Merge remote-tracking branch 'origin/staging-next' into staging

2024-09-29 23:52:55 +00:00 · 2024-06-19 23:28:26 +02:00 · 2024-06-19 23:28:26 +02:00 · af4cfc1e0f
commit af4cfc1e0f
parent 4cc52593cd 11b7fc6440
105 changed files with 1575 additions and 1054 deletions
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -822,3 +822,4 @@ Module System:
 ### Internal {#sec-release-24.05-lib-internal}
 - `lib` now has [Readme for contributing](https://github.com/NixOS/nixpkgs/tree/master/lib#readme).
 - Some function's documentation is now written using the [accepted doc comment syntax](https://github.com/NixOS/rfcs/pull/145).
+- `odoo` has been updated from `16.0.20231024` to `17.0.20240507`.
--- a/nixos/modules/services/admin/docuum.nix
+++ b/nixos/modules/services/admin/docuum.nix
@ -2,7 +2,7 @@

 let
  cfg = config.services.docuum;
-  inherit (lib) mkIf mkEnableOption mkOption getExe types;
+  inherit (lib) mkIf mkEnableOption mkOption getExe types optionals concatMap;
 in
 {
  options.services.docuum = {
@ -14,6 +14,27 @@ in
      default = "10 GB";
      example = "50%";
    };
+
+    minAge = mkOption {
+      description = "Sets the minimum age of images to be considered for deletion.";
+      type = types.nullOr types.str;
+      default = null;
+      example = "1d";
+    };
+
+    keep = mkOption {
+      description = "Prevents deletion of images for which repository:tag matches the specified regex.";
+      type = types.listOf types.str;
+      default = [];
+      example = [ "^my-image" ];
+    };
+
+    deletionChunkSize = mkOption {
+      description = "Removes specified quantity of images at a time.";
+      type = types.int;
+      default = 1;
+      example = 10;
+    };
  };

  config = mkIf cfg.enable {
@ -35,10 +56,13 @@ in
        DynamicUser = true;
        StateDirectory = "docuum";
        SupplementaryGroups = [ "docker" ];
-        ExecStart = utils.escapeSystemdExecArgs [
+        ExecStart = utils.escapeSystemdExecArgs ([
          (getExe pkgs.docuum)
          "--threshold" cfg.threshold
-        ];
+          "--deletion-chunk-size" cfg.deletionChunkSize
+        ] ++ (concatMap (keep: [ "--keep" keep ]) cfg.keep)
+          ++ (optionals (cfg.minAge != null) [ "--min-age" cfg.minAge ])
+        );
      };
    };
  };
--- a/nixos/modules/services/misc/anki-sync-server.md
+++ b/nixos/modules/services/misc/anki-sync-server.md
@ -52,7 +52,7 @@ following options:

 ```nix
 {
-  services.anki-sync-server.host = "0.0.0.0";
+  services.anki-sync-server.address = "0.0.0.0";
  services.anki-sync-server.openFirewall = true;
 }
 ```
--- a/nixos/modules/services/misc/snapper.nix
+++ b/nixos/modules/services/misc/snapper.nix
@ -235,7 +235,7 @@ in
      timerConfig.OnUnitActiveSec = cfg.cleanupInterval;
    };

-    systemd.services.snapper-boot = lib.optionalAttrs cfg.snapshotRootOnBoot {
+    systemd.services.snapper-boot = lib.mkIf cfg.snapshotRootOnBoot {
      description = "Take snapper snapshot of root on boot";
      inherit documentation;
      serviceConfig.ExecStart = "${pkgs.snapper}/bin/snapper --config root create --cleanup-algorithm number --description boot";
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -414,6 +414,7 @@ in {
  pyload = handleTest ./pyload.nix {};
  oci-containers = handleTestOn ["aarch64-linux" "x86_64-linux"] ./oci-containers.nix {};
  odoo = handleTest ./odoo.nix {};
+  odoo16 = handleTest ./odoo.nix { package = pkgs.odoo16; };
  odoo15 = handleTest ./odoo.nix { package = pkgs.odoo15; };
  # 9pnet_virtio used to mount /nix partition doesn't support
  # hibernation. This test happens to work on x86_64-linux but
@ -834,7 +835,7 @@ in {
  scrutiny = handleTest ./scrutiny.nix {};
  sddm = handleTest ./sddm.nix {};
  seafile = handleTest ./seafile.nix {};
-  searx = handleTest ./searx.nix {};
+  searx = runTest ./searx.nix;
  seatd = handleTest ./seatd.nix {};
  service-runner = handleTest ./service-runner.nix {};
  sftpgo = runTest ./sftpgo.nix;
--- a/nixos/tests/odoo.nix
+++ b/nixos/tests/odoo.nix
@ -14,6 +14,18 @@ import ./make-test-python.nix ({ pkgs, lib, package ? pkgs.odoo, ...} : {
        package = package;
        domain = "localhost";
      };
+
+      # odoo does not automatically initialize its database,
+      # even if passing what _should_ be the equivalent of these options:
+      #  settings = {
+      #    options = {
+      #      database = "odoo";
+      #      init = "base";
+      #    };
+      #  };
+      systemd.services.odoo.preStart = ''
+        HOME=$STATE_DIRECTORY ${package}/bin/odoo -d odoo -i base --stop-after-init --without-demo all
+      '';
    };
  };

--- a/nixos/tests/searx.nix
+++ b/nixos/tests/searx.nix
@ -1,4 +1,4 @@
-import ./make-test-python.nix ({ pkgs, ...} :
+{ pkgs, ... }:

 {
  name = "searx";
@ -7,108 +7,108 @@ import ./make-test-python.nix ({ pkgs, ...} :
  };

  # basic setup: searx running the built-in webserver
-  nodes.base = { ... }: {
-    imports = [ ../modules/profiles/minimal.nix ];
+  nodes.base =
+    { ... }:
+    {
+      services.searx = {
+        enable = true;
+        environmentFile = pkgs.writeText "secrets" ''
+          WOLFRAM_API_KEY  = sometoken
+          SEARX_SECRET_KEY = somesecret
+        '';

-    services.searx = {
-      enable = true;
-      environmentFile = pkgs.writeText "secrets" ''
-        WOLFRAM_API_KEY  = sometoken
-        SEARX_SECRET_KEY = somesecret
-      '';
-
-      settings.server =
-        { port = "8080";
+        settings.server = {
+          port = "8080";
          bind_address = "0.0.0.0";
          secret_key = "@SEARX_SECRET_KEY@";
        };
-      settings.engines = [
-        { name = "wolframalpha";
-          api_key = "@WOLFRAM_API_KEY@";
-          engine = "wolframalpha_api";
-        }
-        { name = "startpage";
-          shortcut = "start";
-        }
-      ];
-    };
+        settings.engines = [
+          {
+            name = "wolframalpha";
+            api_key = "@WOLFRAM_API_KEY@";
+            engine = "wolframalpha_api";
+          }
+          {
+            name = "startpage";
+            shortcut = "start";
+          }
+        ];
+      };

-  };
+    };

  # fancy setup: run in uWSGI and use nginx as proxy
-  nodes.fancy = { config, ... }: {
-    imports = [ ../modules/profiles/minimal.nix ];
+  nodes.fancy =
+    { config, ... }:
+    {
+      services.searx = {
+        enable = true;
+        # searx refuses to run if unchanged
+        settings.server.secret_key = "somesecret";

-    services.searx = {
-      enable = true;
-      # searx refuses to run if unchanged
-      settings.server.secret_key = "somesecret";
+        runInUwsgi = true;
+        uwsgiConfig = {
+          # serve using the uwsgi protocol
+          socket = "/run/searx/uwsgi.sock";
+          chmod-socket = "660";

-      runInUwsgi = true;
-      uwsgiConfig = {
-        # serve using the uwsgi protocol
-        socket = "/run/searx/uwsgi.sock";
-        chmod-socket = "660";
-
-        # use /searx as url "mountpoint"
-        mount = "/searx=searx.webapp:application";
-        module = "";
-        manage-script-name = true;
+          # use /searx as url "mountpoint"
+          mount = "/searx=searx.webapp:application";
+          module = "";
+          manage-script-name = true;
+        };
      };
-    };

-    # use nginx as reverse proxy
-    services.nginx.enable = true;
-    services.nginx.virtualHosts.localhost = {
-      locations."/searx".extraConfig =
-        ''
+      # use nginx as reverse proxy
+      services.nginx.enable = true;
+      services.nginx.virtualHosts.localhost = {
+        locations."/searx".extraConfig = ''
          include ${pkgs.nginx}/conf/uwsgi_params;
          uwsgi_pass unix:/run/searx/uwsgi.sock;
        '';
-      locations."/searx/static/".alias = "${config.services.searx.package}/share/static/";
+        locations."/searx/static/".alias = "${config.services.searx.package}/share/static/";
+      };
+
+      # allow nginx access to the searx socket
+      users.users.nginx.extraGroups = [ "searx" ];
+
    };

-    # allow nginx access to the searx socket
-    users.users.nginx.extraGroups = [ "searx" ];
+  testScript = ''
+    base.start()

-  };
+    with subtest("Settings have been merged"):
+        base.wait_for_unit("searx-init")
+        base.wait_for_file("/run/searx/settings.yml")
+        output = base.succeed(
+            "${pkgs.yq-go}/bin/yq eval"
+            " '.engines[] | select(.name==\"startpage\") | .shortcut'"
+            " /run/searx/settings.yml"
+        ).strip()
+        assert output == "start", "Settings not merged"

-  testScript =
-    ''
-      base.start()
+    with subtest("Environment variables have been substituted"):
+        base.succeed("grep -q somesecret /run/searx/settings.yml")
+        base.succeed("grep -q sometoken /run/searx/settings.yml")
+        base.copy_from_vm("/run/searx/settings.yml")

-      with subtest("Settings have been merged"):
-          base.wait_for_unit("searx-init")
-          base.wait_for_file("/run/searx/settings.yml")
-          output = base.succeed(
-              "${pkgs.yq-go}/bin/yq eval"
-              " '.engines[] | select(.name==\"startpage\") | .shortcut'"
-              " /run/searx/settings.yml"
-          ).strip()
-          assert output == "start", "Settings not merged"
+    with subtest("Basic setup is working"):
+        base.wait_for_open_port(8080)
+        base.wait_for_unit("searx")
+        base.succeed(
+            "${pkgs.curl}/bin/curl --fail http://localhost:8080"
+        )
+        base.shutdown()

-      with subtest("Environment variables have been substituted"):
-          base.succeed("grep -q somesecret /run/searx/settings.yml")
-          base.succeed("grep -q sometoken /run/searx/settings.yml")
-          base.copy_from_vm("/run/searx/settings.yml")
-
-      with subtest("Basic setup is working"):
-          base.wait_for_open_port(8080)
-          base.wait_for_unit("searx")
-          base.succeed(
-              "${pkgs.curl}/bin/curl --fail http://localhost:8080"
-          )
-          base.shutdown()
-
-      with subtest("Nginx+uWSGI setup is working"):
-          fancy.start()
-          fancy.wait_for_open_port(80)
-          fancy.wait_for_unit("uwsgi")
-          fancy.succeed(
-              "${pkgs.curl}/bin/curl --fail http://localhost/searx >&2"
-          )
-          fancy.succeed(
-              "${pkgs.curl}/bin/curl --fail http://localhost/searx/static/themes/simple/js/leaflet.js >&2"
-          )
-    '';
-})
+    with subtest("Nginx+uWSGI setup is working"):
+        fancy.start()
+        fancy.wait_for_open_port(80)
+        fancy.wait_for_unit("uwsgi")
+        fancy.succeed(
+            "${pkgs.curl}/bin/curl --fail http://localhost/searx >&2"
+        )
+        fancy.succeed(
+            "${pkgs.curl}/bin/curl --fail http://localhost/searx/static/themes/simple/js/leaflet.js >&2"
+        )
+  '';
+}
--- a/nixos/tests/snapper.nix
+++ b/nixos/tests/snapper.nix
@ -19,7 +19,9 @@ import ./make-test-python.nix ({ ... }:
    services.snapper.filters = "/nix";
  };

-  testScript = ''
+  testScript = { nodes, ... }: let
+    inherit (nodes.machine.services.snapper) snapshotRootOnBoot;
+  in ''
    machine.succeed("btrfs subvolume create /home/.snapshots")
    machine.succeed("snapper -c home list")
    machine.succeed("snapper -c home create --description empty")
@ -31,5 +33,6 @@ import ./make-test-python.nix ({ ... }:
    machine.succeed("snapper -c home delete 2")
    machine.succeed("systemctl --wait start snapper-timeline.service")
    machine.succeed("systemctl --wait start snapper-cleanup.service")
+    machine.${if snapshotRootOnBoot then "succeed" else "fail"}("systemctl cat snapper-boot.service")
  '';
 })
--- a/pkgs/applications/display-managers/lightdm-slick-greeter/default.nix
+++ b/pkgs/applications/display-managers/lightdm-slick-greeter/default.nix
@ -22,13 +22,13 @@

 stdenv.mkDerivation rec {
  pname = "lightdm-slick-greeter";
-  version = "2.0.4";
+  version = "2.0.5";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "slick-greeter";
    rev = version;
-    sha256 = "sha256-1UOODak5YkoMLdIkN1rBIrlr3Zjj5SS2yx90vmF1prA=";
+    sha256 = "sha256-Q37CprukHvDRBcuPbfusKg2DY+JCwmjVX1+KnfSH2iw=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/editors/jetbrains/source/build.nix
+++ b/pkgs/applications/editors/jetbrains/source/build.nix
@ -30,7 +30,7 @@

 let

-  jbr = jetbrains.jdk-no-jcef;
+  jbr = jetbrains.jdk-no-jcef-17;

  ideaSrc = fetchFromGitHub {
    owner = "jetbrains";
--- a/pkgs/applications/file-managers/clifm/default.nix
+++ b/pkgs/applications/file-managers/clifm/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "clifm";
-  version = "1.18";
+  version = "1.19";

  src = fetchFromGitHub {
    owner = "leo-arch";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-tgCGZCLCWcF7ktXqDHjoUkeVqxg6QVOkZb7pbk3nA+U=";
+    hash = "sha256-QNxEvFZ5e4jQV2Tv2/D9KPRDoCoQlrqStFnbKVgcXxg=";
  };

