Merge master into haskell-updates

36 files changed, 384 insertions, 249 deletions

diff --git a/pkgs/applications/audio/qmmp/default.nix b/pkgs/applications/audio/qmmp/default.nix
index 65cf4e3d7b000..54da814c5f204 100644
--- a/pkgs/applications/audio/qmmp/default.nix
+++ b/pkgs/applications/audio/qmmp/default.nix
@@ -26,11 +26,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qmmp";
-  version = "2.1.5";
+  version = "2.1.6";
 
   src = fetchurl {
     url = "https://qmmp.ylsoftware.com/files/qmmp/2.1/${pname}-${version}.tar.bz2";
-    hash = "sha256-Jb4/KxnY1wtrUTbD+X04Wl7b9A2sZ92E/N1K+dVU95U=";
+    hash = "sha256-knqo5yCkcO/bFmM++z+SdiWzpDKK9ooV0wqlcIKj7so=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
diff --git a/pkgs/applications/audio/youtube-music/default.nix b/pkgs/applications/audio/youtube-music/default.nix
index cfb97b549a06d..7f6b7865054f1 100644
--- a/pkgs/applications/audio/youtube-music/default.nix
+++ b/pkgs/applications/audio/youtube-music/default.nix
@@ -1,6 +1,5 @@
 { lib
 , fetchFromGitHub
-, buildNpmPackage
 , makeWrapper
 , electron
 , python3
@@ -14,21 +13,17 @@
 , makeDesktopItem
 }:
 
-let
+stdenv.mkDerivation (finalAttrs: {
   pname = "youtube-music";
-  version = "3.1.0";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "th-ch";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-6ZiftpdCwxCkJzcHryVrUKzM+mM1eQpdLNFl0Dja59Q=";
+    repo = "youtube-music";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-N6TzDTKvMyasksE0qcEGKeNjGAD08OzxpmpoQ11/ZW4=";
   };
 
-in
-stdenv.mkDerivation (finalAttrs: {
-  inherit pname version src;
-
   pnpmDeps = stdenvNoCC.mkDerivation {
     pname = "${finalAttrs.pname}-pnpm-deps";
     inherit (finalAttrs) src version ELECTRON_SKIP_BINARY_DOWNLOAD;
@@ -51,17 +46,15 @@ stdenv.mkDerivation (finalAttrs: {
     dontBuild = true;
     dontFixup = true;
     outputHashMode = "recursive";
-    outputHashAlgo = "sha256";
     outputHash = {
-      x86_64-linux = "sha256-Oy11V7FXfVhLUR9gX0sjQEFuVPFpbaVdT518oOSLcvA=";
-      aarch64-linux = "sha256-6nXemaGiQjp2stjjKItPJ62VcH5Q5pRf63qKtl2haXI=";
-      x86_64-darwin = "sha256-jSMAw+AMD63vqPckZjblw4EDngA4E8h0WlsZu3hUShY=";
-      aarch64-darwin = "sha256-zujXURpIcw7IOw63AW167h6cywYXydhHZMzA2apGZAs=";
+      x86_64-linux = "sha256-V6CSawxBWFbXmAPbck0xCXqRlANpqFAoqSAB4Duf8qM=";
+      aarch64-linux = "sha256-cqBn35soV14CmobKt0napRELio4HKKA8Iw3QSWTxzP8=";
+      x86_64-darwin = "sha256-DY9T1N8Hxr57/XisYT+u2+hQvYMIiyQ3UHeTuA6BhSY=";
+      aarch64-darwin = "sha256-3Zk0SyhVKaz5QdO69/xzWFZj9ueJS6GLWhfW7odWvHc=";
     }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
   };
 
-  nativeBuildInputs =
-    [ makeWrapper python3 nodePackages.pnpm nodePackages.nodejs ]
+  nativeBuildInputs = [ makeWrapper python3 nodePackages.pnpm nodePackages.nodejs ]
     ++ lib.optionals (!stdenv.isDarwin) [ copyDesktopItems ];
 
 
diff --git a/pkgs/applications/editors/eclipse/default.nix b/pkgs/applications/editors/eclipse/default.nix
index ce5910924e10b..732dc7695cc2b 100644
--- a/pkgs/applications/editors/eclipse/default.nix
+++ b/pkgs/applications/editors/eclipse/default.nix
@@ -9,7 +9,7 @@
 # use ./update.sh to help with updating for each quarterly release
 #
 # then, to test:
-# for e in cpp dsl embedcpp modeling platform sdk java jee committers rcp; do for s in pkgs pkgsCross.aarch64-multiplatform; do echo; echo $s $e; nix build -f default.nix ${s}.eclipses.eclipse-${e} -o eclipse-${s}-${e}; done; done
+# for e in cpp dsl embedcpp modeling platform sdk java jee committers rcp; do for s in pkgs pkgsCross.aarch64-multiplatform; do echo; echo $s $e; nix-build -A ${s}.eclipses.eclipse-${e} -o eclipse-${s}-${e}; done; done
 
 let
   platform_major = "4";
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 1c5b3718c1efb..e2fdd0ed37eeb 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1785,8 +1785,8 @@ let
         mktplcRef = {
           publisher = "github";
           name = "copilot";
-          version = "1.156.691";
-          sha256 = "sha256-K7lzwfgqb0gUJAivro/ePaQetM31M+zTBRZMBy92ZuA=";
+          version = "1.172.758";
+          sha256 = "sha256-sK3IiA4mQ6Hse+UpZ81Zb5iBSREzTrs7ypsfGbJiXm4=";
         };
 
         meta = {
@@ -1802,7 +1802,7 @@ let
         mktplcRef = {
           publisher = "github";
           name = "copilot-chat";
-          version = "0.12.2024013003"; # latest version compatible with vscode 1.86
+          version = "0.14.2024030801"; # compatible with vscode >= 1.87
           sha256 = "sha256-4ArWVFko2T6ze/i+HTdXAioWC7euWCycDsQxFTrEtUw=";
         };
         meta = {
diff --git a/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix b/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix
index 1729256670c3f..2de2c1c8789fe 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix
@@ -30,14 +30,24 @@
 
