivation {
@@ -21,13 +20,6 @@ mkDerivation {
  postUnpack = ''
    sourceRoot="$sourceRoot/hadrian"
  '';
-  patches = lib.optionals (!enableHyperlinkedSource) [
-    ./disable-hyperlinked-source.patch
-  ] ++ lib.optionals (lib.elem ghcVersion [ "9.8.1" "9.8.2" ]) [
-    # Incorrect bounds on Cabal
-    # https://gitlab.haskell.org/ghc/ghc/-/issues/24100
-    ./hadrian-9.8.1-allow-Cabal-3.10.patch
-  ];
  # Overwrite UserSettings.hs with a provided custom one
  postPatch = lib.optionalString (userSettings != null) ''
    install -m644 "${writeText "UserSettings.hs" userSettings}" src/UserSettings.hs
--- a/pkgs/development/tools/haskell/hadrian/make-hadrian.nix
+++ b/pkgs/development/tools/haskell/hadrian/make-hadrian.nix
@@ -32,10 +32,6 @@
  # Contents of a non-default UserSettings.hs to use when building hadrian, if any.
  # Should be a string or null.
 , userSettings ? null
-  # Whether to pass --hyperlinked-source to haddock or not. This is a custom
-  # workaround as we wait for this to be configurable via userSettings or similar.
-  # https://gitlab.haskell.org/ghc/ghc/-/issues/23625
-, enableHyperlinkedSource ? false
 }:

 let
@@ -50,7 +46,7 @@ let
 in

 callPackage' ./hadrian.nix ({
-  inherit userSettings enableHyperlinkedSource;
+  inherit userSettings;
 } // lib.optionalAttrs (lib.versionAtLeast ghcVersion "9.9") {
  # Starting with GHC 9.9 development, additional in tree packages are required
  # to build hadrian. (Hackage-released conditional dependencies are handled
--- a/pkgs/development/tools/melange/default.nix
+++ b/pkgs/development/tools/melange/default.nix
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "melange";
-  version = "0.6.11";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "chainguard-dev";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-/P85vrcKWZHXNUIlzLpc9v0I5KEL7HUyr1SM2207l7o=";
+    hash = "sha256-RkX6jS3Oh0pRn7kwNDRi8RQ2apLx3W82yQYI1JLJXjQ=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -25,7 +25,7 @@ buildGoModule rec {
    '';
  };

-  vendorHash = "sha256-R1Fo4N5q00ePkddOJKauC6iDPGMYk15FIKEXqWy6ifQ=";
+  vendorHash = "sha256-0IBpnwAkvrGkll/mE67BXb/TmwYJyX2oG/aBqsKcn4g=";

  subPackages = [ "." ];

--- a/pkgs/development/tools/purescript/spago/default.nix
+++ b/pkgs/development/tools/purescript/spago/default.nix
@@ -1,7 +1,9 @@
 { haskell
+, haskellPackages
 , lib

 # The following are only needed for the passthru.tests:
+, spago
 , cacert
 , git
 , nodejs
@@ -9,53 +11,47 @@
 , runCommand
 }:

-let
-  spago =
-    lib.pipe
-      haskell.packages.ghc90.spago
-      [ haskell.lib.compose.justStaticExecutables
-        (haskell.lib.compose.overrideCabal (oldAttrs: {
-          changelog = "https://github.com/purescript/spago/releases/tag/${oldAttrs.version}";
-        }))
-      ];
-in
+lib.pipe
+  haskellPackages.spago
+  [
+    haskell.lib.compose.justStaticExecutables

-spago.overrideAttrs (oldAttrs: {
-  passthru = (oldAttrs.passthru or {}) // {
-    updateScript = ./update.sh;
+    (haskell.lib.compose.overrideCabal (oldAttrs: {
+      changelog = "https://github.com/purescript/spago/releases/tag/${oldAttrs.version}";

-    # These tests can be run with the following command.  The tests access the
-    # network, so they cannot be run in the nix sandbox.  sudo is needed in
-    # order to change the sandbox option.
-    #
-    # $ sudo nix-build -A spago.passthru.tests --option sandbox relaxed
-    #
-    tests =
-      runCommand
-        "spago-tests"
-        {
-          __noChroot = true;
-          nativeBuildInputs = [
-            cacert
-            git
-            nodejs
-            purescript
-            spago
-          ];
-        }
-        ''
-          # spago expects HOME to be set because it creates a cache file under
-          # home.
-          HOME=$(pwd)
+      passthru = (oldAttrs.passthru or {}) // {
+        updateScript = ./update.sh;

