Merge master into staging-next

2024-09-11 15:08:33 +01:00 · 2024-09-09 12:05:58 +00:00 · 2024-09-09 12:05:58 +00:00 · 90a93f92bb
parent 92d531057e 8a4836def3
commit 90a93f92bb
59 changed files with 911 additions and 528 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4988,6 +4988,12 @@
    githubId = 62989;
    name = "Demyan Rogozhin";
  };
+  denperidge = {
+    email = "contact@denperidge.com";
+    github = "denperidge";
+    githubId = 27348469;
+    name = "Cat";
+  };
  derchris = {
    email = "derchris@me.com";
    github = "derchrisuk";
@ -19386,6 +19392,13 @@
    githubId = 158321;
    name = "Stewart Mackenzie";
  };
+  skeuchel = {
+    name = "Steven Keuchel";
+    email = "steven.keuchel@gmail.com";
+    github = "skeuchel";
+    githubId = 617130;
+    keys = [ { fingerprint = "C4F7 46C7 B560 38D8 210F  0288 5877 DEE9 7428 557F"; } ];
+  };
  skovati = {
    github = "skovati";
    githubId = 49844593;
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@ -162,6 +162,7 @@ in

    boot.kernelParams = [
      "console=${qemu-common.qemuSerialDevice}"
+      "console=tty0"
      # Panic if an error occurs in stage 1 (rather than waiting for
      # user intervention).
      "panic=1" "boot.panic_on_fail"
@ -180,6 +181,7 @@ in
    services.journald.extraConfig =
      ''
        ForwardToConsole=yes
+        TTYPath=/dev/${qemu-common.qemuSerialDevice}
        MaxLevelConsole=debug
      '';

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -444,7 +444,6 @@ in {
  hibernate-systemd-stage-1 = handleTestOn ["x86_64-linux"] ./hibernate.nix { systemdStage1 = true; };
  hitch = handleTest ./hitch {};
  hledger-web = handleTest ./hledger-web.nix {};
-  hocker-fetchdocker = handleTest ./hocker-fetchdocker {};
  hockeypuck = handleTest ./hockeypuck.nix { };
  home-assistant = handleTest ./home-assistant.nix {};
  hostname = handleTest ./hostname.nix {};
--- a/nixos/tests/hocker-fetchdocker/default.nix
+++ b/nixos/tests/hocker-fetchdocker/default.nix
@ -1,16 +0,0 @@
-import ../make-test-python.nix ({ pkgs, ...} : {
-  name = "test-hocker-fetchdocker";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ ixmatus ];
-    broken = true; # tries to download from registry-1.docker.io - how did this ever work?
-  };
-
-  nodes.machine = import ./machine.nix;
-
-  testScript = ''
-    start_all()
-
-    machine.wait_for_unit("sockets.target")
-    machine.wait_until_succeeds("docker run registry-1.docker.io/v2/library/hello-world:latest")
-  '';
-})
--- a/nixos/tests/hocker-fetchdocker/hello-world-container.nix
+++ b/nixos/tests/hocker-fetchdocker/hello-world-container.nix
@ -1,19 +0,0 @@
-{ fetchDockerConfig, fetchDockerLayer, fetchdocker }:
-fetchdocker rec {
-    name = "hello-world";
-    registry = "https://registry-1.docker.io/v2/";
-    repository = "library";
-    imageName = "hello-world";
-    tag = "latest";
-    imageConfig = fetchDockerConfig {
-      inherit tag registry repository imageName;
-      sha256 = "1ivbd23hyindkahzfw4kahgzi6ibzz2ablmgsz6340vc6qr1gagj";
-    };
-    imageLayers = let
-      layer0 = fetchDockerLayer {
-        inherit registry repository imageName;
-        layerDigest = "ca4f61b1923c10e9eb81228bd46bee1dfba02b9c7dac1844527a734752688ede";
-        sha256 = "1plfd194fwvsa921ib3xkhms1yqxxrmx92r2h7myj41wjaqn2kya";
-      };
-      in [ layer0 ];
-  }
--- a/nixos/tests/hocker-fetchdocker/machine.nix
+++ b/nixos/tests/hocker-fetchdocker/machine.nix
@ -1,26 +0,0 @@
-{ pkgs, ... }:
-{ nixpkgs.config.packageOverrides = pkgs': {
-    hello-world-container = pkgs'.callPackage ./hello-world-container.nix { };
-  };
-
-  virtualisation.docker = {
-    enable  = true;
-    package = pkgs.docker;
-  };
-
-  systemd.services.docker-load-fetchdocker-image = {
-    description = "Docker load hello-world-container";
-    wantedBy    = [ "multi-user.target" ];
-    wants       = [ "docker.service" ];
-    after       = [ "docker.service" ];
-
-    script = ''
-      ${pkgs.hello-world-container}/compositeImage.sh | ${pkgs.docker}/bin/docker load
-    '';
-
-    serviceConfig = {
-      Type = "oneshot";
-    };
-  };
-}
-
--- a/pkgs/applications/blockchains/monero-cli/default.nix
+++ b/pkgs/applications/blockchains/monero-cli/default.nix
@ -1,9 +1,30 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch2, cmake, ninja, pkg-config
-, boost, miniupnpc, openssl, unbound
-, zeromq, pcsclite, readline, libsodium, hidapi
-, randomx, rapidjson
-, CoreData, IOKit, PCSC
-, trezorSupport ? true, libusb1, protobuf, python3
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  ninja,
+  pkg-config,
+  boost,
+  libsodium,
+  miniupnpc,
+  openssl,
+  python3,
+  randomx,
+  rapidjson,
+  readline,
+  unbound,
+  zeromq,
+
+  # darwin
+  CoreData,
+  IOKit,
+
+  trezorSupport ? true,
+  hidapi,
+  libusb1,
+  protobuf_21,
+  udev,
 }:

 let
@ -25,40 +46,16 @@ in

 stdenv.mkDerivation rec {
  pname = "monero-cli";
-  version = "0.18.3.3";
+  version = "0.18.3.4";

  src = fetchFromGitHub {
    owner = "monero-project";
    repo = "monero";
    rev = "v${version}";
-    hash = "sha256-1LkKIrud317BEE+713t5wiJV6FcDlJdj4ypXPR0bKTs=";
+    hash = "sha256-nDiFJjhsISYM8kTgJUaPYL44iyccnz5+Pd5beBh+lsM=";
  };

-  patches = [
-    # cmake: remove unused/extera cmake/FindMiniupnpc.cmake and only rely on external/miniupnpc
-    # https://github.com/monero-project/monero/pull/9366
-    (fetchpatch2 {
-      url = "https://github.com/monero-project/monero/commit/5074a543a49f7e23fb39b6462fd4c4c9741c3693.patch?full_index=1";
-      hash = "sha256-dS2hhEU6m2of0ULlsf+/tZMHUmq3vGGXJPGHvtnpQnY=";
-    })
-
-    # cmake: add different parameters to add_monero_library.
-    # https://github.com/monero-project/monero/pull/9367
-    (fetchpatch2 {
-      url = "https://github.com/monero-project/monero/commit/b91ead90254ac6d6daf908f689c38e372a44c615.patch?full_index=1";
-      hash = "sha256-DL2YqkvEONbeEDqLOAo2eSF5JF5gOzKcLKeNlUXBY1w=";
-    })
-
-    # external: update miniupnpc to 2.2.8
-    # https://github.com/monero-project/monero/pull/9367
-    (fetchpatch2 {
-      url = "https://github.com/monero-project/monero/commit/d81da086ec5088a04b3f7b34831e72910300e2f7.patch?full_index=1";
-      hash = "sha256-ZJGiDMk5DMmEXwzoUYPC+DIoebluFh54kMQtQU78ckI=";
-      excludes = [ "external/miniupnp" ];
-    })
-
-    ./use-system-libraries.patch
-  ];
+  patches = [ ./use-system-libraries.patch ];

  postPatch = ''
    # manually install submodules
@ -69,31 +66,60 @@ stdenv.mkDerivation rec {
    cp -r . $source
  '';

-  nativeBuildInputs = [ cmake ninja pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];

-  buildInputs = [
-    boost miniupnpc openssl unbound
-    zeromq pcsclite readline
-    libsodium hidapi randomx rapidjson
-    protobuf
-  ] ++ lib.optionals stdenv.isDarwin [ IOKit CoreData PCSC ]
-    ++ lib.optionals trezorSupport [ libusb1 protobuf python3 ];
+  buildInputs =
+    [
+      boost
+      libsodium
+      miniupnpc
+      openssl
+      randomx
+      rapidjson
+      readline
+      unbound
+      zeromq
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      IOKit
+      CoreData
+    ]
+    ++ lib.optionals trezorSupport [
+      python3
+      hidapi
+      libusb1
+      protobuf_21
+    ]
+    ++ lib.optionals (trezorSupport && stdenv.isLinux) [
+      udev
+    ];

-  cmakeFlags = [
-    "-DUSE_DEVICE_TREZOR=ON"
-    "-DBUILD_GUI_DEPS=ON"
-    "-DReadline_ROOT_DIR=${readline.dev}"
-    "-DRandomX_ROOT_DIR=${randomx}"
-  ] ++ lib.optional stdenv.isDarwin "-DBoost_USE_MULTITHREADED=OFF";
+  cmakeFlags =
+    [
+      # skip submodules init
+      "-DMANUAL_SUBMODULES=ON"
+      # required by monero-gui
+      "-DBUILD_GUI_DEPS=ON"
+      "-DReadline_ROOT_DIR=${readline.dev}"
+    ]
+    ++ lib.optional stdenv.isDarwin "-DBoost_USE_MULTITHREADED=OFF"
+    ++ lib.optional trezorSupport [
+      "-DUSE_DEVICE_TREZOR=ON"
+      # fix build on recent gcc versions
+      "-DCMAKE_CXX_FLAGS=-fpermissive"
+    ];

  outputs = [ "out" "source" ];

-  meta = with lib; {
+  meta = {
    description = "Private, secure, untraceable currency";
-    homepage    = "https://getmonero.org/";
-    license     = licenses.bsd3;
-    platforms   = platforms.all;
-    maintainers = with maintainers; [ rnhmjoj ];
+    homepage = "https://getmonero.org/";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ rnhmjoj ];
    mainProgram = "monero-wallet-cli";
  };
 }
--- a/pkgs/applications/blockchains/monero-cli/use-system-libraries.patch
+++ b/pkgs/applications/blockchains/monero-cli/use-system-libraries.patch
@ -1,14 +1,15 @@
 diff --git a/external/CMakeLists.txt b/external/CMakeLists.txt
-index f8b834ac17...520e148428 100644
+index 5b7f69a56..cc4b0a346 100644
 --- a/external/CMakeLists.txt
 +++ b/external/CMakeLists.txt
-@@ -39,23 +39,12 @@
-   add_compile_options(-D_GNU_SOURCE)
- endif()
+@@ -35,25 +35,14 @@
+ # ...except for FreeBSD, because FreeBSD is a special case that doesn't play well with
+ # others.
 