 let
   gdbDefaultsTo = if gdbUseFixed then "${gdb}/bin/gdb" else "gdb";
+  supported = {
+    x86_64-linux = {
+      sha256 = "sha256-4mKCBqUCOndKEfsJqTIsfwEt+0CZI8QAhBj3Y4+wKlg=";
+      arch = "linux-x64";
+    };
+    aarch64-linux = {
+      sha256 = "sha256-Kjl8mEpayA1xMHEAMJ5k3Ctk3l48KlUBU5w3dL4pGWM=";
+      arch = "linux-arm64";
+    };
+  };
+
+  base = supported.${stdenv.system} or (throw "unsupported platform ${stdenv.system}");
 in
 vscode-utils.buildVscodeMarketplaceExtension {
-  mktplcRef = {
+  mktplcRef = base // {
     name = "cpptools";
     publisher = "ms-vscode";
     version = "1.17.3";
-    sha256 = "sha256-4mKCBqUCOndKEfsJqTIsfwEt+0CZI8QAhBj3Y4+wKlg=";
-    arch = "linux-x64";
   };
 
   nativeBuildInputs = [
@@ -85,6 +95,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
     homepage = "https://marketplace.visualstudio.com/items?itemName=ms-vscode.cpptools";
     license = lib.licenses.unfree;
     maintainers = [ lib.maintainers.jraygauthier lib.maintainers.stargate01 ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
   };
 }
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index 22f4ec88118cd..6770f7a1ecc40 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -15,11 +15,11 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0pz2dn245jzjw2n79mm9angvdlwlwxb4lwdq8za1i99g2m4il1bz";
-    x86_64-darwin = "0d0ivs672zh7w60pxy95awq7c8gxhs7d8wv5cf25289gnzcd6qff";
-    aarch64-linux = "1srir5gr0bdvnxyqrfq00p34ligg0pppr22g9zrdm8jasvrz6fb0";
-    aarch64-darwin = "046kcsanz5msf5xd94b1lxcwclsp3dcwxgzrcxycbsykxslz9gpq";
-    armv7l-linux = "0h576q3jbdy48bvg4h9swd2w7cynxmnm2klj6p719myigx7h2jzg";
+    x86_64-linux = "02rkp86rj7irs5011g6180yihllwfx47afk5vybxab4v23vigidr";
+    x86_64-darwin = "1hpj6kkyby9chr27w2382az7h2bg3x1x7c9j6i5bh8vl81s9yfd4";
+    aarch64-linux = "04fhmfplvyqg2l5xlqldl6kfy1m3y19sf2nikigmsm550b8m6sgc";
+    aarch64-darwin = "1yhyybd27ympg12mp4w46z64g2mi1hbv4d6hfl34l7fq4c5jkjf2";
+    armv7l-linux = "0jpjsfal67la123hqp9607bih3vnjdpbnrghyy1vywy15z71pff5";
   }.${system} or throwSystem;
 
   sourceRoot = lib.optionalString (!stdenv.isDarwin) ".";
@@ -29,7 +29,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.86.2.24057";
+    version = "1.87.1.24068";
     pname = "vscodium";
 
     executableName = "codium";
diff --git a/pkgs/applications/emulators/cemu/default.nix b/pkgs/applications/emulators/cemu/default.nix
index 6e0db9e02c9f3..fa7f68c7063f9 100644
--- a/pkgs/applications/emulators/cemu/default.nix
+++ b/pkgs/applications/emulators/cemu/default.nix
@@ -46,13 +46,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "cemu";
-  version = "2.0-66";
+  version = "2.0-68";
 
   src = fetchFromGitHub {
     owner = "cemu-project";
     repo = "Cemu";
     rev = "v${version}";
-    hash = "sha256-1s1H2rJuN9lRNanKXxKWMLBOFg5z3IwpJCZCmymAH9Y=";
+    hash = "sha256-/c0rpj4s3aNJVH+AlU9R4t321OqTvJHfZQCfyzYB4m8=";
   };
 
   patches = [
diff --git a/pkgs/applications/emulators/ripes/default.nix b/pkgs/applications/emulators/ripes/default.nix
index e1438b1d0a806..4717a1b0601d7 100644
--- a/pkgs/applications/emulators/ripes/default.nix
+++ b/pkgs/applications/emulators/ripes/default.nix
@@ -14,14 +14,14 @@
 stdenv.mkDerivation rec {
   pname = "ripes";
   # Pulling unstable version as latest stable does not build against gcc-13.
-  version = "2.2.6-unstable-2024-01-02";
+  version = "2.2.6-unstable-2024-03-03";
 
   src = fetchFromGitHub {
     owner = "mortbopet";
     repo = "Ripes";
-    rev = "0faf41b669a93a1944707cd7d111a5e9241425fe";
+    rev = "b71f0ddd5d2d346cb97b28fd3f70fef55bb9b6b7";
     fetchSubmodules = true;
-    hash = "sha256-3+jibS1mGYBy9jmucytc7GvB1ZKRfh7aXtDty77hA3k=";
+    hash = "sha256-zQrrWBHNIacRoAEIjR0dlgUTncBCiodcBeT/wbDClWg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/emulators/xemu/default.nix b/pkgs/applications/emulators/xemu/default.nix
index 3fc8adde9b675..43fbd7e5f73b9 100644
--- a/pkgs/applications/emulators/xemu/default.nix
+++ b/pkgs/applications/emulators/xemu/default.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xemu";
-  version = "0.7.118";
+  version = "0.7.119";
 
   src = fetchFromGitHub {
     owner = "xemu-project";
     repo = "xemu";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-IGzPxwNxuqMsZhQ63VUyDzPSBpAgc0U0oUjM/blEd7g=";
+    hash = "sha256-5gH1pQqy45vmgeW61peEi6+ZXpPgyQMUg3dh37oqR6s=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/graphics/xournalpp/default.nix b/pkgs/applications/graphics/xournalpp/default.nix
index 923ee5deda13d..7ff575acab669 100644
--- a/pkgs/applications/graphics/xournalpp/default.nix
+++ b/pkgs/applications/graphics/xournalpp/default.nix
@@ -7,6 +7,7 @@
 , pkg-config
 
 , alsa-lib
+, binutils
 , glib
 , gsettings-desktop-schemas
 , gtk3
@@ -25,16 +26,22 @@
 
 stdenv.mkDerivation rec {
   pname = "xournalpp";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "xournalpp";
-    repo = pname;
+    repo = "xournalpp";
     rev = "v${version}";
-    sha256 = "sha256-6ND0Y+TzdN2rRI10cusgSK1sYMC55Wn5qFCHP4hsdes=";
+    sha256 = "sha256-8UAAX/kixqiY9zEYs5eva0G2K2vlfnYd1yyVHMSfSeY=";
   };
 
+  postPatch = ''
+    substituteInPlace src/util/Stacktrace.cpp \
+      --replace-fail "addr2line" "${binutils}/bin/addr2line"
+  '';
+
   nativeBuildInputs = [ cmake gettext pkg-config wrapGAppsHook ];
+
   buildInputs =
     lib.optionals stdenv.isLinux [
       alsa-lib
@@ -56,8 +63,6 @@ stdenv.mkDerivation rec {
 
   buildFlags = [ "translations" ];
 