  buildInputs = [
--- a/pkgs/applications/finance/odoo/update.sh
+++ b/pkgs/applications/finance/odoo/update.sh
@ -1,27 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused nix coreutils nix-prefetch
-
-set -euo pipefail
-
-DOCKER=$(curl -s https://raw.githubusercontent.com/odoo/docker/master/16.0/Dockerfile)
-
-get_var() {
-  echo "$DOCKER" | grep -E "^[A-Z][A-Z][A-Z] ODOO_$1" | sed -r "s|^[A-Z]{3} ODOO_$1.||g"
-}
-
-VERSION=$(get_var VERSION)
-RELEASE=$(get_var RELEASE)
-
-latestVersion="$VERSION.$RELEASE"
-currentVersion=$(nix-instantiate --eval -E "with import ./. {}; odoo.version or (lib.getVersion odoo)" | tr -d '"')
-
-if [[ "$currentVersion" == "$latestVersion" ]]; then
-  echo "odoo is up-to-date: $currentVersion"
-  exit 0
-fi
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-sed -ri "s| hash.+ # odoo| hash = \"$(nix-prefetch -q fetchzip --url "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.zip")\"; # odoo|g" default.nix
-sed -ri "s| odoo_version.+| odoo_version = \"$VERSION\";|" default.nix
-sed -ri "s| odoo_release.+| odoo_release = \"$RELEASE\";|" default.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -3,10 +3,10 @@
 {
  firefox = buildMozillaMach rec {
    pname = "firefox";
-    version = "127.0";
+    version = "127.0.1";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "5a17bce357e7f445c37540115f2c131ad5a055c0cf04f20bc2eaca18f8d241a99ac76739d172b38f2ad2681633f901a0a15893801082ac5db9e20e31fc8b8291";
+      sha512 = "13df770a89b703033601cab56892a2fc62427521936b366893008e68cd1f48d7b18917a3cede23764d024208819037ad0d28c2d4b73b99fdc204cbd53bb1297e";
    };

    extraPatches = [
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@ -128,6 +128,7 @@ in stdenv.mkDerivation rec {
    homepage    = "https://vivaldi.com";
    license     = licenses.unfree;
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    mainProgram = "vivaldi";
    maintainers = with maintainers; [ otwieracz badmutex ];
    platforms   = [ "x86_64-linux" "aarch64-linux" ];
  };
--- a/pkgs/applications/networking/cluster/kops/default.nix
+++ b/pkgs/applications/networking/cluster/kops/default.nix
@ -62,6 +62,12 @@ rec {
  };

  kops_1_28 = mkKops rec {
+    version = "1.28.5";
+    sha256 = "sha256-spw3lTrp6RlxkTNoZ/3Yz/U2tdvBnwiYORS2QtOSX9k=";
+    rev = "v${version}";
+  };
+
+  kops_1_29 = mkKops rec {
    version = "1.29.0";
    sha256 = "sha256-YneB9pc4IR+tYPRFE5CS+4JK/kPOHMo5/70A3k1x1tg=";
    rev = "v${version}";
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -1,97 +0,0 @@
-{ lib
-, stdenv
-, buildGoModule
-, fetchFromGitHub
-, installShellFiles
-, btrfs-progs
-, testers
-, werf
-}:
-
-buildGoModule rec {
-  pname = "werf";
-  version = "2.5.0";
-
-  src = fetchFromGitHub {
-    owner = "werf";
-    repo = "werf";
-    rev = "v${version}";
-    hash = "sha256-dZwZzBisQUmOz1lij6L0NHigXW2DtUd6s86sHYq8UPA=";
-  };
-
-  vendorHash = "sha256-cWOnIEvVer+USqNQJmhZ7pYSJfzY2xjq2oTxRd/y94w=";
-
-  proxyVendor = true;
-
-  subPackages = [ "cmd/werf" ];
-
-  nativeBuildInputs = [ installShellFiles ];
-
-  buildInputs = lib.optionals stdenv.isLinux [ btrfs-progs ]
-    ++ lib.optionals stdenv.hostPlatform.isGnu [ stdenv.cc.libc.static ];
-
-  CGO_ENABLED = if stdenv.isLinux then 1 else 0;
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X github.com/werf/werf/v2/pkg/werf.Version=${src.rev}"
-  ] ++ lib.optionals (CGO_ENABLED == 1) [
-    "-extldflags=-static"
-    "-linkmode external"
-  ];
-
-  tags = [
-    "containers_image_openpgp"
-    "dfrunmount"
-    "dfrunnetwork"
-    "dfrunsecurity"
-    "dfssh"
-  ] ++ lib.optionals (CGO_ENABLED == 1) [
-    "cni"
-    "exclude_graphdriver_devicemapper"
-    "netgo"
-    "no_devmapper"
-    "osusergo"
-    "static_build"
-  ];
-
-  preCheck = ''
-    # Test all targets.
-    unset subPackages
-
-    # Remove tests that require external services.
-    rm -rf \
-      integration/suites \
-      pkg/true_git/*test.go \
-      test/e2e
-  '' + lib.optionalString (CGO_ENABLED == 0) ''
-    # A workaround for osusergo.
-    export USER=nixbld
-  '';
-
-  postInstall = ''
-    installShellCompletion --cmd werf \
-      --bash <($out/bin/werf completion --shell=bash) \
-      --zsh <($out/bin/werf completion --shell=zsh)
-  '';
-
-  passthru.tests.version = testers.testVersion {
-    package = werf;
-    command = "werf version";
-    version = src.rev;
-  };
-
-  meta = with lib; {
-    description = "GitOps delivery tool";
-    mainProgram = "werf";
-    longDescription = ''
-      The CLI tool gluing Git, Docker, Helm & Kubernetes with any CI system to
-      implement CI/CD and Giterminism.
-    '';
-    homepage = "https://werf.io";
-    changelog = "https://github.com/werf/werf/releases/tag/${src.rev}";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ azahi ];
-  };
-}
--- a/pkgs/applications/networking/dnscontrol/default.nix
+++ b/pkgs/applications/networking/dnscontrol/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "dnscontrol";
-  version = "4.11.0";
+  version = "4.12.0";

  src = fetchFromGitHub {
    owner = "StackExchange";
    repo = "dnscontrol";
    rev = "v${version}";
-    hash = "sha256-TBLxwHiL3knM+GQoTYD2L/deASPpbUsDlGk4VeVmki4=";
+    hash = "sha256-W1X/d2Xf31xQWZH7ShH8Y6axhhyTOqxE/EjxNvR6pBU=";
  };

-  vendorHash = "sha256-kmnV1W0HGlxFZYYUeUd9D/zOabUhM5kDoTZTnRYJ2sM=";
+  vendorHash = "sha256-Dz45h33Rv4Pf5Lo0aok37MNrcbT8f/xrPPkGJMNBo8Y=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -21,14 +21,14 @@
 let
  pname = "qownnotes";
  appname = "QOwnNotes";
-  version = "24.6.1";
+  version = "24.6.3";
 in
 stdenv.mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-FS4VJtTh0LIrrIK+IJxSBqcEsNU7/e6KG3190FLAQC4=";
+    hash = "sha256-UdWyS5DalnGDoNEOx8d9MglKpJeqOXY1mTgLl3r/9gY=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/radio/qlog/default.nix
+++ b/pkgs/applications/radio/qlog/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "qlog";
-  version = "0.35.2";
+  version = "0.36.0";

  src = fetchFromGitHub {
    owner = "foldynl";
    repo = "QLog";
    rev = "v${version}";
-    hash = "sha256-3ht3/J4uJ7Nyfp0xpVDYa8GnV/EvHjf09XGSEBLRGZU=";
+    hash = "sha256-YbjtN08zEj8rlRDC5tS/JsBOH70DV98wmL6pFQTehgg=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -10,7 +10,7 @@ rec {
      , tiniRev, tiniHash
      , buildxSupport ? true, composeSupport ? true, sbomSupport ? false
      # package dependencies
-      , stdenv, fetchFromGitHub, fetchpatch, buildGoPackage
+      , stdenv, fetchFromGitHub, fetchpatch, buildGoModule
      , makeWrapper, installShellFiles, pkg-config, glibc
      , go-md2man, go, containerd, runc, tini, libtool
      , sqlite, iproute2, docker-buildx, docker-compose, docker-sbom
@ -23,7 +23,7 @@ rec {
      , withSeccomp ? stdenv.isLinux, libseccomp
    }:
  let
-    docker-runc = runc.overrideAttrs (oldAttrs: {
+    docker-runc = runc.overrideAttrs {
      pname = "docker-runc";
      inherit version;

@ -36,7 +36,7 @@ rec {

      # docker/runc already include these patches / are not applicable
      patches = [];
-    });
+    };

    docker-containerd = containerd.overrideAttrs (oldAttrs: {
      pname = "docker-containerd";
@ -53,7 +53,7 @@ rec {
        ++ lib.optionals withSeccomp [ libseccomp ];
    });

-    docker-tini = tini.overrideAttrs (oldAttrs: {
+    docker-tini = tini.overrideAttrs {
      pname = "docker-init";
      inherit version;

@ -70,7 +70,7 @@ rec {
      buildInputs = [ glibc glibc.static ];

      env.NIX_CFLAGS_COMPILE = "-DMINIMAL=ON";
-    });
+    };

    moby-src = fetchFromGitHub {
      owner = "moby";
@ -79,13 +79,13 @@ rec {
      hash = mobyHash;
    };

-    moby = buildGoPackage (lib.optionalAttrs stdenv.isLinux rec {
+    moby = buildGoModule (lib.optionalAttrs stdenv.isLinux rec {
      pname = "moby";
      inherit version;

      src = moby-src;

-      goPackagePath = "github.com/docker/docker";
+      vendorHash = null;

      nativeBuildInputs = [ makeWrapper pkg-config go-md2man go libtool installShellFiles ];
      buildInputs = [ sqlite ]
@ -126,16 +126,13 @@ rec {
      buildPhase = ''
        export GOCACHE="$TMPDIR/go-cache"
        # build engine
-        cd ./go/src/${goPackagePath}
        export AUTO_GOPATH=1
        export DOCKER_GITCOMMIT="${cliRev}"
        export VERSION="${version}"
        ./hack/make.sh dynbinary
-        cd -
      '';

      installPhase = ''
-        cd ./go/src/${goPackagePath}
        install -Dm755 ./bundles/dynbinary-daemon/dockerd $out/libexec/docker/dockerd
        install -Dm755 ./bundles/dynbinary-daemon/docker-proxy $out/libexec/docker/docker-proxy

@ -149,7 +146,7 @@ rec {

        # systemd
        install -Dm644 ./contrib/init/systemd/docker.service $out/etc/systemd/system/docker.service
-        substituteInPlace $out/etc/systemd/system/docker.service --replace /usr/bin/dockerd $out/bin/dockerd
+        substituteInPlace $out/etc/systemd/system/docker.service --replace-fail /usr/bin/dockerd $out/bin/dockerd
        install -Dm644 ./contrib/init/systemd/docker.socket $out/etc/systemd/system/docker.socket

        # rootless Docker
@ -169,7 +166,7 @@ rec {
      ++ lib.optional sbomSupport docker-sbom;
    pluginsRef = symlinkJoin { name = "docker-plugins"; paths = plugins; };
  in
-  buildGoPackage (lib.optionalAttrs (!clientOnly) {
+  buildGoModule (lib.optionalAttrs (!clientOnly) {
    # allow overrides of docker components
    # TODO: move packages out of the let...in into top-level to allow proper overrides
    inherit docker-runc docker-containerd docker-tini moby;
@ -184,7 +181,7 @@ rec {
      hash = cliHash;
    };

-    goPackagePath = "github.com/docker/cli";
+    vendorHash = null;

    nativeBuildInputs = [
      makeWrapper pkg-config go-md2man go libtool installShellFiles
@ -197,9 +194,9 @@ rec {

    postPatch = ''
      patchShebangs man scripts/build/
-      substituteInPlace ./scripts/build/.variables --replace "set -eu" ""
+      substituteInPlace ./scripts/build/.variables --replace-fail "set -eu" ""
    '' + lib.optionalString (plugins != []) ''
-      substituteInPlace ./cli-plugins/manager/manager_unix.go --replace /usr/libexec/docker/cli-plugins \
+      substituteInPlace ./cli-plugins/manager/manager_unix.go --replace-fail /usr/libexec/docker/cli-plugins \
          "${pluginsRef}/libexec/docker/cli-plugins"
    '';

@ -207,7 +204,6 @@ rec {
    buildPhase = ''
      export GOCACHE="$TMPDIR/go-cache"

-      cd ./go/src/${goPackagePath}
      # Mimic AUTO_GOPATH
      mkdir -p .gopath/src/github.com/docker/
      ln -sf $PWD .gopath/src/github.com/docker/cli
@ -215,17 +211,14 @@ rec {
      export GITCOMMIT="${cliRev}"
      export VERSION="${version}"
      export BUILDTIME="1970-01-01T00:00:00Z"
-      source ./scripts/build/.variables
-      export CGO_ENABLED=1
-      go build -tags pkcs11 --ldflags "$GO_LDFLAGS" github.com/docker/cli/cmd/docker
-      cd -
+      make dynbinary
+
    '';

    outputs = ["out"] ++ lib.optional (lib.versionOlder version "23") "man";

    installPhase = ''
-      cd ./go/src/${goPackagePath}
-      install -Dm755 ./docker $out/libexec/docker/docker
+      install -Dm755 ./build/docker $out/libexec/docker/docker

      makeWrapper $out/libexec/docker/docker $out/bin/docker \
        --prefix PATH : "$out/libexec/docker:$extraPath"
--- a/pkgs/applications/virtualization/docker/distribution.nix
+++ b/pkgs/applications/virtualization/docker/distribution.nix
@ -1,23 +0,0 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
-
-buildGoPackage rec {
-  pname = "distribution";
-  version = "2.8.3";
-  rev = "v${version}";
-
-  goPackagePath = "github.com/docker/distribution";
-
-  src = fetchFromGitHub {
-    owner = "docker";
-    repo = "distribution";
-    inherit rev;
-    sha256 = "sha256-6/clOTkI1JnDjb+crcHmjbQlaqffP/sntGqUB2ftajU=";
-  };
-
-  meta = with lib; {
-    description = "Docker toolset to pack, ship, store, and deliver content";
-    license = licenses.asl20;
-    maintainers = [];
-    platforms = platforms.unix;
-  };
-}
--- a/pkgs/applications/window-managers/hyprwm/hyprland-protocols/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-protocols/default.nix
@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "hyprland-protocols";
-  version = "0.2";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "hyprwm";
    repo = finalAttrs.pname;
    rev = "v${finalAttrs.version}";
-    hash = "sha256-QPzwwlGKX95tl6ZEshboZbEwwAXww6lNLdVYd6T9Mrc=";
+    hash = "sha256-HUklK5u86w2Yh9dOkk4FdsL8eehcOZ95jPhLixGDRQY=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/coyim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/coyim/default.nix
@ -1,6 +1,6 @@
 { lib
 , stdenv
-, buildGoPackage
+, buildGoModule
 , fetchFromGitHub
 , pkg-config
 , cairo
@ -11,28 +11,28 @@
 , gtk3
 }:

-buildGoPackage rec {
+buildGoModule {
  pname = "coyim";
-  version = "0.4.1";
-
-  goPackagePath = "github.com/coyim/coyim";
+  version = "0.4.1-unstable-2023-09-21";

  src = fetchFromGitHub {
    owner = "coyim";
    repo = "coyim";
-    rev = "v${version}";
-    sha256 = "sha256-PmB6POaHKEXzIAaz3lAbUOhtVOzrj5oXRk90giYo6SI=";
+    rev = "3f84daa8c27277543b1b4ad4536dde5100d9df12";
+    sha256 = "sha256-lzhcUSBuAgYwcmdwnqNxKG0P6ZSjWeLS/g/gaF171D4=";
  };

+  vendorHash = "sha256-zG7r/Db6XiwKoHRduGj3tEh/KT1hsuBoSGLYaZ+qO0Y=";
+
  nativeBuildInputs = [ pkg-config wrapGAppsHook3 ];

  buildInputs = [ glib cairo gdk-pixbuf gtk3 gnome.adwaita-icon-theme ];

-  meta = with lib; {
+  meta = {
    description = "Safe and secure chat client";
    mainProgram = "coyim";
    homepage = "https://coy.im/";
-    license = licenses.gpl3;
+    license = lib.licenses.gpl3;
    platforms = [ "x86_64-linux" "x86_64-darwin" ];
    broken = stdenv.isDarwin;
  };
--- a/pkgs/by-name/di/distribution/package.nix
+++ b/pkgs/by-name/di/distribution/package.nix
@ -0,0 +1,67 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, fetchpatch
+, nix-update-script
+, testers
+, distribution
+}:
+
+buildGoModule rec {
+  pname = "distribution";
+  version = "3.0.0-alpha.1";
+
+  src = fetchFromGitHub {
+    owner = "distribution";
+    repo = "distribution";
+    rev = "v${version}";
+    hash = "sha256-reguAtBkEC9OMUTdCtFY6l0fkk28VoA0IlPcQ0sz84I=";
+  };
+
+  patches = [
+    # fix: load gcs credentials and client inside DriverConstructor
+    # Needed to pass the tests. Remove with next update.
+    (fetchpatch {
+      url = "https://github.com/distribution/distribution/commit/14366a2dff6a8f595e39d258085381731b43cec6.diff";
+      hash = "sha256-0ns9JuIeLBzRLMVxY6uaWTIYcRRbuwQ+n9tmK+Pvf4U=";
+    })
+    # fix: add missing skip in s3 driver test
+    # Needed to pass the tests. Remove with next update.
+    (fetchpatch {
+      url = "https://github.com/distribution/distribution/commit/6908e0d5facd31ed32046df03a09040c964be0b3.patch";
+      hash = "sha256-ww+BwBGw+dkZ2FhVzynehR+sNYCgq8/KkPDP9ac6NWg=";
+    })
+  ];
+
+  vendorHash = null;
+
+  checkFlags = [
+    # TestHTTPChecker: requires internet access.
+    # TestInMemoryDriverSuite: timeout after 10 minutes, looks like a deadlock.
+    "-skip=^TestHTTPChecker$|^TestInMemoryDriverSuite$"
+  ];
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = distribution;
+      version = "v${version}";
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = with lib; {
+    description = "Toolkit to pack, ship, store, and deliver container content";
+    longDescription = ''
+      Distribution is a Open Source Registry implementation for storing and distributing container
+      images and other content using the OCI Distribution Specification. The goal of this project
+      is to provide a simple, secure, and scalable base for building a large scale registry solution
+      or running a simple private registry.
+    '';
+    homepage = "https://distribution.github.io/distribution/";
+    changelog = "https://github.com/distribution/distribution/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = [ ];
+    mainProgram = "registry";
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/by-name/do/docfd/package.nix
+++ b/pkgs/by-name/do/docfd/package.nix
@ -21,7 +21,7 @@ let
 in
 buildDunePackage' rec {
  pname = "docfd";
-  version = "6.0.1";
+  version = "7.0.0";

  minimalOCamlVersion = "5.1";

@ -29,7 +29,7 @@ buildDunePackage' rec {
    owner = "darrenldl";
    repo = "docfd";
    rev = version;
-    hash = "sha256-pNBWSPII+r9MMmyXBzxQ6hMNrN7nwcdhrpufzj00s2E=";
+    hash = "sha256-R/UOA1rf9NnEQQWn/ToCZuUSC48DPqglrb+5ZjCdpb0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/do/docuum/package.nix
+++ b/pkgs/by-name/do/docuum/package.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "docuum";
-  version = "0.24.0";
+  version = "0.25.0";

  src = fetchFromGitHub {
    owner = "stepchowfun";
    repo = "docuum";
    rev = "v${version}";
-    hash = "sha256-/30wuLnCcomgJ14c5rNbitD1dEpvyRal3L60gQdZPBU=";
+    hash = "sha256-nWd6h39jU1eZWPFMxhxActsmrs9k0TDMlealuzTa+o0=";
  };

-  cargoHash = "sha256-BvZM0tAgwoOO0VFQEoifgmENnW3cfKV3Zj872/Lki6A=";
+  cargoHash = "sha256-uoQ1qUII6TSZsosAdNfs2CREVuN2kuT9Bmi5vuDT/rY=";

  checkFlags = [
    # fails, no idea why
--- a/pkgs/by-name/er/errands/package.nix
+++ b/pkgs/by-name/er/errands/package.nix
@ -17,7 +17,7 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "errands";
-  version = "46.2.2";
+  version = "46.2.3";

  pyproject = false;

@ -25,7 +25,7 @@ python3Packages.buildPythonApplication rec {
    owner = "mrvladus";
    repo = "Errands";
    rev = "refs/tags/${version}";
-    hash = "sha256-lX0exxZMbq/iC41bByMfT478vhOQadPJAN72PHiznKc=";
+    hash = "sha256-JBvyMWEUKUKeAOTCbzNwqpv2ox7bS9p+QsLkJv/lK8k=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fu/furmark/package.nix
+++ b/pkgs/by-name/fu/furmark/package.nix
@ -1,6 +1,7 @@
 {
  autoPatchelfHook,
  copyDesktopItems,
+  fetchurl,
  fetchzip,
  lib,
  libGL,
@ -79,6 +80,10 @@ stdenv.mkDerivation (finalAttrs: {
      comment = description;
      desktopName = name;
      genericName = name;
+      icon = fetchurl {
+        url = "https://www.geeks3d.com/furmark/i/20240220-furmark-logo-02.png";
+        hash = "sha256-EqhWQgTEmF/2AcqDxgGtr2m5SMYup28hPEhI6ssFw7g=";
+      };
      categories = [
        "System"
        "Monitor"
--- a/pkgs/by-name/fz/fzf-make/package.nix
+++ b/pkgs/by-name/fz/fzf-make/package.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "fzf-make";
-  version = "0.33.0";
+  version = "0.34.0";

  src = fetchFromGitHub {
    owner = "kyu08";
    repo = "fzf-make";
    rev = "v${version}";
-    hash = "sha256-ct4ugHqSekAZrkuFotjzMzcoJ0+P7d0Qhi79SqVZHPM=";
+    hash = "sha256-x+y0K6b/yCskowOuvjcSCJXM5ym2Qn84/Thui0ahUKU=";
  };

-  cargoHash = "sha256-0VhcpW56OePvHVFPG4QaK8ezvNUAuWyI5gztjuKFKVQ=";
+  cargoHash = "sha256-cIoc3sGy33iTkVAln4oSYSBGB0iAFanv746upxnv0ZA=";

  nativeBuildInputs = [ makeBinaryWrapper ];

--- a/pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix
+++ b/pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-online-accounts-gtk";
-  version = "3.50.2";
+  version = "3.50.3";

  src = fetchFromGitHub {
    owner = "xapp-project";
    repo = "gnome-online-accounts-gtk";
    rev = finalAttrs.version;
-    hash = "sha256-6yGesg/L/9syX990uDuw5Or/uEQ8DGPQYiCRRw4OMzY=";
+    hash = "sha256-peElSkGl2dYeJmMUeB+xDoOY3MhHs7IsIQYr0iJZP58=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gr/graphqlmaker/package.nix
+++ b/pkgs/by-name/gr/graphqlmaker/package.nix
@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "graphqlmaker";
+  version = "0-unstable-2024-05-18";
+
+  src = fetchFromGitHub {
+    owner = "xssdoctor";
+    repo = "graphqlMaker";
+    rev = "ff884ce39156d8458da35c0b0b5d7eb1e1146bb5";
+    hash = "sha256-H3AFCS1WoeVXUdXBV1JKrGIraJP/ql6XG++PxmWUico=";
+  };
+
+  vendorHash = "sha256-1mDOqTsQ3kHs3MEWlRcdqhjIRul7um2mfBAxObhoSlE=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = with lib; {
+    description = "Tool to find graphql queries in Javascript files";
+    homepage = "https://github.com/xssdoctor/graphqlMaker";
+    # https://github.com/xssdoctor/graphqlMaker/issues/1
+    license = licenses.unfree;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "graphqlMaker";
+  };
+}
--- a/pkgs/by-name/he/hednsextractor/package.nix
+++ b/pkgs/by-name/he/hednsextractor/package.nix
@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "hednsextractor";
+  version = "1.0.7";
+
+  src = fetchFromGitHub {
+    owner = "HuntDownProject";
+    repo = "HEDnsExtractor";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Uj5TNQ+X0+ip1DcLanMmFzr5ROuXhuZJSPF9tile+ZQ=";
+  };
+
+  vendorHash = "sha256-8yD/yHSqesyS71YeRBv4ARyXyIbTcan7YjBeKBrg0Vc=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = with lib; {
+    description = "Tool suite for hunting suspicious targets, expose domains and phishing discovery";
+    homepage = "https://github.com/HuntDownProject/HEDnsExtractor";
+    changelog = "https://github.com/HuntDownProject/HEDnsExtractor/releases/tag/v${version}";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "hednsextractor";
+  };
+}
--- a/pkgs/by-name/ko/kor/package.nix
+++ b/pkgs/by-name/ko/kor/package.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kor";
-  version = "0.4.2";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "yonahd";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-fyVMRHDzP7od+cwC01vNP/TOiDctD8E0y8uNWtgiEeA=";
+    hash = "sha256-5x0Zyk4gPMKcZtpgT0QbIm6NeWX+uJwT2NM+yS2oC3o=";
  };

-  vendorHash = "sha256-NPmsXS7P+pCF97N8x3nQhCRoHJLMO5plNtcUqxxexVE=";
+  vendorHash = "sha256-9aZy1i0VrDRySt5A5aQHBXa0mPgD+rsyeqQrd6snWKc=";

  preCheck = ''
    HOME=$(mktemp -d)
--- a/pkgs/by-name/lo/louvre/package.nix
+++ b/pkgs/by-name/lo/louvre/package.nix
@ -22,9 +22,9 @@
 }:
 stdenv.mkDerivation (self: {
  pname = "louvre";
-  version = "2.0.0-1";
+  version = "2.1.0-1";
  rev = "v${self.version}";
-  hash = "sha256-tDpgFtccMlGYrahEC4vlj5cfIzkqUl664ccRhcKIVTQ=";
+  hash = "sha256-qRvAryZ6SIhh5yDugcosVYOM2Tq0XPuaA6ib8/jWxNI=";

  src = fetchFromGitHub {
    inherit (self) rev hash;
--- a/pkgs/by-name/md/mdsh/package.nix
+++ b/pkgs/by-name/md/mdsh/package.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "mdsh";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "zimbatm";
    repo = "mdsh";
    rev = "v${version}";
-    hash = "sha256-ammLbKEKXDSuZMr4DwPpcRSkKh7BzNC+4ZRCqTNNCQk=";
+    hash = "sha256-vN8nFhbZgJIhFuFET9IOmdxT7uBKq/9X+TO9lZsDw6g=";
  };

-  cargoHash = "sha256-wLHMccxk3ceZyGK27t5Kyal48yj9dQNgmEHjH9hR9Pc=";
+  cargoHash = "sha256-0D1RSUJw7fszc9d4nrp+zCzr9l0xF4Ed8DbK5/O5bEY=";

  meta = with lib; {
    description = "Markdown shell pre-processor";
--- a/pkgs/by-name/no/novelwriter/package.nix
+++ b/pkgs/by-name/no/novelwriter/package.nix
@ -7,7 +7,7 @@
  nix-update-script,
 }:
 let
-  version = "2.4.3";
+  version = "2.4.4";
 in
 python3.pkgs.buildPythonApplication {
  pname = "novelwriter";
@ -18,7 +18,7 @@ python3.pkgs.buildPythonApplication {
    owner = "vkbo";
    repo = "novelWriter";
    rev = "v${version}";
-    hash = "sha256-PuoI/2JnbOFuSDTY3uDrySqPl/MGYna+QvSI7WQ8QMk=";
+    hash = "sha256-vYvrSRQTp/8jcCQIL6HgxdSJwogiPJKfVO+9hhK6emc=";
  };