+-find_package(Miniupnpc REQUIRED)
+-
 -message(STATUS "Using in-tree miniupnpc")
 -set(UPNPC_NO_INSTALL TRUE CACHE BOOL "Disable miniupnp installation" FORCE)
-set(UPNPC_BUILD_TESTS FALSE CACHE BOOL "Disable miniupnp internal tests." FORCE)
 -add_subdirectory(miniupnp/miniupnpc)
 -set_property(TARGET libminiupnpc-static PROPERTY FOLDER "external")
 -set_property(TARGET libminiupnpc-static PROPERTY POSITION_INDEPENDENT_CODE ON)
@ -20,19 +21,58 @@ index f8b834ac17...520e148428 100644
 -if(CMAKE_SYSTEM_NAME MATCHES "NetBSD")
 -	set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -D_NETBSD_SOURCE")
 -endif()
-+include(FindPkgConfig)
-+pkg_check_modules(MINIUPNPC REQUIRED IMPORTED_TARGET GLOBAL miniupnpc)
-+get_target_property(MINIUPNPC_INCLUDE_DIR PkgConfig::MINIUPNPC INTERFACE_INCLUDE_DIRECTORIES)
-+set_target_properties(PkgConfig::MINIUPNPC PROPERTIES INTERFACE_INCLUDE_DIRECTORIES "${MINIUPNPC_INCLUDE_DIR}/miniupnpc")
-+set(UPNP_LIBRARIES PkgConfig::MINIUPNPC PARENT_SCOPE)
- 
-set(UPNP_LIBRARIES "libminiupnpc-static" PARENT_SCOPE)
 -
+-set(UPNP_LIBRARIES "libminiupnpc-static" PARENT_SCOPE)
+find_package(PkgConfig REQUIRED)
+pkg_check_modules(MINIUPNPC REQUIRED miniupnpc)
+link_libraries(${MINIUPNPC_LIBRARIES})
+include_directories(${MINIUPNPC_INCLUDE_DIRS})
+ 
+find_package(RapidJSON)
 find_package(Unbound)
+find_library(RANDOMX_LIBRARY randomx)
 
 if(NOT UNBOUND_INCLUDE_DIR)
-@@ -72,4 +61,3 @@
+   die("Could not find libunbound")
+@@ -69,4 +58,3 @@ endif()
 add_subdirectory(db_drivers)
 add_subdirectory(easylogging++)
 add_subdirectory(qrcodegen)
 -add_subdirectory(randomx EXCLUDE_FROM_ALL)
+diff --git a/src/p2p/net_node.inl b/src/p2p/net_node.inl
+index 71f5393e8..bb48083d0 100644
+--- a/src/p2p/net_node.inl
+++ b/src/p2p/net_node.inl
+@@ -60,9 +60,9 @@
+ #include "cryptonote_core/cryptonote_core.h"
+ #include "net/parse.h"
+ 
+-#include <miniupnp/miniupnpc/miniupnpc.h>
+-#include <miniupnp/miniupnpc/upnpcommands.h>
+-#include <miniupnp/miniupnpc/upnperrors.h>
+#include <miniupnpc/miniupnpc.h>
+#include <miniupnpc/upnpcommands.h>
+#include <miniupnpc/upnperrors.h>
+ 
+ #undef MONERO_DEFAULT_LOG_CATEGORY
+ #define MONERO_DEFAULT_LOG_CATEGORY "net.p2p"
+@@ -2989,7 +2989,8 @@ namespace nodetool
+     UPNPUrls urls;
+     IGDdatas igdData;
+     char lanAddress[64];
+-    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress);
+    char wanAddress[64];
+    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress, wanAddress, sizeof wanAddress);
+     freeUPNPDevlist(deviceList);
+     if (result > 0) {
+       if (result == 1) {
+@@ -3057,7 +3058,8 @@ namespace nodetool
+     UPNPUrls urls;
+     IGDdatas igdData;
+     char lanAddress[64];
+-    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress);
+    char wanAddress[64];
+    result = UPNP_GetValidIGD(deviceList, &urls, &igdData, lanAddress, sizeof lanAddress, wanAddress, sizeof wanAddress);
+     freeUPNPDevlist(deviceList);
+     if (result > 0) {
+       if (result == 1) {
--- a/pkgs/applications/blockchains/monero-gui/default.nix
+++ b/pkgs/applications/blockchains/monero-gui/default.nix
@ -1,43 +1,88 @@
-{ lib, stdenv, wrapQtAppsHook, makeDesktopItem
-, fetchFromGitHub
-, cmake, qttools, pkg-config
-, qtbase, qtdeclarative, qtgraphicaleffects
-, qtmultimedia, qtxmlpatterns
-, qtquickcontrols, qtquickcontrols2
-, qtmacextras
-, monero-cli, miniupnpc, unbound, readline
-, boost, libunwind, libsodium, pcsclite
-, randomx, zeromq, libgcrypt, libgpg-error
-, hidapi, rapidjson, quirc
-, trezorSupport ? true, libusb1, protobuf, python3
+{
+  lib,
+  fetchFromGitHub,
+  makeDesktopItem,
+  boost,
+  cmake,
+  libgcrypt,
+  libgpg-error,
+  libsodium,
+  miniupnpc,
+  monero-cli,
+  pkg-config,
+  qtbase,
+  qtdeclarative,
+  qtgraphicaleffects,
+  qtmacextras,
+  qtmultimedia,
+  qtquickcontrols,
+  qtquickcontrols2,
+  qttools,
+  qtxmlpatterns,
+  quirc,
+  randomx,
+  rapidjson,
+  stdenv,
+  unbound,
+  wrapQtAppsHook,
+  zeromq,
+
+  trezorSupport ? true,
+  hidapi,
+  libusb1,
+  protobuf_21,
+  python3,
+  udev,
 }:

 stdenv.mkDerivation rec {
  pname = "monero-gui";
-  version = "0.18.3.3";
+  version = "0.18.3.4";

  src = fetchFromGitHub {
    owner = "monero-project";
    repo = "monero-gui";
    rev = "v${version}";
-    hash = "sha256-6qadBm4bPui11OVY1tLFcHsfswXWBFiJvutIsF6EfX8=";
+    hash = "sha256-wnU24EmZig2W/psy4OhaQVy2WwR0CgljlyYwOg4bzwM=";
  };

  nativeBuildInputs = [
-    cmake pkg-config wrapQtAppsHook
+    cmake
+    pkg-config
+    wrapQtAppsHook
    (lib.getDev qttools)
  ];

-  buildInputs = [
-    qtbase qtdeclarative qtgraphicaleffects
-    qtmultimedia qtquickcontrols qtquickcontrols2
-    qtxmlpatterns
-    monero-cli miniupnpc unbound readline
-    randomx libgcrypt libgpg-error
-    boost libunwind libsodium pcsclite
-    zeromq hidapi rapidjson quirc
-  ] ++ lib.optionals trezorSupport [ libusb1 protobuf python3 ]
-    ++ lib.optionals stdenv.isDarwin [ qtmacextras ];
+  buildInputs =
+    [
+      boost
+      libgcrypt
+      libgpg-error
+      libsodium
+      miniupnpc
+      qtbase
+      qtdeclarative
+      qtgraphicaleffects
+      qtmultimedia
+      qtquickcontrols
+      qtquickcontrols2
+      qtxmlpatterns
+      quirc
+      randomx
+      rapidjson
+      unbound
+      zeromq
+    ]
+    ++ lib.optionals stdenv.isDarwin [ qtmacextras ]
+    ++ lib.optionals trezorSupport [
+      hidapi
+      libusb1
+      protobuf_21
+      python3
+    ]
+    ++ lib.optionals (trezorSupport && stdenv.isLinux) [
+      udev
+    ];

  postUnpack = ''
    # copy monero sources here
@ -68,7 +113,12 @@ stdenv.mkDerivation rec {
      --replace 'add_subdirectory(external)' ""
  '';

-  cmakeFlags = [ "-DARCH=default" ];
+  cmakeFlags =
+    [ "-DARCH=default" ]
+    ++ lib.optional trezorSupport [
+      # fix build on recent gcc versions
+      "-DCMAKE_CXX_FLAGS=-fpermissive"
+    ];

  desktopItem = makeDesktopItem {
    name = "monero-wallet-gui";
@ -76,7 +126,7 @@ stdenv.mkDerivation rec {
    icon = "monero";
    desktopName = "Monero";
    genericName = "Wallet";
-    categories  = [ "Network" "Utility" ];
+    categories = [ "Network" "Utility" ];
  };

  postInstall = ''
@ -93,12 +143,12 @@ stdenv.mkDerivation rec {
    done;
  '';