-  hardeningDisable = [ "format" ];
-
   meta = with lib; {
     description = "Xournal++ is a handwriting Notetaking software with PDF annotation support";
     homepage    = "https://xournalpp.github.io/";
@@ -65,5 +70,6 @@ stdenv.mkDerivation rec {
     license     = licenses.gpl2Plus;
     maintainers = with maintainers; [ andrew-d sikmir ];
     platforms   = platforms.unix;
+    mainProgram = "xournalpp";
   };
 }
diff --git a/pkgs/applications/misc/clight/default.nix b/pkgs/applications/misc/clight/default.nix
index 3adff5c628878..3b0189ddb5c1c 100644
--- a/pkgs/applications/misc/clight/default.nix
+++ b/pkgs/applications/misc/clight/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clight";
-  version = "4.10";
+  version = "4.11";
 
   src = fetchFromGitHub {
     owner = "FedeDP";
     repo = "Clight";
     rev = version;
-    sha256 = "sha256-IAoz4f4XrX8bgesWL4yLK6m5F+c75WNIMFgKBj+W61Q=";
+    sha256 = "sha256-Fu38HRP83Yn2jsq9xnCWOXNlV/0hJKD1/cOOp3EV45Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/makehuman/default.nix b/pkgs/applications/misc/makehuman/default.nix
new file mode 100644
index 0000000000000..70cb33643ee67
--- /dev/null
+++ b/pkgs/applications/misc/makehuman/default.nix
@@ -0,0 +1,145 @@
+{ stdenv
+, lib
+, fetchpatch
+, fetchFromGitHub
+, python3
+, qtbase
+, qttools
+, git-lfs
+, wrapQtAppsHook
+}:
+
+let
+  pydeps = with python3.pkgs; [
+    numpy
+    pyqt5
+    pyopengl
+  ];
+  python = python3.withPackages (pkgs: pydeps);
+in
+stdenv.mkDerivation rec {
+  pname = "makehuman";
+  version = "1.2.0";
+
+  source = fetchFromGitHub {
+    owner = "makehumancommunity";
+    repo = "makehuman";
+    rev = "v${version}";
+    hash = "sha256-mCv6H0B7b4uxozpNHkKsG+Is2H0QYEJnnzKCHixhBpY=";
+    name = "${pname}-source";
+  };
+
+  assets = fetchFromGitHub {
+    owner = "makehumancommunity";
+    repo = "makehuman-assets";
+    rev = "v${version}";
+    hash = "sha256-Jd2A0PAHVdFMnDLq4Mu5wsK/E6A4QpKjUyv66ix1Gbo=";
+    name = "${pname}-assets-source";
+  };
+
+  patches = [
+    # work with numpy>=1.24
+    (fetchpatch {
+      name = "fix-compile_targets.py-when-using-numpy-1.24.0-or-newer";
+      url = "https://patch-diff.githubusercontent.com/raw/makehumancommunity/makehuman/pull/220.patch";
+      hash = "sha256-ip7U83cCBrl+4gM1GZ2QQIER5Qur6HRu3a/TnHqk//g=";
+    })
+    # crash related to collections.Callable -> collections.abc.Callable
+    (fetchpatch {
+      name = "remove-unnecessary-compatibility-test";
+      url = "https://patch-diff.githubusercontent.com/raw/makehumancommunity/makehuman/pull/188.patch";
+      hash = "sha256-HGrk3n7rhV4YgK8mNUdfHwQl8dFT8yuzjxorvwfMmJw=";
+    })
+    # some OpenGL issue causing blank windows on recent Qt
+    (fetchpatch {
+      name = "qt-opengl-update-from-qglwidget-to-qopenglwidget-to-fix-blank";
+      url = "https://patch-diff.githubusercontent.com/raw/makehumancommunity/makehuman/pull/197.patch";
+      hash = "sha256-fEqBwg1Jd36nKWIT9XPr6Buj1N3AmTQg2LBaoX3eTxw=";
+    })
+    # multisampling issue
+    (fetchpatch {
+      name = "switch-default-for-multisampling-and-disable-sample-buffers";
+      url = "https://github.com/makehumancommunity/makehuman/commit/c47b884028a24eb190d097e7523a3059e439cb6f.patch";
+      hash = "sha256-tknQHX9qQYH15gyOLNhxfO3bsFVIv3Z1F7ZXD1IT1h4=";
+    })
+    # PyQt >= 5.12
+    (fetchpatch {
+      name = "fix-scrolling-issue-on-pyqt5>=5.12";
+      url = "https://github.com/makehumancommunity/makehuman/commit/02c4269a2d4c57f68159fe8f437a8b1978b99099.patch";
+      hash = "sha256-yR5tZcELX0N83PW/vS6yB5xKoZcHhVp48invlu7quWM=";
+    })
+  ];
+
+  srcs = [
+    source
+    assets
+  ];
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [
+    python
+    qtbase
+    git-lfs
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    python
+    qtbase
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pydeps
+  ];
+
+  finalSource = "${pname}-final";
+
+  postUnpack = ''
+    mkdir -p $finalSource
+    cp -r $source/makehuman $finalSource
+    chmod u+w $finalSource --recursive
+    cp -r $assets/base/* $finalSource/makehuman/data
+    chmod u+w $finalSource --recursive
+    sourceRoot=$finalSource
+  '';
+
+  configurePhase = ''
+    runHook preConfigure
+    pushd ./makehuman
+    bash ./cleannpz.sh
+    bash ./cleanpyc.sh
+    python3 ./compile_targets.py
+    python3 ./compile_models.py
+    python3 ./compile_proxies.py
+    popd
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    mkdir -p $out/opt $out/bin
+    cp -r * $out/opt
+    python -m compileall -o 0 -o 2 $out/opt
+    ln -s $out/opt/makehuman/makehuman.py $out/bin/makehuman
+    chmod +x $out/bin/makehuman
+    runHook postBuild
+  '';
+
+  preFixup = ''
+    wrapQtApp $out/bin/makehuman
+  '';
+
+  meta = {
+    description = "Software to create realistic humans";
+    homepage = "http://www.makehumancommunity.org/";
+    license = with lib.licenses; [ agpl3Plus cc0 ];
+    longDescription = ''
+      MakeHuman is a GUI program for procedurally generating
+      realistic-looking humans.
+    '';
+    mainProgram = "makehuman";
+    maintainers = with lib.maintainers; [ elisesouche ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/applications/misc/mkgmap/build.xml.patch b/pkgs/applications/misc/mkgmap/build.xml.patch
index 2aced44520628..567c0d5586f85 100644
--- a/pkgs/applications/misc/mkgmap/build.xml.patch
+++ b/pkgs/applications/misc/mkgmap/build.xml.patch
@@ -1,14 +1,6 @@
 --- a/build.xml	(revision 4555)
 +++ a/build.xml	(working copy)
-@@ -222,13 +222,13 @@
- 		<property name="svn.version.build" value="none"/>
- 
- 		<propertyfile file="${build.classes}/mkgmap-version.properties">
--			<entry key="svn.version" value="${svn.version.build}" />
--			<entry key="build.timestamp" value="${build.timestamp}" />
-+			<entry key="svn.version" value="@version@" />
-+			<entry key="build.timestamp" value="unknown" />
- 		</propertyfile>
+@@ -228,7 +228,7 @@
  	</target>
  