-          spago --verbose init
-          spago --verbose build
-          spago --verbose test
+        # These tests can be run with the following command.  The tests access the
+        # network, so they cannot be run in the nix sandbox.  sudo is needed in
+        # order to change the sandbox option.
+        #
+        # $ sudo nix-build -A spago.passthru.tests --option sandbox relaxed
+        #
+        tests =
+          runCommand
+            "spago-tests"
+            {
+              __noChroot = true;
+              nativeBuildInputs = [
+                cacert
+                git
+                nodejs
+                purescript
+                spago
+              ];
+            }
+            ''
+              # spago expects HOME to be set because it creates a cache file under
+              # home.
+              HOME=$(pwd)

-          touch $out
-        '';
-  };
-  meta = (oldAttrs.meta or {}) // {
-    mainProgram = "spago";
-  };
-})
+              spago --verbose init
+              spago --verbose build
+              spago --verbose test
+
+              touch $out
+            '';
+      };
+    }))
+  ]
--- a/pkgs/development/tools/purescript/spago/spago.nix
+++ b/pkgs/development/tools/purescript/spago/spago.nix
@@ -9,16 +9,16 @@
 , optparse-applicative, prettyprinter, process, QuickCheck, retry
 , rio, rio-orphans, safe, semver-range, stm, stringsearch, tar
 , template-haskell, temporary, text, time, transformers, turtle
-, unliftio, unordered-containers, utf8-string, versions, with-utf8
-, zlib
+, unliftio, unordered-containers, uri-encode, utf8-string, versions
+, with-utf8, yaml, zlib
 }:
 mkDerivation {
  pname = "spago";
-  version = "0.20.9";
+  version = "0.21.0";
  src = fetchgit {
    url = "https://github.com/purescript/spago.git";
-    sha256 = "00vdqg7vaw3d9zwh47886lw9fhhlwjagzhaj3aqz4xm92pjavhih";
-    rev = "d16d4914200783fbd820ba89dbdf67270454faf5";
+    sha256 = "1v5y15nhw6smnir0y7y854pa70iv8asxsqph2y8rz1c9lkz5d41g";
+    rev = "c354f4a461f65fcb83aaa843830ea1589f6c7179";
    fetchSubmodules = true;
  };
  isLibrary = true;
@@ -31,7 +31,7 @@ mkDerivation {
    optparse-applicative prettyprinter process retry rio rio-orphans
    safe semver-range stm stringsearch tar template-haskell temporary
    text time transformers turtle unliftio unordered-containers
-    utf8-string versions with-utf8 zlib
+    uri-encode utf8-string versions with-utf8 yaml zlib
  ];
  executableHaskellDepends = [
    ansi-terminal base text turtle with-utf8
@@ -43,4 +43,5 @@ mkDerivation {
  testToolDepends = [ hspec-discover ];
  homepage = "https://github.com/purescript/spago#readme";
  license = lib.licenses.bsd3;
+  mainProgram = "spago";
 }
--- a/pkgs/development/tools/wabt/default.nix
+++ b/pkgs/development/tools/wabt/default.nix
@@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "wabt";
-  version = "1.0.34";
+  version = "1.0.35";

  src = fetchFromGitHub {
    owner = "WebAssembly";
    repo = "wabt";
    rev = version;
-    sha256 = "sha256-KlaMc3k1y6KviMDrMbKPcJOywJasrPZrnvSos8hgu+8=";
+    sha256 = "sha256-oWyHR2HRDA/N5Rm9EXhOi+lZ2N7In6HmE74ZL2Nyu9A=";
    fetchSubmodules = true;
  };