-  meta = with lib; {
-    description  = "Private, secure, untraceable currency";
-    homepage     = "https://getmonero.org/";
-    license      = licenses.bsd3;
-    platforms    = platforms.all;
-    maintainers  = with maintainers; [ rnhmjoj ];
-    mainProgram  = "monero-wallet-gui";
+  meta = {
+    description = "Private, secure, untraceable currency";
+    homepage = "https://getmonero.org/";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ rnhmjoj ];
+    mainProgram = "monero-wallet-gui";
  };
 }
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@ -69,9 +69,9 @@ in rec {

  unstable = fetchurl rec {
    # NOTE: Don't forget to change the hash for staging as well.
-    version = "9.16";
+    version = "9.17";
    url = "https://dl.winehq.org/wine/source/9.x/wine-${version}.tar.xz";
-    hash = "sha256-iQQq6MgLIzP4p9GId/xBecB9Y1erfyjMvabQbzwzDFA=";
+    hash = "sha256-Ptt+tvMbtcP3N43VYj2p2V99TW18g3iv2JyOOjCqCAw=";
    inherit (stable) patches;

    ## see http://wiki.winehq.org/Gecko
@ -117,7 +117,7 @@ in rec {
  staging = fetchFromGitLab rec {
    # https://gitlab.winehq.org/wine/wine-staging
    inherit (unstable) version;
-    hash = "sha256-CUVUatw9SH/LwYwloGHsU8TFjAVQRhd3WBk4AP+2NH4=";
+    hash = "sha256-ez7P9R5Q7t+FpaU5bVer4n2bt+evgXLJb83gP+zxIAw=";
    domain = "gitlab.winehq.org";
    owner = "wine";
    repo = "wine-staging";
--- a/pkgs/applications/file-managers/mc/default.nix
+++ b/pkgs/applications/file-managers/mc/default.nix
@ -24,11 +24,11 @@

 stdenv.mkDerivation rec {
  pname = "mc";
-  version = "4.8.31";
+  version = "4.8.32";

  src = fetchurl {
    url = "https://www.midnight-commander.org/downloads/${pname}-${version}.tar.xz";
-    sha256 = "sha256-JBkc+GZ2dbjjH8Sp0YoKZb3AWYwsXE6gkklM0Tq0qxo=";
+    hash = "sha256-TdyD0e3pryNjs+q5h/VLh89mGTJBEM4tOg5wlE0TWf4=";
  };

  nativeBuildInputs = [ pkg-config unzip ]
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@ -6,7 +6,7 @@

 buildGoModule rec {
  pname = "rclone";
-  version = "1.67.0";
+  version = "1.68.0";

  outputs = [ "out" "man" ];

@ -14,10 +14,10 @@ buildGoModule rec {
    owner = "rclone";
    repo = "rclone";
    rev = "v${version}";
-    hash = "sha256-rTibyh5z89QuPgZMvv3Y6FCugxMIytAg1gdCxE3+QLE=";
+    hash = "sha256-xLTzfS3/9XBqh0B7/VeRKYEHAgc4rY3QcIUS3f1/e0M=";
  };

-  vendorHash = "sha256-Sw9zZf0rup+VyncIpJHp9PKUp60lv+TV4wbWtVTTK3w=";
+  vendorHash = "sha256-vZxdayoKTo/fs5PgEdT4gepNq0kNNmLQhlybWY5kpx0=";

  subPackages = [ "." ];

--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -13,16 +13,16 @@ let
  common = { stname, target, postInstall ? "" }:
    buildGoModule rec {
      pname = stname;
-      version = "1.27.9";
+      version = "1.27.12";

      src = fetchFromGitHub {
        owner = "syncthing";
        repo = "syncthing";
        rev = "v${version}";
-        hash = "sha256-9PKx5jxntG1QjDA+6XySxGahE1IrKKBl/Xk5ZaCAf5I=";
+        hash = "sha256-/HPq71KkWUE0vG7qUBD3JON4N5KBkuRWc4SvX/JA2nQ=";
      };

-      vendorHash = "sha256-Xv5x+/1lx8nyXw72eEHz7+qnkyZfPAnBtDRrOrD2l+g=";
+      vendorHash = "sha256-R5GlsCkfoMc5km+NaV+TNUlM3Ot1ARcXfEFimcZOLI4=";

      nativeBuildInputs = lib.optionals stdenv.isDarwin [
        # Recent versions of macOS seem to require binaries to be signed when
@ -61,14 +61,14 @@ let
        inherit (nixosTests) syncthing syncthing-init syncthing-relay;
      };

-      meta = with lib; {
+      meta = {
        homepage = "https://syncthing.net/";
        description = "Open Source Continuous File Synchronization";
        changelog = "https://github.com/syncthing/syncthing/releases/tag/v${version}";
-        license = licenses.mpl20;
-        maintainers = with maintainers; [ joko peterhoeg ];
+        license = lib.licenses.mpl20;
+        maintainers = with lib.maintainers; [ joko peterhoeg ];
        mainProgram = target;
-        platforms = platforms.unix;
+        platforms = lib.platforms.unix;
      };
    };

@ -90,17 +90,13 @@ in
    '' + lib.optionalString (stdenv.isLinux) ''
      mkdir -p $out/lib/systemd/{system,user}

-      substitute etc/linux-systemd/system/syncthing-resume.service \
-                 $out/lib/systemd/system/syncthing-resume.service \
-                 --replace /usr/bin/pkill ${procps}/bin/pkill
-
      substitute etc/linux-systemd/system/syncthing@.service \
                 $out/lib/systemd/system/syncthing@.service \
-                 --replace /usr/bin/syncthing $out/bin/syncthing
+                 --replace-fail /usr/bin/syncthing $out/bin/syncthing

      substitute etc/linux-systemd/user/syncthing.service \
                 $out/lib/systemd/user/syncthing.service \
-                 --replace /usr/bin/syncthing $out/bin/syncthing
+                 --replace-fail /usr/bin/syncthing $out/bin/syncthing
    '';
  };

@ -118,7 +114,7 @@ in

      substitute cmd/strelaysrv/etc/linux-systemd/strelaysrv.service \
                 $out/lib/systemd/system/strelaysrv.service \
-                 --replace /usr/bin/strelaysrv $out/bin/strelaysrv
+                 --replace-fail /usr/bin/strelaysrv $out/bin/strelaysrv
    '';
  };
 }
--- a/pkgs/applications/virtualization/xen/README.md
+++ b/pkgs/applications/virtualization/xen/README.md
@ -26,6 +26,7 @@ Some other notable packages that compose the Xen Ecosystem include:
 - `ocamlPackages.xenstore-tool`: XAPI's `oxenstore` utilities.
 - `xen-guest-agent`: Guest drivers for UNIX domUs.
 - `win-pvdrivers`: Guest drivers for Windows domUs.
+- `xtf`: The Xen Test Framework.