  	<!-- Compile the product itself (no tests). -->
@@ -35,12 +27,3 @@
  		<mkdir dir="tmp/report"/>
  		<junit printsummary="yes" failureproperty="junit.failure" forkmode="once">
  
-@@ -351,7 +351,7 @@
- 			ignoreerrors="true"/>
- 	</target>
- 
--	<target name="dist" depends="build, check-version, version-file"
-+	<target name="dist" depends="build, version-file"
- 					description="Make the distribution area">
- 
- 		<mkdir dir="${dist}"/>
diff --git a/pkgs/applications/misc/mkgmap/default.nix b/pkgs/applications/misc/mkgmap/default.nix
index 77e843d1c7fa9..ee0c2043a6b4c 100644
--- a/pkgs/applications/misc/mkgmap/default.nix
+++ b/pkgs/applications/misc/mkgmap/default.nix
@@ -1,7 +1,7 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , fetchsvn
-, substituteAll
 , jdk
 , jre
 , ant
@@ -24,14 +24,24 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      # Disable automatic download of dependencies
-      src = ./build.xml.patch;
-      inherit version;
-    })
+    # Disable automatic download of dependencies
+    ./build.xml.patch
+    ./ignore-impure-test.patch
   ];
 
   postPatch = with deps; ''
+    # Fix the output jar timestamps for reproducibility
+    substituteInPlace build.xml \
+        --replace-fail '<jar ' '<jar modificationtime="0" '
+
+    # Manually create version properties file for reproducibility
+    mkdir -p build/classes
+    cat > build/classes/mkgmap-version.properties << EOF
+      svn.version=${version}
+      build.timestamp=unknown
+    EOF
+
+    # Put pre-fetched dependencies into the right place
     mkdir -p lib/compile
     cp ${fastutil} lib/compile/${fastutil.name}
     cp ${osmpbf} lib/compile/${osmpbf.name}
@@ -53,36 +63,51 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ jdk ant makeWrapper ];
 
-  buildPhase = "ant";
+  buildPhase = ''
+    runHook preBuild
+    ant
+    runHook postBuild
+  '';
 
   inherit doCheck;
 
-  checkPhase = "ant test";
+  checkPhase = ''
+    runHook preCheck
+    ant test
+    runHook postCheck
+  '';
 
   installPhase = ''
+    runHook preInstall
+
     install -Dm644 dist/mkgmap.jar -t $out/share/java/mkgmap
     install -Dm644 dist/doc/mkgmap.1 -t $out/share/man/man1
     cp -r dist/lib/ $out/share/java/mkgmap/
     makeWrapper ${jre}/bin/java $out/bin/mkgmap \
       --add-flags "-jar $out/share/java/mkgmap/mkgmap.jar"
-  '' + lib.optionalString withExamples ''
-    mkdir -p $out/share/mkgmap
-    cp -r dist/examples $out/share/mkgmap/
+
+    ${lib.optionalString withExamples ''
+      mkdir -p $out/share/mkgmap
+      cp -r dist/examples $out/share/mkgmap/
+    ''}
+
+    runHook postInstall
   '';
 
   passthru.updateScript = [ ./update.sh "mkgmap" meta.downloadPage ];
 
   meta = with lib; {
     description = "Create maps for Garmin GPS devices from OpenStreetMap (OSM) data";
-    homepage = "https://www.mkgmap.org.uk/";
     downloadPage = "https://www.mkgmap.org.uk/download/mkgmap.html";
-    sourceProvenance = with sourceTypes; [
-      fromSource
-      binaryBytecode  # deps
-    ];
+    homepage = "https://www.mkgmap.org.uk/";
     license = licenses.gpl2Only;
+    mainProgram = "mkgmap";
     maintainers = with maintainers; [ sikmir ];
     platforms = platforms.all;
-    mainProgram = "mkgmap";
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode # deps
+    ];
   };
+
 }
diff --git a/pkgs/applications/misc/mkgmap/ignore-impure-test.patch b/pkgs/applications/misc/mkgmap/ignore-impure-test.patch
new file mode 100644
index 0000000000000..1ed2f7092f08a
--- /dev/null
+++ b/pkgs/applications/misc/mkgmap/ignore-impure-test.patch
@@ -0,0 +1,20 @@
+diff --git a/test/uk/me/parabola/imgfmt/app/srt/SrtCollatorTest.java b/test/uk/me/parabola/imgfmt/app/srt/SrtCollatorTest.java
+index e1e4ac7..954b918 100644
+--- a/test/uk/me/parabola/imgfmt/app/srt/SrtCollatorTest.java
++++ b/test/uk/me/parabola/imgfmt/app/srt/SrtCollatorTest.java
+@@ -17,6 +17,7 @@ import java.text.Collator;
+ import uk.me.parabola.mkgmap.srt.SrtTextReader;
+ 
+ import org.junit.Before;
++import org.junit.Ignore;
+ import org.junit.Test;
+ 
+ import static org.junit.Assert.*;
+@@ -111,6 +112,7 @@ public class SrtCollatorTest {
+ 	 * meant to be identical to the java one.
+ 	 */
+ 	@Test
++	@Ignore
+ 	public void testJavaRules() {
+ 		Collator collator = Collator.getInstance();
+ 
diff --git a/pkgs/applications/misc/mkgmap/splitter/build.xml.patch b/pkgs/applications/misc/mkgmap/splitter/build.xml.patch
index a028dbef03145..1fb0a14ef4c3a 100644
--- a/pkgs/applications/misc/mkgmap/splitter/build.xml.patch
+++ b/pkgs/applications/misc/mkgmap/splitter/build.xml.patch
@@ -1,13 +1,6 @@
 --- a/build.xml	(revision 597)
 +++ a/build.xml	(working copy)
-@@ -207,12 +207,12 @@
- 		<property name="svn.version.build" value="unknown"/>
- 
- 		<propertyfile file="${build.classes}/splitter-version.properties">
--			<entry key="svn.version" value="${svn.version.build}" />
--			<entry key="build.timestamp" value="${build.timestamp}" />
-+			<entry key="svn.version" value="@version@" />
-+			<entry key="build.timestamp" value="unknown" />
+@@ -212,7 +212,7 @@
  		</propertyfile>
  	</target>
  