--- a/pkgs/os-specific/linux/fnotifystat/default.nix
+++ b/pkgs/os-specific/linux/fnotifystat/default.nix
@@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "fnotifystat";
-  version = "0.02.11";
+  version = "0.03.00";

  src = fetchFromGitHub {
    owner = "ColinIanKing";
    repo = pname;
    rev = "V${version}";
-    hash = "sha256-CwjaDL5pt2HMUhq0Q3s6Ssp3jr9uwCdVhT1JzlKcQQw=";
+    hash = "sha256-UGww0/m+JMftQyAguc8UpPrtIphjCq9TINabFaAKN0A=";
  };

  installFlags = [
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "klipper";
-  version = "0.12.0-unstable-2024-04-20";
+  version = "0.12.0-unstable-2024-05-14";

  src = fetchFromGitHub {
    owner = "KevinOConnor";
    repo = "klipper";
-    rev = "2f6e94c94cae036b70b02df996dc12e2e61e5dcb";
-    sha256 = "sha256-qDV0L86NLQl8O/w9yuTnMZ0MdYfFn+u+jFUCDl5p1LY=";
+    rev = "e0cbd7b5fc1ce6d1dfbc8daf8e59f57bf3c5e5b9";
+    sha256 = "sha256-fPeFul9BLWuw6T4IdRROCd9BY0e6sxr82Q3orDZnye8=";
  };

  sourceRoot = "${src.name}/klippy";
--- a/pkgs/servers/mail/stalwart/default.nix
+++ b/pkgs/servers/mail/stalwart/default.nix
@@ -10,6 +10,7 @@
 , stdenv
 , darwin
 , nix-update-script
+, nixosTests
 , rocksdb_8_3
 }:

@@ -60,7 +61,10 @@ rustPlatform.buildRustPackage {
  # Tests require reading to /etc/resolv.conf
  doCheck = false;

-  passthru.update-script = nix-update-script { };
+  passthru = {
+    update-script = nix-update-script { };
+    tests.stalwart-mail = nixosTests.stalwart-mail;
+  };

  meta = with lib; {
    description = "Secure & Modern All-in-One Mail Server (IMAP, JMAP, SMTP)";
--- a/pkgs/servers/search/weaviate/default.nix
+++ b/pkgs/servers/search/weaviate/default.nix
@@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "weaviate";
-  version = "1.24.11";
+  version = "1.25.0";

  src = fetchFromGitHub {
    owner = "weaviate";
    repo = "weaviate";
    rev = "v${version}";
-    hash = "sha256-rXe9svvHu/6sQhHJ++jwb5gJEeVwoK/Z8rV7swUM3Kk=";
+    hash = "sha256-3ZjsFIxrlDCkbiIPNH+nkCwl9SEGA1h6632ZlIc9HBc=";
  };

-  vendorHash = "sha256-f7LskkQbsPwNmrzLTze0C66y++7Vqtb15tjW142TQmE=";
+  vendorHash = "sha256-4QSc4dU1bEpKpiG7FwSq/BbnFL94DqgjQo6zN67d8Sw=";

  subPackages = [ "cmd/weaviate-server" ];

--- a/pkgs/servers/x11/xorg/xwayland.nix
+++ b/pkgs/servers/x11/xorg/xwayland.nix
@@ -4,6 +4,7 @@
 , fetchpatch
 , fontutil
 , lib
+, libdecor
 , libei
 , libGL
 , libGLU
@@ -33,6 +34,7 @@
 , pkg-config
 , pixman
 , stdenv
+, systemd
 , wayland
 , wayland-protocols
 , wayland-scanner
@@ -47,21 +49,20 @@

 stdenv.mkDerivation rec {
  pname = "xwayland";
-  version = "23.2.6";
+  version = "24.1.0";

  src = fetchurl {
    url = "mirror://xorg/individual/xserver/${pname}-${version}.tar.xz";
-    hash = "sha256-HJo2a058ytug+b0xPFnq4S0jvXJUOyKibq+LIINc/G0=";
+    hash = "sha256-vvIcTxiAek7VccTi32CrY7VGa71QLszrJIW4kqt23MI=";
  };

  patches = [
-    # Backport fix for libei scrolling
-    # Notably affects Steam Input, but also anything else using xtest
+    # Backport fix for pkg-config generation to make CMake happy
    # FIXME: remove when merged
-    # Upstream PR: https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1531
+    # Upstream PR: https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1543
    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/317712eb5a1aa4a1c3d737a8fcaee57add9981c9.patch";
-      hash = "sha256-TZo38Pyr9IJUF+3bqlmF4M84XGgo9G6WFTvbaP9r0XU=";
+      url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/8cb1c21a4240a5b6bf4aeeef51819639b4e0ad24.patch";
+      hash = "sha256-MZPP9QgYO4RFJ/vcjkpu7SVSo5Dh09ZdZjOwTopjdYQ=";
    })
  ];