  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
--- a/pkgs/by-name/od/odoo/package.nix
+++ b/pkgs/by-name/od/odoo/package.nix
@ -0,0 +1,111 @@
+{ stdenv
+, lib
+, fetchgit
+, fetchzip
+, python310
+, rtlcss
+, wkhtmltopdf
+, nixosTests
+, odoo_version ? "17.0"
+, odoo_release ? "20240610"
+}:
+
+let
+  python = python310.override {
+    packageOverrides = final: prev: {
+      # requirements.txt fixes docutils at 0.17; the default 0.21.1 tested throws exceptions
+      docutils-0_17 = prev.docutils.overridePythonAttrs (old: rec {
+        version = "0.17";
+        src = fetchgit {
+          url = "git://repo.or.cz/docutils.git";
+          rev = "docutils-${version}";
+          hash = "sha256-O/9q/Dg1DBIxKdNBOhDV16yy5ez0QANJYMjeovDoWX8=";
+        };
+        buildInputs = with prev; [setuptools];
+      });
+    };
+  };
+in python.pkgs.buildPythonApplication rec {
+  pname = "odoo";
+  version = "${odoo_version}.${odoo_release}";
+
+  format = "setuptools";
+
+  src = fetchzip {
+    # find latest version on https://nightly.odoo.com/${odoo_version}/nightly/src
+    url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.zip";
+    name = "${pname}-${version}";
+    hash = "sha256-blibGJyaz+MxMazOXhPbGBAJWZoGubirwSnjVYyLBJs="; # odoo
+  };
+
+  # needs some investigation
+  doCheck = false;
+
+  makeWrapperArgs = [
+    "--prefix" "PATH" ":" "${lib.makeBinPath [ wkhtmltopdf rtlcss ]}"
+  ];
+
+  propagatedBuildInputs = with python.pkgs; [
+    babel
+    chardet
+    cryptography
+    decorator
+    docutils-0_17  # sphinx has a docutils requirement >= 18
+    ebaysdk
+    freezegun
+    gevent
+    greenlet
+    idna
+    jinja2
+    libsass
+    lxml
+    markupsafe
+    num2words
+    ofxparse
+    passlib
+    pillow
+    polib
+    psutil
+    psycopg2
+    pydot
+    pyopenssl
+    pypdf2
+    pyserial
+    python-dateutil
+    python-ldap
+    python-stdnum
+    pytz
+    pyusb
+    qrcode
+    reportlab
+    requests
+    rjsmin
+    urllib3
+    vobject
+    werkzeug
+    xlrd
+    xlsxwriter
+    xlwt
+    zeep
+
+    setuptools
+    mock
+  ];
+
+  # takes 5+ minutes and there are not files to strip
+  dontStrip = true;
+
+  passthru = {
+    updateScript = ./update.sh;
+    tests = {
+      inherit (nixosTests) odoo;
+    };
+  };
+
+  meta = with lib; {
+    description = "Open Source ERP and CRM";
+    homepage = "https://www.odoo.com/";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ mkg20001 siriobalmelli ];
+  };
+}
--- a/pkgs/by-name/od/odoo/update.sh
+++ b/pkgs/by-name/od/odoo/update.sh
@ -0,0 +1,26 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused nix coreutils nix-prefetch
+
+set -euo pipefail
+
+VERSION="17.0" # must be incremented manually
+
+RELEASE="$(
+    curl "https://nightly.odoo.com/$VERSION/nightly/src/" |
+        sed -nE 's/.*odoo_'"$VERSION"'.(20[0-9]{6}).tar.gz.*/\1/p' |
+        tail -n 1
+)"
+
+latestVersion="$VERSION.$RELEASE"
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; odoo.version or (lib.getVersion odoo)" | tr -d '"')
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+    echo "odoo is up-to-date: $currentVersion"
+    exit 0
+fi
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+sed -ri "s| hash.+ # odoo| hash = \"$(nix-prefetch -q fetchzip --url "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.zip")\"; # odoo|g" package.nix
+sed -ri "s|, odoo_version \? .+|, odoo_version ? \"$VERSION\"|" package.nix
+sed -ri "s|, odoo_release \? .+|, odoo_release ? \"$RELEASE\"|" package.nix
--- a/pkgs/applications/finance/odoo/odoo15.nix
+++ b/pkgs/applications/finance/odoo/odoo15.nix
--- a/pkgs/applications/finance/odoo/default.nix
+++ b/pkgs/applications/finance/odoo/default.nix
@ -23,6 +23,9 @@ let
          inherit version;
          hash = "sha256-K4wORHtLnbzIXdl7butNy69si2w74L1lTiVVPgohV9g=";
        };
+        disabledTests = old.disabledTests ++ [
+          "test_response_body"
+        ];
      });
    };
  };
@ -99,7 +102,6 @@ in python.pkgs.buildPythonApplication rec {
  dontStrip = true;

  passthru = {
-    updateScript = ./update.sh;
    tests = {
      inherit (nixosTests) odoo;
    };
--- a/pkgs/by-name/op/openpgp-card-tools/package.nix
+++ b/pkgs/by-name/op/openpgp-card-tools/package.nix
@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "openpgp-card-tools";
-  version = "0.11.0";
+  version = "0.11.2";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "openpgp-card";
    repo = "openpgp-card-tools";
    rev = "v${version}";
-    hash = "sha256-GKBli6ybMDqB105POFEocU2X/xvd56V87k6Y6BsNt18=";
+    hash = "sha256-4PRUBzVy1sb15sYsbitBrOfQnsdbGKoR2OA4EjSc8B8=";
  };

-  cargoHash = "sha256-mLZErQhgRWDMdDC5tWjG9NCvLaSdF4A3uCdN8+QMWjU=";
+  cargoHash = "sha256-Jm1181WQfYZPKnu0f2om/hxkJ8Bm5AA/3IwBgZkpF0I=";

  nativeBuildInputs = [ pkg-config rustPlatform.bindgenHook ];

--- a/pkgs/by-name/op/openvas-scanner/package.nix
+++ b/pkgs/by-name/op/openvas-scanner/package.nix
@ -31,13 +31,13 @@

 stdenv.mkDerivation rec {
  pname = "openvas-scanner";
-  version = "23.4.0";
+  version = "23.4.1";

  src = fetchFromGitHub {
    owner = "greenbone";
    repo = "openvas-scanner";
    rev = "refs/tags/v${version}";
-    hash = "sha256-8/a8OkaulT0uZb3CllLo0CWqloVbYF/6CY7a/Xn48T8=";
+    hash = "sha256-D0HQ00NCep0hAQ+dDWoinIxivloqgjPbp2lUunTxoyM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/re/redocly/package.nix
+++ b/pkgs/by-name/re/redocly/package.nix
@ -8,16 +8,16 @@

 buildNpmPackage rec {
  pname = "redocly";
-  version = "1.14.0";
+  version = "1.15.0";

  src = fetchFromGitHub {
    owner = "Redocly";
    repo = "redocly-cli";
    rev = "@redocly/cli@${version}";
-    hash = "sha256-R5GSkRbe7GpdQ9y3PvRcWcl27HgEJMHyOLgR0zVF6jA=";
+    hash = "sha256-qGjFueL05f7DgDa0/B+w1Ix2tRx7PicMneub2sWJ7Gw=";
  };

-  npmDepsHash = "sha256-o1Z8v/LR77TUKufv60B/P4XWR7Ebf0PTX7ee3YgjnBs=";
+  npmDepsHash = "sha256-pO1ewVInuPCLDk2V4HRqOCFmT1VTVa/qRkJ5rxREWMU=";

  npmBuildScript = "prepare";

--- a/pkgs/by-name/ru/rusty-diceware/package.nix
+++ b/pkgs/by-name/ru/rusty-diceware/package.nix
@ -0,0 +1,29 @@
+{ fetchFromGitLab
+, lib
+, rustPlatform
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "rusty-diceware";
+  version = "0.5.8";
+
+  src = fetchFromGitLab {
+    owner = "yuvallanger";
+    repo = "rusty-diceware";
+    rev = "diceware-v${version}";
+    hash = "sha256-GDWvHHl4EztTaR0jI4XL1I9qE2KSL+q9C8IvLWQF4Ys=";
+  };
+
+  cargoHash = "sha256-5SAKrNgFG3O+hLKvEGhawyRi7wiEPWmxPsLtEX0OkDM=";
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "Commandline diceware, with or without dice, written in Rustlang";
+    homepage = "https://gitlab.com/yuvallanger/rusty-diceware";
+    changelog = "https://gitlab.com/yuvallanger/rusty-diceware/-/blob/v${version}/CHANGELOG.md?ref_type=heads";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ cherrykitten ];
+    mainProgram = "diceware";
+  };
+}
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@ -1,84 +1,97 @@
-{ lib
-, python3
-, fetchFromGitHub
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+  nixosTests
 }:

-python3.pkgs.toPythonModule (python3.pkgs.buildPythonApplication rec {
-  pname = "searxng";
-  version = "0-unstable-2024-05-31";
+python3.pkgs.toPythonModule (
+  python3.pkgs.buildPythonApplication rec {
+    pname = "searxng";
+    version = "0-unstable-2024-06-19";

-  src = fetchFromGitHub {
-    owner = "searxng";
-    repo = "searxng";
-    rev = "18fb701be225560b3fb1011cc533f785823f26a4";
-    hash = "sha256-okE/Uxl7YqcM99kLJ4KAlMQi50x5m0bPfYp5bv62WEw=";
-  };
+    src = fetchFromGitHub {
+      owner = "searxng";
+      repo = "searxng";
+      rev = "acf3f109b2a99a5e6f25f5f2975016a36673c6ef";
+      hash = "sha256-NdFnB5JEaWo7gt+RwxKxkVtEL8uGLlc4z0ROHN+zoL4=";
+    };

-  postPatch = ''
-    sed -i 's/==.*$//' requirements.txt
-
-    # can't be fetchpatched as it is essentially empty and it complains about that
-    # TODO: drop when updating to a version that includes https://github.com/searxng/searxng/pull/3563
-    touch searx/answerers/random/__init__.py
-    touch searx/answerers/statistics/__init__.py
-  '';
-
-  preBuild =
-    let
-      versionString = lib.concatStringsSep "." (builtins.tail (lib.splitString "-" (lib.removePrefix "0-" version)));
-      commitAbbrev = builtins.substring 0 8 src.rev;
-    in
-    ''
-      export SEARX_DEBUG="true";
-
-      cat > searx/version_frozen.py <<EOF
-      VERSION_STRING="${versionString}+${commitAbbrev}"
-      VERSION_TAG="${versionString}+${commitAbbrev}"
-      DOCKER_TAG="${versionString}-${commitAbbrev}"
-      GIT_URL="https://github.com/searxng/searxng"
-      GIT_BRANCH="master"
-      EOF
+    postPatch = ''
+      sed -i 's/==.*$//' requirements.txt
    '';

-  propagatedBuildInputs = with python3.pkgs; [
-    babel
-    certifi
-    python-dateutil
-    fasttext-predict
-    flask
-    flask-babel
-    brotli
-    jinja2
-    lxml
-    pygments
-    pytomlpp
-    pyyaml
-    redis
-    uvloop
-    setproctitle
-    httpx
-    httpx-socks
-    markdown-it-py
-  ] ++ httpx.optional-dependencies.http2
-  ++ httpx-socks.optional-dependencies.asyncio;
+    preBuild =
+      let
+        versionString = lib.concatStringsSep "." (
+          builtins.tail (lib.splitString "-" (lib.removePrefix "0-" version))
+        );
+        commitAbbrev = builtins.substring 0 8 src.rev;
+      in
+      ''
+        export SEARX_DEBUG="true";

-  # tests try to connect to network
-  doCheck = false;
+        cat > searx/version_frozen.py <<EOF
+        VERSION_STRING="${versionString}+${commitAbbrev}"
+        VERSION_TAG="${versionString}+${commitAbbrev}"
+        DOCKER_TAG="${versionString}-${commitAbbrev}"
+        GIT_URL="https://github.com/searxng/searxng"
+        GIT_BRANCH="master"
+        EOF
+      '';

-  postInstall = ''
-    # Create a symlink for easier access to static data
-    mkdir -p $out/share
-    ln -s ../${python3.sitePackages}/searx/static $out/share/
+    dependencies =
+      with python3.pkgs;
+      [
+        babel
+        certifi
+        python-dateutil
+        fasttext-predict
+        flask
+        flask-babel
+        brotli
+        jinja2
+        lxml
+        pygments
+        pytomlpp
+        pyyaml
+        redis
+        uvloop
+        setproctitle
+        httpx
+        httpx-socks
+        markdown-it-py
+      ]
+      ++ httpx.optional-dependencies.http2
+      ++ httpx-socks.optional-dependencies.asyncio;

-    # copy config schema for the limiter
-    cp searx/limiter.toml $out/${python3.sitePackages}/searx/limiter.toml
-  '';
+    # tests try to connect to network
+    doCheck = false;

-  meta = with lib; {
-    homepage = "https://github.com/searxng/searxng";
-    description = "Fork of Searx, a privacy-respecting, hackable metasearch engine";
-    license = licenses.agpl3Plus;
-    mainProgram = "searxng-run";
-    maintainers = with maintainers; [ SuperSandro2000 _999eagle ];
-  };
-})
+    postInstall = ''
+      # Create a symlink for easier access to static data
+      mkdir -p $out/share
+      ln -s ../${python3.sitePackages}/searx/static $out/share/
+
+      # copy config schema for the limiter
+      cp searx/limiter.toml $out/${python3.sitePackages}/searx/limiter.toml
+    '';
+
+    passthru = {
+      tests = {
+        searxng = nixosTests.searx;
+      };
+    };
+
+    meta = with lib; {
+      homepage = "https://github.com/searxng/searxng";
+      description = "Fork of Searx, a privacy-respecting, hackable metasearch engine";
+      license = licenses.agpl3Plus;
+      mainProgram = "searxng-run";
+      maintainers = with maintainers; [
+        SuperSandro2000
+        _999eagle
+      ];
+    };
+  }
+)
--- a/pkgs/by-name/sy/syft/package.nix
+++ b/pkgs/by-name/sy/syft/package.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "syft";
-  version = "1.6.0";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "anchore";
    repo = "syft";
    rev = "refs/tags/v${version}";
-    hash = "sha256-qh+iuqnLX8Qr8sOP3YobwcFdOhnlIrnoBR53ZeCPdB4=";
+    hash = "sha256-fTqyFsFWSsVt2Thd15nlsmnNIhQSLAv9SaaaVJWto/8=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@ -28,7 +28,7 @@ buildGoModule rec {
  # hash mismatch with darwin
  proxyVendor = true;

-  vendorHash = "sha256-CmkxbyXUvFqa3sRcT7aao+pdZxJVFQiNcwmCmWzgF5c=";
+  vendorHash = "sha256-U4PZPUsfWCJB2YFJkirF8Q46pRmhKqzSnk7GpKOrfbU=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/tr/troubadix/package.nix
+++ b/pkgs/by-name/tr/troubadix/package.nix
@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "troubadix";
-  version = "24.6.1";
+  version = "24.6.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "greenbone";
    repo = "troubadix";
    rev = "refs/tags/v${version}";
-    hash = "sha256-R747RD7jye2SANZoUk/bpHwXviBEBF2c+LeCwQBxlH8=";
+    hash = "sha256-W6RC0JKTBLlPSgWlAggU8HRNY+nRAYtLlG0cnnYMaFM=";
  };

  pythonRelaxDeps = [ "validators" ];
--- a/pkgs/by-name/uv/uv/Cargo.lock
+++ b/pkgs/by-name/uv/uv/Cargo.lock
@ -313,9 +313,9 @@ dependencies = [