@@ -25,15 +18,6 @@
      <javac srcdir="${test}" destdir="${build.test-classes}" debug="yes" includeantruntime="false">
        <include name="**/*.java"/>
        <classpath refid="test.classpath"/>
-@@ -261,7 +261,7 @@
- 	  <fail if="junit.failure" message="Test failed.  See test-reports/index.html"/>
- 	</target>
- 
--  <target name="dist" depends="build, check-version, version-file" description="Make the distribution area">
-+  <target name="dist" depends="build, version-file" description="Make the distribution area">
- 
-     <mkdir dir="${dist}"/>
-     <mkdir dir="${dist}/doc/api"/>
 @@ -324,7 +324,7 @@
  	</target>
  
diff --git a/pkgs/applications/misc/mkgmap/splitter/default.nix b/pkgs/applications/misc/mkgmap/splitter/default.nix
index d9b886cbe2b3f..010b140e9bf93 100644
--- a/pkgs/applications/misc/mkgmap/splitter/default.nix
+++ b/pkgs/applications/misc/mkgmap/splitter/default.nix
@@ -1,7 +1,7 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchurl
 , fetchsvn
-, substituteAll
 , jdk
 , jre
 , ant
@@ -23,17 +23,25 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      # Disable automatic download of dependencies
-      src = ./build.xml.patch;
-      inherit version;
-    })
-
+    # Disable automatic download of dependencies
+    ./build.xml.patch
     # Fix func.SolverAndProblemGeneratorTest test
     ./fix-failing-test.patch
   ];
 
   postPatch = with deps; ''
+    # Fix the output jar timestamps for reproducibility
+    substituteInPlace build.xml \
+        --replace-fail '<jar ' '<jar modificationtime="0" '
+
+    # Manually create version properties file for reproducibility
+    mkdir -p build/classes
+    cat > build/classes/splitter-version.properties << EOF
+      svn.version=${version}
+      build.timestamp=unknown
+    EOF
+
+    # Put pre-fetched dependencies into the right place
     mkdir -p lib/compile
     cp ${fastutil} lib/compile/${fastutil.name}
     cp ${osmpbf} lib/compile/${osmpbf.name}
@@ -52,32 +60,46 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ jdk ant makeWrapper ];
 
-  buildPhase = "ant";
+  buildPhase = ''
+    runHook preBuild
+    ant
+    runHook postBuild
+  '';
 
   inherit doCheck;
 
-  checkPhase = "ant run.tests && ant run.func-tests";
+  checkPhase = ''
+    runHook preCheck
+    ant run.tests
+    ant run.func-tests
+    runHook postCheck
+  '';
 
   installPhase = ''
+    runHook preInstall
+
     install -Dm644 dist/splitter.jar -t $out/share/java/splitter
     install -Dm644 doc/splitter.1 -t $out/share/man/man1
     cp -r dist/lib/ $out/share/java/splitter/
     makeWrapper ${jre}/bin/java $out/bin/splitter \
       --add-flags "-jar $out/share/java/splitter/splitter.jar"
+
+    runHook postInstall
   '';
 
   passthru.updateScript = [ ../update.sh "mkgmap-splitter" meta.downloadPage ];
 
   meta = with lib; {
     description = "Utility for splitting OpenStreetMap maps into tiles";
-    homepage = "https://www.mkgmap.org.uk/";
     downloadPage = "https://www.mkgmap.org.uk/download/splitter.html";
-    sourceProvenance = with sourceTypes; [
-      fromSource
-      binaryBytecode  # deps
-    ];
+    homepage = "https://www.mkgmap.org.uk/";
     license = licenses.gpl2Only;
+    mainProgram = "splitter";
     maintainers = with maintainers; [ sikmir ];
     platforms = platforms.all;
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode # deps
+    ];
   };
 }
diff --git a/pkgs/applications/misc/phoc/default.nix b/pkgs/applications/misc/phoc/default.nix
index 83e6d678d61c3..e50b9787236af 100644
--- a/pkgs/applications/misc/phoc/default.nix
+++ b/pkgs/applications/misc/phoc/default.nix
@@ -65,7 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
         inherit (finalAttrs) src;
         preferLocalBuild = true;
         allowSubstitutes = false;
-        phases = "unpackPhase installPhase";
         installPhase = "cp subprojects/packagefiles/wlroots/$name $out";
       })
     ];
diff --git a/pkgs/applications/misc/swaynotificationcenter/default.nix b/pkgs/applications/misc/swaynotificationcenter/default.nix
index 2a5dd6da19355..b22c483f61779 100644
--- a/pkgs/applications/misc/swaynotificationcenter/default.nix
+++ b/pkgs/applications/misc/swaynotificationcenter/default.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "SwayNotificationCenter";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "ErikReider";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-7O+DX4uuncUqx5zEKQprZE6tctteT6NU01V2EBHiFqA=";
+    hash = "sha256-SR3FfEit50y4XSCLh3raUoigRNXpxh0mk4qLhQ/FozM=";
   };
 
   # build pkg-config is required to locate the native `scdoc` input
diff --git a/pkgs/applications/networking/clash-verge/default.nix b/pkgs/applications/networking/clash-verge/default.nix
deleted file mode 100644
index f83583283d4f2..0000000000000
--- a/pkgs/applications/networking/clash-verge/default.nix
+++ /dev/null
@@ -1,63 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, dpkg
-, wrapGAppsHook
-, autoPatchelfHook
-, clash-meta
-, openssl
-, webkitgtk
-, udev
-, libayatana-appindicator
-}:
-
-stdenv.mkDerivation rec {
-  pname = "clash-verge";
-  version = "1.3.8";
-
-  src = fetchurl {
-    url = "https://github.com/zzzgydi/clash-verge/releases/download/v${version}/clash-verge_${version}_amd64.deb";
-    hash = "sha256-kOju4yaa+EKzFWDrk0iSJVoWkQMBjQG3hKLfAsqlsy8=";
-  };
-
-  nativeBuildInputs = [
-    dpkg
-    wrapGAppsHook
-    autoPatchelfHook
-  ];
-
-  buildInputs = [
-    openssl
-    webkitgtk
-    stdenv.cc.cc
-  ];
-
-  runtimeDependencies = [
-    (lib.getLib udev)
-    libayatana-appindicator
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin
-    mv usr/* $out
-    rm $out/bin/{clash,clash-meta}
-
-    runHook postInstall
-  '';
-
-  postFixup = ''
-    ln -s ${lib.getExe clash-meta} $out/bin/clash-meta
-  '';
-
-  meta = with lib; {
-    description = "A Clash GUI based on tauri";
-    homepage = "https://github.com/zzzgydi/clash-verge";
-    platforms = [ "x86_64-linux" ];
-    license = licenses.gpl3Plus;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ zendo ];
-    mainProgram = "clash-verge";
-  };
-}
diff --git a/pkgs/applications/networking/cluster/glooctl/default.nix b/pkgs/applications/networking/cluster/glooctl/default.nix
index 487fe6085af68..594e52737cdce 100644
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.16.5";
+  version = "1.16.6";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-pxF5X3fCBeWFLQj8S0xYDcQNRs375RJIrl62nGjZZr0=";
+    hash = "sha256-vn04bNkg0De46kLcyuaWt9watBXFIGI+4X8SBW3XNyg=";
   };
 
