Merge staging-next into staging

2026-10-04 14:00:04 +00:00 · 2025-01-12 18:04:40 +00:00
parent a084f39340 74a6c68160
commit e290d23688
121 changed files with 955 additions and 661 deletions
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -0,0 +1,12 @@
+{
+  "name": "nixpkgs",
+  "image": "mcr.microsoft.com/devcontainers/universal:2-linux",
+  "features": {
+    "ghcr.io/devcontainers/features/nix:1": {
+      "multiUser": false
+    }
+  },
+  "remoteEnv": {
+    "NIXPKGS": "/workspaces/nixpkgs"
+  }
+}
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@@ -20,6 +20,7 @@ permissions:

 jobs:
  periodic-merge:
+    if: github.repository_owner == 'NixOS'
    strategy:
      # don't fail fast, so that all pairs are tried
      fail-fast: false
--- a/.github/workflows/periodic-merge-6h.yml
+++ b/.github/workflows/periodic-merge-6h.yml
@@ -20,6 +20,7 @@ permissions:

 jobs:
  periodic-merge:
+    if: github.repository_owner == 'NixOS'
    strategy:
      # don't fail fast, so that all pairs are tried
      fail-fast: false
--- a/.github/workflows/periodic-merge.yml
+++ b/.github/workflows/periodic-merge.yml
@@ -14,7 +14,6 @@ on:

 jobs:
  merge:
-    if: github.repository_owner == 'NixOS'
    runs-on: ubuntu-24.04
    name: ${{ inputs.from }} → ${{ inputs.into }}
    steps:
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -23202,6 +23202,12 @@
    githubId = 178444;
    name = "Thomas Bereknyei";
  };
+  tombert = {
+    email = "thomas@gebert.app";
+    github = "tombert";
+    githubId = 2027925;
+    name = "Thomas Gebert";
+  };
  tomfitzhenry = {
    email = "tom@tom-fitzhenry.me.uk";
    github = "tomfitzhenry";
--- a/nixos/modules/services/networking/strongswan-swanctl/module.nix
+++ b/nixos/modules/services/networking/strongswan-swanctl/module.nix
@@ -42,6 +42,7 @@ in  {
    ];

    environment.etc."swanctl/swanctl.conf".source = configFile;
+    environment.etc."strongswan.conf".text = cfg.strongswan.extraConfig;

    # The swanctl command complains when the following directories don't exist:
    # See: https://wiki.strongswan.org/projects/strongswan/wiki/Swanctldirectory
@@ -67,14 +68,10 @@ in  {
      wants    = [ "network-online.target" ];
      after    = [ "network-online.target" ];
      path     = with pkgs; [ kmod iproute2 iptables util-linux ];
-      environment = {
-        STRONGSWAN_CONF = pkgs.writeTextFile {
-          name = "strongswan.conf";
-          text = cfg.strongswan.extraConfig;
-        };
-        SWANCTL_DIR = "/etc/swanctl";
-      };
-      restartTriggers = [ config.environment.etc."swanctl/swanctl.conf".source ];
+      restartTriggers = [
+        config.environment.etc."swanctl/swanctl.conf".source
+        config.environment.etc."strongswan.conf".source
+      ];
      serviceConfig = {
        ExecStart     = "${cfg.package}/sbin/charon-systemd";
        Type          = "notify";
--- a/nixos/modules/services/security/endlessh-go.nix
+++ b/nixos/modules/services/security/endlessh-go.nix
@@ -110,7 +110,13 @@ in
            );
          DynamicUser = true;
          RootDirectory = rootDirectory;
-          BindReadOnlyPaths = [ builtins.storeDir ];
+          BindReadOnlyPaths = [
+            builtins.storeDir
+            "-/etc/hosts"
+            "-/etc/localtime"
+            "-/etc/nsswitch.conf"
+            "-/etc/resolv.conf"
+          ];
          InaccessiblePaths = [ "-+${rootDirectory}" ];
          RuntimeDirectory = baseNameOf rootDirectory;
          RuntimeDirectoryMode = "700";
--- a/nixos/modules/services/web-apps/komga.nix
+++ b/nixos/modules/services/web-apps/komga.nix
@@ -8,7 +8,12 @@
 let
  cfg = config.services.komga;
  inherit (lib) mkOption mkEnableOption maintainers;
-  inherit (lib.types) port str bool;
+  inherit (lib.types)
+    port
+    str
+    bool
+    submodule
+    ;

  settingsFormat = pkgs.formats.yaml { };
 in
@@ -53,13 +58,14 @@ in
      };

      settings = lib.mkOption {
-        inherit (settingsFormat) type;
-        default = { };
-        defaultText = lib.literalExpression ''
-          {
-            server.port = 8080;
-          }
-        '';
+        type = submodule {
+          freeformType = settingsFormat.type;
+          options.server.port = mkOption {
+            type = port;
+            description = "The port that Komga will listen on.";
+            default = 8080;
+          };
+        };
        description = ''
          Komga configuration.

@@ -87,11 +93,7 @@ in
        }
      ];

-      services.komga.settings = {
-        server.port = lib.mkDefault 8080;
-      };
-
-      networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+      networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.settings.server.port ];

      users.groups = mkIf (cfg.group == "komga") { komga = { }; };

--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -185,6 +185,10 @@ let
                    echo "reused"
                    passphrase=$(cat /crypt-ramfs/passphrase)
                    break
+                elif [ -e /dev/mapper/${dev.name} ]; then
+                    echo "opened externally"
+                    rm -f /crypt-ramfs/device
+                    return
                else
                    # ask cryptsetup-askpass
                    echo -n "${dev.device}" > /crypt-ramfs/device
--- a/pkgs/applications/audio/librespot/default.nix
+++ b/pkgs/applications/audio/librespot/default.nix
@@ -14,6 +14,8 @@
  withPulseAudio ? false,
  libpulseaudio,
  withRodio ? true,
+  withAvahi ? false,
+  avahi-compat,
 }:

 rustPlatform.buildRustPackage rec {
@@ -41,6 +43,7 @@ rustPlatform.buildRustPackage rec {
  buildInputs =
    [ openssl ]
    ++ lib.optional withALSA alsa-lib
+    ++ lib.optional withAvahi avahi-compat
    ++ lib.optional withPortAudio portaudio
    ++ lib.optional withPulseAudio libpulseaudio;

@@ -48,6 +51,7 @@ rustPlatform.buildRustPackage rec {
  buildFeatures =
    lib.optional withRodio "rodio-backend"
    ++ lib.optional withALSA "alsa-backend"
+    ++ lib.optional withAvahi "with-avahi"
    ++ lib.optional withPortAudio "portaudio-backend"
    ++ lib.optional withPulseAudio "pulseaudio-backend";

--- a/pkgs/applications/emulators/libretro/cores/puae.nix
+++ b/pkgs/applications/emulators/libretro/cores/puae.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "puae";
-  version = "0-unstable-2024-10-19";
+  version = "0-unstable-2025-01-11";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-uae";
-    rev = "c60e42ef9ad474518d4be859b7c1da2c0c7e1d6f";
-    hash = "sha256-WCkz7BUgYaI+yRhPmNuOKGJC/GxV+n2aeJVn8vhx0Ng=";
+    rev = "67785f95db6e96dc081a2207751ab98b06b422ab";
+    hash = "sha256-jJ1yki9uPutIdAI6TBKPWjiZc7W5K9n7P/oYA/UWJf4=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/misc/rofi/default.nix
+++ b/pkgs/applications/misc/rofi/default.nix
@@ -27,14 +27,14 @@

 stdenv.mkDerivation rec {
  pname = "rofi-unwrapped";
-  version = "1.7.6";
+  version = "1.7.7";

  src = fetchFromGitHub {
    owner = "davatorium";
    repo = "rofi";
    rev = version;
    fetchSubmodules = true;
-    hash = "sha256-hT9FMCAwY8hZx4y1l0vHfcReIJUBxSmixZJhKP8nRpw=";
+    hash = "sha256-2rPEn+XotijqLYo2EcoiJbgdbRk4SCQ+D4jZ1gwpCQw=";
  };

  preConfigure = ''
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -24,7 +24,7 @@ let
  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "7.0.3495.27";
+  version = "7.0.3495.29";

  suffix = {
    aarch64-linux = "arm64";
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
  src = fetchurl {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
    hash = {
-      aarch64-linux = "sha256-AX6PCYPpz5z9bUZqdfoTqtW9USLQRh8YgITk7DdJkUU=";
-      x86_64-linux = "sha256-pZgmRLwx64m9SwYX2cTwYEkHLYFQgIFblW9dSiYxXv8=";
+      aarch64-linux = "sha256-GdywFoaxx2VSpOJ0FJIhFcIRDJEhozCWvYvdatmEi5o=";
+      x86_64-linux = "sha256-PNSGx2oCIbB3vaNFS+7coM9Xw+2qDELJBXX8zA1UC3Q=";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

--- a/pkgs/applications/networking/instant-messengers/qtox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qtox/default.nix
@@ -1,17 +1,14 @@
 { lib
 , stdenv
-, mkDerivation
 , fetchFromGitHub
 , cmake
 , pkg-config
 , perl
+, kdePackages
 , libtoxcore
 , libpthreadstubs
 , libXdmcp
 , libXScrnSaver
-, qtbase
-, qtsvg
-, qttools
 , ffmpeg
 , filter-audio
 , libexif
@@ -21,28 +18,27 @@
 , openal
 , pcre
 , qrencode
+, qt6
 , sqlcipher
-, AVFoundation
 }:

-mkDerivation rec {
+stdenv.mkDerivation rec {
  pname = "qtox";
-  version = "1.17.6";
+  version = "1.18.0";

  src = fetchFromGitHub {
-    owner = "qTox";
+    owner = "TokTok";
    repo = "qTox";
-    rev = "v${version}";
-    sha256 = "sha256-naKWoodSMw0AEtACvkASFmw9t0H0d2pcqOW79NNTYF0=";
+    tag = "v${version}";
+    hash = "sha256-UgUlWeFrNoNR1ZwobfNLmDBn9/Aw4LUMeSgIfrq/uqo=";
  };

  buildInputs = [
+    kdePackages.sonnet
    libtoxcore
    libpthreadstubs
    libXdmcp
    libXScrnSaver
-    qtbase
-    qtsvg
    ffmpeg
    filter-audio
    libexif
@@ -52,17 +48,16 @@ mkDerivation rec {
    openal
    pcre
    qrencode
+    qt6.qtbase
+    qt6.qtsvg
    sqlcipher
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ AVFoundation ];
+  ];

-  nativeBuildInputs = [ cmake pkg-config qttools ]
+  nativeBuildInputs = [ cmake pkg-config qt6.qttools qt6.wrapQtAppsHook ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [ perl ];

  cmakeFlags = [
    "-DGIT_DESCRIBE=v${version}"
-    "-DENABLE_STATUSNOTIFIER=False"
-    "-DENABLE_GTK_SYSTRAY=False"
-    "-DENABLE_APPINDICATOR=False"
    "-DTIMESTAMP=1"
  ];

--- a/pkgs/applications/version-management/git-cinnabar/default.nix
+++ b/pkgs/applications/version-management/git-cinnabar/default.nix
@@ -45,6 +45,10 @@ stdenv.mkDerivation (finalAttrs: {

  enableParallelBuilding = true;

+  # Disable automated version-check
+  buildNoDefaultFeatures = true;
+  checkNoDefaultFeatures = true;
+
  installPhase = ''
    runHook preInstall

--- a/pkgs/applications/video/openshot-qt/default.nix
+++ b/pkgs/applications/video/openshot-qt/default.nix
@@ -17,12 +17,12 @@

 let
  pname = "openshot-qt";
-  version = "3.2.1";
+  version = "3.3.0";
  src = fetchFromGitHub {
    owner = "OpenShot";
    repo = "openshot-qt";
    tag = "v${version}";
-    hash = "sha256-zZZ7C/1+Qh7KS1WJ8YWkhFgw0+UHJhjk+145u9/TBcI=";
+    hash = "sha256-+QI1772ys1Czd+KSVBAdAUjLg9mUcMZs+UhkNljY7nQ=";
  };
 in
 mkDerivationWith python3.pkgs.buildPythonApplication {
--- a/pkgs/applications/window-managers/i3/default.nix
+++ b/pkgs/applications/window-managers/i3/default.nix
@@ -66,36 +66,27 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.mesonBool "mans" true)
  ];

-  buildInputs =
-    [
-      libxcb
-      xcbutilkeysyms
-      xcbutil
-      xcbutilwm
-      xcbutilxrm
-      libxkbcommon
-      libstartup_notification
-      libX11
-      pcre2
-      libev
-      yajl
-      xcb-util-cursor
-      perl
-      pango
-      perlPackages.AnyEventI3
-      perlPackages.X11XCB
-      perlPackages.IPCRun
-      perlPackages.ExtUtilsPkgConfig
-      perlPackages.InlineC
-    ]
-    ++ lib.optionals finalAttrs.doCheck [
-      xorgserver
-      xvfb-run
-      xdotool
-      xorg.setxkbmap
-      xorg.xrandr
-      which
-    ];
+  buildInputs = [
+    libxcb
+    xcbutilkeysyms
+    xcbutil
+    xcbutilwm
+    xcbutilxrm
+    libxkbcommon
+    libstartup_notification
+    libX11
+    pcre2
+    libev
+    yajl
+    xcb-util-cursor
+    perl
+    pango
+    perlPackages.AnyEventI3
+    perlPackages.X11XCB
+    perlPackages.IPCRun
+    perlPackages.ExtUtilsPkgConfig
+    perlPackages.InlineC
+  ];

  postPatch = ''
    patchShebangs .
@@ -111,6 +102,15 @@ stdenv.mkDerivation (finalAttrs: {
  # xvfb-run is available only on Linux
  doCheck = stdenv.hostPlatform.isLinux;

+  nativeCheckInputs = lib.optionals finalAttrs.doCheck [
+    xorgserver
+    xvfb-run
+    xdotool
+    xorg.setxkbmap
+    xorg.xrandr
+    which
+  ];
+
  checkPhase = ''
    runHook preCheck