 ## Updating

@ -100,6 +101,8 @@ open a PR fixing the script, and update Xen manually:
   ```

   Change the value of `xenToEvaluate` to evaluate all relevant Xen packages.
+1. Run `xtf --all --host` as root when booted into the Xen update, and make
+   sure no tests fail.
 1. Clean up your changes and commit them, making sure to follow the
   [Nixpkgs Contribution Guidelines](../../../../CONTRIBUTING.md).
 1. Open a PR and await a review from the current maintainers.
--- a/pkgs/by-name/at/athens/package.nix
+++ b/pkgs/by-name/at/athens/package.nix
@ -1,24 +1,29 @@
-{ lib
-, fetchFromGitHub
-, buildGoModule
-, testers
-, athens
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  testers,
+  athens,
 }:
+
 buildGoModule rec {
  pname = "athens";
-  version = "0.14.1";
+  version = "0.15.1";

  src = fetchFromGitHub {
    owner = "gomods";
    repo = "athens";
    rev = "v${version}";
-    hash = "sha256-vpg5EcQSxVFjDFKa4oHwF5fNHhLWtj3ZMi2wbMZNn/8=";
+    hash = "sha256-JERyECQ3/pI+ApWyWvUwZqkGBmA+6pP7Uj+RfpUGsOw=";
  };

-  vendorHash = "sha256-LajNPzGbWqW+9aqiquk2LvSUjKwi1gbDY4cKXmn3PWk=";
+  vendorHash = "sha256-tCpwiqJHGRo9vqUh00k+tg4X6WNPnnknV7zjPkgs6Zs=";

  CGO_ENABLED = "0";
-  ldflags = [ "-s" "-w" "-X github.com/gomods/athens/pkg/build.version=${version}" ];
+  ldflags = [
+    "-s"
+    "-X github.com/gomods/athens/pkg/build.version=${version}"
+  ];

  subPackages = [ "cmd/proxy" ];

@ -27,9 +32,7 @@ buildGoModule rec {
  '';

  passthru = {
-    tests.version = testers.testVersion {
-      package = athens;
-    };
+    tests.version = testers.testVersion { package = athens; };
  };

  meta = with lib; {
@ -38,7 +41,10 @@ buildGoModule rec {
    changelog = "https://github.com/gomods/athens/releases/tag/v${version}";
    license = licenses.mit;
    mainProgram = "athens";
-    maintainers = with maintainers; [ katexochen malt3 ];
+    maintainers = with maintainers; [
+      katexochen
+      malt3
+    ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/by-name/ca/capslock/package.nix
+++ b/pkgs/by-name/ca/capslock/package.nix
@ -1,37 +1,36 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
 }:

 buildGoModule rec {
  pname = "capslock";
-  version = "0.1.1";
+  version = "0.2.4";

  src = fetchFromGitHub {
    owner = "google";
    repo = "capslock";
    rev = "v${version}";
-    hash = "sha256-mGrq43YCjF137c5ynQxL7IXDCUbnbBLv5E0tw/boObE=";
+    hash = "sha256-xeezGU9bI1MwonSGv+XimSfboMQr/1TPMTduDQ+MP1g=";
  };

-  vendorHash = "sha256-WTbHcVARbz7cvAY7IZnACTrN5h9NXWXfxxEWq4hssOM=";
+  vendorHash = "sha256-Z4oj+af8jqqhgHQrTb+lkbIMMa/yOnvkMti/s+wiQsI=";

-  subPackages = [
-    "cmd/capslock"
-  ];
+  subPackages = [ "cmd/capslock" ];

  CGO_ENABLED = "0";

-  ldflags = [
-    "-s"
-    "-w"
-  ];
+  ldflags = [ "-s" ];

-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
    description = "Capability analysis CLI for Go packages that informs users of which privileged operations a given package can access";
    homepage = "https://github.com/google/capslock";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
    mainProgram = "capslock";
-    maintainers = with maintainers; [ katexochen ];
+    maintainers = with lib.maintainers; [ katexochen ];
  };
 }
--- a/pkgs/by-name/cr/cronutils/package.nix
+++ b/pkgs/by-name/cr/cronutils/package.nix
@ -1,14 +1,19 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchpatch
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  nix-update-script,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "cronutils";
  version = "1.10";

-  outputs = [ "out" "man" ];
+  outputs = [
+    "out"
+    "man"
+  ];

  src = fetchFromGitHub {
    owner = "google";
@ -43,12 +48,14 @@ stdenv.mkDerivation (finalAttrs: {
    "-Wno-format-nonliteral"
  ]);

-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
    changelog = "https://github.com/google/cronutils/releases/tag/version%2F${finalAttrs.version}";
    description = "Utilities to assist running periodic batch processing jobs";
    homepage = "https://github.com/google/cronutils";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ katexochen ];
-    platforms = platforms.all;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ katexochen ];
+    platforms = lib.platforms.all;
  };
 })
--- a/pkgs/by-name/fo/formatjson5/package.nix
+++ b/pkgs/by-name/fo/formatjson5/package.nix
@ -1,8 +1,10 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, stdenv
-, darwin
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  stdenv,
+  darwin,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage rec {
@ -19,13 +21,9 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-zPgaZPDyNVPmBXz6QwOYnmh/sbJ8aPST8znLMfIWejk=";

-  buildInputs = lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
+  buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];

-  cargoBuildFlags = [
-    "--example formatjson5"
-  ];
+  cargoBuildFlags = [ "--example formatjson5" ];

  postInstall =
    let
@ -35,6 +33,8 @@ rustPlatform.buildRustPackage rec {
      install -D target/${cargoTarget}/release/examples/formatjson5 $out/bin/formatjson5
    '';

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "JSON5 formatter";
    homepage = "https://github.com/google/json5format";
--- a/pkgs/by-name/go/goat/package.nix
+++ b/pkgs/by-name/go/goat/package.nix
@ -1,26 +1,31 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
 }:
+
 buildGoModule {
  pname = "goat";
-  version = "unstable-2022-08-15"; # Upstream currently isn't doing tags/releases.
+  version = "0-unstable-2024-07-31"; # Upstream currently isn't doing tags/releases.

  src = fetchFromGitHub {
    owner = "blampe";
    repo = "goat";
-    rev = "07bb911fe3106cc3c1d1097318a9fffe816b59fe";
-    hash = "sha256-gSSDp9Q2hGH85dkE7RoER5ig+Cz1oSOD0FNRBeTZM4U=";
+    rev = "177de93b192b8ffae608e5d9ec421cc99bf68402";
+    hash = "sha256-/DR6RN7dCROp18P7dgm4DMppwdtYl0AOVNMEtXz8ldk=";
  };

  vendorHash = "sha256-24YllmSUzRcqWbJ8NLyhsJaoGG2+yE8/eXX6teJ1nV8=";

-  meta = with lib; {
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
+  meta = {
    description = "Go ASCII Tool. Render ASCII art as SVG diagrams";
    homepage = "https://github.com/blampe/goat";
-    license = licenses.mit;
-    maintainers = with maintainers; [ katexochen ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ katexochen ];
    mainProgram = "goat";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
  };
 }
--- a/pkgs/by-name/hp/hpp-fcl/package.nix
+++ b/pkgs/by-name/hp/hpp-fcl/package.nix
@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  doxygen,
+  boost,
+  eigen,
+  assimp,
+  octomap,
+  qhull,
+  pythonSupport ? false,
+  python3Packages,
+  zlib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hpp-fcl";
+  version = "2.4.5";
+
+  src = fetchFromGitHub {
+    owner = "humanoid-path-planner";
+    repo = "hpp-fcl";
+    rev = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-0OORdtT7vMpvK3BPJvtvuLcz0+bfu1+nVvzs3y+LyQw=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    doxygen
+  ] ++ lib.optionals pythonSupport [ python3Packages.numpy ];
+
+  propagatedBuildInputs =
+    [
+      assimp
+      qhull
+      octomap
+      zlib
+    ]
+    ++ lib.optionals (!pythonSupport) [
+      boost
+      eigen
+    ]
+    ++ lib.optionals pythonSupport [
+      python3Packages.boost
+      python3Packages.eigenpy
+    ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "HPP_FCL_HAS_QHULL" true)
+    (lib.cmakeBool "INSTALL_DOCUMENTATION" true)
+    (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport)
+  ];
+
+  doCheck = true;
+  # pythonImportsCheck, but in stdenv.mkDerivation
+  postInstall = lib.optionalString pythonSupport ''
+    PYTHONPATH=$out/${python3Packages.python.sitePackages}:$PYTHONPATH
+    python -c "import hppfcl"
+  '';
+
+  outputs = [
+    "dev"
+    "out"
+    "doc"
+  ];
+  postFixup = ''
+    moveToOutput share/ament_index "$dev"
+    moveToOutput share/${finalAttrs.pname} "$dev"
+  '';
+
+  meta = {
+    description = "Extension of the Flexible Collision Library";
+    homepage = "https://github.com/humanoid-path-planner/hpp-fcl";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ nim65s ];
+  };
+})
--- a/pkgs/by-name/ig/igvm-tooling/package.nix
+++ b/pkgs/by-name/ig/igvm-tooling/package.nix
@ -1,9 +1,11 @@
-{ lib
-, python3
-, fetchFromGitHub
-, fetchpatch
-, which
-, acpica-tools
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+  fetchpatch,
+  which,
+  acpica-tools,
+  nix-update-script,
 }:

 python3.pkgs.buildPythonApplication rec {
@ -38,18 +40,20 @@ python3.pkgs.buildPythonApplication rec {

  nativeBuildInputs = [ acpica-tools ];

-  propagatedBuildInputs = (with python3.pkgs; [
-    setuptools
-    ecdsa
-    cstruct
-    pyelftools
-    pytest
-    cached-property
-    frozendict
-  ]) ++ [
-    acpica-tools
-    which
-  ];