-  vendorHash = "sha256-kbbgEnpqev7b4Sycmhs8xbu+yO4oMELh9xDmw7YyWYU=";
+  vendorHash = "sha256-UyzqKpF2WBj25Bm4MtkF6yjl87A61vGsteBNCjJV178=";
 
   subPackages = [ "projects/gloo/cli/cmd" ];
 
diff --git a/pkgs/applications/networking/cluster/kubent/default.nix b/pkgs/applications/networking/cluster/kubent/default.nix
index f650394ef0e4f..d0b8eaf422e68 100644
--- a/pkgs/applications/networking/cluster/kubent/default.nix
+++ b/pkgs/applications/networking/cluster/kubent/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubent";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "doitintl";
     repo = "kube-no-trouble";
     rev = version;
-    sha256 = "sha256-fJRaahK/tDns+edi1GIdYRk4+h2vbY2LltZN2hxvKGI=";
+    sha256 = "sha256-/gCbj0RDwV5E8kNkEu+37ilzw/A0BAXiYfHGPdkCsRs=";
   };
 
-  vendorHash = "sha256-nEc0fngop+0ju8hDu7nowBsioqCye15Jo1mRlM0TtlQ=";
+  vendorHash = "sha256-6hp7mzE45Tlmt4ybhpdJLYCv+WqQ9ak2S47kJTwyGVI=";
 
   ldflags = [
     "-w" "-s"
diff --git a/pkgs/applications/networking/cluster/kubeshark/default.nix b/pkgs/applications/networking/cluster/kubeshark/default.nix
index b901889c08328..db45fae4cc9b9 100644
--- a/pkgs/applications/networking/cluster/kubeshark/default.nix
+++ b/pkgs/applications/networking/cluster/kubeshark/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubeshark";
-  version = "52.1.63";
+  version = "52.1.66";
 
   src = fetchFromGitHub {
     owner = "kubeshark";
     repo = "kubeshark";
     rev = "v${version}";
-    hash = "sha256-Ub8FsynnsAiLF4YwZHbhmQIJANAe/lCUgfq3ys/dtO8=";
+    hash = "sha256-4xw4DQ5C3QpykMSac7jGuW5L8Yx1XcBAMLypTvD5T7c=";
   };
 
   vendorHash = "sha256-SmvO9DYOXxnmN2dmHPPOguVwEbWSH/xNLBB+idpzopo=";
diff --git a/pkgs/applications/networking/gnmic/default.nix b/pkgs/applications/networking/gnmic/default.nix
index 37d22d3e32d6a..223c5c4beb02f 100644
--- a/pkgs/applications/networking/gnmic/default.nix
+++ b/pkgs/applications/networking/gnmic/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "gnmic";
-  version = "0.35.1";
+  version = "0.36.2";
 
   src = fetchFromGitHub {
     owner = "openconfig";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-1Rtq/tRDU8hwrEYhP2/2qPWAYeCPL03m4NpXO3sGUdo=";
+    hash = "sha256-PUOIKPkzM6riiXR8R1Io0QI/qr6HaexfFgbp2Hx2SOo=";
   };
 
-  vendorHash = "sha256-HoOjVfpowb5jvAYdQ3cbCQmSl1RJKPDjvOaOGfhe5TY=";
+  vendorHash = "sha256-zrG/rNoYtfVNN50g41txLQIcBAKi1yE5p1TODrDiXzU=";
 
   ldflags = [
     "-s" "-w"
diff --git a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
index b0e1f76a972b0..d53b122068a91 100644
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@@ -36,16 +36,16 @@ let
 in
 buildNpmPackage rec {
   pname = "deltachat-desktop";
-  version = "1.44.0";
+  version = "1.44.1";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
     rev = "v${version}";
-    hash = "sha256-EHMKk5V77b+wTf72K9FUclrUzmAm51l4uv3vhOrCloA=";
+    hash = "sha256-fL+9oPQ5dAgvQREZ7A+hKo2MnZKeVvadQDvDPsDNbnQ=";
   };
 
-  npmDepsHash = "sha256-nuhOrgHXKK01EirWYmGF17V+aYhZipwmhnAuNqwSQ/c=";
+  npmDepsHash = "sha256-rUxJLDsAfp+brecTThYTdHIVIfVkKwZ/W5sHV0hHHIk=";
 
   postPatch = ''
     test \
diff --git a/pkgs/applications/networking/instant-messengers/discord/default.nix b/pkgs/applications/networking/instant-messengers/discord/default.nix
index 3392aff89add6..88b773f7c62ea 100644
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@@ -2,7 +2,7 @@
 let
   versions =
     if stdenv.isLinux then {
-      stable = "0.0.43";
+      stable = "0.0.44";
       ptb = "0.0.72";
       canary = "0.0.285";
       development = "0.0.13";
@@ -17,7 +17,7 @@ let
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-DO8bS5luSKhKW6sJZhz4xVeIPexQVoaD4xYugHCN3uk=";
+        hash = "sha256-mzpir5Js3pDtuOK5bKocd74p0PcDnMpNpx8PpchE6FE=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
diff --git a/pkgs/applications/networking/irc/halloy/default.nix b/pkgs/applications/networking/irc/halloy/default.nix
index df0113f258728..2758914f73cc6 100644
--- a/pkgs/applications/networking/irc/halloy/default.nix
+++ b/pkgs/applications/networking/irc/halloy/default.nix
@@ -15,13 +15,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "halloy";
-  version = "2024.2";
+  version = "2024.3";
 
   src = fetchFromGitHub {
     owner = "squidowl";
     repo = "halloy";
     rev = "refs/tags/${version}";
-    hash = "sha256-SzjMoXISd4fMHoenF1CK3Yn8bfLq9INuOmt86QTcgk8=";
+    hash = "sha256-9yEkM65c8R71oQ0C54xZqwRh609+HSaq4Hb8izNM52A=";
   };
 
   cargoLock = {
diff --git a/pkgs/applications/networking/sync/rclone/default.nix b/pkgs/applications/networking/sync/rclone/default.nix
index ebb0f17e784b9..3b9727e2914ab 100644
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "rclone";
-  version = "1.65.2";
+  version = "1.66.0";
 
   src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
+    owner = "rclone";
+    repo = "rclone";
     rev = "v${version}";
-    hash = "sha256-P7VJ6pauZ7J8LvyYNi7ANsKrYOcmInZCfRO+X+K6LzI=";
+    hash = "sha256-75RnAROICtRUDn95gSCNO0F6wes4CkJteNfUN38GQIY=";
   };
 