--- a/pkgs/by-name/ar/arc-browser/package.nix
+++ b/pkgs/by-name/ar/arc-browser/package.nix
@@ -10,11 +10,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "arc-browser";
-  version = "1.74.0-57065";
+  version = "1.77.0-57419";

  src = fetchurl {
    url = "https://releases.arc.net/release/Arc-${finalAttrs.version}.dmg";
-    hash = "sha256-muTTHJOQKY/oqGJ4OXgoyOhgAo0hW6Y12Dknq/KWTMw=";
+    hash = "sha256-euPJvD/BM0jVh3oBMsZNAZeyxTNRA4dmwIYNhwTjHoI=";
  };

  nativeBuildInputs = [ undmg ];
--- a/pkgs/by-name/ar/ares/package.nix
+++ b/pkgs/by-name/ar/ares/package.nix
@@ -13,6 +13,7 @@
  libao,
  libicns,
  libpulseaudio,
+  librashader,
  openal,
  pkg-config,
  stdenv,
@@ -24,19 +25,17 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ares";
-  version = "136";
+  version = "141";

  src = fetchFromGitHub {
    owner = "ares-emulator";
    repo = "ares";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Hks/MWusPiBVdb5L+53qtR6VmXG/P4rDzsvHxLeA8Do=";
+    hash = "sha256-iNcoNdGw/DfYc9tsOGsPYoZLhVwNzJe8bVotx6Rl0j4=";
  };

  patches = [
    ./patches/001-dont-rebuild-on-install.patch
-    ./patches/002-fix-ruby.diff
-    ./patches/003-darwin-specific.patch
  ];

  nativeBuildInputs =
@@ -54,6 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
    [
      SDL2
      libao
+      librashader
    ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [
      alsa-lib
@@ -68,7 +68,12 @@ stdenv.mkDerivation (finalAttrs: {
      udev
    ];

-  appendRunpaths = [ (lib.makeLibraryPath [ vulkan-loader ]) ];
+  appendRunpaths = [
+    (lib.makeLibraryPath [
+      librashader
+      vulkan-loader
+    ])
+  ];

  makeFlags =
    lib.optionals stdenv.hostPlatform.isLinux [
--- a/pkgs/by-name/ar/ares/patches/002-fix-ruby.diff
+++ b/pkgs/by-name/ar/ares/patches/002-fix-ruby.diff
@@ -1,27 +0,0 @@
-diff -Naur source-old/ruby/GNUmakefile source-new/ruby/GNUmakefile
--- source-old/ruby/GNUmakefile    2024-01-23 16:12:41.009951705 +0000
-+++ source-new/ruby/GNUmakefile    2024-01-23 16:13:54.619174062 +0000
-@@ -29,20 +29,9 @@
-       ruby += input.sdl
-     endif
-   else ifeq ($(platform),linux)
-    pkg_check = $(if $(shell $(pkg_config) $1 && echo 1),$2)
-    ruby += video.glx video.glx2 video.xshm
-    ruby += $(call pkg_check,xv,video.xvideo)
-    ruby += audio.oss audio.alsa
-    ruby += $(call pkg_check,openal,audio.openal)
-    ruby += $(call pkg_check,libpulse,audio.pulseaudio)
-    ruby += $(call pkg_check,libpulse-simple,audio.pulseaudiosimple)
-    ruby += $(call pkg_check,ao,audio.ao)
-    ruby += input.xlib
-    ruby += $(call pkg_check,libudev,input.udev)
-    ifeq ($(sdl2),true)
-      ruby += $(call pkg_check,sdl2,input.sdl)
-      ruby += $(call pkg_check,sdl2,audio.sdl)
-    endif
-+    ruby += video.glx video.glx2 video.xshm video.xvideo
-+    ruby += audio.oss audio.alsa audio.openal audio.pulseaudio audio.pulseaudiosimple audio.ao
-+    ruby += input.xlib input.udev input.sdl
-   else ifeq ($(platform),bsd)
-     pkg_check = $(if $(shell $(pkg_config) $1 && echo 1),$2)
-     ruby += video.glx video.glx2 video.xshm
--- a/pkgs/by-name/ar/ares/patches/003-darwin-specific.patch
+++ b/pkgs/by-name/ar/ares/patches/003-darwin-specific.patch
@@ -1,48 +0,0 @@
-diff -Naur source-old/desktop-ui/GNUmakefile source-new/desktop-ui/GNUmakefile
--- source-old/desktop-ui/GNUmakefile	1969-12-31 21:00:01.000000000 -0300
-+++ source-new/desktop-ui/GNUmakefile	2023-07-08 12:20:08.206582916 -0300
-@@ -91,8 +91,7 @@
- 	cp resource/$(name).plist $(output.path)/$(name).app/Contents/Info.plist
- 	cp -R $(ares.path)/Shaders $(output.path)/$(name).app/Contents/Resources/
- 	cp -R $(mia.path)/Database $(output.path)/$(name).app/Contents/Resources/	
-	sips -s format icns resource/$(name).png --out $(output.path)/$(name).app/Contents/Resources/$(name).icns
-	codesign --force --deep --options runtime --entitlements resource/$(name).selfsigned.entitlements --sign - $(output.path)/$(name).app
-+	png2icns $(output.path)/$(name).app/Contents/Resources/$(name).icns resource/$(name).png
- else ifeq ($(platform),windows)
- 	$(call mkdir,$(output.path)/Shaders/)
- 	$(call mkdir,$(output.path)/Database/)
-@@ -115,8 +114,8 @@
- else ifeq ($(shell id -un),root)
- 	$(error "make install should not be run as root")
- else ifeq ($(platform),macos)
-	mkdir -p ~/Library/Application\ Support/$(name)/
-	cp -R $(output.path)/$(name).app /Applications/$(name).app
-+	mkdir -p $(prefix)/Applications/
-+	cp -R $(output.path)/$(name).app $(prefix)/Applications/$(name).app
- else ifneq ($(filter $(platform),linux bsd),)
- 	mkdir -p $(prefix)/bin/
- 	mkdir -p $(prefix)/share/applications/
-diff -Naur source-old/mia/GNUmakefile source-new/mia/GNUmakefile
--- source-old/mia/GNUmakefile	1969-12-31 21:00:01.000000000 -0300
-+++ source-new/mia/GNUmakefile	2023-07-08 12:16:55.991517276 -0300
-@@ -39,7 +39,7 @@
- 	mkdir -p $(output.path)/$(name).app/Contents/Resources/
- 	mv $(output.path)/$(name) $(output.path)/$(name).app/Contents/MacOS/$(name)
- 	cp resource/$(name).plist $(output.path)/$(name).app/Contents/Info.plist
-	sips -s format icns resource/$(name).png --out $(output.path)/$(name).app/Contents/Resources/$(name).icns
-+	png2icns $(output.path)/$(name).app/Contents/Resources/$(name).icns resource/$(name).png
- endif
- 
- verbose: hiro.verbose nall.verbose all;
-diff -Naur source-old/tools/genius/GNUmakefile source-new/tools/genius/GNUmakefile
--- source-old/tools/genius/GNUmakefile	1969-12-31 21:00:01.000000000 -0300
-+++ source-new/tools/genius/GNUmakefile	2023-07-08 12:16:16.273503940 -0300
-@@ -26,7 +26,7 @@
- 	mkdir -p $(output.path)/$(name).app/Contents/Resources/
- 	mv $(output.path)/$(name) $(output.path)/$(name).app/Contents/MacOS/$(name)
- 	cp data/$(name).plist $(output.path)/$(name).app/Contents/Info.plist
-	sips -s format icns data/$(name).png --$(output.path) $(output.path)/$(name).app/Contents/Resources/$(name).icns
-+	png2icns $(output.path)/$(name).app/Contents/Resources/$(name).icns data/$(name).png
- endif
- 
- verbose: hiro.verbose nall.verbose all;
--- a/pkgs/by-name/ar/arpack/package.nix
+++ b/pkgs/by-name/ar/arpack/package.nix
@@ -12,14 +12,14 @@
 assert useMpi -> !blas.isILP64;
 assert useAccel -> stdenv.hostPlatform.isDarwin;

-stdenv.mkDerivation rec {
-  pname = "arpack";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "arpack${lib.optionalString useMpi "-mpi"}";
  version = "3.9.1";

  src = fetchFromGitHub {
    owner = "opencollab";
    repo = "arpack-ng";
-    rev = version;
+    tag = finalAttrs.version;
    sha256 = "sha256-HCvapLba8oLqx9I5+KDAU0s/dTmdWOEilS75i4gyfC0=";
  };

@@ -31,10 +31,17 @@ stdenv.mkDerivation rec {
  ]) ++ lib.optional useMpi mpi;

  nativeCheckInputs = lib.optional useMpi openssh;
+  checkInputs =
+    # work around for `ld: file not found: @rpath/libquadmath.0.dylib`
+    # which occurs due to an mpi test linking with `-flat_namespace`
+    # can remove once `-flat_namespace` is removed or
+    # https://github.com/NixOS/nixpkgs/pull/370526 is merged
+    lib.optional (useMpi && stdenv.hostPlatform.isDarwin) gfortran.cc;

  # a couple tests fail when run in parallel
  doCheck = true;
  enableParallelChecking = false;
+  __darwinAllowLocalNetworking = true;

  env = lib.optionalAttrs useAccel {
    # Without these flags some tests will fail / segfault when using Accelerate
@@ -46,10 +53,11 @@ stdenv.mkDerivation rec {
  cmakeFlags = [
    (lib.cmakeBool "BUILD_SHARED_LIBS" stdenv.hostPlatform.hasSharedLibraries)
    (lib.cmakeBool "EIGEN" true)
-    (lib.cmakeBool "EXAMPLES" true)
+    (lib.cmakeBool "EXAMPLES" finalAttrs.doCheck)
    (lib.cmakeBool "ICB" true)
    (lib.cmakeBool "INTERFACE64" (!useAccel && blas.isILP64))
    (lib.cmakeBool "MPI" useMpi)
+    (lib.cmakeBool "TESTS" finalAttrs.doCheck)
  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
    "-DBLA_VENDOR=${if useAccel then "Apple" else "Generic"}"
  ];
@@ -63,7 +71,7 @@ stdenv.mkDerivation rec {