+  propagatedBuildInputs =
+    (with python3.pkgs; [
+      setuptools
+      ecdsa
+      cstruct
+      pyelftools
+      pytest
+      cached-property
+      frozendict
+    ])
+    ++ [
+      acpica-tools
+      which
+    ];

  postInstall = ''
    mkdir -p $out/share/igvm-tooling/acpi/acpi-clh
@ -58,11 +62,16 @@ python3.pkgs.buildPythonApplication rec {
    find $out/share/igvm-tooling/acpi -name "*.dsl" -exec iasl -f {} \;
  '';

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "IGVM Image Generator";
    homepage = "https://github.com/microsoft/igvm-tooling";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ malt3 katexochen ];
+    maintainers = with lib.maintainers; [
+      malt3
+      katexochen
+    ];
    changelog = "https://github.com/microsoft/igvm-tooling/releases/tag/igvm-${version}";
    mainProgram = "igvmgen";
    platforms = lib.platforms.all;
--- a/pkgs/by-name/in/inv-sig-helper/package.nix
+++ b/pkgs/by-name/in/inv-sig-helper/package.nix
@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+
+  # nativeBuildInputs
+  pkg-config,
+
+  # buildInputs
+  openssl,
+  darwin,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "inv-sig-helper";
+  version = "0-unstable-2024-08-17";
+
+  src = fetchFromGitHub {
+    owner = "iv-org";
+    repo = "inv_sig_helper";
+    rev = "215d32c76e5e9e598de6e4f8542316f80dd92f57";
+    hash = "sha256-Ge0XoWrscyZSrkmtDPkAnv96IVylKZTcgGgonbFV43I=";
+  };
+
+  cargoHash = "sha256-JVpLUhNJ7/4WZwLn/zOurpP8kF5WblF3nphJh6keHG8=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs =
+    [ openssl ]
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.Security
+      darwin.apple_sdk.frameworks.SystemConfiguration
+    ];
+
+  meta = {
+    description = "Rust service that decrypts YouTube signatures and manages player information";
+    homepage = "https://github.com/iv-org/inv_sig_helper";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    mainProgram = "inv_sig_helper_rust";
+  };
+}
--- a/pkgs/by-name/le/leftwm-config/package.nix
+++ b/pkgs/by-name/le/leftwm-config/package.nix
@ -0,0 +1,27 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "leftwm-config";
+  version = "0-unstable-2024-03-13";
+
+  src = fetchFromGitHub {
+    owner = "leftwm";
+    repo = "leftwm-config";
+    rev = "a9f2f21ece3a01d6c36610295ae3163644d3f99e";
+    hash = "sha256-wyb/26EyNyBJeTDUvnMxlMiQjaCGBES8t4VteNY1I/A=";
+  };
+
+  cargoHash = "sha256-U3mgbG9h2cDqr0aqxbI2CJUOweIoDXDxmsWg0zxolSo=";
+
+  meta = {
+    description = "Little satellite utility for LeftWM";
+    homepage = "https://github.com/leftwm/leftwm-config";
+    maintainers = with lib.maintainers; [ denperidge ];
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/le/leftwm-theme/package.nix
+++ b/pkgs/by-name/le/leftwm-theme/package.nix
@ -0,0 +1,43 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  openssl,
+  pkg-config,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "leftwm-theme";
+  version = "unstable-2024-03-05";
+
+  src = fetchFromGitHub {
+    owner = "leftwm";
+    repo = "leftwm-theme";
+    rev = "b394824ff874b269a90c29e2d45b0cacc4d209f5";
+    hash = "sha256-cV4tY1qKNluSSGf+WwKFK3iVE7cMevafl6qQvhy1flE=";
+  };
+
+  cargoHash = "sha256-VEQn1LFXiZCVR2WgOFoHo18d3cdIoq9/zNjg8GMs0j8=";
+
+  checkFlags = [
+    # direct writing /tmp
+    "--skip=models::config::test::test_config_new"
+    # with network access when testing
+    "--skip=operations::update::test::test_update_repos"
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  env = {
+    OPENSSL_NO_VENDOR = 1;
+  };
+
+  meta = {
+    description = "Theme manager for LeftWM";
+    homepage = "https://github.com/leftwm/leftwm-theme";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ denperidge ];
+  };
+}
--- a/pkgs/by-name/oe/oelint-adv/package.nix
+++ b/pkgs/by-name/oe/oelint-adv/package.nix
@ -6,13 +6,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "oelint-adv";
-  version = "5.7.2";
+  version = "6.0.0";
  format = "setuptools";

  src = fetchPypi {
    inherit version;
    pname = "oelint_adv";
-    hash = "sha256-nHtOSOAKbmbmihaL8qvXBOB76LaC9E95UFQ479X/Rgo=";
+    hash = "sha256-tN+DHLj/sey8CipQT5nnwym0JkiIkR8WJg2jKys+4Yk=";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication {
  pname = "renode-dts2repl";
-  version = "0-unstable-2024-08-30";
+  version = "0-unstable-2024-09-05";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "antmicro";
    repo = "dts2repl";
-    rev = "231e1330c3210d31f08bf739ef69f096f0732291";
-    hash = "sha256-oD67tMJ23FBZzELtTdFZ2E7AtKs9m3T6L1rRuibfvY8=";
+    rev = "3444d8aa86bb4ad3907c7d6886feafd65b8c2ff8";
+    hash = "sha256-aHSuu9dYmY4ZKs6bzJostzeO1hFgkt/VBAbs2Ntj6dU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/sn/snicat/package.nix
+++ b/pkgs/by-name/sn/snicat/package.nix
@ -1,31 +1,27 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
-, fetchpatch
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
 }:
+
 buildGoModule rec {
  pname = "snicat";
-  version = "0.0.1";
+  version = "0.0.1-unstable-2024-09-05";

  src = fetchFromGitHub {
    owner = "CTFd";
    repo = "snicat";
-    rev = version;
-    hash = "sha256-fFlTBOz127le2Y7F9KKhbcldcyFEpAU5QiJ4VCAPs9Y=";
+    rev = "8c8f06e59d5aedb9a97115a4e0eafa75b17a6cdf";
+    hash = "sha256-71wVth+VzEnGW8ErWmj6XjhNtVpx/q8lViIA71njwqU=";
  };

-  patches = [
-    # Migrate to Go modules
-    (fetchpatch {
-      url = "https://github.com/CTFd/snicat/commit/098a5ce3141bae5d2e188338d78517d710d10f70.patch";
-      hash = "sha256-pIdXViUz14nkvL1H3u3oFkm308XA2POtKIGZOKDO6p8=";
-    })
-  ];
-
  vendorHash = "sha256-27ykI9HK1jFanxwa6QrN6ZS548JbFNSZHaXr4ciCVOE=";
  proxyVendor = true;

-  ldflags = [ "-s" "-X main.version=v${version}" ];
+  ldflags = [
+    "-s"
+    "-X main.version=v${version}"
+  ];

  postInstall = ''
    mv $out/bin/snicat $out/bin/sc
--- a/pkgs/by-name/te/templ/package.nix
+++ b/pkgs/by-name/te/templ/package.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "templ";
-  version = "0.2.771";
+  version = "0.2.778";

  src = fetchFromGitHub {
    owner = "a-h";
    repo = "templ";
    rev = "v${version}";
-    hash = "sha256-1S8rdq+dRVh5NulXZw70TC5NjaWb6YdIfT6NcZTvx8U=";
+    hash = "sha256-lU8aVTw73HX0lNGPyD8Xnvtnr2VFTXv/S6xCVn6Lg74=";
  };

  vendorHash = "sha256-ZWY19f11+UI18jeHYIEZjdb9Ii74mD6w+dYRLPkdfBU=";
--- a/pkgs/by-name/up/uplosi/package.nix
+++ b/pkgs/by-name/up/uplosi/package.nix
@ -1,8 +1,11 @@
-{ lib
-, fetchFromGitHub
-, buildGoModule
-, installShellFiles
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  installShellFiles,
+  nix-update-script,
 }:
+
 buildGoModule rec {
  pname = "uplosi";
  version = "0.3.0";
@ -17,7 +20,10 @@ buildGoModule rec {
  vendorHash = "sha256-o7PPgW3JL47G6Na5n9h3RasRMfU25FD1U/wCMaydRmc=";

  CGO_ENABLED = "0";
-  ldflags = [ "-s" "-w" "-X main.version=${version}" ];
+  ldflags = [
+    "-s"
+    "-X main.version=${version}"
+  ];

  nativeBuildInputs = [ installShellFiles ];

@ -28,13 +34,18 @@ buildGoModule rec {
      --zsh <($out/bin/uplosi completion zsh)
  '';

-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
    description = "Upload OS images to cloud provider";
    homepage = "https://github.com/edgelesssys/uplosi";
    changelog = "https://github.com/edgelesssys/uplosi/releases/tag/v${version}";
-    license = licenses.asl20;
+    license = lib.licenses.asl20;
    mainProgram = "uplosi";
-    maintainers = with maintainers; [ katexochen malt3 ];
-    platforms = platforms.unix;
+    maintainers = with lib.maintainers; [
+      katexochen
+      malt3
+    ];
+    platforms = lib.platforms.unix;
  };
 }
--- a/pkgs/by-name/xt/xtf/package.nix
+++ b/pkgs/by-name/xt/xtf/package.nix
@ -0,0 +1,78 @@
+{
+  lib,
+  fetchgit,
+  unstableGitUpdater,
+  stdenv,
+  doxygen,
+  graphviz,
+  python3Packages,
+}:
+
+stdenv.mkDerivation {
+  pname = "xtf";
+  version = "0-unstable-2024-07-25";
+
+  outputs = [
+    "out" # xtf-runner and test suite.
+    "doc" # Autogenerated HTML documentation website.
+    "dev" # Development headers.
+  ];
+
+  src = fetchgit {
+    url = "https://xenbits.xenproject.org/git-http/xtf.git";
+    rev = "f37c4574dd79d058c035be989ac6648508556a1a";
+    hash = "sha256-3eOKQXdyFX0iY90UruK8lLfnXQt+cOlvyW/KMj2hczQ=";
+  };
+
+  nativeBuildInputs =
+    (with python3Packages; [
+      python
+      wrapPython
+    ])
+    ++ [
+      doxygen
+      graphviz
+    ];
+
+  buildFlags = [ "doxygen" ];
+
+  installFlags = [
+    "xtfdir=$(out)/share/xtf"
+  ];
+
+  postInstall =
+    # Much like Xen, XTF installs its files to dist/nix/store/*/*,
+    # so we need to copy them to the right place.
+    ''
+      mkdir -p ''${!outputBin}/share
+      cp -prvd dist/nix/store/*/* ''${!outputBin}
+    ''
+    # The documentation and development headers aren't in the dist/
+    # folder, so we copy those too.
+    + ''