-  vendorHash = "sha256-budC8psvTtfVi3kYOaJ+dy/9H11ekJVkXMmeV9RhXVU=";
+  vendorHash = "sha256-zGBwgIuabLDqWbutvPHDbPRo5Dd9kNfmgToZXy7KVgI=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/applications/office/jameica/default.nix b/pkgs/applications/office/jameica/default.nix
index e6aa7cb21d14e..683d51bf43f2a 100644
--- a/pkgs/applications/office/jameica/default.nix
+++ b/pkgs/applications/office/jameica/default.nix
@@ -1,4 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, makeDesktopItem, makeWrapper, wrapGAppsHook, ant, jdk, jre, gtk2, glib, xorg, Cocoa }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeDesktopItem
+, makeWrapper
+, wrapGAppsHook
+, ant
+, jdk
+, jre
+, gtk2
+, glib
+, libXtst
+, Cocoa
+}:
 
 let
   _version = "2.10.4";
@@ -26,10 +39,6 @@ stdenv.mkDerivation rec {
   pname = "jameica";
   inherit version;
 
-  nativeBuildInputs = [ ant jdk wrapGAppsHook makeWrapper ];
-  buildInputs = lib.optionals stdenv.isLinux [ gtk2 glib xorg.libXtst ]
-    ++ lib.optional stdenv.isDarwin Cocoa;
-
   src = fetchFromGitHub {
     owner = "willuhn";
     repo = "jameica";
@@ -37,15 +46,29 @@ stdenv.mkDerivation rec {
     hash = "sha256-MSVSd5DyVL+dcfTDv1M99hxickPwT2Pt6QGNsu6DGZI=";
   };
 
+  postPatch = ''
+    # Fix jar timestamps for reproducibility
+    substituteInPlace build/build.xml \
+        --replace-fail '<jar ' '<jar modificationtime="0" '
+  '';
+
+  nativeBuildInputs = [ ant jdk wrapGAppsHook makeWrapper ];
+  buildInputs = lib.optionals stdenv.isLinux [ gtk2 glib libXtst ]
+    ++ lib.optional stdenv.isDarwin Cocoa;
+
   dontWrapGApps = true;
 
   # there is also a build.gradle, but it only seems to be used to vendor 3rd party libraries
   # and is not able to build the application itself
   buildPhase = ''
-    (cd build; ant -Dsystem.version=${version} init compile jar)
+    runHook preBuild
+    ant -f build -Dsystem.version=${version} init compile jar
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/libexec $out/lib $out/bin $out/share/{applications,jameica-${version},java}/
 
     # copy libraries except SWT
@@ -57,6 +80,8 @@ stdenv.mkDerivation rec {
     install -Dm644 plugin.xml $out/share/java/
     install -Dm644 build/jameica-icon.png $out/share/pixmaps/jameica.png
     cp ${desktopItem}/share/applications/* $out/share/applications/
+
+    runHook postInstall
   '';
 
   postFixup = ''
diff --git a/pkgs/applications/office/portfolio/default.nix b/pkgs/applications/office/portfolio/default.nix
index 4eb15447ff6ed..3f5fab53e6df9 100644
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "PortfolioPerformance";
-  version = "0.68.0";
+  version = "0.68.1";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-AzWbmew1kleFdhX1IYHwxzNGEe8rw3rvRKGtF9J7tWw=";
+    hash = "sha256-ZXtBKc5vQz9fDyiG+DYOx7DsnnsORiltOacdx4AqFjg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/office/tryton/default.nix b/pkgs/applications/office/tryton/default.nix
index 34c65d4e2fe70..bb6a16bb5140e 100644
--- a/pkgs/applications/office/tryton/default.nix
+++ b/pkgs/applications/office/tryton/default.nix
@@ -21,13 +21,13 @@ with lib;
 
 python3Packages.buildPythonApplication rec {
   pname = "tryton";
-  version = "7.0.5";
+  version = "7.0.7";
 
   disabled = !python3Packages.isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-NAnNBfwnMky0qbtU3P5+kHJwCj6nfIQCtYgu6nXLcaQ=";
+    sha256 = "sha256-NODeDEgmf/nSKrM+RxAUsUwsbVQT7OSDrTOGVBwOzpw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/logic/elan/0001-dynamically-patchelf-binaries.patch b/pkgs/applications/science/logic/elan/0001-dynamically-patchelf-binaries.patch
index 74da9d854f344..0b33d4242eb7e 100644
--- a/pkgs/applications/science/logic/elan/0001-dynamically-patchelf-binaries.patch
+++ b/pkgs/applications/science/logic/elan/0001-dynamically-patchelf-binaries.patch
@@ -2,7 +2,7 @@ diff --git a/src/elan-dist/src/component/package.rs b/src/elan-dist/src/componen
 index c51e76d..ae8159e 100644
 --- a/src/elan-dist/src/component/package.rs
 +++ b/src/elan-dist/src/component/package.rs
-@@ -56,6 +56,35 @@ fn unpack_without_first_dir<R: Read>(archive: &mut tar::Archive<R>, path: &Path)
+@@ -56,6 +56,37 @@ fn unpack_without_first_dir<R: Read>(archive: &mut tar::Archive<R>, path: &Path)
          entry
              .unpack(&full_path)
              .chain_err(|| ErrorKind::ExtractingPackage)?;
@@ -26,9 +26,11 @@ index c51e76d..ae8159e 100644
 +        use std::os::unix::fs::PermissionsExt;
 +        let new_path = dest_path.with_extension("orig");
 +        ::std::fs::rename(dest_path, &new_path)?;
-+        ::std::fs::write(dest_path, format!(r#"#! @shell@
-+LEAN_CC="${{LEAN_CC:-@cc@}}" exec -a "$0" {} "$@" -L {}/lib  # use bundled libraries, but not bundled compiler that doesn't know about NIX_LDFLAGS
-+"#, new_path.to_str().unwrap(), dest_path.parent().unwrap().parent().unwrap().to_str().unwrap()))?;
++        ::std::fs::write(dest_path, r#"#! @shell@
++dir="$(dirname "${BASH_SOURCE[0]}")"
++# use bundled libraries, but not bundled compiler that doesn't know about NIX_LDFLAGS
++LEAN_CC="${LEAN_CC:-@cc@}" exec -a "$0" "$dir/leanc.orig" "$@" -L"$dir/../lib"
++"#)?;
 +        ::std::fs::set_permissions(dest_path, ::std::fs::Permissions::from_mode(0o755))?;
 +    }
 +
diff --git a/pkgs/applications/science/logic/elan/default.nix b/pkgs/applications/science/logic/elan/default.nix
index 129aacc07f62a..245f8db13ce60 100644
--- a/pkgs/applications/science/logic/elan/default.nix
+++ b/pkgs/applications/science/logic/elan/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, runCommand, patchelf, makeWrapper, pkg-config, curl, runtimeShell, fetchpatch
+{ stdenv, lib, runCommand, patchelf, makeWrapper, pkg-config, curl, runtimeShell
 , openssl, zlib, fetchFromGitHub, rustPlatform, libiconv }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,14 +23,6 @@ rustPlatform.buildRustPackage rec {
   buildFeatures = [ "no-self-update" ];
 