@@ -76,6 +77,7 @@ stdenv.mkDerivation rec {
  ];
  buildInputs = [
    egl-wayland
+    libdecor
    libepoxy
    libei
    fontutil
@@ -102,6 +104,7 @@ stdenv.mkDerivation rec {
    mesa
    openssl
    pixman
+    systemd
    wayland
    wayland-protocols
    xkbcomp
@@ -112,7 +115,6 @@ stdenv.mkDerivation rec {
    libunwind
  ];
  mesonFlags = [
-    (lib.mesonBool "xwayland_eglstream" true)
    (lib.mesonBool "xcsecurity" true)
    (lib.mesonOption "default_font_path" defaultFontPath)
    (lib.mesonOption "xkb_bin_dir" "${xkbcomp}/bin")
@@ -132,7 +134,7 @@ stdenv.mkDerivation rec {
    homepage = "https://wayland.freedesktop.org/xserver.html";
    license = licenses.mit;
    mainProgram = "Xwayland";
-    maintainers = with maintainers; [ emantor ];
+    maintainers = with maintainers; [ emantor k900 ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/tools/admin/granted/default.nix
+++ b/pkgs/tools/admin/granted/default.nix
@@ -12,16 +12,16 @@

 buildGoModule rec {
  pname = "granted";
-  version = "0.25.0";
+  version = "0.26.0";

  src = fetchFromGitHub {
    owner = "common-fate";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-oXwBVtkHy0bIs/5iHUvxO2gxccgBC0/+7EV09LIsROo=";
+    sha256 = "sha256-Ny2HHNawUmjqo0rTlM5yulOkqQUM/x1ySbXIE6vbegQ=";
  };

-  vendorHash = "sha256-EtS0cSDFWrR2rkKtNihBCZGBZC0TXruEuP2fqw0ZuIQ=";
+  vendorHash = "sha256-f0vL9YD5PmoZFeOv2oeYtm2gYPYCJ6aYTan9AVr0/gc=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/tools/misc/cf-terraforming/default.nix
+++ b/pkgs/tools/misc/cf-terraforming/default.nix
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "cf-terraforming";
-  version = "0.19.0";
+  version = "0.20.0";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = "cf-terraforming";
    rev = "v${version}";
-    sha256 = "sha256-eGfPk3qptNf6QfVKDT4MwJav7z+ri+eEiB7KHGRxzOE=";
+    sha256 = "sha256-r5iRXhbjmFNlzoOe9s6vheROl/XKbeIfGD+ACl0hmro=";
  };

-  vendorHash = "sha256-cWFCEC20D2nhVeW7P/w5YSt1tQbWTPDWF/eaxEvWoLo=";
+  vendorHash = "sha256-FinthjJeXwfjyNORdgmgArjRk+2zUlVV67P52V/lK+A=";
  ldflags = [ "-X github.com/cloudflare/cf-terraforming/internal/app/cf-terraforming/cmd.versionString=${version}" ];

  # The test suite insists on downloading a binary release of Terraform from
--- a/pkgs/tools/package-management/poetry/unwrapped.nix
+++ b/pkgs/tools/package-management/poetry/unwrapped.nix
@@ -38,7 +38,7 @@

 buildPythonPackage rec {
  pname = "poetry";
-  version = "1.8.2";
+  version = "1.8.3";
  pyproject = true;

  disabled = pythonOlder "3.8";
@@ -47,7 +47,7 @@ buildPythonPackage rec {
    owner = "python-poetry";
    repo = "poetry";
    rev = "refs/tags/${version}";
-    hash = "sha256-MBWVeS/UHpzeeNUeiHMoXnLA3enRO/6yGIbg4Vf2GxU=";
+    hash = "sha256-PPHt9GG5XJzrhnuAS8L+0Pa3El3RNCdEbXbLnHopDWg=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/wayland/wluma/Cargo.lock
+++ b/pkgs/tools/wayland/wluma/Cargo.lock
--- a/pkgs/tools/wayland/wluma/default.nix
+++ b/pkgs/tools/wayland/wluma/default.nix
@@ -7,24 +7,23 @@
 , pkg-config
 , udev
 , v4l-utils
+, dbus
+, nix-update-script
 }:

 rustPlatform.buildRustPackage rec {
  pname = "wluma";
-  version = "4.3.0";
+  version = "4.4.0";

  src = fetchFromGitHub {
    owner = "maximbaz";
    repo = "wluma";
    rev = version;
-    sha256 = "sha256-FaX87k8LdBhrBX4qvokSHkcNaQZ0+oSbkn9d0dK6FGo=";
+    sha256 = "sha256-Ow3SjeulYiHY9foXrmTtLK3F+B3+DrtDjBUke3bJeDw=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "toml-0.5.9" = "sha256-WUQFF9Hfo3JK65AKAF7qNZex6l7F3N8HXmJlu8cJUEE=";
-    };
  };

  nativeBuildInputs = [
@@ -37,6 +36,7 @@ rustPlatform.buildRustPackage rec {
    udev
    v4l-utils
    vulkan-loader
+    dbus
  ];

  postInstall = ''
@@ -44,12 +44,14 @@ rustPlatform.buildRustPackage rec {
      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ wayland ]}"
  '';

+  passthru.updateScript = nix-update-script { };
+
  meta = with lib; {
    description = "Automatic brightness adjustment based on screen contents and ALS";
    homepage = "https://github.com/maximbaz/wluma";
    changelog = "https://github.com/maximbaz/wluma/releases/tag/${version}";
    license = licenses.isc;
-    maintainers = with maintainers; [ yshym jmc-figueira ];
+    maintainers = with maintainers; [ yshym jmc-figueira atemu ];
    platforms = platforms.linux;
    mainProgram = "wluma";
  };
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -35714,7 +35714,7 @@ with pkgs;

  xlife = callPackage ../applications/graphics/xlife { };

-  xmobar = haskellPackages.xmobar;
+  xmobar = haskellPackages.xmobar.bin;

  xmonad-log = callPackage ../tools/misc/xmonad-log { };

--- a/pkgs/top-level/haskell-packages.nix
+++ b/pkgs/top-level/haskell-packages.nix
@@ -360,6 +360,32 @@ in {
      llvmPackages = pkgs.llvmPackages_15;
    };
    ghc98 = compiler.ghc982;
+    ghc9101 = callPackage ../development/compilers/ghc/9.10.1.nix {
+      bootPkgs =
+        # For GHC 9.6 no armv7l bindists are available.
+        if stdenv.hostPlatform.isAarch32 then
+          packages.ghc963
+        else if stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian then
+          packages.ghc963
+        else if stdenv.hostPlatform.isDarwin then
+          # it seems like the GHC 9.6.* bindists are built with a different
+          # toolchain than we are using (which I'm guessing from the fact
+          # that 9.6.4 bindists pass linker flags our ld doesn't support).
+          # With both 9.6.3 and 9.6.4 binary it is impossible to link against
+          # the clock package (probably a hsc2hs problem).
+          packages.ghc963
+        else
+          packages.ghc963Binary;
+      inherit (buildPackages.python3Packages) sphinx;
+      # Need to use apple's patched xattr until
+      # https://github.com/xattr/xattr/issues/44 and
+      # https://github.com/xattr/xattr/issues/55 are solved.
+      inherit (buildPackages.darwin) xattr autoSignDarwinBinariesHook;
+      # 2023-01-15: Support range >= 11 && < 16
+      buildTargetLlvmPackages = pkgsBuildTarget.llvmPackages_15;
+      llvmPackages = pkgs.llvmPackages_15;
+    };
+    ghc910 = compiler.ghc9101;
    ghcHEAD = callPackage ../development/compilers/ghc/head.nix {
      bootPkgs =
        # For GHC 9.6 no armv7l bindists are available.
@@ -525,6 +551,12 @@ in {
      compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-9.8.x.nix { };
    };
    ghc98 = packages.ghc982;
+    ghc9101 = callPackage ../development/haskell-modules {
+      buildHaskellPackages = bh.packages.ghc9101;
+      ghc = bh.compiler.ghc9101;
+      compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-9.10.x.nix { };
+    };
+    ghc910 = packages.ghc9101;
    ghcHEAD = callPackage ../development/haskell-modules {
      buildHaskellPackages = bh.packages.ghcHEAD;
      ghc = bh.compiler.ghcHEAD;
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4189,6 +4189,8 @@ self: super: with self; {

  filecheck = callPackage ../development/python-modules/filecheck { };