 [[package]]
 name = "axoupdater"
-version = "0.6.5"
+version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "669a5ea910fb9b97e3df709c7d0f626fc9e5e9cb83c00bd3a1b4c54835ed8b66"
+checksum = "8cc5997cf9d00fa790ba6f19688d93b89760bd641d1c2482bcfbc2bf56988576"
 dependencies = [
 "axoasset",
 "axoprocess",
@ -683,9 +683,9 @@ dependencies = [

 [[package]]
 name = "clap"
-version = "4.5.6"
+version = "4.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9689a29b593160de5bc4aacab7b5d54fb52231de70122626c178e6a368994c7"
+checksum = "5db83dced34638ad474f39f250d7fea9598bdd239eaced1bdf45d597da0f433f"
 dependencies = [
 "clap_builder",
 "clap_derive",
@ -693,9 +693,9 @@ dependencies = [

 [[package]]
 name = "clap_builder"
-version = "4.5.6"
+version = "4.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e5387378c84f6faa26890ebf9f0a92989f8873d4d380467bcd0d8d8620424df"
+checksum = "f7e204572485eb3fbf28f871612191521df159bc3e15a9f5064c66dba3a8c05f"
 dependencies = [
 "anstream",
 "anstyle",
@ -827,9 +827,9 @@ dependencies = [

 [[package]]
 name = "configparser"
-version = "3.0.4"
+version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ec6d3da8e550377a85339063af6e3735f4b1d9392108da4e083a1b3b9820288"
+checksum = "e57e3272f0190c3f1584272d613719ba5fc7df7f4942fe542e63d949cf3a649b"

 [[package]]
 name = "console"
@ -1618,12 +1618,12 @@ dependencies = [

 [[package]]
 name = "http-body-util"
-version = "0.1.1"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0475f8b2ac86659c21b64320d5d653f9efe42acd2a4e560073ec61a155a34f1d"
+checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f"
 dependencies = [
 "bytes",
- "futures-core",
+ "futures-util",
 "http",
 "http-body",
 "pin-project-lite",
@ -1670,19 +1670,21 @@ dependencies = [

 [[package]]
 name = "hyper-rustls"
-version = "0.26.0"
+version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0bea761b46ae2b24eb4aef630d8d1c398157b6fc29e6350ecf090a0b70c952c"
+checksum = "5ee4be2c948921a1a5320b629c4193916ed787a7f7f293fd3f7f5a6c9de74155"
 dependencies = [
 "futures-util",
 "http",
 "hyper",
 "hyper-util",
 "rustls",
+ "rustls-native-certs",
 "rustls-pki-types",
 "tokio",
 "tokio-rustls",
 "tower-service",
+ "webpki-roots",
 ]

 [[package]]
@ -2710,7 +2712,7 @@ dependencies = [
 "indoc",
 "libc",
 "memoffset 0.9.1",
- "parking_lot 0.12.3",
+ "parking_lot 0.11.2",
 "portable-atomic",
 "pyo3-build-config",
 "pyo3-ffi",
@ -2797,6 +2799,53 @@ dependencies = [
 "uv-normalize",
 ]

+[[package]]
+name = "quinn"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4ceeeeabace7857413798eb1ffa1e9c905a9946a57d81fb69b4b71c4d8eb3ad"
+dependencies = [
+ "bytes",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "thiserror",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddf517c03a109db8100448a4be38d498df8a210a99fe0e1b9eaf39e78c640efe"
+dependencies = [
+ "bytes",
+ "rand",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "slab",
+ "thiserror",
+ "tinyvec",
+ "tracing",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9096629c45860fc7fb143e125eb826b5e721e10be3263160c7d60ca832cf8c46"
+dependencies = [
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.36"
@ -2923,13 +2972,13 @@ dependencies = [

 [[package]]
 name = "reflink-copy"
-version = "0.1.17"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c3138c30c59ed9b8572f82bed97ea591ecd7e45012566046cc39e72679cff22"
+checksum = "6d731e7e3ebfcf422d96b8473e507d5b64790900dd5464772d38d1da9da24d3a"
 dependencies = [
 "cfg-if",
 "rustix",
- "windows 0.56.0",
+ "windows 0.57.0",
 ]

 [[package]]
@ -3017,9 +3066,9 @@ dependencies = [

 [[package]]
 name = "reqwest"
-version = "0.12.4"
+version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "566cafdd92868e0939d3fb961bd0dc25fcfaaed179291093b3d43e6b3150ea10"
+checksum = "c7d6d2a27d57148378eb5e111173f4276ad26340ecc5c49a4a2152167a2d6a37"
 dependencies = [
 "async-compression",
 "base64 0.22.1",
@ -3040,6 +3089,7 @@ dependencies = [
 "once_cell",
 "percent-encoding",
 "pin-project-lite",
+ "quinn",
 "rustls",
 "rustls-native-certs",
 "rustls-pemfile",
@ -3267,11 +3317,11 @@ dependencies = [

 [[package]]
 name = "rustls"
-version = "0.22.4"
+version = "0.23.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf4ef73721ac7bcd79b2b315da7779d8fc09718c6b3d2d1b2d94850eb8c18432"
+checksum = "05cff451f60db80f490f3c182b77c35260baace73209e9cdbbe526bfe3a4d402"
 dependencies = [
- "log",
+ "once_cell",
 "ring",
 "rustls-pki-types",
 "rustls-webpki",
@ -3695,9 +3745,9 @@ dependencies = [

 [[package]]
 name = "sync_wrapper"
-version = "0.1.2"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
+checksum = "a7065abeca94b6a8a577f9bd45aa0867a2238b74e8eb67cf10d492bc39351394"

 [[package]]
 name = "sys-info"
@ -3976,9 +4026,9 @@ dependencies = [

 [[package]]
 name = "tokio-rustls"
-version = "0.25.0"
+version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
+checksum = "0c7bc40d0e5a97695bb96e27995cd3a08538541b0a846f65bba7a359f36700d4"
 dependencies = [
 "rustls",
 "rustls-pki-types",
@ -4368,7 +4418,7 @@ checksum = "a183cf7feeba97b4dd1c0d46788634f6221d87fa961b305bed08c851829efcc0"

 [[package]]
 name = "uv"
-version = "0.2.11"
+version = "0.2.13"
 dependencies = [
 "anstream",
 "anyhow",
@ -4384,6 +4434,7 @@ dependencies = [
 "filetime",
 "flate2",
 "fs-err",
+ "futures",
 "ignore",
 "indicatif",
 "indoc",
@ -4427,11 +4478,11 @@ dependencies = [
 "uv-normalize",
 "uv-requirements",
 "uv-resolver",
+ "uv-settings",
 "uv-toolchain",
 "uv-types",
 "uv-virtualenv",
 "uv-warnings",
- "uv-workspace",
 ]

 [[package]]
@ -4589,7 +4640,6 @@ dependencies = [
 "distribution-filename",
 "distribution-types",
 "fs-err",
- "futures",
 "install-wheel-rs",
 "mimalloc",
 "owo-colors",
@ -4614,13 +4664,12 @@ dependencies = [
 "uv-configuration",
 "uv-dispatch",
 "uv-distribution",
- "uv-fs",
 "uv-git",
 "uv-installer",
 "uv-resolver",
+ "uv-settings",
 "uv-toolchain",
 "uv-types",
- "uv-workspace",
 "walkdir",
 ]

@ -4793,6 +4842,14 @@ dependencies = [
 "walkdir",
 ]

+[[package]]
+name = "uv-macros"
+version = "0.0.1"
+dependencies = [
+ "quote",
+ "syn 2.0.66",
+]
+
 [[package]]
 name = "uv-normalize"
 version = "0.0.1"
@ -4856,6 +4913,7 @@ dependencies = [
 "itertools 0.13.0",
 "once-map",
 "owo-colors",
+ "path-slash",
 "pep440_rs",
 "pep508_rs",
 "petgraph",
@ -4886,6 +4944,29 @@ dependencies = [
 "uv-warnings",
 ]

+[[package]]
+name = "uv-settings"
+version = "0.0.1"
+dependencies = [
+ "dirs-sys",
+ "distribution-types",
+ "fs-err",
+ "install-wheel-rs",
+ "pep508_rs",
+ "pypi-types",
+ "schemars",
+ "serde",
+ "thiserror",
+ "toml",
+ "tracing",
+ "uv-configuration",
+ "uv-fs",
+ "uv-macros",
+ "uv-normalize",
+ "uv-resolver",
+ "uv-toolchain",
+]
+
 [[package]]
 name = "uv-state"
 version = "0.0.1"
@ -4921,6 +5002,7 @@ dependencies = [
 "schemars",
 "serde",
 "serde_json",
+ "target-lexicon",
 "temp-env",
 "tempfile",
 "test-log",
@ -4961,7 +5043,7 @@ dependencies = [

 [[package]]
 name = "uv-version"
-version = "0.2.11"
+version = "0.2.13"

 [[package]]
 name = "uv-virtualenv"
@ -4989,29 +5071,6 @@ dependencies = [
 "rustc-hash",
 ]

-[[package]]
-name = "uv-workspace"
-version = "0.0.1"
-dependencies = [
- "dirs-sys",
- "distribution-types",
- "fs-err",
- "install-wheel-rs",
- "pep508_rs",
- "pypi-types",
- "schemars",
- "serde",
- "thiserror",
- "toml",
- "tracing",
- "uv-configuration",
- "uv-fs",
- "uv-normalize",
- "uv-resolver",
- "uv-toolchain",
- "uv-warnings",
-]
-
 [[package]]
 name = "valuable"
 version = "0.1.0"
@ -5240,11 +5299,11 @@ dependencies = [

 [[package]]
 name = "windows"
-version = "0.56.0"
+version = "0.57.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1de69df01bdf1ead2f4ac895dc77c9351aefff65b2f3db429a343f9cbf05e132"
+checksum = "12342cb4d8e3b046f3d80effd474a7a02447231330ef77d71daa6fbc40681143"
 dependencies = [
- "windows-core 0.56.0",
+ "windows-core 0.57.0",
 "windows-targets 0.52.5",
 ]

@ -5259,12 +5318,12 @@ dependencies = [

 [[package]]
 name = "windows-core"
-version = "0.56.0"
+version = "0.57.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4698e52ed2d08f8658ab0c39512a7c00ee5fe2688c65f8c0a4f06750d729f2a6"
+checksum = "d2ed2439a290666cd67ecce2b0ffaad89c2a56b976b736e6ece670297897832d"
 dependencies = [
- "windows-implement 0.56.0",
- "windows-interface 0.56.0",
+ "windows-implement 0.57.0",
+ "windows-interface 0.57.0",
 "windows-result",
 "windows-targets 0.52.5",
 ]
@ -5282,9 +5341,9 @@ dependencies = [

 [[package]]
 name = "windows-implement"
-version = "0.56.0"
+version = "0.57.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6fc35f58ecd95a9b71c4f2329b911016e6bec66b3f2e6a4aad86bd2e99e2f9b"
+checksum = "9107ddc059d5b6fbfbffdfa7a7fe3e22a226def0b2608f72e9d552763d3e1ad7"
 dependencies = [
 "proc-macro2",
 "quote",
@ -5304,9 +5363,9 @@ dependencies = [

 [[package]]
 name = "windows-interface"
-version = "0.56.0"
+version = "0.57.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08990546bf4edef8f431fa6326e032865f27138718c587dc21bc0265bbcb57cc"
+checksum = "29bee4b38ea3cde66011baa44dba677c432a78593e202392d1e9070cf2a7fca7"
 dependencies = [
 "proc-macro2",
 "quote",
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@ -16,14 +16,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "uv";
-  version = "0.2.11";
+  version = "0.2.13";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "uv";
    rev = "refs/tags/${version}";
-    hash = "sha256-SkWhff9nYlbbzsXb9EWMzC0aKRU+LbJqClBddq1yl3Y=";
+    hash = "sha256-/YRmaPNTw3RsaB4bTb5UO0qXtRe2h1oD4Bav6VQ4W04=";
  };

  cargoDeps = rustPlatform.importCargoLock {
--- a/pkgs/by-name/wa/waybar/package.nix
+++ b/pkgs/by-name/wa/waybar/package.nix
@ -150,9 +150,10 @@ stdenv.mkDerivation (finalAttrs: {

  mesonFlags =
    (lib.mapAttrsToList lib.mesonEnable {
-      "cava" = cavaSupport;
+      "cava" = cavaSupport && lib.asserts.assertMsg sndioSupport "Sndio support is required for Cava";
      "dbusmenu-gtk" = traySupport;
      "jack" = jackSupport;
+      "libevdev" = evdevSupport;
      "libinput" = inputSupport;
      "libnl" = nlSupport;
      "libudev" = udevSupport;
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@ -0,0 +1,105 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  btrfs-progs,
+  testers,
+  werf,
+}:
+
+buildGoModule rec {
+  pname = "werf";
+  version = "2.6.1";
+
+  src = fetchFromGitHub {
+    owner = "werf";
+    repo = "werf";
+    rev = "v${version}";
+    hash = "sha256-10RyCVF1w5xj/qhFXQTlyrt9HG/4di2fUwUtDHU6t44=";
+  };
+
+  vendorHash = "sha256-d1Dn+JN8tiBVx7YDbtvLW0YgIW2ENrEdx4gKatYy1hw=";
+
+  proxyVendor = true;
+
+  subPackages = [ "cmd/werf" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  buildInputs =
+    lib.optionals stdenv.isLinux [ btrfs-progs ]
+    ++ lib.optionals stdenv.hostPlatform.isGnu [ stdenv.cc.libc.static ];
+
+  CGO_ENABLED = if stdenv.isLinux then 1 else 0;
+
+  ldflags =
+    [
+      "-s"
+      "-w"
+      "-X github.com/werf/werf/v2/pkg/werf.Version=v${version}"
+    ]
+    ++ lib.optionals (CGO_ENABLED == 1) [
+      "-extldflags=-static"
+      "-linkmode external"
+    ];
+
+  tags =
+    [
+      "containers_image_openpgp"
+      "dfrunmount"
+      "dfrunnetwork"
+      "dfrunsecurity"
+      "dfssh"
+    ]
+    ++ lib.optionals (CGO_ENABLED == 1) [
+      "cni"
+      "exclude_graphdriver_devicemapper"
+      "netgo"
+      "no_devmapper"
+      "osusergo"
+      "static_build"
+    ];
+
+  preCheck =
+    ''
+      # Test all targets.
+      unset subPackages
+
+      # Remove tests that require external services.
+      rm -rf \
+        integration/suites \
+        pkg/true_git/*test.go \
+        test/e2e
+    ''
+    + lib.optionalString (CGO_ENABLED == 0) ''
+      # A workaround for osusergo.
+      export USER=nixbld
+    '';
+
+  postInstall = ''
+    installShellCompletion --cmd werf \
+      --bash <($out/bin/werf completion --shell=bash) \
+      --zsh <($out/bin/werf completion --shell=zsh)
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = werf;
+    command = "werf version";
+    version = src.rev;
+  };
+
+  meta = with lib; {
+    description = "GitOps delivery tool";
+    mainProgram = "werf";
+    longDescription = ''
+      The CLI tool gluing Git, Docker, Helm & Kubernetes with any CI system to
+      implement CI/CD and Giterminism.
+    '';
+    homepage = "https://werf.io";
+    changelog = "https://github.com/werf/werf/releases/tag/${src.rev}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ azahi ];
+  };
+}
--- a/pkgs/by-name/xm/xmonad-log/package.nix
+++ b/pkgs/by-name/xm/xmonad-log/package.nix
@ -1,19 +1,18 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:

-buildGoPackage rec {
+buildGoModule {
  pname = "xmonad-log";
-  version = "0.1.0";
-
-  goPackagePath = "github.com/xintron/xmonad-log";
+  version = "0.1.0-unstable-2024-06-14";

  src = fetchFromGitHub {
    owner = "xintron";
    repo = "xmonad-log";
-    rev = version;
-    sha256 = "1il6v0zcjw0pfb1hjj198y94jmlcx255h422ph0f1zr7afqkzmaw";
+    rev = "70c76d59c22cf5f412467cd42fa9ff34eeb2bd1b";
+    sha256 = "sha256-hDYb3mSX2+FX/2uazCKPXmNj0avDlutwSMjST7wLBVY=";
  };

-  goDeps = ./deps.nix;
+  vendorHash = "sha256-58zK6t3rb+19ilaQaNgsMVFQBYKPIV40ww8klrGbpnw=";
+  proxyVendor = true;

  meta = with lib; {
    description = "xmonad DBus monitoring solution";
--- a/pkgs/desktops/cinnamon/bulky/default.nix
+++ b/pkgs/desktops/cinnamon/bulky/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "bulky";
-  version = "3.2";
+  version = "3.3";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "bulky";
    rev = version;
-    hash = "sha256-Zt5J8+CYiPxp/e1wDaJp7R91vYJmGNqPQs39J/OIwiQ=";
+    hash = "sha256-S4wAcwlJnXHYQEnP9WApCTjvVHKMrAt7gQ2l8zvFrs0=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/cinnamon/pix/default.nix
+++ b/pkgs/desktops/cinnamon/pix/default.nix
@ -31,13 +31,13 @@

 stdenv.mkDerivation rec {
  pname = "pix";
-  version = "3.4.0";
+  version = "3.4.1";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    sha256 = "sha256-XXt5tq+Zfm6fqorsFAWV3guii6gTK5JRgw26GkNkoos=";
+    sha256 = "sha256-QkgjUzoBOXE3mxXy/Lq3YkHq7f9oE97FeP7PHIBDHvc=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/cinnamon/xviewer/default.nix
+++ b/pkgs/desktops/cinnamon/xviewer/default.nix
@ -27,13 +27,13 @@

 stdenv.mkDerivation rec {
  pname = "xviewer";
-  version = "3.4.4";
+  version = "3.4.5";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Kr3GoroQUzOePJiYeJYE9wrqWKcfX7ncu3tZSxOdnvU=";
+    sha256 = "sha256-J6KDkGPbcRBofsJVmd+1IEapSfSd3ftjz0AggvBI8ck=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/jetbrains-jdk/17.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/17.nix
@ -0,0 +1,156 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, jetbrains
+, openjdk17
+, openjdk17-bootstrap
+, git
+, autoconf
+, unzip
+, rsync
+, debugBuild ? false
+, withJcef ? true
+
+, libXdamage
+, libXxf86vm
+, libXrandr
+, libXi
+, libXcursor
+, libXrender
+, libX11
+, libXext
+, libxcb
+, nss
+, nspr
+, libdrm
+, mesa
+, wayland
+, udev
+}:
+
+assert debugBuild -> withJcef;
+
+let
+  arch = {
+    "aarch64-linux" = "aarch64";
+    "x86_64-linux" = "x64";
+  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  cpu = stdenv.hostPlatform.parsed.cpu.name;
+in
+openjdk17.overrideAttrs (oldAttrs: rec {
+  pname = "jetbrains-jdk" + lib.optionalString withJcef "-jcef";
+  javaVersion = "17.0.11";
+  build = "1207.24";
+  # To get the new tag:
+  # git clone https://github.com/jetbrains/jetbrainsruntime
+  # cd jetbrainsruntime
+  # git reset --hard [revision]
+  # git log --simplify-by-decoration --decorate=short --pretty=short | grep "jbr-" --color=never | cut -d "(" -f2 | cut -d ")" -f1 | awk '{print $2}' | sort -t "-" -k 2 -g | tail -n 1 | tr -d ","
+  openjdkTag = "jbr-17.0.8+7";
+  version = "${javaVersion}-b${build}";
+
+  src = fetchFromGitHub {
+    owner = "JetBrains";
+    repo = "JetBrainsRuntime";
+    rev = "jb${version}";
+    hash = "sha256-a7cJF2iCW/1GK0/GmVbaY5pYcn3YtZy5ngFkyAGRhu0=";
+  };
+
+  BOOT_JDK = openjdk17-bootstrap.home;
+  # run `git log -1 --pretty=%ct` in jdk repo for new value on update
+  SOURCE_DATE_EPOCH = 1715809405;
+
+  patches = [ ];
+
+  dontConfigure = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    ${lib.optionalString withJcef "cp -r ${jetbrains.jcef} jcef_linux_${arch}"}
+
+    sed \
+        -e "s/OPENJDK_TAG=.*/OPENJDK_TAG=${openjdkTag}/" \
+        -e "s/SOURCE_DATE_EPOCH=.*//" \
+        -e "s/export SOURCE_DATE_EPOCH//" \
+        -i jb/project/tools/common/scripts/common.sh
+    sed -i "s/STATIC_CONF_ARGS/STATIC_CONF_ARGS \$configureFlags/" jb/project/tools/linux/scripts/mkimages_${arch}.sh
+    sed \
+        -e "s/create_image_bundle \"jb/#/" \
+        -e "s/echo Creating /exit 0 #/" \
+        -i jb/project/tools/linux/scripts/mkimages_${arch}.sh
+
+    patchShebangs .
+    ./jb/project/tools/linux/scripts/mkimages_${arch}.sh ${build} ${if debugBuild then "fd" else (if withJcef then "jcef" else "nomod")}
+
+    runHook postBuild
+  '';
+
+  installPhase =
+    let
+      buildType = if debugBuild then "fastdebug" else "release";
+      debugSuffix = if debugBuild then "-fastdebug" else "";
+      jcefSuffix = if debugBuild || !withJcef then "" else "_jcef";
+      jbrsdkDir = "jbrsdk${jcefSuffix}-${javaVersion}-linux-${arch}${debugSuffix}-b${build}";
+    in
+    ''
+      runHook preInstall
+
+      mv build/linux-${cpu}-server-${buildType}/images/jdk/man build/linux-${cpu}-server-${buildType}/images/${jbrsdkDir}
+      rm -rf build/linux-${cpu}-server-${buildType}/images/jdk
+      mv build/linux-${cpu}-server-${buildType}/images/${jbrsdkDir} build/linux-${cpu}-server-${buildType}/images/jdk
+    '' + oldAttrs.installPhase + "runHook postInstall";
+
+  postInstall = lib.optionalString withJcef ''
+    chmod +x $out/lib/openjdk/lib/chrome-sandbox
+  '';
+
+  dontStrip = debugBuild;
+
+  postFixup = ''
+    # Build the set of output library directories to rpath against
+    LIBDIRS="${lib.makeLibraryPath [
+      libXdamage libXxf86vm libXrandr libXi libXcursor libXrender libX11 libXext libxcb
+      nss nspr libdrm mesa wayland udev
+    ]}"
+    for output in $outputs; do
+      if [ "$output" = debug ]; then continue; fi
+      LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort -u | tr '\n' ':'):$LIBDIRS"
+    done
+    # Add the local library paths to remove dependencies on the bootstrap
+    for output in $outputs; do
+      if [ "$output" = debug ]; then continue; fi
+      OUTPUTDIR=$(eval echo \$$output)
+      BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
+      echo "$BINLIBS" | while read i; do
+        patchelf --set-rpath "$LIBDIRS:$(patchelf --print-rpath "$i")" "$i" || true
+        patchelf --shrink-rpath "$i" || true
+      done
+    done
+  '';
+
+  nativeBuildInputs = [ git autoconf unzip rsync ] ++ oldAttrs.nativeBuildInputs;
+
+  meta = with lib; {
+    description = "An OpenJDK fork to better support Jetbrains's products.";
+    longDescription = ''
+      JetBrains Runtime is a runtime environment for running IntelliJ Platform
+      based products on Windows, Mac OS X, and Linux. JetBrains Runtime is
+      based on OpenJDK project with some modifications. These modifications
+      include: Subpixel Anti-Aliasing, enhanced font rendering on Linux, HiDPI
+      support, ligatures, some fixes for native crashes not presented in
+      official build, and other small enhancements.
+      JetBrains Runtime is not a certified build of OpenJDK. Please, use at
+      your own risk.
+    '';
+    homepage = "https://confluence.jetbrains.com/display/JBR/JetBrains+Runtime";
+    inherit (openjdk17.meta) license platforms mainProgram;
+    maintainers = with maintainers; [ edwtjo ];
+
+    broken = stdenv.isDarwin;
+  };
+
+  passthru = oldAttrs.passthru // {
+    home = "${jetbrains.jdk}/lib/openjdk";
+  };
+})
--- a/pkgs/development/python-modules/aiowatttime/default.nix
+++ b/pkgs/development/python-modules/aiowatttime/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "aiowatttime";
-  version = "2023.12.0";
+  version = "2024.06.0";
  format = "pyproject";

  disabled = pythonOlder "3.10";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "bachya";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-sodgFveVE2Z894z36AzXF6c3iI4UhaqMJK+H6CjsvGA=";
+    hash = "sha256-c5L+Nx+CoWEc6Bs61GOHPBelExe5I7EOlMQ+QV6nktI=";
  };

  nativeBuildInputs = [ poetry-core ];
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@ -366,7 +366,7 @@

 buildPythonPackage rec {
  pname = "boto3-stubs";
-  version = "1.34.128";
+  version = "1.34.129";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -374,7 +374,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "boto3_stubs";
    inherit version;
-    hash = "sha256-9N/yCKnPAHl6bCsYR6so0LkxqGpBvwDI5PVbN/tmEaU=";
+    hash = "sha256-CXHgszlO4agOSfTcLoUI3JqHi/kbNNlbsx6Mw0CdFvk=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "botocore-stubs";
-  version = "1.34.128";
+  version = "1.34.129";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "botocore_stubs";
    inherit version;
-    hash = "sha256-AOWRCzr7dkIiCNerbD87LUEl4yA+Fb9HwP9fnjjwDBk=";
+    hash = "sha256-Ub/NAA2bafFkucZMYhUYmvx6hgm8Jj+Tmr0QcEzah6Q=";
  };

  nativeBuildInputs = [ poetry-core ];
--- a/pkgs/development/python-modules/clustershell/default.nix
+++ b/pkgs/development/python-modules/clustershell/default.nix
@ -69,10 +69,9 @@ buildPythonPackage rec {
    rm tests/TaskDistantPdshMixin.py
    rm tests/TaskDistantPdshTest.py
    rm tests/TaskRLimitsTest.py
+    rm tests/TreeGatewayTest.py

    nosetests -v \
-      -e test_channel_ctl_shell_remote1 \
-      -e test_channel_ctl_shell_remote2 \
      -e test_fromall_grouplist \
      -e test_rank_placeholder \
      -e test_engine_on_the_fly_launch \
@ -92,9 +91,6 @@ buildPythonPackage rec {
      -e testClushConfigSetRlimit  \
      -e testTimerInvalidateInHandler \
      -e testTimerSetNextFireInHandler \
-      -e test_channel_ctl_shell_mlocal1 \
-      -e test_channel_ctl_shell_mlocal2 \
-      -e test_channel_ctl_shell_mlocal3 \
      -e test_node_placeholder \
    tests/*.py
  '';
--- a/pkgs/development/python-modules/dnf-plugins-core/default.nix
+++ b/pkgs/development/python-modules/dnf-plugins-core/default.nix
@ -23,7 +23,7 @@ in

 buildPythonPackage rec {
  pname = "dnf-plugins-core";
-  version = "4.7.0";
+  version = "4.8.0";
  format = "other";

  outputs = [
@ -35,7 +35,7 @@ buildPythonPackage rec {
    owner = "rpm-software-management";
    repo = "dnf-plugins-core";
    rev = "refs/tags/${version}";
-    hash = "sha256-AQnnXjkUajztbyoKzKhxiKxZsb2o2+7C15fsrxGkWcM=";
+    hash = "sha256-8RkTSO+F5fc3T8r79PRoW5KfEG2DmIzN2ylC9Np6LrQ=";
  };

  patches = [ ./fix-python-install-dir.patch ];
--- a/pkgs/development/python-modules/dunamai/default.nix
+++ b/pkgs/development/python-modules/dunamai/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "dunamai";
-  version = "1.19.2";
+  version = "1.20.0";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "mtkennerly";
    repo = "dunamai";
    rev = "refs/tags/v${version}";
-    hash = "sha256-oLJlBytdp9uVdKEdYDMz/IYnPP7XVnCUcThKO3IiW10=";
+    hash = "sha256-K7G5BiUm8QTRbw0W3ebTld7CAZI8sYSnRsD7vQhCptE=";
  };

  nativeBuildInputs = [ poetry-core ];
--- a/pkgs/development/python-modules/google-generativeai/default.nix
+++ b/pkgs/development/python-modules/google-generativeai/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "google-generativeai";
-  version = "0.6.0";
+  version = "0.7.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "google";
    repo = "generative-ai-python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-LPT7pyI1crgLCMHZmjGLFvDwuLwdPNGojgvli6qUOy8=";
+    hash = "sha256-cK5Go5mFy+dC5/B4aMLDjZytNZn79r+ZvOEwAW0FPrI=";
  };

  pythonRelaxDeps = [ "google-ai-generativelanguage" ];
--- a/pkgs/development/python-modules/griffe/default.nix
+++ b/pkgs/development/python-modules/griffe/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "griffe";
-  version = "0.46.0";
+  version = "0.47.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "mkdocstrings";
    repo = "griffe";
    rev = "refs/tags/${version}";
-    hash = "sha256-ZvOH2MF9MH7FB5DDQ70rYB7fgqoffbqZhKgpWYtChck=";
+    hash = "sha256-NkS8cD0G/nbquQfMVcdbTLnJx26PQnqWB8UnBTNIBdE=";
  };

  build-system = [ pdm-backend ];
--- a/pkgs/development/python-modules/gvm-tools/default.nix
+++ b/pkgs/development/python-modules/gvm-tools/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "gvm-tools";
-  version = "24.3.0";
+  version = "24.6.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "greenbone";
    repo = "gvm-tools";
    rev = "refs/tags/v${version}";
-    hash = "sha256-LLXMdT1q6IWsbsRjflpGN5pcjUCXWzdFK3gMw4mBm0U=";
+    hash = "sha256-R8wpkzL2QxGdvc6vWtrbIGEiryc+QQ3OitdxMcpH+F4=";
  };