+      mkdir -p ''${!outputDoc}/share/doc/xtf
+      cp -prvd docs/autogenerated/html ''${!outputDoc}/share/doc/xtf
+
+      mkdir -p ''${!outputDev}/include
+      cp -prvd include ''${!outputDev}
+    ''
+    # Wrap xtf-runner, and link it to $out/bin.
+    # This is necessary because the real xtf-runner should
+    # be in the same directory as the tests/ directory.
+    + ''
+      wrapPythonProgramsIn "''${!outputBin}/share/xtf" "''${!outputBin} $pythonPath"
+      mkdir -p ''${!outputBin}/bin
+      ln -s ''${!outputBin}/share/xtf/xtf-runner ''${!outputBin}/bin/xtf-runner
+    '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    description = "Xen Test Framework and Suite for creating microkernel-based tests";
+    homepage = "https://xenbits.xenproject.org/docs/xtf/index.html";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ sigmasquadron ];
+    mainProgram = "xtf-runner";
+    platforms = lib.lists.intersectLists lib.platforms.linux lib.platforms.x86_64;
+  };
+}
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;

 buildNpmPackage rec {
  pname = "Iosevka${toString set}";
-  version = "31.5.0";
+  version = "31.6.0";

  src = fetchFromGitHub {
    owner = "be5invis";
    repo = "iosevka";
    rev = "v${version}";
-    hash = "sha256-kjydpYLOw1uZGmedemZKey0go8DRmgnUq5nrVM0NfxY=";
+    hash = "sha256-5FqfJCquF26Mbpm2pN9P1gg4B2nASZz9utFJWBgScLY=";
  };

-  npmDepsHash = "sha256-PpoSzHQMqdlGfcWvIH34ATcf4HZB+VbA6X7zqzV9xZk=";
+  npmDepsHash = "sha256-/qx+pnXbAgdkUCHH2SQSgI0omjrL3PLtni3iLbswd3c=";

  nativeBuildInputs = [
    remarshal
--- a/pkgs/desktops/deepin/apps/deepin-reader/use-pkg-config.diff
+++ b/pkgs/desktops/deepin/apps/deepin-reader/use-pkg-config.diff
@ -1,46 +0,0 @@
-diff --git a/3rdparty/deepin-pdfium/src/3rdparty/pdfium/pdfium.pri b/3rdparty/deepin-pdfium/src/3rdparty/pdfium/pdfium.pri
-index 3e04f340..894b0ac7 100755
--- a/3rdparty/deepin-pdfium/src/3rdparty/pdfium/pdfium.pri
-+++ b/3rdparty/deepin-pdfium/src/3rdparty/pdfium/pdfium.pri
-@@ -20,13 +20,8 @@ DEFINES +=  USE_SYSTEM_LIBJPEG \
-             USE_SYSTEM_LIBOPENJPEG2 \
-             USE_SYSTEM_FREETYPE
- 
-INCLUDEPATH += /usr/include/openjpeg-2.3 \
-               /usr/include/openjpeg-2.4 \
-               /usr/include/freetype2 \
-               /usr/include/freetype2/freetype \
-               /usr/include/freetype2/freetype/config
-
-LIBS += -lopenjp2 -llcms2 -lfreetype
-+CONFIG += link_pkgconfig
-+PKGCONFIG += libopenjp2 lcms2 freetype2
- 
- #QMAKE_CXXFLAGS += "-Wc++11-narrowing"  #is_clang
- #QMAKE_CXXFLAGS += "-Wno-inconsistent-missing-override"  #is_clang Suppress no override warning for overridden functions.
-diff --git a/3rdparty/deepin-pdfium/src/src.pro b/3rdparty/deepin-pdfium/src/src.pro
-index 196b91d3..bda71ff4 100755
--- a/3rdparty/deepin-pdfium/src/src.pro
-+++ b/3rdparty/deepin-pdfium/src/src.pro
-@@ -2,7 +2,9 @@ TARGET = $$PWD/../lib/deepin-pdfium
- 
- TEMPLATE = lib
- 
-CONFIG += c++14
-+CONFIG += c++14 link_pkgconfig
-+
-+PKGCONFIG += chardet
- 
- ###安全漏洞检测
- #QMAKE_CXX += -g -fsanitize=undefined,address -O2
-@@ -28,10 +30,6 @@ include($$PWD/3rdparty/pdfium/pdfium.pri)
- 
- INCLUDEPATH += $$PWD/../include
- 
-INCLUDEPATH += /usr/include/chardet
-
-LIBS += -lchardet
-
- public_headers += \
-     $$PWD/../include/dpdfglobal.h \
-     $$PWD/../include/dpdfdoc.h \
--- a/pkgs/development/compilers/openjdk/22.nix
+++ b/pkgs/development/compilers/openjdk/22.nix
@ -42,6 +42,7 @@
 , gtk3
 , glib
 , writeShellScript
+, versionCheckHook
 }:

 let
@ -254,6 +255,13 @@ stdenv.mkDerivation (finalAttrs: {
  pos = __curPos;
  meta = import ./meta.nix lib featureVersion;

+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/java";
+
+  doInstallCheck = true;
+
  passthru = {
    updateScript =
      let
--- a/pkgs/development/libraries/hpp-fcl/default.nix
+++ b/pkgs/development/libraries/hpp-fcl/default.nix
@ -1,74 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, cmake
-, doxygen
-, boost
-, eigen
-, assimp
-, octomap
-, qhull
-, pythonSupport ? false
-, python3Packages
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "hpp-fcl";
-  version = "2.4.5";
-
-  src = fetchFromGitHub {
-    owner = "humanoid-path-planner";
-    repo = "hpp-fcl";
-    rev = "v${finalAttrs.version}";
-    fetchSubmodules = true;
-    hash = "sha256-0OORdtT7vMpvK3BPJvtvuLcz0+bfu1+nVvzs3y+LyQw=";
-  };
-
-  strictDeps = true;
-
-  nativeBuildInputs = [
-    cmake
-    doxygen
-  ] ++ lib.optionals pythonSupport [
-    python3Packages.numpy
-  ];
-
-  propagatedBuildInputs = [
-    assimp
-    qhull
-    octomap
-  ] ++ lib.optionals (!pythonSupport) [
-    boost
-    eigen
-  ] ++ lib.optionals pythonSupport [
-    python3Packages.boost
-    python3Packages.eigenpy
-  ];
-
-  cmakeFlags = [
-    "-DHPP_FCL_HAS_QHULL=ON"
-    "-DINSTALL_DOCUMENTATION=ON"
-  ] ++ lib.optionals (!pythonSupport) [
-    "-DBUILD_PYTHON_INTERFACE=OFF"
-  ];
-
-  doCheck = true;
-  pythonImportsCheck = lib.optionals (!pythonSupport) [
-    "hppfcl"
-  ];
-
-  outputs = [ "dev" "out" "doc" ];
-  postFixup = ''
-    moveToOutput share/ament_index "$dev"
-    moveToOutput share/${finalAttrs.pname} "$dev"
-  '';
-
-
-  meta = with lib; {
-    description = "Extension of the Flexible Collision Library";
-    homepage = "https://github.com/humanoid-path-planner/hpp-fcl";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ nim65s ];
-    platforms = platforms.unix;
-  };
-})
--- a/pkgs/development/python-modules/cwl-utils/default.nix
+++ b/pkgs/development/python-modules/cwl-utils/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "cwl-utils";
-  version = "0.33";
+  version = "0.34";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "common-workflow-language";
    repo = "cwl-utils";
    rev = "refs/tags/v${version}";
-    hash = "sha256-+GvG5Uu2nQWYCcuAkBkegsmMCWhf269jH6Zcex99I4M=";
+    hash = "sha256-HzLDUhiFegYPWAKt3YoiWiunNHcDEx9FvRXwxKd7wp0=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/google-auth-oauthlib/default.nix
+++ b/pkgs/development/python-modules/google-auth-oauthlib/default.nix
@ -14,31 +14,32 @@

 buildPythonPackage rec {
  pname = "google-auth-oauthlib";
-  version = "1.2.0";
+  version = "1.2.1";
  pyproject = true;

  disabled = pythonOlder "3.6";

  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-KS0tN4M0nysHNKCgIHseHjIqwZPCwJ2PfGE/t8xQHqg=";
+    pname = "google_auth_oauthlib";
+    inherit version;
+    hash = "sha256-r9DK0JKi6qU82OgphVfW3hA0xstKdAUAtTV7ZIr5cmM=";
  };

-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [
+  dependencies = [
    google-auth
    requests-oauthlib
  ];

-  passthru.optional-dependencies = {
+  optional-dependencies = {
    tool = [ click ];
  };

  nativeCheckInputs = [
    mock
    pytestCheckHook
-  ] ++ passthru.optional-dependencies.tool;
+  ] ++ optional-dependencies.tool;

  disabledTests =
    [
@ -53,11 +54,11 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "google_auth_oauthlib" ];

  meta = with lib; {
-    changelog = "https://github.com/googleapis/google-auth-library-python-oauthlib/blob/v${version}/CHANGELOG.md";
    description = "Google Authentication Library: oauthlib integration";
    homepage = "https://github.com/GoogleCloudPlatform/google-auth-library-python-oauthlib";
+    changelog = "https://github.com/googleapis/google-auth-library-python-oauthlib/blob/v${version}/CHANGELOG.md";
    license = licenses.asl20;
-    mainProgram = "google-oauthlib-tool";
    maintainers = with maintainers; [ terlar ];
+    mainProgram = "google-oauthlib-tool";
  };
 }
--- a/pkgs/development/python-modules/mkdocstrings/default.nix
+++ b/pkgs/development/python-modules/mkdocstrings/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "mkdocstrings";
-  version = "0.26.0";
+  version = "0.26.1";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "mkdocstrings";
    repo = "mkdocstrings";
    rev = "refs/tags/${version}";
-    hash = "sha256-266Kd3jp35RBvN1t11OiWszV5ehsZUXZxXpU+dA9XSg=";
+    hash = "sha256-YV9Cncry+RXXGxRYN4dXp5E2msGA4Kq2QSvcPywWV2c=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "publicsuffixlist";
-  version = "1.0.2.20240906";
+  version = "1.0.2.20240907";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-AHvj0eyJKPGXEIk6Cu/q2cDDiGCDH/QvBPGm9Cfy2w8=";
+    hash = "sha256-+DzSFzdgGyirt8X+vW7fzofyHOLXbuVySxV+8CZ5ZlQ=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pyaussiebb/default.nix
+++ b/pkgs/development/python-modules/pyaussiebb/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "pyaussiebb";
-  version = "0.1.1";
+  version = "0.1.4";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -21,23 +21,23 @@ buildPythonPackage rec {
    owner = "yaleman";
    repo = "aussiebb";
    rev = "refs/tags/v${version}";
-    hash = "sha256-XNf9vYMlTLqhYIVNw9GjPcXpOm5EYCcC4aGukR8g3zc=";
+    hash = "sha256-IW2HraJbgvf0G1eRXNpnsPMWlLXi2P9DTyk+tG5Hc2U=";
  };