  meta = {
    homepage = "https://github.com/opencollab/arpack-ng";
-    changelog = "https://github.com/opencollab/arpack-ng/blob/${src.rev}/CHANGES";
+    changelog = "https://github.com/opencollab/arpack-ng/blob/${finalAttrs.version}/CHANGES";
    description = ''
      A collection of Fortran77 subroutines to solve large scale eigenvalue
      problems.
@@ -72,4 +80,4 @@ stdenv.mkDerivation rec {
    maintainers = with lib.maintainers; [ ttuegel dotlambda ];
    platforms = lib.platforms.unix;
  };
-}
+})
--- a/pkgs/by-name/au/auto-cpufreq/package.nix
+++ b/pkgs/by-name/au/auto-cpufreq/package.nix
@@ -11,14 +11,14 @@
 }:
 python3Packages.buildPythonPackage rec {
  pname = "auto-cpufreq";
-  version = "2.4.0";
+  version = "2.5.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "AdnanHodzic";
    repo = "auto-cpufreq";
    tag = "v${version}";
-    hash = "sha256-Xsh3d7rQY7RKzZ7J0swrgxZEyITb7B3oX5F/tcBGjfk=";
+    hash = "sha256-iDvgL5dQerQnu2ERKAWGvWppG7cQ/0uKEfVY93ItvO4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/au/auto-cpufreq/prevent-install-and-copy.patch
+++ b/pkgs/by-name/au/auto-cpufreq/prevent-install-and-copy.patch
@@ -1,8 +1,8 @@
-diff --git c/auto_cpufreq/bin/auto_cpufreq.py i/auto_cpufreq/bin/auto_cpufreq.py
-index 7192366..96289e1 100755
--- c/auto_cpufreq/bin/auto_cpufreq.py
-+++ i/auto_cpufreq/bin/auto_cpufreq.py
-@@ -134,20 +134,7 @@ def main(monitor, live, daemon, install, update, remove, force, config, stats, g
+diff --git a/auto_cpufreq/bin/auto_cpufreq.py b/auto_cpufreq/bin/auto_cpufreq.py
+index d9fcd37..7436a7e 100755
+--- a/auto_cpufreq/bin/auto_cpufreq.py
+++ b/auto_cpufreq/bin/auto_cpufreq.py
+@@ -136,20 +136,7 @@ def main(monitor, live, daemon, install, update, remove, force, config, stats, g
                 except KeyboardInterrupt: break
             conf.notifier.stop()
         elif install:
@@ -24,7 +24,7 @@ index 7192366..96289e1 100755
         elif update:
             root_check()
             custom_dir = "/opt/auto-cpufreq/source"
-@@ -185,21 +172,7 @@ def main(monitor, live, daemon, install, update, remove, force, config, stats, g
+@@ -187,21 +174,7 @@ def main(monitor, live, daemon, install, update, remove, force, config, stats, g
                     run(["auto-cpufreq", "--version"])
                 else: print("Aborted")
         elif remove:
@@ -47,96 +47,3 @@ index 7192366..96289e1 100755
         elif stats:
             not_running_daemon_check()
             config_info_dialog()
-diff --git c/auto_cpufreq/core.py i/auto_cpufreq/core.py
-index b51d55d..4e4b5d3 100755
--- c/auto_cpufreq/core.py
-+++ i/auto_cpufreq/core.py
-@@ -277,18 +277,12 @@ def get_current_gov():
-     )
- 
- def cpufreqctl():
-    """
-    deploy cpufreqctl.auto-cpufreq script
-    """
-    if not (IS_INSTALLED_WITH_SNAP or os.path.isfile("/usr/local/bin/cpufreqctl.auto-cpufreq")):
-        copy(SCRIPTS_DIR / "cpufreqctl.sh", "/usr/local/bin/cpufreqctl.auto-cpufreq")
-+    # scripts are already in the correct place
-+    pass
- 
- def cpufreqctl_restore():
-    """
-    remove cpufreqctl.auto-cpufreq script
-    """
-    if not IS_INSTALLED_WITH_SNAP and os.path.isfile("/usr/local/bin/cpufreqctl.auto-cpufreq"):
-        os.remove("/usr/local/bin/cpufreqctl.auto-cpufreq")
-+    # no need to restore
-+    pass
- 
- def footer(l=79): print("\n" + "-" * l + "\n")
- 
-@@ -306,27 +300,8 @@ def remove_complete_msg():
-     footer()
- 
- def deploy_daemon():
-    print("\n" + "-" * 21 + " Deploying auto-cpufreq as a daemon " + "-" * 22 + "\n")
-
-    cpufreqctl() # deploy cpufreqctl script func call
-
-    bluetooth_disable() # turn off bluetooth on boot
-
-    auto_cpufreq_stats_path.touch(exist_ok=True)
-
-    print("\n* Deploy auto-cpufreq install script")
-    copy(SCRIPTS_DIR / "auto-cpufreq-install.sh", "/usr/local/bin/auto-cpufreq-install")
-
-    print("\n* Deploy auto-cpufreq remove script")
-    copy(SCRIPTS_DIR / "auto-cpufreq-remove.sh", "/usr/local/bin/auto-cpufreq-remove")
-
-    # output warning if gnome power profile is running
-    gnome_power_detect_install()
-    gnome_power_svc_disable()
-
-    tlp_service_detect() # output warning if TLP service is detected
-
-    call("/usr/local/bin/auto-cpufreq-install", shell=True)
-+    # prevent needless copying and system changes
-+    pass
- 
- def deploy_daemon_performance():
-     print("\n" + "-" * 21 + " Deploying auto-cpufreq as a daemon (performance) " + "-" * 22 + "\n")
-@@ -359,34 +334,7 @@ def deploy_daemon_performance():
-     call("/usr/local/bin/auto-cpufreq-install", shell=True)
- 
- def remove_daemon():
-    # check if auto-cpufreq is installed
-    if not os.path.exists("/usr/local/bin/auto-cpufreq-remove"):
-        print("\nauto-cpufreq daemon is not installed.\n")
-        sys.exit(1)
-
-    print("\n" + "-" * 21 + " Removing auto-cpufreq daemon " + "-" * 22 + "\n")
-
-    bluetooth_enable() # turn on bluetooth on boot
-
-    # output warning if gnome power profile is stopped
-    gnome_power_rm_reminder()
-    gnome_power_svc_enable()
-
-    # run auto-cpufreq daemon remove script
-    call("/usr/local/bin/auto-cpufreq-remove", shell=True)
-
-    # remove auto-cpufreq-remove
-    os.remove("/usr/local/bin/auto-cpufreq-remove")
-
-    # delete override pickle if it exists
-    if os.path.exists(governor_override_state):  os.remove(governor_override_state)
-
-    # delete stats file
-    if auto_cpufreq_stats_path.exists():
-        if auto_cpufreq_stats_file is not None: auto_cpufreq_stats_file.close()
-        auto_cpufreq_stats_path.unlink()
-
-    cpufreqctl_restore() # restore original cpufrectl script
-+    pass
- 
- def gov_check():
-     for gov in AVAILABLE_GOVERNORS:
--- a/pkgs/by-name/ba/barman/package.nix
+++ b/pkgs/by-name/ba/barman/package.nix
@@ -50,6 +50,7 @@ python3Packages.buildPythonApplication rec {
    [
      # Assertion error
      "test_help_output"
+      "test_exits_on_unsupported_target"
    ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
      # FsOperationFailed
--- a/pkgs/by-name/bi/bigpemu/package.nix
+++ b/pkgs/by-name/bi/bigpemu/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  SDL2,
+  glui,
+  libGLU,
+  libGL,
+  buildFHSEnv,
+}:
+let
+  bigpemu-unwrapped = stdenv.mkDerivation rec {
+    pname = "BigPEmu";
+    version = "1.17";
+    src = fetchurl {
+      url = "https://www.richwhitehouse.com/jaguar/builds/BigPEmu_Linux64_v${
+        builtins.replaceStrings [ "." ] [ "" ] version
+      }.tar.gz";
+      hash = "sha256-R5f3LD5RcGwdwcZqXGaCSFDyHaJrQ1ghS3kqVvBd38A=";
+    };
+
+    installPhase = ''
+      mkdir -p $out/bin
+      tar -xvf $src -C $out/bin --strip-components=1
+    '';
+
+    meta = {
+      description = "Atari Jaguar Emulator (BigPEmu) by Richard Whitehouse";
+      homepage = "https://www.richwhitehouse.com/jaguar/index.php";
+      license = lib.licenses.unfree;
+      maintainers = with lib.maintainers; [
+        tombert
+        hughobrien
+      ];
+      platforms = with lib.platforms; [ "x86_64-linux" ];
+    };
+  };
+in
+buildFHSEnv {
+  name = "bigpemu";
+  version = bigpemu-unwrapped.version;
+  targetPkgs = pkgs: [
+    glui
+    libGL
+    libGLU
+    SDL2
+  ];
+  runScript = "${bigpemu-unwrapped}/bin/bigpemu";
+  passthru = {
+    unwrapped = bigpemu-unwrapped;
+    updateScript = ./update.sh;
+  };
+}
--- a/pkgs/by-name/bi/bigpemu/update.sh
+++ b/pkgs/by-name/bi/bigpemu/update.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl pup common-updater-scripts
+set -eu -o pipefail
+page="https://www.richwhitehouse.com/jaguar/index.php?content=download"
+extractor='font:contains("Current Version") strong text{}'
+lastest_version="$(curl "$page" | pup "$extractor")"
+update-source-version \
+    --ignore-same-version \
+    bigpemu.unwrapped "$lastest_version"
--- a/pkgs/by-name/bu/bun/package.nix
+++ b/pkgs/by-name/bu/bun/package.nix
@@ -14,7 +14,7 @@
 }:

 stdenvNoCC.mkDerivation rec {
-  version = "1.1.42";
+  version = "1.1.43";
  pname = "bun";

  src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@@ -73,19 +73,19 @@ stdenvNoCC.mkDerivation rec {
    sources = {
      "aarch64-darwin" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-ZKcP4pC9Y5GgnVVdTk4ajfVlQ+UmuxOBqzRKOFNIVyw=";
+        hash = "sha256-3sbiB84OHnxm7bSAL6eu+EKeOUQZvWqlqCGuXDCuoBE=";
      };
      "aarch64-linux" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-AGZIRW0qjVCqYhPZr2WiUELOAfhAYDluXqo8mPeE3Rc=";
+        hash = "sha256-SjI5u1jhmsRMRDqpANuhqyz3YCCiWzz1XJxG5IZharM=";
      };
      "x86_64-darwin" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64-baseline.zip";
-        hash = "sha256-SLSVr8hUxjXZuqqcG9nlrdulSa9/rOnNffP781OP5Cw=";
+        hash = "sha256-q2vBAlBJ7FRowGje7F50MUdgDrOmeyG0xHYC1nRpETY=";
      };
      "x86_64-linux" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-NoIGwwONj6q8Y+MFnu6mTCr5xQ7Q37+4b2SYS6adsa8=";
+        hash = "sha256-j5iqhwkVV2R9wjxlwyBrFO6QLI4n0CA9qhIAstH6PCE=";
      };
    };
    updateScript = writeShellScript "update-bun" ''
--- a/pkgs/by-name/ca/cargo-chef/package.nix
+++ b/pkgs/by-name/ca/cargo-chef/package.nix
@@ -6,14 +6,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-chef";
-  version = "0.1.68";
+  version = "0.1.69";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-NTFrNSEIzHppwOOjI3VadjhdV6EgGUmJzyX5JmTsJoI=";
+    hash = "sha256-zDVolVllWl0DM0AByglKhU8JQpkdcmyVGe1vYo+eamk=";
  };

-  cargoHash = "sha256-DoIkK/tj3AYt0vm7u7f4SmgOKbdQZv3ZunMFT68+37E=";
+  cargoHash = "sha256-RyPomJJbI67izQMuKf6fBSbM6Ar9Wm4oHYqnOnP/b8U=";

  meta = with lib; {
    description = "Cargo-subcommand to speed up Rust Docker builds using Docker layer caching";
--- a/pkgs/by-name/ca/cargo-tauri/test-app.nix
+++ b/pkgs/by-name/ca/cargo-tauri/test-app.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
      src
      ;

-    hash = "sha256-jrp7epYWnfyqQbNL+XhrO4NvSTt2NOMd/icfbUYLvpA=";
+    hash = "sha256-vTjJz2t7ZrMQqOPjcWAoAl2tfKqJ0zgipegSpEvwJ9k=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/cb/cbmc/package.nix
+++ b/pkgs/by-name/cb/cbmc/package.nix
@@ -2,29 +2,28 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  testers,
  bison,
  cadical,
-  cbmc,
  cmake,
  flex,
  makeWrapper,
  perl,
  substituteAll,
  cudd,
-  fetchurl,
  nix-update-script,
+  fetchpatch,
+  versionCheckHook,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "cbmc";
-  version = "6.4.0";
+  version = "6.4.1";

  src = fetchFromGitHub {
    owner = "diffblue";
    repo = "cbmc";
    tag = "cbmc-${finalAttrs.version}";
-    hash = "sha256-PZZnseOE3nodE0zwyG+82gm55BO4rsCcP4T+fZq7L6I=";
+    hash = "sha256-O8aZTW+Eylshl9bmm9GzbljWB0+cj2liZHs2uScERkM=";
  };

  srcglucose = fetchFromGitHub {
@@ -47,16 +46,18 @@ stdenv.mkDerivation (finalAttrs: {
    makeWrapper
  ];

-  buildInputs = [ cadical ];
-
-  # do not download sources
-  # link existing cadical instead
  patches = [
    (substituteAll {
      src = ./0001-Do-not-download-sources-in-cmake.patch;
      inherit cudd;
    })
    ./0002-Do-not-download-sources-in-cmake.patch
+    # Fixes build with libc++ >= 19 due to the removal of std::char_traits<unsigned>.
+    # Remove for versions > 6.4.1.
+    (fetchpatch {
+      url = "https://github.com/diffblue/cbmc/commit/684bf4221c8737952e6469304f5a360dc3d5439d.patch";
+      hash = "sha256-3hHu6FcyHjfeFjNxhyhxxk7I/SK98BXT+xy7NgtEt50=";
+    })
  ];

  postPatch =
@@ -91,13 +92,13 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optionals stdenv.cc.isGNU [
-      # Needed with GCC 12 but breaks on darwin (with clang)
-      "-Wno-error=maybe-uninitialized"
-    ]
-    ++ lib.optionals stdenv.cc.isClang [
+    lib.optionals stdenv.cc.isClang [
      # fix "argument unused during compilation"
      "-Wno-unused-command-line-argument"
+      # fix "variable 'plus_overflow' set but not used"
+      "-Wno-error=unused-but-set-variable"
+      # fix "passing no argument for the '...' parameter of a variadic macro is a C++20 extension"
+      "-Wno-error=c++20-extensions"
    ]
  );

@@ -105,15 +106,21 @@ stdenv.mkDerivation (finalAttrs: {
  cmakeFlags = [
    "-DWITH_JBMC=OFF"
    "-Dsat_impl=cadical"
-    "-Dcadical_INCLUDE_DIR=${cadical.dev}/include"
  ];

-  passthru.tests.version = testers.testVersion {
-    package = cbmc;
-    command = "cbmc --version";
-  };
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/cbmc";
+  versionCheckProgramArg = "--version";

-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "cbmc-(.*)"
+    ];
+  };

  meta = {
    description = "CBMC is a Bounded Model Checker for C and C++ programs";
--- a/pkgs/by-name/de/dendrite/package.nix
+++ b/pkgs/by-name/de/dendrite/package.nix
@@ -11,16 +11,16 @@

 buildGoModule rec {
  pname = "matrix-dendrite";
-  version = "0.13.8";
+  version = "0.14.0";

  src = fetchFromGitHub {
-    owner = "matrix-org";
+    owner = "element-hq";
    repo = "dendrite";
    rev = "v${version}";
-    hash = "sha256-zUpZdG2cdZ95L70qLG2HaUlD+G66XTi4f1V4+ZZAh30=";
+    hash = "sha256-B8ODjhL2XuAkTjggqr7re3oJohDnq1mWgms5bZFV/AI=";
  };

-  vendorHash = "sha256-rGOB1ikY3BgChvD1YZUF66g8P6gE29b/k9kxvHR0+WQ=";
+  vendorHash = "sha256-vLdSOSxIvfiVZfM7nRnKNwiklxHBSG7KybC35k4GcaQ=";

  subPackages = [
    # The server
@@ -66,10 +66,10 @@ buildGoModule rec {
  };

  meta = with lib; {
-    homepage = "https://matrix-org.github.io/dendrite";
+    homepage = "https://element-hq.github.io/dendrite";
    description = "Second-generation Matrix homeserver written in Go";
-    changelog = "https://github.com/matrix-org/dendrite/releases/tag/v${version}";
-    license = licenses.asl20;
+    changelog = "https://github.com/element-hq/dendrite/releases/tag/v${version}";
+    license = licenses.agpl3Plus;
    maintainers = teams.matrix.members;
    platforms = platforms.unix;
  };
--- a/pkgs/by-name/di/dinit/package.nix
+++ b/pkgs/by-name/di/dinit/package.nix
@@ -15,7 +15,11 @@ stdenv.mkDerivation rec {
    owner = "davmac314";
    repo = "dinit";
    rev = "v${version}";
-    hash = "sha256-AgUfU8cKAumICwLg2LvcSiS3YCP5I687Po3vj+ZOSSQ=";
+    # fix for case-insensitive filesystems
+    postFetch = ''
+      [ -f "$out/BUILD" ] && rm "$out/BUILD"
+    '';
+    hash = "sha256-KW75uB9cJY+nKcD6hapjisLGvi2NcfwaDR7/Zw3/YrE=";
  };

  postPatch = ''
--- a/pkgs/by-name/do/docker-slim/package.nix
+++ b/pkgs/by-name/do/docker-slim/package.nix
@@ -18,6 +18,8 @@ buildGoModule rec {

  vendorHash = null;