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/hdate/default.nix
+++ b/pkgs/development/python-modules/hdate/default.nix
@ -3,7 +3,8 @@
  astral,
  buildPythonPackage,
  fetchFromGitHub,
-  poetry-core,
+  pdm-backend,
+  pythonRelaxDepsHook,
  pytestCheckHook,
  pythonOlder,
  pytz,
@ -11,25 +12,24 @@

 buildPythonPackage rec {
  pname = "hdate";
-  version = "0.10.8";
+  version = "0.10.9";
  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "py-libhdate";
    repo = "py-libhdate";
    rev = "refs/tags/v${version}";
-    hash = "sha256-SANCZl+1ghUuuxZAl6oycvo7hB7mIagjVEmwzarsspk=";
+    hash = "sha256-Cni8GegB8GAhtIKKCgSn3QavE/Gi9Rcm9v0grToMyq4=";
  };

-  build-system = [
-    poetry-core
-  ];
-
  pythonRelaxDeps = [
    "astral"
-    "pytz"
+  ];
+
+  build-system = [
+    pdm-backend
  ];

  dependencies = [
@ -47,7 +47,7 @@ buildPythonPackage rec {
    description = "Python module for Jewish/Hebrew date and Zmanim";
    homepage = "https://github.com/py-libhdate/py-libhdate";
    changelog = "https://github.com/py-libhdate/py-libhdate/releases/tag/v${version}";
-    license = with licenses; [ gpl3Plus ];
+    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ fab ];
  };
 }
--- a/pkgs/development/python-modules/oauthenticator/default.nix
+++ b/pkgs/development/python-modules/oauthenticator/default.nix
@ -21,14 +21,14 @@

 buildPythonPackage rec {
  pname = "oauthenticator";
-  version = "16.3.0";
+  version = "16.3.1";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-QMddGJUfafXoBxMCjlx1lH45a4Bab3AP4j8Px7JxYaQ=";
+    hash = "sha256-gFhhOCcmorkrLxrup9fICh5ueCrc64fxfuZXTQG1tMk=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "publicsuffixlist";
-  version = "0.10.1.20240616";
+  version = "0.10.1.20240618";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-fVmEBr9omsCeRAsaPUZ07y1in/bx7JeGHIPwrBxGpY8=";
+    hash = "sha256-+wJoH/vCwNPmQlQfikDmnqbNQlMLA315N+U4Yvy/mMw=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pyorthanc/default.nix
+++ b/pkgs/development/python-modules/pyorthanc/default.nix
@ -10,29 +10,25 @@

 buildPythonPackage rec {
  pname = "pyorthanc";
-  version = "1.16.1";
+  version = "1.18.0";
  disabled = pythonOlder "3.8";

-  format = "pyproject";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "gacou54";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-6l3L0YUAqedyRjlQ6K3SaAMdGK2C0AeKpJj6MyXi4RA=";
+    hash = "sha256-ObZjTiEB4a7ForsugzKZDdIsTEWOX1zbv53ZJ4AllHE=";
  };

-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];

-  propagatedBuildInputs = [
+  dependencies = [
    httpx
    pydicom
  ];

-  pythonRelaxDeps = [ "httpx" ];
-
  doCheck = false; # requires orthanc server (not in Nixpkgs)

  pythonImportsCheck = [ "pyorthanc" ];
--- a/pkgs/development/python-modules/python-gvm/default.nix
+++ b/pkgs/development/python-modules/python-gvm/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "python-gvm";
-  version = "24.3.0";
+  version = "24.6.0";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "greenbone";
    repo = "python-gvm";
    rev = "refs/tags/v${version}";
-    hash = "sha256-GIEsP8+RJMIehsBbZWpIRXCdqxm042lPbYTHY7/fknM=";
+    hash = "sha256-4Wa8O6kt4FsQk6VvE1dCdl9hQReO3YCf/4hTGcGaQxE=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "reolink-aio";
-  version = "0.9.2";
+  version = "0.9.3";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "starkillerOG";
    repo = "reolink_aio";
    rev = "refs/tags/${version}";
-    hash = "sha256-wkOmwZ4pE5AqZkAUyxgBHywCcJlcMauzJ8OO3Po2u4s=";
+    hash = "sha256-tCT43wbDScL/aoQFmLPkrw59a88f4qpNeNa0Q27H9wA=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "tencentcloud-sdk-python";
-  version = "3.0.1170";
+  version = "3.0.1171";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    rev = "refs/tags/${version}";
-    hash = "sha256-O0bxsvQYJaKEkgdglWH8q4NddA1LFpAU05HHHf8yhVE=";
+    hash = "sha256-8ZjC4gfTVLuH8b90xzURHhowFS/vdXBjWP64ZoiM7/E=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/timm/default.nix
+++ b/pkgs/development/python-modules/timm/default.nix
@ -5,6 +5,7 @@
  fetchFromGitHub,
  pdm-backend,
  huggingface-hub,
+  numpy,
  pyyaml,
  safetensors,
  torch,
@ -16,22 +17,23 @@

 buildPythonPackage rec {
  pname = "timm";
-  version = "1.0.3";
+  version = "1.0.7";
  pyproject = true;

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "huggingface";
    repo = "pytorch-image-models";
    rev = "refs/tags/v${version}";
-    hash = "sha256-h2J1v2zXUMGRKBBqq+RnxrXKOzlD5RRrVoODWSuj9Ms=";
+    hash = "sha256-0o88gOZvHXblGPwyRIz2D3sD7wdg0J0knrAFlognEOY=";
  };

  build-system = [ pdm-backend ];

  dependencies = [
    huggingface-hub
+    numpy
    pyyaml
    safetensors
    torch
--- a/pkgs/development/python-modules/tskit/default.nix
+++ b/pkgs/development/python-modules/tskit/default.nix
@ -2,7 +2,7 @@
  lib,
  buildPythonPackage,
  fetchPypi,
-  setuptools-scm,
+  setuptools,
  pythonOlder,
  numpy,
  jsonschema,
@ -11,20 +11,21 @@

 buildPythonPackage rec {
  pname = "tskit";
-  version = "0.5.6";
-  format = "pyproject";
+  version = "0.5.7";
+  pyproject = true;
+
  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-3f4hPxywY822mCF3IwooBezX38fM1zAm4Th4q//SzkY=";
+    hash = "sha256-yD+2W1tzzi+5wFoZrqNe+jJLpWyx6ZILBgKivDE+wiM=";
  };

-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [
-    numpy
+  dependencies = [
    jsonschema
+    numpy
    svgwrite
  ];

@ -34,11 +35,11 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "tskit" ];

-  meta = with lib; {
+  meta = {
    description = "Tree sequence toolkit";
    mainProgram = "tskit";
    homepage = "https://github.com/tskit-dev/tskit";
-    license = licenses.mit;
-    maintainers = with maintainers; [ alxsimon ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ alxsimon ];
  };
 }
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@ -20,7 +20,7 @@

 buildPythonPackage rec {
  pname = "twilio";
-  version = "9.1.1";
+  version = "9.2.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -29,7 +29,7 @@ buildPythonPackage rec {
    owner = "twilio";
    repo = "twilio-python";
    rev = "refs/tags/${version}";
-    hash = "sha256-LluMl5NdyI4aobxNoLtBv5BU4sAq/EhqvqNAxhOA5Og=";
+    hash = "sha256-vENcbkWXSdhHv3QYjhu8j2UmzmEFHaSD0xDb2pbxqMM=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "checkov";
-  version = "3.2.138";
+  version = "3.2.140";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = "checkov";
    rev = "refs/tags/${version}";
-    hash = "sha256-xgEVUZF6d/vmqaKVTxt0MtppqDBhPEzQcY37WVOR/EE=";
+    hash = "sha256-CqmXUz58eBMNrgfTDP/7M03R8vw9ys9/devRfFvWbBw=";
  };

  patches = [ ./flake8-compat-5.x.patch ];
--- a/pkgs/development/tools/analysis/codeql/default.nix
+++ b/pkgs/development/tools/analysis/codeql/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "codeql";
-  version = "2.17.4";
+  version = "2.17.5";

  dontConfigure = true;
  dontBuild = true;
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {

  src = fetchzip {
    url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-4BfIu81e/XR23Kp8+b6/KRbuji2Od53a1urcyjXX1q8=";
+    hash = "sha256-Ay+8NOYq1sBIDhCoju2/L8Ghegmxz5NmtpBLb0hqH/E=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/dprint/default.nix
+++ b/pkgs/development/tools/dprint/default.nix
@ -2,14 +2,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "dprint";
-  version = "0.46.2";
+  version = "0.46.3";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-P7q2WLTGydC652N4jvTiF7hm4HRmSWnRv9+AuxRoC5Y=";
+    sha256 = "sha256-IyhKxCqLyboEZINalI6bd///sUxWvmWlQVrzMA2sNdU=";
  };

-  cargoHash = "sha256-xmMFqqADIwIII+arW9gZyf95yXOkBMDRDOaG0Nay7hQ=";
+  cargoHash = "sha256-46t6Y2UuRCAnvOhEPLgYN+fHHtJYxuflRT3DClLTDQk=";

  buildInputs = lib.optionals stdenv.isDarwin [ CoreFoundation Security ];

--- a/pkgs/development/tools/operator-sdk/default.nix
+++ b/pkgs/development/tools/operator-sdk/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "operator-sdk";
-  version = "1.34.2";
+  version = "1.35.0";

  src = fetchFromGitHub {
    owner = "operator-framework";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-vVa1ljPRSHSo7bVqPkRt/jbuSlzLmnVaLnyreskwOrM=";
+    hash = "sha256-KalG1DLhvXEjNAOeP79BMYvI74j6nKnDkOYubIJ0Shs=";
  };

-  vendorHash = "sha256-YspUrnSS6d8Ta8dmUjx9A5D/V5Bqm08DQJrRBaIGyQg=";
+  vendorHash = "sha256-TuDbQoC9at3yQikGTfsAKJ5kc/naqLqfHEwXLOv+12A=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/development/tools/twilio-cli/default.nix
+++ b/pkgs/development/tools/twilio-cli/default.nix
@ -2,11 +2,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "twilio-cli";
-  version = "5.20.1";
+  version = "5.21.0";

  src = fetchzip {
    url = "https://twilio-cli-prod.s3.amazonaws.com/twilio-v${finalAttrs.version}/twilio-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-tS30wEXUhzPUPh5gY+UZF274/EOfwMGU19glXUrDuw0=";
+    hash = "sha256-rtI89baKJS4itwTcHY9IjKeskQO6mz/c746wdVy4cG4=";
  };

  buildInputs = [ nodejs-slim ];
--- a/pkgs/development/web/bun/default.nix
+++ b/pkgs/development/web/bun/default.nix
@ -12,7 +12,7 @@
 }:

 stdenvNoCC.mkDerivation rec {
-  version = "1.1.13";
+  version = "1.1.14";
  pname = "bun";

  src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@ -51,19 +51,19 @@ stdenvNoCC.mkDerivation rec {
    sources = {
      "aarch64-darwin" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-pg6nL+brc1B7GyBt8Y/FFqdBKt8uTw9KhNqITYbdi5A=";
+        hash = "sha256-JKUAmUW/Lh78RUZBOk1cXLpMrhxskXW6BO+WcYanWFs=";
      };
      "aarch64-linux" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-18iAnXEELi+YvRVs1PP1MqZPeROVVl4T+qu2izyE4s0=";
+        hash = "sha256-kBkzOLG8O4OvjwKHiDiYFEvAe3QtDJDdoGKvMzSY5wA=";
      };
      "x86_64-darwin" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64.zip";
-        hash = "sha256-NeYGWYG3kRevI0CIShe4AHJzLRDV9cFbiaP7lpZO18A=";
+        hash = "sha256-zDngJ0zTRCQqufNmGRjwzi+77K4TpP6C/2lVqA4yEI0=";
      };
      "x86_64-linux" = fetchurl {
        url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-QC6dsWjRYiuBIojxPvs8NFMSU6ZbXbZ9Q/+u+45NmPc=";
+        hash = "sha256-LCfBxZMR+DI9HDvk3ZCJGFPtev+4U9AcxY/qDYbpOuA=";
      };
    };
    updateScript = writeShellScript "update-bun" ''
@ -92,7 +92,7 @@ stdenvNoCC.mkDerivation rec {
      lgpl21Only # javascriptcore and webkit
    ];
    mainProgram = "bun";
-    maintainers = with maintainers; [ DAlperin jk thilobillerbeck cdmistman coffeeispower ];
+    maintainers = with maintainers; [ DAlperin jk thilobillerbeck cdmistman coffeeispower diogomdp ];
    platforms = builtins.attrNames passthru.sources;
    # Broken for Musl at 2024-01-13, tracking issue:
    # https://github.com/NixOS/nixpkgs/issues/280716
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@ -13,16 +13,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "deno";
-  version = "1.44.2";
+  version = "1.44.3";

  src = fetchFromGitHub {
    owner = "denoland";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Q76j1cbRL52jmmkpTZMkpP3/FCeGZqKYAN819mQY9BE=";
+    hash = "sha256-KSCHVoKZiInxsnM+2sgyl87Wz9K9mjGjT4356m3+haY=";
  };

-  cargoHash = "sha256-UtnHOzlko5RUAbohwU755BDLSF/Rx20vabaKokEsRLU=";
+  cargoHash = "sha256-/ZxCM8/xLccOzzU5gfX0eC/DJwgqFngXM3cg+F/ZFAM=";

  postPatch = ''
    # upstream uses lld on aarch64-darwin for faster builds
--- a/pkgs/development/web/flyctl/default.nix
+++ b/pkgs/development/web/flyctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "flyctl";
-  version = "0.2.71";
+  version = "0.2.72";

  src = fetchFromGitHub {
    owner = "superfly";
    repo = "flyctl";
    rev = "v${version}";
-    hash = "sha256-d2qoTRWuUh7Kn0uqT3fIlB8BbFJmyVEIlfInS3m+etc=";
+    hash = "sha256-v2+xDeErVkgiGavPpBtKg7+BBhiKZdmbo2NIFL7iXvw=";
  };

  vendorHash = "sha256-iRZrjkWQxuUW/YM5TygFt+g8suM5iLGsWsCt4QQOX3M=";
@ -35,14 +35,12 @@ buildGoModule rec {
  '';