+  filedate = callPackage ../development/python-modules/filedate { };
+
  filedepot = callPackage ../development/python-modules/filedepot { };

  filelock = callPackage ../development/python-modules/filelock { };
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -74,6 +74,7 @@ let
    ghc965
    ghc981
    ghc982
+    ghc9101
  ];

  # packagePlatforms applied to `haskell.packages.*`
@@ -503,22 +504,27 @@ let
      cabal-install = lib.subtractLists [
        compilerNames.ghc981
        compilerNames.ghc982
+        compilerNames.ghc9101
      ] released;
      Cabal_3_10_3_0 = lib.subtractLists [
        compilerNames.ghc981
        compilerNames.ghc982
+        compilerNames.ghc9101
      ] released;
      Cabal-syntax_3_10_3_0 = lib.subtractLists [
        compilerNames.ghc981
        compilerNames.ghc982
+        compilerNames.ghc9101
      ] released;
      cabal2nix = lib.subtractLists [
        compilerNames.ghc981
        compilerNames.ghc982
+        compilerNames.ghc9101
      ] released;
      cabal2nix-unstable = lib.subtractLists [
        compilerNames.ghc981
        compilerNames.ghc982
+        compilerNames.ghc9101
      ] released;
      funcmp = released;
      haskell-language-server = lib.subtractLists [
@@ -526,25 +532,31 @@ let
        compilerNames.ghc8107
        # Support ceased as of 2.5.0.0
        compilerNames.ghc902
+        # No support yet (2024-05-12)
+        compilerNames.ghc9101
      ] released;
      hoogle = lib.subtractLists [
        compilerNames.ghc981
        compilerNames.ghc982
+        compilerNames.ghc9101
      ] released;
      hlint = lib.subtractLists [
        compilerNames.ghc902
        compilerNames.ghc981
        compilerNames.ghc982
+        compilerNames.ghc9101
      ] released;
      hpack = lib.subtractLists [
        compilerNames.ghc981
        compilerNames.ghc982
+        compilerNames.ghc9101
      ] released;
      hsdns = released;
      jailbreak-cabal = released;
      language-nix = lib.subtractLists [
        compilerNames.ghc981
        compilerNames.ghc982
+        compilerNames.ghc9101
      ] released;
      large-hashable = [
        compilerNames.ghc928
@@ -553,6 +565,7 @@ let
      titlecase = lib.subtractLists [
        compilerNames.ghc981
        compilerNames.ghc982
+        compilerNames.ghc9101
      ] released;
      ghc-api-compat = [
        compilerNames.ghc8107
@@ -564,14 +577,17 @@ let
      ghc-lib = lib.subtractLists [
        compilerNames.ghc981
        compilerNames.ghc982
+        compilerNames.ghc9101
      ] released;
      ghc-lib-parser = lib.subtractLists [
        compilerNames.ghc981
        compilerNames.ghc982
+        compilerNames.ghc9101
      ] released;
      ghc-lib-parser-ex = lib.subtractLists [
        compilerNames.ghc981
        compilerNames.ghc982
+        compilerNames.ghc9101
      ] released;
      ghc-source-gen = [
        # Feel free to remove these as they break,
@@ -588,11 +604,15 @@ let
      hashable = lib.subtractLists [
        compilerNames.ghc981
        compilerNames.ghc982
+        compilerNames.ghc9101
+      ] released;
+      primitive = lib.subtractLists [
+        compilerNames.ghc9101
      ] released;
-      primitive = released;
      weeder = lib.subtractLists [
        compilerNames.ghc981
        compilerNames.ghc982
+        compilerNames.ghc9101
      ] released;
    })
    {