-  nativeBuildInputs = [ poetry-core ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'requests = "^2.27.1"' 'requests = "*"'
+  '';

-  propagatedBuildInputs = [
+  build-system = [ poetry-core ];
+
+  dependencies = [
    aiohttp
    requests
    loguru
    pydantic
  ];

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'requests = "^2.27.1"' 'requests = "*"'
-  '';
-
  # Tests require credentials and requests-testing
  doCheck = false;

--- a/pkgs/development/python-modules/pyexploitdb/default.nix
+++ b/pkgs/development/python-modules/pyexploitdb/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "pyexploitdb";
-  version = "0.2.33";
+  version = "0.2.34";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "pyExploitDb";
    inherit version;
-    hash = "sha256-K7IK1Cc8SvEgGvszEnSZepQ+ZvqoVdd+7QdnFk7imTk=";
+    hash = "sha256-5vWR6LNJknxVQ5Mmgw+c4clXhVQsHc68R1MMdzdsMgM=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pypoolstation/default.nix
+++ b/pkgs/development/python-modules/pypoolstation/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "pypoolstation";
-  version = "0.5.4";
+  version = "0.5.6";
  format = "pyproject";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-SA5Eqz0WoisVVAjeKQymVh17+fHa7SuiYXgOL2BiJcc=";
+    hash = "sha256-E5/Z7TgIZlbIDB9I+DJI812ce8ctidDAXGCHBFzk7F8=";
  };

  nativeBuildInputs = [ poetry-core ];
--- a/pkgs/development/python-modules/python-xz/default.nix
+++ b/pkgs/development/python-modules/python-xz/default.nix
@ -9,18 +9,18 @@
 buildPythonPackage rec {
  pname = "python-xz";
  version = "0.5.0";
-  format = "setuptools";
+  pyproject = true;

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
    hash = "sha256-oYjwQ26BFFXxvaYdzp2+bw/BQwM0v/n1r9DmaLs1R3Q=";
  };

-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [ setuptools-scm ];

-  # has no tests
+  # Module has no tests
  doCheck = false;

  pythonImportsCheck = [ "xz" ];
@ -28,6 +28,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Pure Python library for seeking within compressed xz files";
    homepage = "https://github.com/Rogdham/python-xz";
+    changelog = "https://github.com/Rogdham/python-xz/blob/v${version}/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with lib.maintainers; [ mxmlnkn ];
    platforms = platforms.all;
--- a/pkgs/development/python-modules/ratarmount/default.nix
+++ b/pkgs/development/python-modules/ratarmount/default.nix
@ -2,26 +2,43 @@
  lib,
  buildPythonPackage,
  fetchPypi,
-  pythonOlder,
  fusepy,
+  indexed-gzip,
+  indexed-zstd,
+  libarchive-c,
+  python-xz,
+  pythonOlder,
+  rapidgzip,
+  rarfile,
  ratarmountcore,
+  setuptools,
 }:

 buildPythonPackage rec {
  pname = "ratarmount";
-  version = "0.15.1";
-  format = "setuptools";
+  version = "0.15.2";
+  pyproject = true;

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-hprXZGgE2fpg8Km3gWO60e7teUB4Age5skNPc4p+wIg=";
+    hash = "sha256-1JAj9vA/aZLDvZC7j5PD1OL9n4I0gag4Ezc0i68OQsw=";
  };

-  propagatedBuildInputs = [
-    ratarmountcore
+  pythonRelaxDeps = [ "python-xz" ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
    fusepy
+    indexed-gzip
+    indexed-zstd
+    libarchive-c
+    python-xz
+    rapidgzip
+    rarfile
+    ratarmountcore
  ];

  checkPhase = ''
@ -34,10 +51,10 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Mounts archives as read-only file systems by way of indexing";
-    mainProgram = "ratarmount";
    homepage = "https://github.com/mxmlnkn/ratarmount";
+    changelog = "https://github.com/mxmlnkn/ratarmount/blob/v${version}/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with lib.maintainers; [ mxmlnkn ];
-    platforms = platforms.all;
+    mainProgram = "ratarmount";
  };
 }
--- a/pkgs/development/python-modules/ratarmountcore/default.nix
+++ b/pkgs/development/python-modules/ratarmountcore/default.nix
@ -2,53 +2,61 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  pythonOlder,
-  pytestCheckHook,
-  indexed-bzip2,
  indexed-gzip,
  indexed-zstd,
+  libarchive-c,
+  pytestCheckHook,
  python-xz,
-  setuptools,
+  pythonOlder,
  rapidgzip,
  rarfile,
+  setuptools,
  zstandard, # Python bindings
  zstd, # System tool
 }:

 buildPythonPackage rec {
  pname = "ratarmountcore";
-  version = "0.6.3";
+  version = "0.7.2";
  pyproject = true;

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.10";

  src = fetchFromGitHub {
    owner = "mxmlnkn";
    repo = "ratarmount";
    rev = "core-v${version}";
-    hash = "sha256-2jG066BUkhyHRqRyFAucQRJrjXQNw2ccCxERKkltO3Y=";
+    hash = "sha256-2LPGKdofx2ID8BU0dZhGiZ3tUkd+niEVGvTSBFX4InU=";
    fetchSubmodules = true;
  };

  sourceRoot = "${src.name}/core";

-  nativeBuildInputs = [ setuptools ];
-  propagatedBuildInputs = [
-    indexed-gzip
-    indexed-bzip2
-    indexed-zstd
-    python-xz
-    rapidgzip
-    rarfile
-  ];
+  build-system = [ setuptools ];

-  pythonImportsCheck = [ "ratarmountcore" ];
+  optional-dependencies = {
+    full = [
+      indexed-gzip
+      indexed-zstd
+      python-xz
+      rapidgzip
+      rarfile
+    ];
+    _7z = [ libarchive-c ];
+    bzip2 = [ rapidgzip ];
+    gzip = [ indexed-gzip ];
+    rar = [ rarfile ];
+    xz = [ python-xz ];
+    zstd = [ indexed-zstd ];
+  };

  nativeCheckInputs = [
    pytestCheckHook
    zstandard
    zstd
-  ];
+  ] ++ lib.flatten (builtins.attrValues optional-dependencies);
+
+  pythonImportsCheck = [ "ratarmountcore" ];

  disabledTestPaths = [
    # Disable this test because for arcane reasons running pytest with nix-build uses 10-100x
@ -60,9 +68,17 @@ buildPythonPackage rec {
    "tests/test_BlockParallelReaders.py"
  ];

+  disabledTests = [
+    # Tests with issues
+    "test_file_versions"
+    "test_stream_compressed"
+    "test_chimera_file"
+  ];
+
  meta = with lib; {
    description = "Library for accessing archives by way of indexing";
    homepage = "https://github.com/mxmlnkn/ratarmount/tree/master/core";
+    changelog = "https://github.com/mxmlnkn/ratarmount/blob/core-v${version}/core/CHANGELOG.md";
    license = licenses.mit;
    maintainers = with lib.maintainers; [ mxmlnkn ];
  };
--- a/pkgs/development/python-modules/ydata-profiling/default.nix
+++ b/pkgs/development/python-modules/ydata-profiling/default.nix
@ -28,7 +28,7 @@

 buildPythonPackage rec {
  pname = "ydata-profiling";
-  version = "4.8.3";
+  version = "4.9.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -36,14 +36,18 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "ydataai";
    repo = pname;
-    rev = "refs/tags/${version}";
-    hash = "sha256-tMwhoVnn65EvZK5NBvh/G36W8tH7I9qaL+NTK3IZVdI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-OZCgtnsLXLJ0m1t/mWqQTbFL8DPKaR9Tr7QCGT2HpvE=";
  };

  preBuild = ''
    echo ${version} > VERSION
  '';

+  pythonRelaxDeps = [
+    "scipy"
+  ];
+
  propagatedBuildInputs = [
    dacite
    htmlmin
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "sgt-puzzles";
-  version = "20240827.52afffa";
+  version = "20240909.53ceb98";

  src = fetchurl {
    url = "http://www.chiark.greenend.org.uk/~sgtatham/puzzles/puzzles-${version}.tar.gz";
-    hash = "sha256-G+FZnr7+XvvxDpBWyH4Dv8NEjSWTXDoVNzbzNpMTbLg=";
+    hash = "sha256-BRbTm6dnogzkAVYZjQ8/YTEB4A8edNa2yymR3KlqAE4=";
  };

  sgt-puzzles-menu = fetchurl {
--- a/pkgs/servers/monitoring/net-snmp/default.nix
+++ b/pkgs/servers/monitoring/net-snmp/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl
+{ lib, stdenv, fetchurl, fetchpatch
 , file, openssl, perl, nettools
 , autoreconfHook
 , withPerlTools ? false
@ -27,7 +27,11 @@ in stdenv.mkDerivation rec {
  in [
    (fetchAlpinePatch "fix-includes.patch" "0zpkbb6k366qpq4dax5wknwprhwnhighcp402mlm7950d39zfa3m")
    (fetchAlpinePatch "netsnmp-swinst-crash.patch" "0gh164wy6zfiwiszh58fsvr25k0ns14r3099664qykgpmickkqid")
-    (fetchAlpinePatch "fix-fd_mask.patch" "/i9ve61HjDzqZt+u1wajNtSQoizl+KePvhcAt24HKd0=")
+    (fetchpatch {
+      name = "configure-musl.patch";
+      url = "https://github.com/net-snmp/net-snmp/commit/a62169f1fa358be8f330ea8519ade0610fac525b.patch";
+      hash = "sha256-+vWH095fFL3wE6XLsTaPXgMDya0LRWdlL6urD5AIBUs=";
+    })
  ];

  outputs = [ "bin" "out" "dev" "lib" ];
--- a/pkgs/servers/nextcloud/packages/apps/hmr_enabler.nix
+++ b/pkgs/servers/nextcloud/packages/apps/hmr_enabler.nix
@ -0,0 +1,38 @@
+{
+  php,
+  fetchFromGitHub,
+  lib,
+}:
+
+php.buildComposerProject (finalAttrs: {
+  pname = "hmr_enabler";
+  # composer doesn't support our unstable version format
+  # version = "0-unstable-2024-08-24";
+  version = "0";
+
+  src = fetchFromGitHub {
+    owner = "nextcloud";
+    repo = "hmr_enabler";
+    rev = "d5d9d330d405ac4aa0de1a87d1133784560462ed";
+    hash = "sha256-uLCpwvMVQ20z9vlO5q/GVPnaaQZ7ZjE8+V/zuqaB9Yo=";
+  };
+
+  composerNoDev = false;
+
+  vendorHash = "sha256-ZuEEcFT+q49CCooEwdiu2Co345s0ZCC7jeEksi6A99A=";
+
+  postInstall = ''