  # We override checkPhase to be able to test ./... while using subPackages
-  # Temporary fix for https://github.com/superfly/flyctl/issues/3642. We
-  # should go back to buildGoDir instead of go test once that is resolved.
  checkPhase = ''
    runHook preCheck
    # We do not set trimpath for tests, in case they reference test assets
    export GOFLAGS=''${GOFLAGS//-trimpath/}

-    go test ./...
+    buildGoDir test ./...

    runHook postCheck
  '';
--- a/pkgs/games/ferium/default.nix
+++ b/pkgs/games/ferium/default.nix
@ -9,18 +9,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "ferium";
-  version = "4.6.0";
+  version = "4.7.0";

  src = fetchFromGitHub {
    owner = "gorilla-devs";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-a4bX5pC3FSCswvUG1wFeo3e6F+CmyfYowv7OhF2DZss=";
+    hash = "sha256-jj3BdaxH7ofhHNF2eu+burn6+/0bPQQZ8JfjXAFyN4A=";
  };

  buildInputs = lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];

-  cargoHash = "sha256-CyDFBSTdUjapMtb6cNOEV53wTJDWotdSZZgHAQpsa9I=";
+  cargoHash = "sha256-dysKHi6CqPrF/q7LPn1+TwOP3p2KwauhTuqLCda3OSs=";

  # Disable the GUI file picker so that GTK/XDG dependencies aren't used
  buildNoDefaultFeatures = true;
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@ -1,7 +1,7 @@
 {
    "testing": {
-        "version": "6.10-rc3",
-        "hash": "sha256:11kjvjww4n0l4knq1v4rsbnac4s01r69yk1lrb9hgikszxyjklwk"
+        "version": "6.10-rc4",
+        "hash": "sha256:1cx7c25fa8pvabhwph0rdqdryalxgl7rs1ry0v4k048bxpisvahf"
    },
    "6.1": {
        "version": "6.1.94",
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
@ -6,7 +6,7 @@
 , ... } @ args:

 let
-  version = "5.15.158-rt76"; # updated by ./update-rt.sh
+  version = "5.15.160-rt77"; # updated by ./update-rt.sh
  branch = lib.versions.majorMinor version;
  kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@ -19,14 +19,14 @@ in buildLinux (args // {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1inmdpif3qf1blmvjj4i7y42bylvhv0wyj3b0apq12zxlj1iq1zr";
+    sha256 = "018v19a7rhzc4szybzzn86jlnk42x7jm6xkadfd2d3xq6f7727pl";
  };

  kernelPatches = let rt-patch = {
    name = "rt";
    patch = fetchurl {
      url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "17kw7cs1p0qgqf911prn3472c1j7r01g0mzqxsxpkdvhawxps7wy";
+      sha256 = "0id4m1k1xq84bxgnchm8r2iwfqw6nacv5n1ksgyzj6q6v66ik3wk";
    };
  }; in [ rt-patch ] ++ kernelPatches;

--- a/pkgs/servers/monitoring/grafana-image-renderer/default.nix
+++ b/pkgs/servers/monitoring/grafana-image-renderer/default.nix
@ -7,18 +7,18 @@

 mkYarnPackage rec {
  pname = "grafana-image-renderer";
-  version = "3.10.5";
+  version = "3.11.0";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "grafana-image-renderer";
    rev = "v${version}";
-    hash = "sha256-Ah78mapwGTD5mTPN7oKk8iwXpp2RMQ8nm0QX3/jTjKU=";
+    hash = "sha256-FoRXXeKiruXM8/Yh63zn2NuAj/JBXRNgNLLAuJ+sVIw=";
  };

  offlineCache = fetchYarnDeps {
    yarnLock = src + "/yarn.lock";
-    hash = "sha256-o8Bxc5KyoYMYJ6FwQ6PSi7A0LhU4VNuXh5xXbEXLb4Y=";
+    hash = "sha256-utJS1UsJ2SJ72w2zFpbP33Jz+eTG5aoKfvRP9muB9gg=";
  };

  packageJSON = ./package.json;
--- a/pkgs/servers/monitoring/grafana-image-renderer/package.json
+++ b/pkgs/servers/monitoring/grafana-image-renderer/package.json
@ -25,7 +25,7 @@
    "test-diff": "cross-env SAVE_DIFF=true jest"
  },
  "dependencies": {
-    "@grpc/grpc-js": "^1.7.0",
+    "@grpc/grpc-js": "^1.8.22",
    "@grpc/proto-loader": "^0.7.2",
    "@hapi/boom": "^10.0.0",
    "@puppeteer/browsers": "^1.6.0",
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@ -58,10 +58,6 @@ let

      patches = [
        ./patch/cmake-includedir.patch
-
-        # Fix build with libxml 2.12 and Clang 16.
-        # https://github.com/MariaDB/server/pull/2983
-        ./patch/0001-Fix-build-with-libxml2-2.12.patch
      ]
        # Fixes a build issue as documented on
        # https://jira.mariadb.org/browse/MDEV-26769?focusedCommentId=206073&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-206073
@ -248,29 +244,31 @@ in
    # see https://mariadb.org/about/#maintenance-policy for EOLs
    mariadb_105 = self.callPackage generic {
      # Supported until 2025-06-24
-      version = "10.5.23";
-      hash = "sha256-P3wzsgjLeZ2wFKh09WcY6t/yLulXgfo2Cqa8aWEJrP4=";
+      # TODO should be removed
+      version = "10.5.25";
+      hash = "sha256-lhnQ9R6GQ1dGayxjMBo0pT99/ZnxjE/UUvqyK/Obpk4=";
      inherit (self.darwin) cctools;
      inherit (self.darwin.apple_sdk.frameworks) CoreServices;
    };
    mariadb_106 = self.callPackage generic {
      # Supported until 2026-07-06
-      version = "10.6.16";
-      hash = "sha256-Xvg4Q+eW3Nqa6keyRpDd9thI9D9D4R+dmgzCHHj7uc8=";
+      version = "10.6.18";
+      hash = "sha256-aJihER9HEwcJ4ouix70aV+S7VxAfbhCeWX1R5tOFzxg=";
      inherit (self.darwin) cctools;
      inherit (self.darwin.apple_sdk.frameworks) CoreServices;
    };
    mariadb_1011 = self.callPackage generic {
      # Supported until 2028-02-16
-      version = "10.11.6";
-      hash = "sha256-HAFjRj6Y1x9HgHQWEaQJge7ivETTkmAcpJu/lI0E3Wc=";
+      version = "10.11.8";
+      hash = "sha256-XwTz4z2fHL7/BeecVNQdMCYwUAyZWu5ysGOOL5383w8=";
      inherit (self.darwin) cctools;
      inherit (self.darwin.apple_sdk.frameworks) CoreServices;
    };
    mariadb_110 = self.callPackage generic {
      # Supported until 2024-06-07
-      version = "11.0.4";
-      hash = "sha256-J2ls3zEVnyJUEOtchmW4VkWhxZmBzlr2vP9sll/u3ms=";
+      # TODO should be removed
+      version = "11.0.6";
+      hash = "sha256-AYnWKUbDfG20a/GkaLqVgLy6joDwWVjsSDwzh+zPmgA=";
      inherit (self.darwin) cctools;
      inherit (self.darwin.apple_sdk.frameworks) CoreServices;
    };
--- a/pkgs/servers/traefik/default.nix
+++ b/pkgs/servers/traefik/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "traefik";
-  version = "3.0.2";
+  version = "3.0.3";

  # Archive with static assets for webui
  src = fetchzip {
    url = "https://github.com/traefik/traefik/releases/download/v${version}/traefik-v${version}.src.tar.gz";
-    hash = "sha256-h/LN++Jw8Yr08uH5T2Br1YVJtiAToI/1k4YDxqmFCZQ=";
+    hash = "sha256-vjY8sbNkY/kdQiJ020iUWxIVzxkmpkeLhxBThc6tUuE=";
    stripRoot = false;
  };

-  vendorHash = "sha256-XVRVrfraI7lQOrQKv0L557903hwZXlzI+9/tpXnAlW0=";
+  vendorHash = "sha256-rvo3nw9yUfikO82cy6BbukwqwBSrUCCEta3nKBprCbk=";

  subPackages = [ "cmd/traefik" ];

--- a/pkgs/test/haskell/cabalSdist/local/generated.nix
+++ b/pkgs/test/haskell/cabalSdist/local/generated.nix
@ -3,7 +3,14 @@
 mkDerivation {
  pname = "local";
  version = "0.1.0.0";
-  src = ./.;
+  src = lib.fileset.toSource {
+    root = ./.;
+    fileset = lib.fileset.unions [
+      ./app
+      ./CHANGELOG.md
+      ./local.cabal
+    ];
+  };
  isLibrary = false;
  isExecutable = true;
  executableHaskellDepends = [ base ];
--- a/pkgs/test/haskell/setBuildTarget/default.nix
+++ b/pkgs/test/haskell/setBuildTarget/default.nix
@ -7,7 +7,15 @@ let
      mkDerivation {
        pname = "haskell-setBuildTarget";
        version = "0.1.0.0";
-        src = ./.;
+        src = lib.fileset.toSource {
+          root = ./.;
+          fileset = lib.fileset.unions [
+            ./haskell-setBuildTarget.cabal
+            ./Bar.hs
+            ./Foo.hs
+            ./Setup.hs
+          ];
+        };
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [ base ];
--- a/pkgs/tools/admin/qovery-cli/default.nix
+++ b/pkgs/tools/admin/qovery-cli/default.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "qovery-cli";
-  version = "0.94.11";
+  version = "0.94.13";

  src = fetchFromGitHub {
    owner = "Qovery";
    repo = "qovery-cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-2p3KUIu3L78X2/i5B6+RoMmoyG5vqg8RWDXeUYlpqwU=";
+    hash = "sha256-LFVl4IlLoJyOdHv0rqL2GfUvLpp/8qT951fQkW8MHy4=";
  };

-  vendorHash = "sha256-OKerPm5odNWCD5AqfNHqcQSeWu53ZVqCbIowzf6tO9A=";
+  vendorHash = "sha256-qrDadHGhjwsAIfIQIkUeT7Tehv1sTtsfzgPyKxc5zJE=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
@ -13,13 +13,13 @@ in

 stdenv.mkDerivation rec {
  pname = "ibus-typing-booster";
-  version = "2.25.8";
+  version = "2.25.9";

  src = fetchFromGitHub {
    owner = "mike-fabian";
    repo = "ibus-typing-booster";
    rev = version;
-    hash = "sha256-0fjtLsIoMiI7zhaxU8RcoG4k48e02sJZvpjEBDfB/I0=";
+    hash = "sha256-dQifLJjgTKkFYBOJKxGXA1w97UBa0Bh56I6nRk0GVj0=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook3 gobject-introspection ];
--- a/pkgs/tools/misc/fdupes/default.nix
+++ b/pkgs/tools/misc/fdupes/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "fdupes";
-  version = "2.3.0";
+  version = "2.3.1";

  src = fetchFromGitHub {
    owner = "adrianlopezroche";
    repo = "fdupes";
    rev = "v${version}";
-    hash = "sha256-BW6a5vKRAuXs/zWPHhtZs6Y4scyCEfqHEAkGUSUiwkI=";
+    hash = "sha256-yOUgPa13DHDcuEqJMpBQVMOKFH/rlH44rWiIPRwnztM=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/misc/wasm-tools/default.nix
+++ b/pkgs/tools/misc/wasm-tools/default.nix
@ -5,19 +5,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "wasm-tools";
-  version = "1.210.0";
+  version = "1.211.1";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-qp00/cgx2FpdBbt5CXYFD/V6SOtz7VQfRq0zJsELVuc=";
+    hash = "sha256-xd5/QB6/V8cyoygShmcIzUgXZNs+kBuPtKy56BSoxKo=";
    fetchSubmodules = true;
  };

  # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
  auditable = false;
-  cargoHash = "sha256-jNr0oyd+8E5ppPcV5LMAbOro4ZodgskCHAhe5TgC/6I=";
+  cargoHash = "sha256-H3eEwVZB6xzZwW5Bvgs7yPV58QUNvLSWSDigLzs2uG0=";
  cargoBuildFlags = [ "--package" "wasm-tools" ];
  cargoTestFlags = [ "--all" ];

--- a/pkgs/tools/misc/xmonad-log/deps.nix
+++ b/pkgs/tools/misc/xmonad-log/deps.nix
@ -1,12 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-[
-  {
-    goPackagePath = "github.com/godbus/dbus";
-    fetch = {
-      type = "git";
-      url = "https://github.com/godbus/dbus";
-      rev = "a389bdde4dd695d414e47b755e95e72b7826432c";
-      sha256 = "1ckvg15zdsgmbn4mi36cazkb407ixc9mmyf7vwj8b8wi3d00rgn9";
-    };
-  }
-]
--- a/pkgs/tools/package-management/libdnf/default.nix
+++ b/pkgs/tools/package-management/libdnf/default.nix
@ -24,7 +24,7 @@

 stdenv.mkDerivation rec {
  pname = "libdnf";
-  version = "0.73.1";
+  version = "0.73.2";

  outputs = [ "out" "dev" "py" ];

@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
    owner = "rpm-software-management";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-mZCrJ1fXqKE1sMYKWHLLQEPkdLwPwqJz+8n+DlNmxvM=";
+    hash = "sha256-tdAbkIb3BAhNKFbjIGHEdVNwh3E1sKFLP+L4MhifsQM=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/text/epub2txt2/default.nix
+++ b/pkgs/tools/text/epub2txt2/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "epub2txt2";
-  version = "2.06";
+  version = "2.07";

  src = fetchFromGitHub {
    owner = "kevinboone";
    repo = pname;
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-zzcig5XNh9TqUHginsfoC47WrKavqi6k6ezir+OOMJk=";
+    sha256 = "sha256-/P81ZXhB0wyRx2bb/CO7+kTTNspYKoGUpBGLb8Yfb5I=";
  };

  makeFlags = [ "CC:=$(CC)" "PREFIX:=$(out)" ];
--- a/Show More
+++ b/Show More