+  env.CGO_ENABLED = 0;
+
  subPackages = [
    "cmd/slim"
    "cmd/slim-sensor"
--- a/pkgs/by-name/fl/flaresolverr/package.nix
+++ b/pkgs/by-name/fl/flaresolverr/package.nix
@@ -79,5 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
    mainProgram = "flaresolverr";
    maintainers = with maintainers; [ paveloom ];
    inherit (undetected-chromedriver.meta) platforms;
+    # See https://github.com/NixOS/nixpkgs/issues/332776
+    broken = true;
  };
 })
--- a/pkgs/by-name/gh/gh-markdown-preview/package.nix
+++ b/pkgs/by-name/gh/gh-markdown-preview/package.nix
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "gh-markdown-preview";
-  version = "1.8.0";
+  version = "1.9.0";

  src = fetchFromGitHub {
    owner = "yusukebe";
    repo = "gh-markdown-preview";
    rev = "v${version}";
-    hash = "sha256-y9AiHmBfDSJ6oCevUAUkg18qHe/oP7A6PLiz3MZqU0s=";
+    hash = "sha256-qvR23dXj+ERf5yhVbsJ3XcdePaAwuDvdya1zr5wtNsQ=";
  };

  vendorHash = "sha256-O6Q9h5zcYAoKLjuzGu7f7UZY0Y5rL2INqFyJT2QZJ/E=";
--- a/pkgs/by-name/gi/git-mit/package.nix
+++ b/pkgs/by-name/gi/git-mit/package.nix
@@ -10,7 +10,7 @@
 }:

 let
-  version = "5.14.2";
+  version = "5.14.3";
 in
 rustPlatform.buildRustPackage {
  pname = "git-mit";
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
    owner = "PurpleBooth";
    repo = "git-mit";
    rev = "v${version}";
-    hash = "sha256-5x+Sw1Lgi8x/8+neokPSIxq/PuuvUNt4KZ/fE8EdKQI=";
+    hash = "sha256-+7rl4wxVQq4bLBsnLSeJD+1kkRuf7FCi81pXGrNNOPI=";
  };

-  cargoHash = "sha256-MLSJiEZDbHcbUACuJASDuygND+ZN36rSeo4AtbsxnqA=";
+  cargoHash = "sha256-44Eo3ewjJj+JLnGfqm3Zb4v4qKklC23pFyJSGcKE8q8=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/go/gobgpd/package.nix
+++ b/pkgs/by-name/go/gobgpd/package.nix
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "gobgpd";
-  version = "3.32.0";
+  version = "3.33.0";

  src = fetchFromGitHub {
    owner = "osrg";
    repo = "gobgp";
    tag = "v${version}";
-    hash = "sha256-DIOii1jFVK3jwDLaLFWBbbQPC9eQnTwLYwI8uC8G8ig=";
+    hash = "sha256-Q1wwRCxFe3bX3EMiDExxKSafJkLptbX69ZMW0faK8Bg=";
  };

  vendorHash = "sha256-FYLH1Ej8Bm0+tS5Ikj1CPF+1t5opmzee8iHRZSW94Yk=";
--- a/pkgs/by-name/he/helm-ls/package.nix
+++ b/pkgs/by-name/he/helm-ls/package.nix
@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "helm-ls";
-  version = "0.1.0";
+  version = "0.1.1";

  src = fetchFromGitHub {
    owner = "mrjosh";
    repo = "helm-ls";
    rev = "v${version}";
-    hash = "sha256-EuZbbeRssacrctIbxBbd2GOh8zgFi2OBRregfC88se0=";
+    hash = "sha256-pf/gC0jIrJUfU//uj+CGkUsNDVFeS6Wm4kx3Di9wpVI=";
  };

-  vendorHash = "sha256-AWKCE2BZGVYcr6Pe8URQo11Xnr3sfgWWkm9v7vvILOo=";
+  vendorHash = "sha256-VAxmMDZIbbcGHoRL06oqWkDnWZBuweKyoCLSqItWHyg=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/ia/ianny/package.nix
+++ b/pkgs/by-name/ia/ianny/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "ianny";
-  version = "1.0.0";
+  version = "2.0.0";

  src = fetchFromGitHub {
    owner = "zefr0x";
    repo = "ianny";
    rev = "v${version}";
-    hash = "sha256-1QkGs4qCzEA4K3H39QcRV+yINIeZRkjBBkASO69F7ik=";
+    hash = "sha256-F8Uc2BsQ5f7yaUXXDhLvyyYKUDAuvP9cCR2h3vblr0g=";
  };

-  cargoHash = "sha256-gKCmiqHkCB7nP5XIaFi/8Wi/x5WFEHEmHczKiIDDxXE=";
+  cargoHash = "sha256-b3B1LMa3gIL2xF9GL7jLXagesC9FEQHb8drocgx2MqY=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ dbus.dev ];
--- a/pkgs/by-name/im/impl/package.nix
+++ b/pkgs/by-name/im/impl/package.nix
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "impl";
-  version = "1.3.0";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "josharian";
    repo = "impl";
    rev = "v${version}";
-    hash = "sha256-a9jAoZp/wVnTyaE4l2yWSf5aSxXEtqN6SoxU68XhRhk=";
+    hash = "sha256-0TSyg7YEPur+h0tkDxI3twr2PzT7tmo3shKgmSSJ6qk=";
  };

  vendorHash = "sha256-vTqDoM/LK5SHkayLKYig+tCrXLelOoILmQGCxlTWHog=";
--- a/pkgs/by-name/in/interactsh/package.nix
+++ b/pkgs/by-name/in/interactsh/package.nix
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "interactsh";
-  version = "1.2.2";
+  version = "1.2.3";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = pname;
    tag = "v${version}";
-    hash = "sha256-aPjeP9Js2lpJBiWYTpJjKo445wSkNcatszBZMutIIR0=";
+    hash = "sha256-ugrcGOlVRPTWhIX6Bpzl9iVydiVY5BWN3yNK/CaZS6A=";
  };

-  vendorHash = "sha256-SYs04LgWy6Fd9SUAxs4tB+VK2CK3gqb7fDYkp16i67Q=";
+  vendorHash = "sha256-HgYaSjg4oFNOTOiUd2YXpdUWdpKqJFF5KDejxp0J4cU=";

  modRoot = ".";
  subPackages = [
--- a/pkgs/by-name/ki/kitex/package.nix
+++ b/pkgs/by-name/ki/kitex/package.nix
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "kitex";
-  version = "0.12.0";
+  version = "0.12.1";

  src = fetchFromGitHub {
    owner = "cloudwego";
    repo = "kitex";
    rev = "v${version}";
-    hash = "sha256-tCZHDdDwMgZVGeARNfBC3/vQHNN5chKt607R6htx8HI=";
+    hash = "sha256-UK+zGMtIZRoITxLrqmPd5mk3FwjjzOLH2Zpke89XgU4=";
  };

-  vendorHash = "sha256-OkCCrdEiq63JTATlsMF3lwZ4JjYIwKOHAz2fqDj64Do=";
+  vendorHash = "sha256-dbw4SRYCGlBJCwjcGGVi3u6dkNcXLw9l8EnXPw727cI=";

  subPackages = [ "tool/cmd/kitex" ];

--- a/pkgs/by-name/li/libpointmatcher/package.nix
+++ b/pkgs/by-name/li/libpointmatcher/package.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "libpointmatcher";
-  version = "1.4.3";
+  version = "1.4.4";

  src = fetchFromGitHub {
    owner = "norlab-ulaval";
    repo = "libpointmatcher";
    rev = version;
-    hash = "sha256-ewsU3aCFPeem1pJpqKaceMhL7SwTYOaYlcwOfMxwkSs=";
+    hash = "sha256-OkfWdim0JDKiBx5spYpkMyFrLQP3AMWBVDpzmFwqNFM=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/li/librashader/package.nix
+++ b/pkgs/by-name/li/librashader/package.nix
@@ -0,0 +1,70 @@
+{
+  fetchFromGitHub,
+  lib,
+  rustPlatform,
+  stdenv,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "librashader";
+  version = "0.6.2";
+
+  src = fetchFromGitHub {
+    owner = "SnowflakePowered";
+    repo = "librashader";
+    rev = "librashader-v0.6.2";
+    hash = "sha256-zkvCpQ5Cq3sDOspc12/gPmNi6hn/nBe1UfWrMGi/o0Q=";
+  };
+
+  patches = [
+    ./patches/fix-optional-dep-syntax.patch
+  ];
+
+  cargoHash = "sha256-eUZOFdbOPs81LAMEV4i6eYRN8NYVcnmble/L+ptx2EA=";
+
+  RUSTC_BOOTSTRAP = 1;
+
+  buildPhase = ''
+    runHook preBuild
+    cargo run -p librashader-build-script -- --profile optimized
+    runHook postBuild
+  '';
+
+  doCheck = false;
+
+  installPhase =
+    ''
+      runHook preInstall
+      cd target/optimized
+      mkdir -p $out/lib $out/include/librashader
+    ''
+    + (
+      if stdenv.hostPlatform.isDarwin then
+        ''
+          install_name_tool -id $out/lib/librashader.dylib librashader.dylib
+          install -m755 librashader.dylib $out/lib/librashader.dylib
+        ''
+      else
+        ''
+          patchelf --set-soname librashader.so.2 librashader.so
+          install -m755 librashader.so $out/lib/librashader.so.2
+          ln -s $out/lib/librashader.so.2 $out/lib/librashader.so
+        ''
+    )
+    + ''
+      install -m644 librashader.h -t $out/include/librashader
+      install -m644 ../../include/librashader_ld.h -t $out/include/librashader
+      runHook postInstall
+    '';
+
+  meta = {
+    description = "RetroArch Shaders for All";
+    homepage = "https://github.com/SnowflakePowered/librashader";
+    license = with lib.licenses; [
+      mpl20
+      gpl3Only
+    ];
+    maintainers = with lib.maintainers; [ nadiaholmquist ];
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/by-name/li/librashader/patches/fix-optional-dep-syntax.patch
+++ b/pkgs/by-name/li/librashader/patches/fix-optional-dep-syntax.patch
@@ -0,0 +1,31 @@
+diff --git a/librashader-capi/Cargo.toml b/librashader-capi/Cargo.toml
+index 4a103ab7..38971ddb 100644
+--- a/librashader-capi/Cargo.toml
+++ b/librashader-capi/Cargo.toml
+@@ -17,12 +17,12 @@ crate-type = [ "cdylib", "staticlib" ]
+ [features]
+ default = ["runtime-all" ]
+ runtime-all = ["runtime-opengl", "runtime-d3d9", "runtime-d3d11", "runtime-d3d12", "runtime-vulkan", "runtime-metal"]
+-runtime-opengl = ["glow", "librashader/runtime-gl"]
+-runtime-d3d11 = ["windows", "librashader/runtime-d3d11", "windows/Win32_Graphics_Direct3D11"]
+-runtime-d3d12 = ["windows", "librashader/runtime-d3d12", "windows/Win32_Graphics_Direct3D12"]
+-runtime-d3d9 = ["windows", "librashader/runtime-d3d9", "windows/Win32_Graphics_Direct3D9"]
+runtime-opengl = ["dep:glow", "librashader/runtime-gl"]
+runtime-d3d11 = ["dep:windows", "librashader/runtime-d3d11", "windows/Win32_Graphics_Direct3D11"]
+runtime-d3d12 = ["dep:windows", "librashader/runtime-d3d12", "windows/Win32_Graphics_Direct3D12"]
+runtime-d3d9 = ["dep:windows", "librashader/runtime-d3d9", "windows/Win32_Graphics_Direct3D9"]
+ 
+-runtime-vulkan = ["ash", "librashader/runtime-vk"]
+runtime-vulkan = ["dep:ash", "librashader/runtime-vk"]
+ runtime-metal = ["__cbindgen_internal_objc", "librashader/runtime-metal"]
+ 
+ reflect-unstable = []
+@@ -33,7 +33,7 @@ __cbindgen_internal = ["runtime-all"]
+ 
+ # make runtime-metal depend on this, so its automatically implied.
+ # this will make cbindgen generate __OBJC__ ifdefs for metal functions.
+-__cbindgen_internal_objc = ["objc2-metal", "objc2"]
+__cbindgen_internal_objc = ["dep:objc2-metal", "dep:objc2"]
+ 
+ [dependencies]
+ thiserror = "2"
--- a/pkgs/by-name/li/licensure/package.nix
+++ b/pkgs/by-name/li/licensure/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "licensure";
-  version = "0.5.1";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "chasinglogic";
    repo = "licensure";
    rev = version;
-    hash = "sha256-bo1bac/K8HMZaeLVYZRqYOS8p+62suGlgSyYz8Atj+0=";
+    hash = "sha256-YPdVVHJ/ldILGbg95x7D06chG8Q6a+NnTAimuvBScpE=";
  };

-  cargoHash = "sha256-Ywfn+6qdKD9CG2/xdHR2XDsj5LF5XPJ2+XR5H1o2iXk=";
+  cargoHash = "sha256-Vam66mHnDuyVfrbi897DCDmoF812YeGG0KtSYzHrteY=";
  nativeBuildInputs = [ pkg-config ];
  buildInputs =
    [
--- a/pkgs/by-name/lz/lziprecover/package.nix
+++ b/pkgs/by-name/lz/lziprecover/package.nix
@@ -5,13 +5,14 @@
  lzip,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "lziprecover";
-  version = "1.24";
+  version = "1.25";

  src = fetchurl {
-    url = "mirror://savannah/lzip/lziprecover/${pname}-${version}.tar.gz";
-    sha256 = "sha256-HWmc+u/pLrJiSjZSWAvK/gu7mP54GMJebegjvN0NRY8=";
+    url = "mirror://savannah/lzip/lziprecover/lziprecover-${finalAttrs.version}.tar.gz";
+    sha256 = "4f392f9c780ae266ee3d0db166b0f1b4d3ae07076e401dc2b199dc3a0fff8b45";
+    # This hash taken from the mailing list announcement.
  };

  configureFlags = [
@@ -26,12 +27,15 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  meta = with lib; {
+  meta = {
    homepage = "https://www.nongnu.org/lzip/lziprecover.html";
    description = "Data recovery tool for lzip compressed files";
    license = lib.licenses.gpl2Plus;
-    maintainers = with maintainers; [ vlaci ];
+    maintainers = with lib.maintainers; [
+      vlaci
+      ehmry
+    ];
    platforms = lib.platforms.all;
    mainProgram = "lziprecover";
  };
-}
+})
--- a/pkgs/by-name/ma/magic-wormhole-rs/package.nix
+++ b/pkgs/by-name/ma/magic-wormhole-rs/package.nix
@@ -8,16 +8,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "magic-wormhole-rs";
-  version = "0.7.4";
+  version = "0.7.5";

  src = fetchFromGitHub {
    owner = "magic-wormhole";
    repo = "magic-wormhole.rs";
    rev = version;
-    sha256 = "sha256-cPFstE442xuNnW8PQZ8y+0sXTaWk3QYjTn3HG+zWzY0=";
+    sha256 = "sha256-wah3Mkw3oFUx4rD6OkLvYyHsz6Z8pFFPhKlc0D7gIQA=";
  };

-  cargoHash = "sha256-+OcjILDwGg0eybzBgVIZeVelnQatPU6rgd/b6buvTRQ=";
+  cargoHash = "sha256-iAwlaEfegM2uo728kUhh7GhfponqmZ48ri6iUyRVRUI=";