+    chmod -R u+w $out/share
+    mv $out/share/php/hmr_enabler/* $out/
+    rm -r $out/share $out/composer.* $out/Makefile $out/psalm.xml $out/tests
+  '';
+
+  meta = {
+    description = " Development Nextcloud app to enable apps to use hot module reloading";
+    homepage = "https://github.com/nextcloud/hmr_enabler";
+    changelog = "https://github.com/nextcloud/hmr_enabler/blob/master/CHANGELOG.md";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ onny ];
+  };
+
+})
--- a/pkgs/servers/nextcloud/packages/default.nix
+++ b/pkgs/servers/nextcloud/packages/default.nix
@ -2,28 +2,58 @@
 # Licensed under: MIT
 # Slightly modified

-{ lib, pkgs, newScope, apps }:
+{
+  lib,
+  pkgs,
+  newScope,
+  apps,
+  callPackage,
+}:

-let packages = self:
-  let
-    generatedJson = {
-      inherit apps;
-    };
-    appBaseDefs = builtins.fromJSON (builtins.readFile ./nextcloud-apps.json);
+let
+  packages =
+    self:
+    let
+      generatedJson = {
+        inherit apps;
+      };
+      appBaseDefs = builtins.fromJSON (builtins.readFile ./nextcloud-apps.json);

-  in {
-    # Create a derivation from the official Nextcloud apps.
-    # This takes the data generated from the go tool.
-    mkNextcloudDerivation = self.callPackage ({ }: { pname, data }:
-      pkgs.fetchNextcloudApp {
-        appName = pname;
-        appVersion = data.version;
-        license = appBaseDefs.${pname};
-        inherit (data) url hash description homepage;
-      }) {};
+    in
+    {
+      # Create a derivation from the official Nextcloud apps.
+      # This takes the data generated from the go tool.
+      mkNextcloudDerivation = self.callPackage (
+        { }:
+        { pname, data }:
+        pkgs.fetchNextcloudApp {
+          appName = pname;
+          appVersion = data.version;
+          license = appBaseDefs.${pname};
+          inherit (data)
+            url
+            hash
+            description
+            homepage
+            ;
+        }
+      ) { };

-  } // lib.mapAttrs (type: pkgs:
-    lib.makeExtensible (_: lib.mapAttrs (pname: data: self.mkNextcloudDerivation { inherit pname; inherit data; }) pkgs))
-    generatedJson;
+    }
+    // lib.mapAttrs (
+      type: pkgs:
+      lib.makeExtensible (
+        _:
+        lib.mapAttrs (
+          pname: data:
+          self.mkNextcloudDerivation {
+            inherit pname data;
+          }
+        ) pkgs
+      )
+    ) generatedJson;

-in (lib.makeExtensible (_: (lib.makeScope newScope packages))).extend (selfNC: superNC: {})
+in
+(lib.makeExtensible (_: (lib.makeScope newScope packages))).extend (
+  import ./thirdparty.nix
+)
--- a/pkgs/servers/nextcloud/packages/thirdparty.nix
+++ b/pkgs/servers/nextcloud/packages/thirdparty.nix
@ -0,0 +1,12 @@
+_:
+{ apps, callPackage, ... }:
+{
+
+  apps = apps.extend (
+    self: super: {
+
+      hmr_enabler = callPackage ./apps/hmr_enabler.nix { };
+
+    }
+  );
+}
--- a/pkgs/servers/sqlpage/default.nix
+++ b/pkgs/servers/sqlpage/default.nix
@ -11,8 +11,8 @@

 let
  apexcharts = fetchurl {
-    url = "https://cdn.jsdelivr.net/npm/apexcharts@3.50.0/dist/apexcharts.min.js";
-    hash = "sha256-pLaS+eABqnCs0TLhRUEBQVLeF7RSlW5LjsmS7eV4iKI=";
+    url = "https://cdn.jsdelivr.net/npm/apexcharts@3.52.0/dist/apexcharts.min.js";
+    hash = "sha256-2sxp9+shRA5LMxzhgx+fpeQPIY2ZWgBdt4mp5V2Yn+E=";
  };
  tablerCss = fetchurl {
    url = "https://cdn.jsdelivr.net/npm/@tabler/core@1.0.0-beta20/dist/css/tabler.min.css";
@ -42,18 +42,18 @@ in

 rustPlatform.buildRustPackage rec {
  pname = "sqlpage";
-  version = "0.25.0";
+  version = "0.28.0";

  src = fetchFromGitHub {
    owner = "lovasoa";
    repo = "SQLpage";
    rev = "v${version}";
-    hash = "sha256-ixxTaJ72EqGqvopcIr/7kRfFyK9p5laAmu7+jR5Tp1I=";
+    hash = "sha256-veqkHjIbR4qENarmXHakDDG4Rxq9mUD/io+dfwaWAqg=";
  };

  postPatch = ''
    substituteInPlace sqlpage/apexcharts.js \
-      --replace-fail '/* !include https://cdn.jsdelivr.net/npm/apexcharts@3.50.0/dist/apexcharts.min.js */' \
+      --replace-fail '/* !include https://cdn.jsdelivr.net/npm/apexcharts@3.52.0/dist/apexcharts.min.js */' \
      "$(cat ${apexcharts})"
    substituteInPlace sqlpage/sqlpage.css \
      --replace-fail '/* !include https://cdn.jsdelivr.net/npm/@tabler/core@1.0.0-beta20/dist/css/tabler.min.css */' \
@ -75,7 +75,7 @@ rustPlatform.buildRustPackage rec {
      "$(cat ${tomselect})"
    '';

-  cargoHash = "sha256-yD82/h5dgcvp8OBfAoRfkq+YsauPncaRjfGM7dRQq5E=";
+  cargoHash = "sha256-idX3uU1nSI2a93srlJ1HvKcwVD0C4FmkQKTEYod5qgg=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/stdenv/freebsd/bootstrap-tools-spurious.txt
+++ b/pkgs/stdenv/freebsd/bootstrap-tools-spurious.txt
@ -149,7 +149,6 @@ lib/engines-3/capi.so
 lib/engines-3/devcrypto.so
 lib/engines-3/loader_attic.so
 lib/engines-3/padlock.so
-lib/freebsd/libclang_rt.builtins-x86_64.a
 lib/gawk/filefuncs.so
 lib/gawk/fnmatch.so
 lib/gawk/fork.so
--- a/pkgs/tools/filesystems/mtdutils/default.nix
+++ b/pkgs/tools/filesystems/mtdutils/default.nix
@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
    downloadPage = "https://git.infradead.org/mtd-utils.git";
    license = licenses.gpl2Plus;
    homepage = "http://www.linux-mtd.infradead.org/";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ skeuchel ];
    platforms = with platforms; linux;
  };
 }
--- a/pkgs/tools/graphics/exiftags/default.nix
+++ b/pkgs/tools/graphics/exiftags/default.nix
@ -23,5 +23,9 @@ stdenv.mkDerivation rec {
    license = lib.licenses.free;
    maintainers = [ ];
    platforms = with lib.platforms; unix;
+    knownVulnerabilities = [
+      "CVE-2023-50671"
+      "CVE-2024-42851"
+    ];
  };
 }
--- a/pkgs/tools/networking/mosh/default.nix
+++ b/pkgs/tools/networking/mosh/default.nix
@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
      especially over Wi-Fi, cellular, and long-distance links.
    '';
    license = licenses.gpl3Plus;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ skeuchel ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/tools/security/passage/default.nix
+++ b/pkgs/tools/security/passage/default.nix
@ -18,15 +18,15 @@
 , tree ? null
 }:

-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "passage";
-  version = "unstable-2022-05-01";
+  version = "1.7.4a2";

  src = fetchFromGitHub {
    owner = "FiloSottile";
    repo = "passage";
-    rev = "1262d308f09db9b243513a428ab4b8fb1c30d31d";
-    sha256 = "1val8wl9kzlxj4i1rrh2iiyf97w9akffvr0idvbkdb09hfzz4lz8";
+    rev = "${finalAttrs.version}";
+    hash = "sha256-tGHJFzDc2K117r5EMFdKsfw/+EpdZ0qzaExt+RGI4qo=";
  };

  patches = [
@ -77,4 +77,4 @@ stdenv.mkDerivation {
      passwords.
    '';
  };
-}
+})
--- a/pkgs/tools/text/igrep/default.nix
+++ b/pkgs/tools/text/igrep/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "igrep";
-  version = "1.2.0";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "konradsz";
    repo = "igrep";
    rev = "v${version}";
-    hash = "sha256-L5mHuglU0CvTi02pbR8xfezBoH8L/DS+7jgvYvb4yro=";
+    hash = "sha256-ZZhzBGLpzd9+rok+S/ypKpWXVzXaA1CnviC7LfgP/CU=";
  };

-  cargoHash = "sha256-k63tu5Ffus4z0yd8vQ79q4+tokWAXD05Pvv9JByfnDg=";
+  cargoHash = "sha256-raSz/+u7P04qHmvdfYoWKOKtNtaFlgmT8Nw0ImhCMkU=";

  buildInputs = lib.optionals stdenv.isDarwin [ Security ];

--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -5543,11 +5543,6 @@ with pkgs;

  loccount = callPackage ../development/tools/misc/loccount { };

-  logseq = callPackage ../by-name/lo/logseq/package.nix {
-    # electron version from: https://github.com/logseq/logseq/blob/0.10.9/package.json#L116
-    electron = electron_27;
-  };
-
  long-shebang = callPackage ../misc/long-shebang { };

  lssecret = callPackage ../misc/lssecret {};
@ -20682,8 +20677,6 @@ with pkgs;

  hound = callPackage ../development/tools/misc/hound { };

-  hpp-fcl = callPackage ../development/libraries/hpp-fcl { };
-
  hpx = callPackage ../development/libraries/hpx {
    boost = boost179;
    asio = asio.override { boost = boost179; };
@ -34929,7 +34922,7 @@ with pkgs;
  lndmanage = callPackage ../applications/blockchains/lndmanage { };

  monero-cli = callPackage ../applications/blockchains/monero-cli {
-    inherit (darwin.apple_sdk.frameworks) CoreData IOKit PCSC;
+    inherit (darwin.apple_sdk.frameworks) CoreData IOKit;
  };

  haven-cli = callPackage ../applications/blockchains/haven-cli {
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -841,7 +841,7 @@ with self; {
      url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/App-cpanminus-1.7047.tar.gz";
      hash = "sha256-lj5jxuGocl/y9iTpCGOWrhUNtR3QozfDeB0JqZSvBaU=";
    };
-    # Use TLS endpoints for downloads and metadata by default
+    # CVE-2024-45321: Use TLS endpoints for downloads and metadata
    preConfigure = ''
      substituteInPlace bin/cpanm \
        --replace-fail http://www.cpan.org https://www.cpan.org \