  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ libxcb ];

--- a/pkgs/by-name/mc/mcrl2/package.nix
+++ b/pkgs/by-name/mc/mcrl2/package.nix
@@ -5,25 +5,25 @@
  cmake,
  libGLU,
  libGL,
-  qt5,
+  qt6,
  boost,
 }:

 stdenv.mkDerivation rec {
-  version = "202307";
+  version = "202407";
  build_nr = "1";
  pname = "mcrl2";

  src = fetchurl {
    url = "https://www.mcrl2.org/download/release/mcrl2-${version}.${build_nr}.tar.gz";
-    hash = "sha256-zCHCO8tGyOxqUc0x3t/N3dUh4eG7slemlgK/QZsA4JA=";
+    hash = "sha256-VhP9BFSujxYMcQVu6P6k6yiH2UUhCB3P+Pj+9Ir7x6s=";
  };

  nativeBuildInputs = [ cmake ];
  buildInputs = [
    libGLU
    libGL
-    qt5.qtbase
+    qt6.qtbase
    boost
  ];

--- a/pkgs/by-name/my/mympd/package.nix
+++ b/pkgs/by-name/my/mympd/package.nix
@@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mympd";
-  version = "19.0.2";
+  version = "19.0.3";

  src = fetchFromGitHub {
    owner = "jcorporation";
    repo = "myMPD";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-44aorX4i+/kwWMIlM1Z+I81PT+Udjk0llg706eVKONY=";
+    sha256 = "sha256-aNb/zM/KF46XDV0GjQfm2XvkbToJZf6ZdwK1E1ShA+o=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/n2/n2048/package.nix
+++ b/pkgs/by-name/n2/n2048/package.nix
@@ -5,28 +5,39 @@
  ncurses,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "n2048";
  version = "0.1";
+
  src = fetchurl {
-    url = "http://www.dettus.net/n2048/n2048_v${version}.tar.gz";
-    sha256 = "184z2rr0rnj4p740qb4mzqr6kgd76ynb5gw9bj8hrfshcxdcg1kk";
+    url = "http://www.dettus.net/n2048/n2048_v${finalAttrs.version}.tar.gz";
+    hash = "sha256-c4bHWmdQuwyRXIm/sqw3p71pMv6VLAzIuUTaDHIWn6A=";
  };
+
+  env = {
+    NIX_CFLAGS_COMPILE = toString [
+      "-Wno-error=implicit-function-declaration"
+    ];
+  };
+
  buildInputs = [
    ncurses
  ];
+
  makeFlags = [
    "DESTDIR=$(out)"
  ];
+
  preInstall = ''
    mkdir -p "$out"/{share/man,bin}
  '';
-  meta = with lib; {
+
+  meta = {
    description = "Console implementation of 2048 game";
    mainProgram = "n2048";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [ raskin ];
-    platforms = platforms.linux;
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ raskin ];
+    platforms = lib.platforms.linux;
    homepage = "http://www.dettus.net/n2048/";
  };
-}
+})
--- a/pkgs/by-name/nf/nfpm/package.nix
+++ b/pkgs/by-name/nf/nfpm/package.nix
@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "nfpm";
-  version = "2.41.1";
+  version = "2.41.2";

  src = fetchFromGitHub {
    owner = "goreleaser";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-/me2qMOaZ0QQ1wUrMs8T/CZ5t3tL25eVYlpoWSzCJhM=";
+    hash = "sha256-anEKmMFB4szA6xdwzU2vtJO8rH4i8TCF+kiOOv8kBHs=";
  };

-  vendorHash = "sha256-dGVfWKnlZxVdqgZSIRrEWmqSf360J/LKkyiMkKJ88ro=";
+  vendorHash = "sha256-xtfqHeWaLMxH5paFBsbiSCVd/po9c3yy0INuy1F7Yds=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/init.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/init.py
@@ -38,7 +38,7 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa

    common_build_flags = argparse.ArgumentParser(add_help=False)
    common_build_flags.add_argument("--builders")
-    common_build_flags.add_argument("--include", "-I")
+    common_build_flags.add_argument("--include", "-I", action="append")
    common_build_flags.add_argument("--quiet", action="store_true")
    common_build_flags.add_argument("--print-build-logs", "-L", action="store_true")
    common_build_flags.add_argument("--show-trace", action="store_true")
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
@@ -43,8 +43,8 @@ def dict_to_flags(d: Args | None) -> list[str]:
                flags.append(flag)
                flags.append(value)
            case list():
-                flags.append(flag)
                for v in value:
+                    flags.append(flag)
                    flags.append(v)
            case _:
                assert_never(value)
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -150,6 +150,55 @@ def test_execute_nix_boot(mock_run: Any, tmp_path: Path) -> None:
    )


+@patch.dict(nr.process.os.environ, {}, clear=True)
+@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
+def test_execute_nix_build_vm(mock_run: Any, tmp_path: Path) -> None:
+    config_path = tmp_path / "test"
+    config_path.touch()
+
+    def run_side_effect(args: list[str], **kwargs: Any) -> CompletedProcess[str]:
+        if args[0] == "nix-build":
+            return CompletedProcess([], 0, str(config_path))
+        else:
+            return CompletedProcess([], 0)
+
+    mock_run.side_effect = run_side_effect
+
+    nr.execute(
+        [
+            "nixos-rebuild",
+            "build-vm",
+            "--no-flake",
+            "-I",
+            "nixos-config=./configuration.nix",
+            "-I",
+            "nixpkgs=$HOME/.nix-defexpr/channels/pinned_nixpkgs",
+            "--fast",
+        ]
+    )
+
+    assert mock_run.call_count == 1
+    mock_run.assert_has_calls(
+        [
+            call(
+                [
+                    "nix-build",
+                    "<nixpkgs/nixos>",
+                    "--attr",
+                    "config.system.build.vm",
+                    "--include",
+                    "nixos-config=./configuration.nix",
+                    "--include",
+                    "nixpkgs=$HOME/.nix-defexpr/channels/pinned_nixpkgs",
+                ],
+                check=True,
+                stdout=PIPE,
+                **DEFAULT_RUN_KWARGS,
+            )
+        ]
+    )
+
+
@patch.dict(nr.process.os.environ, {}, clear=True)
@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
 def test_execute_nix_build_image_flake(mock_run: Any, tmp_path: Path) -> None:
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py
@@ -23,6 +23,7 @@ def test_dict_to_flags() -> None:
        "value",
        "--test-flag-4",
        "v1",
+        "--test-flag-4",
        "v2",
        "-t",
        "-vvvvv",
--- a/pkgs/by-name/nw/nwg-dock-hyprland/package.nix
+++ b/pkgs/by-name/nw/nwg-dock-hyprland/package.nix
@@ -10,7 +10,7 @@

 buildGoModule rec {
  pname = "nwg-dock-hyprland";
-  version = "0.4.0";
+  version = "0.4.2";

  src = fetchFromGitHub {
    owner = "nwg-piotr";
--- a/pkgs/by-name/op/open-in-mpv/package.nix
+++ b/pkgs/by-name/op/open-in-mpv/package.nix
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "open-in-mpv";
-  version = "2.4.2";
+  version = "2.4.3";

  src = fetchFromGitHub {
    owner = "Baldomo";
    repo = "open-in-mpv";
    rev = "v${version}";
-    hash = "sha256-5Hu/BXUMI8CSOvE09I0YXfQ6BuIRA37yLlSTqWrrqy0=";
+    hash = "sha256-mr1c2L5D1v+4VoPA4i5q7/RCdWLLZ1UfTGayiG5Nm6M=";
  };

  vendorHash = "sha256-G6GZO2+CfEAYcf7zBcqDa808A0eJjM8dq7+4VGZ+P4c=";
--- a/pkgs/by-name/pa/patchy/package.nix
+++ b/pkgs/by-name/pa/patchy/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  nix-update-script,
+  versionCheckHook,
+}:
+let
+  version = "1.2.7";
+in
+rustPlatform.buildRustPackage {
+  pname = "patchy";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "nik-rev";
+    repo = "patchy";
+    tag = "v${version}";
+    hash = "sha256-Npb+qcguxZAvWggJC5NtxCeUCU/nOtjCbK5gfkDTkfw=";
+  };
+  cargoHash = "sha256-vtKIDmfKSSZjorIGQ13OYrdmzabS5//j2/n7kJC9O7k=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Makes it easy to maintain personal forks";
+    longDescription = ''
+      Patchy makes it easy to declaratively manage personal forks by
+      automatically merging pull request of your liking to have more
+      features.
+    '';
+    homepage = "https://github.com/nik-rev/patchy";
+    changelog = "https://github.com/nik-rev/patchy/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    mainProgram = "patchy";
+    maintainers = with lib.maintainers; [ louis-thevenet ];
+  };
+}
--- a/pkgs/by-name/pi/pinentry-rofi/package.nix
+++ b/pkgs/by-name/pi/pinentry-rofi/package.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    autoconf-archive
    autoreconfHook
+    guile
    pkg-config
    texinfo
    makeWrapper
--- a/pkgs/by-name/re/remind/package.nix
+++ b/pkgs/by-name/re/remind/package.nix
@@ -40,6 +40,8 @@ tcl.mkTclDerivation rec {
      --replace-fail 'set Remind "remind"' "set Remind \"$out/bin/remind\"" \
      --replace-fail 'set Rem2PS "rem2ps"' "set Rem2PS \"$out/bin/rem2ps\"" \
      --replace-fail 'set Rem2PDF "rem2pdf"' "set Rem2PDF \"$out/bin/rem2pdf\""
+    substituteInPlace configure \
+      --replace-fail 'f=-ffat-lto-objects' ""
  '';

  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin (toString [
--- a/pkgs/by-name/re/remnote/package.nix
+++ b/pkgs/by-name/re/remnote/package.nix
@@ -6,10 +6,10 @@
 }:
 let
  pname = "remnote";
-  version = "1.18.26";
+  version = "1.18.28";
  src = fetchurl {
    url = "https://download2.remnote.io/remnote-desktop2/RemNote-${version}.AppImage";
-    hash = "sha256-G7I2r/jZ3Ht8Is2TagNnyQolasfLlO57qzGcVT4QvkI=";
+    hash = "sha256-ixKZwwqk93pc8N+DJe2H7oyjf0+u7kQRDRFOm2VbJZs=";
  };
  appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in
--- a/pkgs/by-name/re/resolve-march-native/package.nix
+++ b/pkgs/by-name/re/resolve-march-native/package.nix
@@ -7,13 +7,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "resolve-march-native";
-  version = "5.1.0";
+  version = "6.0.1";

  src = fetchFromGitHub {
    owner = "hartwork";
    repo = pname;
    tag = version;
-    hash = "sha256-02d7ip5E/vkOMkkeHOx1m7FdpurXT9O6HdwrygNPHdY=";
+    hash = "sha256-YJvKLHxn80RRVEOGeg9BwxhDZ8Hhg5Qa6ryLOXumY5w=";
  };

  # NB: The tool uses gcc at runtime to resolve the -march=native flags
--- a/pkgs/by-name/rq/rqlite/package.nix
+++ b/pkgs/by-name/rq/rqlite/package.nix
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "rqlite";
-  version = "8.36.3";
+  version = "8.36.5";

  src = fetchFromGitHub {
    owner = "rqlite";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Q5taKIs3kjB1KrIxRO27/sbhamta9ljO+btghJ+M5zE=";
+    sha256 = "sha256-T5pyec+sS3hBlQTUevIP3v8vlxZEFMSFN7doJliTUCg=";
  };

-  vendorHash = "sha256-lMDE8M8O6HIJE585OaI1islvffVHncr5CwLoVVSCOh4=";
+  vendorHash = "sha256-+otWcVUAqO2e9v+4T5QTw2DOVfDUGu6hP/1/6LO21nY=";

  subPackages = [
    "cmd/rqlite"
--- a/pkgs/by-name/sq/squeezelite/package.nix
+++ b/pkgs/by-name/sq/squeezelite/package.nix
@@ -40,13 +40,13 @@ stdenv.mkDerivation {
  pname = binName;
  # versions are specified in `squeezelite.h`
  # see https://github.com/ralph-irving/squeezelite/issues/29
-  version = "2.0.0.1517";
+  version = "2.0.0.1518";

  src = fetchFromGitHub {
    owner = "ralph-irving";
    repo = "squeezelite";
-    rev = "262994a989dc29ce3be4390c57c6a43373dfdca2";
-    hash = "sha256-QmjjVbE5lQhKMt2Loq7wPV16phcEUUcdiNGdmImkoAI=";
+    rev = "ed3c82052db4846e8e0da01c5bf8db130db00dee";
+    hash = "sha256-nxEsraKV5OPaeRuN2NRvxGtUb189ArP3blxSOMPD2II=";
  };

  buildInputs =
--- a/pkgs/by-name/st/strongswan/package.nix
+++ b/pkgs/by-name/st/strongswan/package.nix
@@ -49,7 +49,9 @@ stdenv.mkDerivation rec {
    '';

  configureFlags =
-    [ "--enable-swanctl"
+    [
+      "--sysconfdir=/etc"
+      "--enable-swanctl"
      "--enable-cmd"
      "--enable-openssl"
      "--enable-eap-sim" "--enable-eap-sim-file" "--enable-eap-simaka-pseudonym"
@@ -93,10 +95,9 @@ stdenv.mkDerivation rec {
      "--disable-scripts"
    ];

-  postInstall = ''
-    # this is needed for l2tp
-    echo "include /etc/ipsec.secrets" >> $out/etc/ipsec.secrets
-  '';
+  installFlags = [
+    "sysconfdir=${placeholder "out"}/etc"
+  ];

  NIX_LDFLAGS = lib.optionalString stdenv.cc.isGNU "-lgcc_s" ;

--- a/pkgs/by-name/st/stu/package.nix
+++ b/pkgs/by-name/st/stu/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "stu";
-  version = "0.6.5";
+  version = "0.6.6";

  src = fetchFromGitHub {
    owner = "lusingander";
    repo = "stu";
    rev = "v${version}";
-    hash = "sha256-GqeKb3Fu0MkM98AGDOEuO3zbzSHOWQFiamCSgMk4xBI=";
+    hash = "sha256-an/FNDwtP8EKPwuhu/Dkqj5hZym6wpySEfr66C21pvw=";
  };

-  cargoHash = "sha256-fK7eHNUKAE6FykHllnIe0vNEEzeykpqvnM29KBn4l2I=";
+  cargoHash = "sha256-qZG+3Wh3R8LRvSQR5RQ1ZwAbk8s1mxg10P5I9clcMSo=";

  passthru.tests.version = testers.testVersion { package = stu; };

--- a/pkgs/by-name/ta/tangara-companion/package.nix
+++ b/pkgs/by-name/ta/tangara-companion/package.nix
@@ -0,0 +1,79 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+
+  copyDesktopItems,
+  makeDesktopItem,
+
+  gdk-pixbuf,
+  glib,
+  graphene,
+  gtk4,
+  libadwaita,
+  pango,
+  pkg-config,
+  udev,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "tangara-companion";
+  version = "0.4.3";
+
+  src = fetchFromGitHub {
+    owner = "haileys";
+    repo = pname;
+    tag = "v${version}";
+    hash = "sha256-pTE+xlXWIOOt1oiKosnbXTCLYoAqP3CfXA283a//Ds0=";
+  };
+
+  useFetchCargoVendor = true;
+
+  cargoHash = "sha256-C7Q3Oo/aBBH6pW1zSFQ2nD07+wu8uXfRSwNif2pVlW0=";
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    glib
+    pkg-config
+  ];
+
+  buildInputs = [
+    gdk-pixbuf
+    glib
+    graphene
+    gtk4
+    libadwaita
+    pango
+    udev
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      desktopName = "Tangara Companion";
+      comment = meta.description;
+      type = "Application";
+      exec = meta.mainProgram;
+      terminal = false;
+      categories = [
+        "Utility"
+        "GTK"
+      ];
+      icon = "tangara-companion";
+      startupNotify = true;
+    })
+  ];
+
+  postInstall = ''
+    install -Dm644 $src/data/assets/icon.svg $out/share/icons/hicolor/scalable/apps/tangara-companion.svg
+  '';
+
+  meta = {
+    description = "Companion app for Cool Tech Zone Tangara";
+    mainProgram = "tangara-companion";
+    homepage = "https://github.com/haileys/tangara-companion";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ benpye ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/ta/taterclient-ddnet/package.nix
+++ b/pkgs/by-name/ta/taterclient-ddnet/package.nix
@@ -34,18 +34,18 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "taterclient-ddnet";
-  version = "10.0.1";
+  version = "10.0.3";

  src = fetchFromGitHub {
    owner = "sjrc6";
    repo = "taterclient-ddnet";
    tag = "V${finalAttrs.version}";
-    hash = "sha256-mYT/njNzMwGOFKcWZMGOpS0DMu7Wy07nBP4wGpDi4Fc=";
+    hash = "sha256-RhOZuPsjyXq5UcM+5dawDi1BfjMMQ3K9O3PHkCg5sDI=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit (finalAttrs) pname src version;
-    hash = "sha256-aJmdh9OthB2OyrFdxkq4xjLBphA7nn3JVmcNdJZ4pZ8=";
+    hash = "sha256-NDeHpf1iYApP/Y/DE7FGBu67ld6A0+8227oTVlOMe1M=";
  };

  nativeBuildInputs = [
@@ -94,6 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeBool "CLIENT" true)
    (lib.cmakeBool "SERVER" false)
    (lib.cmakeBool "TOOLS" false)
+    (lib.cmakeBool "DISCORD" false)
    (lib.cmakeFeature "CLIENT_EXECUTABLE" clientExecutable)
  ];

--- a/pkgs/by-name/ts/tsukimi/package.nix
+++ b/pkgs/by-name/ts/tsukimi/package.nix
@@ -15,18 +15,18 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "tsukimi";
-  version = "0.18.2";
+  version = "0.18.3";

  src = fetchFromGitHub {
    owner = "tsukinaha";
    repo = "tsukimi";
    tag = "v${version}";
-    hash = "sha256-5c/Rfiz9CkBasfWTCviC3HnWKkMVOEWoaMvsZyQN/iw=";
+    hash = "sha256-MbGWPvCq4nzrp8ArXud9A+6uPcnbxs42M2QwjZxUn5w=";
    fetchSubmodules = true;
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-KvyF10kP/zRpgNdy+lLkgUgqiu075QvezYklMbkVvxQ=";
+  cargoHash = "sha256-59JakfFFM4Tpi1J3ja0aDhC5oty/0QKNLcU58nRewTg=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/tt/tty-share/package.nix
+++ b/pkgs/by-name/tt/tty-share/package.nix
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "tty-share";
-  version = "2.4.0";
+  version = "2.4.1";

  src = fetchFromGitHub {
    owner = "elisescu";
    repo = "tty-share";
    rev = "v${version}";
-    sha256 = "sha256-7rNSBpiZslUGWw0P/Q1zRtNxo9MN8Vq6hG8pD6bJIsA=";
+    sha256 = "sha256-+Bh39WtzReOmHcvpGbNfEdBqw7ZL9Vhxu5d337CMc/M=";
  };

  # Upstream has a `./vendor` directory with all deps which we rely upon.
--- a/pkgs/by-name/ua/uacme/package.nix
+++ b/pkgs/by-name/ua/uacme/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "uacme";
-  version = "1.7.5";
+  version = "1.7.6";

  src = fetchFromGitHub {
    owner = "ndilieto";
    repo = "uacme";
    rev = "v${version}";
-    hash = "sha256-MaPMNAUuQmJAbl7qBqNCkzW4k6nkibezEMRaCho5I68=";
+    hash = "sha256-he0k4o/5JGFDxLrHBO6PNtRgKUzIkGby96cSz0ymuRs=";
  };

  configureFlags = [ "--with-openssl" ];
--- a/pkgs/by-name/un/unpoller/package.nix
+++ b/pkgs/by-name/un/unpoller/package.nix
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "unpoller";
-  version = "2.11.2";
+  version = "2.14.0";

  src = fetchFromGitHub {
    owner = "unpoller";
    repo = "unpoller";
    rev = "v${version}";
-    hash = "sha256-/X2hCtF38X0twHsHSjpf23Mdz9aK43z3jhWbfkUo0kQ=";
+    hash = "sha256-2yDrnBi5ZaFfgpqZS1PZM3Fp3zqb5oMuMbsoAeZan8o=";
  };

-  vendorHash = "sha256-d7kkdiGMT3bN1dfNo8m+zp3VY8kaZM2BWO3B3iAdUQY=";
+  vendorHash = "sha256-ZylkCictJNJ/QrWEbBIXDEKElpZRw2Yrj/IHMx0lqg0=";

  ldflags = [
    "-w"
--- a/pkgs/by-name/vu/vuetorrent/package.nix
+++ b/pkgs/by-name/vu/vuetorrent/package.nix
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "vuetorrent";
-  version = "2.19.0";
+  version = "2.21.0";

  src = fetchFromGitHub {
    owner = "VueTorrent";
    repo = "VueTorrent";
    tag = "v${version}";
-    hash = "sha256-lT0KalQNn3SMSxY6baIuLph/OLNL3y2U9+eNw8r90yI=";
+    hash = "sha256-+DB1C7lWB1bBdQIxXhil5LYORgy7cTZISnU60mbPNK0=";
  };

-  npmDepsHash = "sha256-GOBBZg9/e/XEKEJuW3ie9eOd7jTeid69aQRUddXOjC0=";
+  npmDepsHash = "sha256-mfYLCErwVrL9PZDKGa0NiL+CQnJk1fDnB3bvCcvupHw=";

  installPhase = ''
    runHook preInstall
--- a/pkgs/by-name/wa/wal-g/package.nix
+++ b/pkgs/by-name/wa/wal-g/package.nix
@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "wal-g";
-  version = "3.0.3";
+  version = "3.0.5";

  src = fetchFromGitHub {
    owner = "wal-g";
    repo = "wal-g";
    rev = "v${version}";
-    sha256 = "sha256-r46svvUAMjZx+Oc/vTWet9iZLEiXkRFevUz4x0OixVI=";
+    sha256 = "sha256-wVr0L2ZXMuEo6tc2ajNzPinVQ8ZVzNOSoaHZ4oFsA+U=";
  };

-  vendorHash = "sha256-CfXLeFQA7ix1DP+DB5qWQryS2tLFNlfZrA3OBYxIpjU=";
+  vendorHash = "sha256-YDLAmRfDl9TgbabXj/1rxVQ052NZDg3IagXVTe5i9dw=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@@ -1,14 +1,14 @@
 {
  "darwin": {
-    "hash": "sha256-Un5dqYt3kGh3ODZnP2nskfzhma7KkpZXJTqPfwcZ4Dw=",
-    "version": "0.2024.12.18.08.02.stable_05"
+    "hash": "sha256-S1gNm8joPS2VKsTF2zUG9zSttFkSPBBOs4bpcph+saE=",
+    "version": "0.2025.01.08.08.02.stable_04"
  },
  "linux_x86_64": {
-    "hash": "sha256-U14TFQg72vfizYu8qXjH+JafL5aWndz1sbMSF3TD/+E=",
-    "version": "0.2024.12.18.08.02.stable_05"
+    "hash": "sha256-HHQnH4Sqju68RCBZxUpmdlpN6xSMB+3al8wKgLuvPVs=",
+    "version": "0.2025.01.08.08.02.stable_04"
  },
  "linux_aarch64": {
-    "hash": "sha256-lbZawoh9VUhNlbs+pxUu5pdWsizq9B1UPBsaNxUSs20=",
-    "version": "0.2024.12.18.08.02.stable_05"
+    "hash": "sha256-N0qHBTE6pczK5ceHXvCxNxWR9O7qcCtkgiPkGFUgNNE=",
+    "version": "0.2025.01.08.08.02.stable_04"
  }
 }
--- a/pkgs/by-name/we/webcord/package.nix
+++ b/pkgs/by-name/we/webcord/package.nix
@@ -11,16 +11,18 @@

 buildNpmPackage rec {
  pname = "webcord";
-  version = "4.10.2";
+  version = "4.10.3";

  src = fetchFromGitHub {
    owner = "SpacingBat3";
    repo = "WebCord";
    tag = "v${version}";
-    hash = "sha256-vzTT8tHpbJSt1PosgKTg3pT4a9UfPabtJppLLD9znhU=";
+    hash = "sha256-ga94CBc87q1U06Bm6ju304CHrIlFRLcIwNJx3GB2S+w=";
  };

-  npmDepsHash = "sha256-nVQv+GSnfQa8V/RitvV2juokbiRJ/vIMLWcg9QPDbP0=";
+  npmDepsHash = "sha256-h14sYaUeXb57kjxSSiXyvDjaswWi1qPAU/x1xQz3BaY=";
+
+  makeCacheWritable = true;

  nativeBuildInputs = [
    copyDesktopItems
--- a/pkgs/by-name/wo/wofi-power-menu/package.nix
+++ b/pkgs/by-name/wo/wofi-power-menu/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  makeWrapper,
+  wofi,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "wofi-power-menu";
+  version = "0.2.5";
+
+  src = fetchFromGitHub {
+    owner = "szaffarano";
+    repo = "wofi-power-menu";
+    tag = "v${version}";
+    hash = "sha256-V1aN8jkWmZz+ynVzZlDE/WYSBnt8XpPEb6NImd6OA4g=";
+  };
+
+  cargoHash = "sha256-KWpPyuI963v4D5uLUBNoLWU29lM1PD46uSR1LAUI+Es=";
+
+  postPatch = ''
+    sed -i 's/^version = .*/version = "${version}"/' Cargo.toml
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = ''
+    wrapProgram $out/bin/wofi-power-menu \
+      --prefix PATH : ${lib.makeBinPath [ wofi ]}
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Highly configurable power menu using the wofi launcher power-menu";
+    homepage = "https://github.com/szaffarano/wofi-power-menu";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "wofi-power-menu";
+  };
+}
--- a/pkgs/by-name/xh/xh/package.nix
+++ b/pkgs/by-name/xh/xh/package.nix
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "xh";
-  version = "0.23.0";
+  version = "0.23.1";

  src = fetchFromGitHub {
    owner = "ducaale";
    repo = "xh";
    rev = "v${version}";
-    hash = "sha256-rHhL2IWir+DpbNFu2KddslmhhiSpkpU633JYFYCoWvY=";
+    hash = "sha256-fNsiM9B3E34x8m+RuVlZXIhsoB0JaxloAUfa0RmXobQ=";
  };

-  cargoHash = "sha256-5V27ZV+5jWFoGMFe5EXmLdX2BjPuWDMdn4DK54ZIfUY=";
+  cargoHash = "sha256-SVinnMapZ2mFvihYYuBpvyzXQsnwBrpazk/yhSa++8g=";

  buildFeatures = lib.optional withNativeTls "native-tls";

--- a/pkgs/by-name/xl/xlights/package.nix
+++ b/pkgs/by-name/xl/xlights/package.nix
@@ -6,11 +6,11 @@

 appimageTools.wrapType2 rec {
  pname = "xlights";
-  version = "2024.19";
+  version = "2024.20";

  src = fetchurl {
    url = "https://github.com/smeighan/xLights/releases/download/${version}/xLights-${version}-x86_64.AppImage";
-    hash = "sha256-pq+Xe2PRmQ1XpxH1gQi2zTpJlFABTer3g52PNgSOFnw=";
+    hash = "sha256-2AGmCXmTMf5DYxO+qC7qPpPqmGrnoeREw7a1kuboDc4=";
  };

  meta = {
--- a/pkgs/by-name/yq/yq-go/package.nix
+++ b/pkgs/by-name/yq/yq-go/package.nix
@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "yq-go";
-  version = "4.44.6";
+  version = "4.45.1";

  src = fetchFromGitHub {
    owner = "mikefarah";
    repo = "yq";
    rev = "v${version}";
-    hash = "sha256-C9ql10PnEeGF8mnyLR25ibwLyE4SlqnpDNcPei9FnBw=";
+    hash = "sha256-AsTDbeRMb6QJE89Z0NGooyTY3xZpWFoWkT7dofsu0DI=";
  };

-  vendorHash = "sha256-B6ivzm7J0wYdYruGZ2N6SyvghsRRJlVlk84CuaF5PVA=";
+  vendorHash = "sha256-d4dwhZYzEuyh1zJQ2xU0WkygHjoVLoCBrDKuAHUzu1w=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix
+++ b/pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix
@@ -1,38 +1,43 @@
+# To update, get the latest URLs from Archive Downloads, eg.
+# https://www.oracle.com/java/technologies/javase/graalvm-jdk23-archive-downloads.html
+# Then run this script:
+# $ rg -No "(https://.+)\"" -r '$1' pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix | \
+#   parallel -k 'echo {}; nix hash convert --hash-algo sha256 --to sri $(curl -s {}.sha256)'
 {
  "22" = {
    "aarch64-linux" = {
-      hash = "sha256-E0Fm6mFB7o39pu7JVWOoXT9BdPWiSXBx2hPvlruD5ls=";
-      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.1_linux-aarch64_bin.tar.gz";
+      hash = "sha256-skemwlgUzJzqm2XOyKkjblIwKnHDSqpzdunrMB+Dlvs=";
+      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.2_linux-aarch64_bin.tar.gz";
    };
    "x86_64-linux" = {
-      hash = "sha256-1YPNsBygI6N+7UXZ0YS2i3qNf1C1jd4TaQQfKUw09KM=";
-      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.1_linux-x64_bin.tar.gz";
+      hash = "sha256-GIGqLEMbBQbssXBDmDKwU7dXNo1xCb1CIpjKI+eTnNA=";
+      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.2_linux-x64_bin.tar.gz";
    };
    "x86_64-darwin" = {
-      hash = "sha256-waR39L44Ew8wznRc67tYD3HGFZ2UUD4+ELerWnxNpms=";
-      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.1_macos-x64_bin.tar.gz";
+      hash = "sha256-n8vz/5bzjzHi9ZC7Yq3xngZVNcguJ7X9dC3vAFvvNSg=";
+      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.2_macos-x64_bin.tar.gz";
    };
    "aarch64-darwin" = {
-      hash = "sha256-dzUVPih81jopuxAx8sAYdwonNOXHyyirUUOhvStK1F8=";
-      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.1_macos-aarch64_bin.tar.gz";
+      hash = "sha256-O4IYBkBDJXRrCj3jISgSPVje85W2kd8cQmedlzfVh+c=";
+      url = "https://download.oracle.com/graalvm/22/archive/graalvm-jdk-22.0.2_macos-aarch64_bin.tar.gz";
    };
  };
  "17" = {
    "aarch64-linux" = {
-      hash = "sha256-0J/XaXGzNyBgxrW1HgUvtBCPPRfAvzwOx67p/QcY4u0=";
-      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.11_linux-aarch64_bin.tar.gz";
+      hash = "sha256-vZkdSGuS3rdDN7iB4PE6dkycHpD8NYgZCA9zIfpRdeg=";
+      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.12_linux-aarch64_bin.tar.gz";
    };
    "x86_64-linux" = {
-      hash = "sha256-t0GHR7MGSZDSAGeX7bsI1ziugaP4euRcJq+covDBUYw=";
-      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.11_linux-x64_bin.tar.gz";
+      hash = "sha256-tvPaziTPGWDseQIW9MhvANT0PfZOTotUj2OC8EiUcT8=";
+      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.12_linux-x64_bin.tar.gz";
    };
    "x86_64-darwin" = {
-      hash = "sha256-q9b6I5hSVt67gkYzUtsJDSi4bPEkzpkoeC5ZyxfqJRc=";
-      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.11_macos-x64_bin.tar.gz";
+      hash = "sha256-PsrBRx8/qVpWxbdcZdueYKxFUfVu2gnrnaleYEnqd9c=";
+      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.12_macos-x64_bin.tar.gz";
    };
    "aarch64-darwin" = {
-      hash = "sha256-o4BGCfnD25AVYwG1Ol+2eDVCgiB+mk4I1JBIjyETK6s=";
-      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.11_macos-aarch64_bin.tar.gz";
+      hash = "sha256-TN/cbJOV9nc+/NGRtmBfG3yOG3irkAq1z/NHIKP+/8U=";
+      url = "https://download.oracle.com/graalvm/17/archive/graalvm-jdk-17.0.12_macos-aarch64_bin.tar.gz";
    };
  };
 }
--- a/pkgs/development/libraries/libmikmod/default.nix
+++ b/pkgs/development/libraries/libmikmod/default.nix
@@ -14,11 +14,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "libmikmod";
-  version = "3.3.11.1";
+  version = "3.3.12";

  src = fetchurl {
    url = "mirror://sourceforge/mikmod/libmikmod-${version}.tar.gz";
-    sha256 = "06bdnhb0l81srdzg6gn2v2ydhhaazza7rshrcj3q8dpqr3gn97dd";
+    sha256 = "sha256-re9iFIY1FqSltE6/LHHvhOzf6zRElz2suscJEcm8Z+k=";
  };

  buildInputs =
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -579,14 +579,14 @@ buildLuarocksPackage {
 fzf-lua = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder }:
 buildLuarocksPackage {
  pname = "fzf-lua";
-  version = "0.0.1594-1";
+  version = "0.0.1635-1";
  knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/fzf-lua-0.0.1594-1.rockspec";
-    sha256 = "1hc23a5kf3343jzcqwlz51af5a3yfxhbspsfy4p1lzvw596hlq38";
+    url    = "mirror://luarocks/fzf-lua-0.0.1635-1.rockspec";
+    sha256 = "0d7kvdxs923qhmrfh7zcnsxqnfd5fzzi2mlgpvskb6pjg5qnshar";
  }).outPath;
  src = fetchzip {
-    url    = "https://github.com/ibhagwan/fzf-lua/archive/dbc5bd14e72ba680df44906e957b0a821121726b.zip";
-    sha256 = "1qcgacgrn6jmqi623rqav45rz83r9m3xv4k5bm5f8lnqdyi3r0av";
+    url    = "https://github.com/ibhagwan/fzf-lua/archive/af6ecbd7f421e7894127a9e94b40e13172fbfb13.zip";
+    sha256 = "0zvbid4553sag41l5zx3j331nq17p1k6n2gbs7ynkbbd530qvsmf";
  };

  disabled = luaOlder "5.1";
@@ -630,8 +630,8 @@ buildLuarocksPackage {
  src = fetchFromGitHub {
    owner = "lewis6991";
    repo = "gitsigns.nvim";
-    rev = "5f808b5e4fef30bd8aca1b803b4e555da07fc412";
-    hash = "sha256-H7A+AxioiedSuC+jqRwP4c7DjZR/0j4o/fTUasT2urc=";
+    rev = "68114837e81ca16d06514c3a997c9102d1b25c15";
+    hash = "sha256-NmqXgzGp+y/WWrMxXKuQFIsKS3kYxKyAA6Qa5SGvqIw=";
  };

  disabled = lua.luaversion != "5.1";
@@ -2377,14 +2377,14 @@ buildLuarocksPackage {
 luautf8 = callPackage({ buildLuarocksPackage, fetchurl, luaOlder }:
 buildLuarocksPackage {
  pname = "luautf8";
-  version = "0.1.5-2";
+  version = "0.1.6-1";
  knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/luautf8-0.1.5-2.rockspec";
-    sha256 = "0v788kk1aj7r70w9fgjlp3qrpjbpa9z9l1m7d13csk0pgfkm5iqz";
+    url    = "mirror://luarocks/luautf8-0.1.6-1.rockspec";
+    sha256 = "0piqf7nxhkgawib8ymvqaw2jn0ksnw1ahcxxiry121r4cxq5i65h";
  }).outPath;
  src = fetchurl {
-    url    = "https://github.com/starwing/luautf8/archive/refs/tags/0.1.5.tar.gz";
-    sha256 = "077ji840wfmy7hq0y13l01dv6jhasznykf89gk9m672jhz6dxggl";
+    url    = "https://github.com/starwing/luautf8/archive/refs/tags/0.1.6.tar.gz";
+    sha256 = "0mlnfsskbsjd6d643yb9i03r5135w5x8hrlaa00bv6mhmys76s5p";
  };

  disabled = luaOlder "5.1";
@@ -2795,14 +2795,14 @@ buildLuarocksPackage {
 neotest = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder, nvim-nio, plenary-nvim }:
 buildLuarocksPackage {
  pname = "neotest";
-  version = "5.7.0-1";
+  version = "5.8.0-1";
  knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/neotest-5.7.0-1.rockspec";
-    sha256 = "1fzvcz54vrcjashjpq6bd10yy0kvzsfz2kk2b7imfqnjgwq44d15";
+    url    = "mirror://luarocks/neotest-5.8.0-1.rockspec";
+    sha256 = "05gm5hpy5pralchkr0d3zfc5l7zs9qv6xflk9482rysfnkm7d3dh";
  }).outPath;
  src = fetchzip {
-    url    = "https://github.com/nvim-neotest/neotest/archive/0dccb5ebcf00de245e2060fa17822a9464f5c41a.zip";
-    sha256 = "15zkhdbkgla3ycxzbl6l2wspcx5ig9q58wsp3cnh1biffk4zn102";
+    url    = "https://github.com/nvim-neotest/neotest/archive/d66cf4e05a116957f0d3a7755a24291c7d1e1f72.zip";
+    sha256 = "09bxarrrfnqvyv22ls6lm0y03ngcp6r372b8hy4rld902psdb11q";
  };

  disabled = luaOlder "5.1";
@@ -2871,8 +2871,8 @@ buildLuarocksPackage {
  src = fetchFromGitHub {
    owner = "hrsh7th";
    repo = "nvim-cmp";
-    rev = "b555203ce4bd7ff6192e759af3362f9d217e8c89";
-    hash = "sha256-Z/Qy2ErbCa7dbjZVuJUkMmb4d24amNunNgRcbCGPfOg=";
+    rev = "8c82d0bd31299dbff7f8e780f5e06d2283de9678";
+    hash = "sha256-TmXpMgkPWXHn4+leojZg1V18wOiPDsKQeG1h8nGgVHo=";
  };

  disabled = luaOlder "5.1" || luaAtLeast "5.4";
@@ -3192,14 +3192,14 @@ buildLuarocksPackage {
 rustaceanvim = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder }:
 buildLuarocksPackage {
  pname = "rustaceanvim";
-  version = "5.20.1-1";
+  version = "5.22.0-1";
  knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/rustaceanvim-5.20.1-1.rockspec";
-    sha256 = "0g1s35k1wysi59mhnfbzhxhgqd4jm2n250q8cqizpazslhis8gvf";
+    url    = "mirror://luarocks/rustaceanvim-5.22.0-1.rockspec";
+    sha256 = "0qjawr2y5ll9kksyfjx1v52kk7kca4hs5c7rqiz4zvvxszqbpayp";
  }).outPath;
  src = fetchzip {
-    url    = "https://github.com/mrcjkb/rustaceanvim/archive/v5.20.1.zip";
-    sha256 = "1zq7p087cg9c9fl7lpcb7pg6kndiywp9cp2ja6jml3q6smb84i4d";
+    url    = "https://github.com/mrcjkb/rustaceanvim/archive/v5.22.0.zip";
+    sha256 = "0wxvfj6xb5b3ikxjdwnri8mc1dnjgln67yp83461c2p822yiwl6s";
  };

  disabled = luaOlder "5.1";
@@ -3411,8 +3411,8 @@ buildLuarocksPackage {
  src = fetchFromGitHub {
    owner = "nvim-telescope";
    repo = "telescope.nvim";
-    rev = "2eca9ba22002184ac05eddbe47a7fe2d5a384dfc";
-    hash = "sha256-npb61MZYAotz71Co5G1dUeIqWt7GVeqZNz0A2Yz2dy4=";
+    rev = "415af52339215926d705cccc08145f3782c4d132";
+    hash = "sha256-5y8srYKaAqFplMtDjsc8GdDF8yui5vCNMiOeFLrC/sM=";
  };

  disabled = lua.luaversion != "5.1";
@@ -3549,16 +3549,16 @@ buildLuarocksPackage {
 vusted = callPackage({ buildLuarocksPackage, busted, fetchFromGitHub, fetchurl, luasystem }:
 buildLuarocksPackage {
  pname = "vusted";
-  version = "2.5.1-1";
+  version = "2.5.2-1";
  knownRockspec = (fetchurl {
-    url    = "mirror://luarocks/vusted-2.5.1-1.rockspec";
-    sha256 = "14h1vbms6ygqpdfsms1prvp29ld8kk1w2qa2c9b6i02h3dg45dv6";
+    url    = "mirror://luarocks/vusted-2.5.2-1.rockspec";
+    sha256 = "15khykwiqipzrgj84ny4wc18iv5qs4a6vl6czmy2g8pxldipqf81";
  }).outPath;
  src = fetchFromGitHub {
    owner = "notomo";
    repo = "vusted";
-    rev = "v2.5.1";
-    hash = "sha256-XHAPgLNGVdqyeukqimLqRlDhuiMEhOhBO0vUIFDAPjM=";
+    rev = "v2.5.2";
+    hash = "sha256-sYRMzuCUDFe77JMG9D4LedcPa+hAKIKZiEt+stOVl7g=";
  };

  propagatedBuildInputs = [ busted luasystem ];
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -877,12 +877,6 @@ in
  });

  vusted = prev.vusted.overrideAttrs (_: {
-    postConfigure = ''
-      cat ''${rockspecFilename}
-      substituteInPlace ''${rockspecFilename} \
-        --replace-fail '"luasystem = 0.2.1",' "'luasystem >= 0.2',"
-    '';
-
    # make sure vusted_entry.vim doesn't get wrapped
    postInstall = ''
      chmod -x $out/bin/vusted_entry.vim
--- a/pkgs/development/misc/juce/default.nix
+++ b/pkgs/development/misc/juce/default.nix
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchpatch,

  # Native build inputs
  cmake,
--- a/pkgs/development/python-modules/aiohomeconnect/default.nix
+++ b/pkgs/development/python-modules/aiohomeconnect/default.nix
@@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "aiohomeconnect";
-  version = "0.7.5";
+  version = "0.9.0";
  pyproject = true;

  disabled = pythonOlder "3.11";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "MartinHjelmare";
    repo = "aiohomeconnect";
    tag = "v${version}";
-    hash = "sha256-1+2ezwmlzLYbrODGNoOzd9Gbjl/5BzarmXr8eiaKZ9c=";
+    hash = "sha256-SHrhlchjyUPhf/LnIHB/b90aglboVArcQ/YTOw1vbII=";
  };

  pythonRelaxDeps = [ "httpx" ];
--- a/pkgs/development/python-modules/aiohttp-fast-zlib/default.nix
+++ b/pkgs/development/python-modules/aiohttp-fast-zlib/default.nix
@@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "aiohttp-fast-zlib";
-  version = "0.2.0";
+  version = "0.2.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bdraco";
    repo = "aiohttp-fast-zlib";
    tag = "v${version}";
-    hash = "sha256-fvZVviKN/CL42Zmmm6k/JNdeAljRoqN63rlduNJVr98=";
+    hash = "sha256-OVxt1SQXOFbgnmA3FP56xixmgh5gOe/HDgzPVlr0JPg=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/aioimaplib/default.nix
+++ b/pkgs/development/python-modules/aioimaplib/default.nix
@@ -1,48 +1,46 @@
 {
  lib,
-  asynctest,
  buildPythonPackage,
-  docutils,
  fetchFromGitHub,
  imaplib2,
  mock,
+  poetry-core,
  pyopenssl,
+  pytest-asyncio,
  pytestCheckHook,
  pythonOlder,
  pytz,
-  setuptools,
-  tzlocal,
 }:

 buildPythonPackage rec {
  pname = "aioimaplib";
-  version = "1.1.0";
+  version = "1.2.0";
  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "bamthomas";
    repo = "aioimaplib";
    tag = version;
-    hash = "sha256-TjCPGZGsSb+04kQNzHU3kWBo2vY34ujEqh1GIMIehJc=";
+    hash = "sha256-GBehZq2F9vJQGbeBuG1EGmTt8s7XcnTIIK0QQAB+ZII=";
  };

-  build-system = [ setuptools ];
+  build-system = [ poetry-core ];

  nativeCheckInputs = [
-    asynctest
-    docutils
    imaplib2
    mock
    pyopenssl
+    pytest-asyncio
    pytestCheckHook
    pytz
-    tzlocal
  ];

-  # https://github.com/bamthomas/aioimaplib/issues/54
-  doCheck = pythonOlder "3.11";
+  disabledTests = [
+    # TimeoutError
+    "test_idle_start__exits_queue_get_without_timeout_error"
+  ];

  pythonImportsCheck = [ "aioimaplib" ];

--- a/pkgs/development/python-modules/airthings-ble/default.nix
+++ b/pkgs/development/python-modules/airthings-ble/default.nix
@@ -5,6 +5,7 @@
  bleak,
  bleak-retry-connector,
  buildPythonPackage,
+  cbor2,
  fetchFromGitHub,
  poetry-core,
  pytest-cov-stub,
@@ -14,16 +15,16 @@

 buildPythonPackage rec {
  pname = "airthings-ble";
-  version = "0.9.2";
+  version = "1.0.0";
  pyproject = true;

-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.12";

  src = fetchFromGitHub {
    owner = "vincegio";
    repo = "airthings-ble";
    tag = version;
-    hash = "sha256-m2jsXLrj2yS2Wi2dSwyxBv/nXmU738gd5iJ1JVfakUg=";
+    hash = "sha256-RKvQ3w3unDk/U6dz3r0Pn3ppVA6ZGxUoyuVk5jbI8jc=";
  };

  build-system = [ poetry-core ];
@@ -32,7 +33,8 @@ buildPythonPackage rec {
    async-interrupt
    bleak
    bleak-retry-connector
-  ] ++ lib.optionals (pythonOlder "3.11") [ async-timeout ];
+    cbor2
+  ];

  nativeCheckInputs = [
    pytest-cov-stub
@@ -45,7 +47,7 @@ buildPythonPackage rec {
    description = "Library for Airthings BLE devices";
    homepage = "https://github.com/vincegio/airthings-ble";
    changelog = "https://github.com/vincegio/airthings-ble/releases/tag/${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
  };
 }
--- a/pkgs/development/python-modules/azure-mgmt-compute/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-compute/default.nix
@@ -11,14 +11,15 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-compute";
-  version = "33.0.0";
+  version = "33.1.0";
  pyproject = true;

  disabled = pythonOlder "3.8";

  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-o8wP5PCcjh01I8G/uSYg3+JjoKiTsKwToz1wV+nd3dI=";
+    pname = "azure_mgmt_compute";
+    inherit version;
+    hash = "sha256-9aXhilp6A1RWK7+libXbSq8eisOhlKKpENtVkA0lNek=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/boschshcpy/default.nix
+++ b/pkgs/development/python-modules/boschshcpy/default.nix
@@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "boschshcpy";
-  version = "0.2.101";
+  version = "0.2.104";
  pyproject = true;

  disabled = pythonOlder "3.10";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "tschamm";
    repo = "boschshcpy";
    tag = version;
-    hash = "sha256-PUTa4ypq6zmoeNMp5SyqB05H//M2zNVILcjmU5Mzv8M=";
+    hash = "sha256-16LHTg+ROP+sn9iFXSNTqgE/zW+mWMeVgItFJeGItaI=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/finitude/default.nix
+++ b/pkgs/development/python-modules/finitude/default.nix
@@ -6,27 +6,29 @@
  pyserial,
  pythonOlder,
  pyyaml,
+  legacy-cgi,
  setuptools,
 }:

 buildPythonPackage rec {
  pname = "finitude";
  version = "0.1.1";
-  format = "pyproject";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "dulitz";
-    repo = pname;
-    rev = "v${version}";
+    repo = "finitude";
+    tag = "v${version}";
    hash = "sha256-yCI5UCRDhw+dJoTKyjmHbAGBm3by2AyxHKlqCywnLcs=";
  };

-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [
+  dependencies = [
    pyserial
+    legacy-cgi
    prometheus-client
    pyyaml
  ];
@@ -36,10 +38,11 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "finitude" ];

-  meta = with lib; {
+  meta = {
    description = "Python module to get data from ABCD bus (RS-485) used by Carrier Infinity and Bryant Evolution HVAC systems";
    homepage = "https://github.com/dulitz/finitude";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
+    changelog = "https://github.com/dulitz/finitude/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
  };
 }
--- a/pkgs/development/python-modules/flask-bootstrap/default.nix
+++ b/pkgs/development/python-modules/flask-bootstrap/default.nix
@@ -1,32 +1,53 @@
 {
  lib,
  buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  setuptools,
  flask,
  visitor,
  dominate,
+  pytestCheckHook,
+  requests,
 }:

 buildPythonPackage rec {
  pname = "flask-bootstrap";
  version = "3.3.7.1";
+  pyproject = true;

-  src = fetchPypi {
-    pname = "Flask-Bootstrap";
-    inherit version;
-    sha256 = "1j1s2bplaifsnmr8vfxa3czca4rz78xyhrg4chx39xl306afs26b";
+  src = fetchFromGitHub {
+    owner = "mbr";
+    repo = "flask-bootstrap";
+    tag = version;
+    hash = "sha256-TsRSNhrI1jZU/beX3G7LM64IrFagD6AYiluoGzy12jE=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    flask
    visitor
    dominate
  ];

-  meta = with lib; {
+  pythonImportsCheck = [ "flask_bootstrap" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    requests
+  ];
+
+  disabledTests = [
+    # requires network access
+    "test_bootstrap_version_matches"
+    # requires flask-appconfig
+    "test_index"
+  ];
+
+  meta = {
    homepage = "https://github.com/mbr/flask-bootstrap";
    description = "Ready-to-use Twitter-bootstrap for use in Flask";
-    license = licenses.asl20;
+    license = lib.licenses.asl20;
    maintainers = [ ];
  };
 }
--- a/pkgs/development/python-modules/flask-common/default.nix
+++ b/pkgs/development/python-modules/flask-common/default.nix
@@ -1,39 +0,0 @@
-{
-  lib,
-  fetchPypi,
-  buildPythonPackage,
-  crayons,
-  flask,
-  flask-caching,
-  gunicorn,
-  maya,
-  meinheld,
-  whitenoise,
-}:
-
-buildPythonPackage rec {
-  pname = "flask-common";
-  version = "0.3.0";
-
-  src = fetchPypi {
-    pname = "Flask-Common";
-    inherit version;
-    sha256 = "13d99f2dbc0a332b8bc4b2cc394d3e48f89672c266868e372cd9d7b433d921a9";
-  };
-
-  propagatedBuildInputs = [
-    crayons
-    flask
-    flask-caching
-    gunicorn
-    maya
-    meinheld
-    whitenoise
-  ];
-
-  meta = with lib; {
-    description = "Flask extension with lots of common time-savers";
-    homepage = "https://github.com/kennethreitz/flask-common";
-    license = licenses.asl20; # XXX: setup.py lists BSD but git repo has Apache 2.0 LICENSE
-  };
-}
--- a/pkgs/development/python-modules/flask-seasurf/default.nix
+++ b/pkgs/development/python-modules/flask-seasurf/default.nix
@@ -1,53 +1,40 @@
 {
  lib,
  fetchFromGitHub,
-  fetchpatch,
  buildPythonPackage,
-  isPy3k,
+  setuptools,
  flask,
  mock,
-  unittestCheckHook,
+  pytestCheckHook,
 }:

 buildPythonPackage rec {
  pname = "flask-seasurf";
-  version = "1.1.1";
-  disabled = !isPy3k;
+  version = "2.0.0";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "maxcountryman";
    repo = "flask-seasurf";
-    rev = version;
-    hash = "sha256-L/ZUEqqHmsyXG5eShcITII36ttwQlZN5GBngo+GcCdw=";
+    tag = version;
+    hash = "sha256-ajQiDizNaF0em9CVeaHEuJEeSaYraJh9YgvhvBPTIsk=";
  };

-  patches = [
-    # Remove usage of deprecated flask._app_ctx_stack
-    (fetchpatch {
-      url = "https://github.com/maxcountryman/flask-seasurf/commit/9039764a4e44aeb1acb6ae7747deb438bee0826b.patch";
-      hash = "sha256-bVYzJN6MXzH3fNMknd2bh+04JlPJRkU0cLcWv+Rigqc=";
-    })
-    ./0001-Fix-with-new-dependency-versions.patch
-  ];
+  build-system = [ setuptools ];

-  postPatch = ''
-    # Disable some tests, pytest is not supported
-    sed -i "s#\(\(test_header_set_on_post\|test_https_good_referer\|test_https_referer_check_disabled\)(self):\)#\1\n        return#g" test_seasurf.py
-  '';
-
-  propagatedBuildInputs = [ flask ];
+  dependencies = [ flask ];

  nativeCheckInputs = [
-    unittestCheckHook
+    pytestCheckHook
    mock
  ];

  pythonImportsCheck = [ "flask_seasurf" ];

-  meta = with lib; {
+  meta = {
    description = "Flask extension for preventing cross-site request forgery";
    homepage = "https://github.com/maxcountryman/flask-seasurf";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ zhaofengli ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ zhaofengli ];
  };
 }
--- a/pkgs/development/python-modules/flask-silk/default.nix
+++ b/pkgs/development/python-modules/flask-silk/default.nix
@@ -2,12 +2,15 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  setuptools,
  flask,
+  pytestCheckHook,
 }:

 buildPythonPackage {
  pname = "flask-silk";
-  version = "unstable-2018-06-28";
+  version = "0.2-unstable-2018-06-14";
+  pyproject = true;

  # master fixes flask import syntax and has no major changes
  # new release requested: https://github.com/sublee/flask-silk/pull/6
@@ -15,15 +18,28 @@ buildPythonPackage {
    owner = "sublee";
    repo = "flask-silk";
    rev = "3a8166550f9a0ec52edae7bf31d9818c4c15c531";
-    sha256 = "0mplziqw52jfspas6vsm210lmxqqzgj0dxm8y0i3gpbyyykwcmh0";
+    hash = "sha256-AFbGp/d+3Tci8Kj2BuT7GPdKQRBVb6PV1U6KwnH89FY=";
  };

-  propagatedBuildInputs = [ flask ];
+  build-system = [ setuptools ];

-  meta = with lib; {
+  dependencies = [ flask ];
+
+  pythonImportsCheck = [ "flask_silk" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pytestFlagsArray = [ "test.py" ];
+
+  disabledTests = [
+    # requires network access
+    "test_subdomain"
+  ];
+
+  meta = {
    description = "Adds silk icons to your Flask application or module, or extension";
-    license = licenses.bsd3;
-    maintainers = teams.sage.members;
+    license = lib.licenses.bsd3;
+    maintainers = lib.teams.sage.members;
    homepage = "https://github.com/sublee/flask-silk";
  };
 }
--- a/pkgs/development/python-modules/flask-sslify/default.nix
+++ b/pkgs/development/python-modules/flask-sslify/default.nix
@@ -3,27 +3,32 @@
  fetchPypi,
  buildPythonPackage,
  flask,
+  setuptools,
 }:

 buildPythonPackage rec {
  pname = "flask-sslify";
  version = "0.1.5";
+  pyproject = true;

  src = fetchPypi {
    pname = "Flask-SSLify";
    inherit version;
-    sha256 = "0gjl1m828z5dm3c5dpc2qjgi4llf84cp72mafr0ib5fd14y1sgnk";
+    hash = "sha256-0z4dPAnNlRVBdqqKcxlBjlISn8SC3VbYqK18JFANVD4=";
  };

-  propagatedBuildInputs = [ flask ];
+  build-system = [ setuptools ];

+  dependencies = [ flask ];
+
+  # no tests
  doCheck = false;
  pythonImportsCheck = [ "flask_sslify" ];

-  meta = with lib; {
+  meta = {
    description = "Flask extension that redirects all incoming requests to HTTPS";
    homepage = "https://github.com/kennethreitz42/flask-sslify";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [ zhaofengli ];
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ zhaofengli ];
  };
 }
--- a/pkgs/development/python-modules/flask-versioned/default.nix
+++ b/pkgs/development/python-modules/flask-versioned/default.nix
@@ -2,26 +2,37 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  setuptools,
  flask,
+  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage {
  pname = "flask-versioned";
-  version = "0.9.4-20101221";
+  version = "0.9.4";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "pilt";
    repo = "flask-versioned";
    rev = "38046fb53a09060de437c90a5f7370a6b94ffc31"; # no tags
-    sha256 = "1wim9hvx7lxzfg35c0nc7p34j4vw9mzisgijlz4ibgykah4g1y37";
+    hash = "sha256-Z/jwCFTTvxXJpzI+HX9NfBNJxj3MAlbGc7/T0zdMNfI=";
  };

-  propagatedBuildInputs = [ flask ];
+  build-system = [ setuptools ];

-  meta = with lib; {
+  dependencies = [ flask ];
+
+  pythonImportsCheck = [ "flaskext.versioned" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonNamespaces = [ "flaskext" ];
+
+  meta = {
    description = "Flask plugin to rewrite file paths to add version info";
    homepage = "https://github.com/pilt/flask-versioned";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
    maintainers = [ ];
  };
 }
--- a/Show More
+++ b/Show More