   patches = lib.optionals stdenv.isLinux [
-    # revert temporary directory creation, because it break the wrapper
-    # https://github.com/NixOS/nixpkgs/pull/289941#issuecomment-1980778358
-    (fetchpatch {
-      url = "https://github.com/leanprover/elan/commit/bd54acaab75d08b3912ee1f051af8657f3a9cfdf.patch";
-      hash = "sha256-6If/wxWSea8Zjlp3fx9wh3D0TjmWZbvCuY9q5c2qJGA=";
-      revert = true;
-    })
-
     # Run patchelf on the downloaded binaries.
     # This is necessary because Lean 4 is now dynamically linked.
     (runCommand "0001-dynamically-patchelf-binaries.patch" {
diff --git a/pkgs/applications/science/math/primesieve/default.nix b/pkgs/applications/science/math/primesieve/default.nix
index 8ca3f1393a76c..4d3c06bd9287d 100644
--- a/pkgs/applications/science/math/primesieve/default.nix
+++ b/pkgs/applications/science/math/primesieve/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "primesieve";
-  version = "12.0";
+  version = "12.1";
 
   src = fetchFromGitHub {
     owner = "kimwalisch";
     repo = "primesieve";
     rev = "v${version}";
-    hash = "sha256-xmOq18falvT8PKhJPwWm/aeOMf7I3ywR+h5OkTM3G6s=";
+    hash = "sha256-AHl2GfZ1oJ8ZyjJzvg10AqN7TA7HFZ+qa6N2v51Qa78=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/version-management/jujutsu/default.nix b/pkgs/applications/version-management/jujutsu/default.nix
index 9503c79e04d05..b6b4bd8e8e411 100644
--- a/pkgs/applications/version-management/jujutsu/default.nix
+++ b/pkgs/applications/version-management/jujutsu/default.nix
@@ -11,7 +11,6 @@
 , libssh2
 , libgit2
 , zstd
-, fetchpatch
 , installShellFiles
 , nix-update-script
 , testers
@@ -20,19 +19,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jujutsu";
-  version = "0.14.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "martinvonz";
     repo = "jj";
     rev = "v${version}";
-    hash = "sha256-xnGnervyXPfZyQTYsPu09fj+QvbEZ6rDJ4fYHBeF/RY=";
+    hash = "sha256-yppQIffjpyQ2nqhiZbV2pSMQJx8srmHjAk+UClCQfRw=";
   };
 
-  cargoHash = "sha256-wuZ0zthaemzyDn5J2au2L2k0QJnzbrCRjSBIPivEbnQ=";
+  cargoHash = "sha256-2BmKC8DaOdD/THchImmGqplhDrHQHEMyWORWnE2ygSM=";
 
   cargoBuildFlags = [ "--bin" "jj" ]; # don't install the fake editors
-  useNextest = true; # nextest is the upstream integration framework
+  useNextest = false; # nextest is the upstream integration framework, but is problematic for test skipping
   ZSTD_SYS_USE_PKG_CONFIG = "1";    # disable vendored zlib
   LIBSSH2_SYS_USE_PKG_CONFIG = "1"; # disable vendored libssh2
 
@@ -63,6 +62,11 @@ rustPlatform.buildRustPackage rec {
       --zsh <($out/bin/jj util completion zsh)
   '';
 
+  checkFlags = [
+    # signing tests spin up an ssh-agent and do git checkouts
+    "--skip=test_ssh_signing"
+  ];
+
   passthru = {
     updateScript = nix-update-script { };
     tests = {
diff --git a/pkgs/applications/video/rtabmap/default.nix b/pkgs/applications/video/rtabmap/default.nix
index 200fab2743396..1147d1ef1d949 100644
--- a/pkgs/applications/video/rtabmap/default.nix
+++ b/pkgs/applications/video/rtabmap/default.nix
@@ -27,32 +27,20 @@
 
 stdenv.mkDerivation rec {
   pname = "rtabmap";
-  version = "0.21.0";
+  version = "0.21.4";
 
   src = fetchFromGitHub {
     owner = "introlab";
     repo = "rtabmap";
     rev = "refs/tags/${version}";
-    hash = "sha256-1xb8O3VrErldid2OgAUMG28mSUO7QBUsPuSz8p03tSI";
+    hash = "sha256-HrIATYRuhFfTlO4oTRZo7CM30LFVyatZJON31Fe4HTQ=";
   };
 
-  patches = [
-    # Fix build with g2o 20230806
-    (fetchpatch {
-      url = "https://github.com/introlab/rtabmap/commit/85cc6fe3c742855ad16c8442895e12dbb10b6e8b.patch";
-      hash = "sha256-P6GkYKCNwe9dgZdgF/oEhgjA3bJnwXFWJCPoyIknQCo=";
-    })
-    # Fix typo in previous patch
-    (fetchpatch {
-      url = "https://github.com/introlab/rtabmap/commit/c4e94bcdc31b859c1049724dbb7671e4597d86de.patch";
-      hash = "sha256-1btkV4/y+bnF3xEVqlUy/9F6BoANeTOEJjZLmRzG3iA=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook wrapGAppsHook ];
   buildInputs = [
     ## Required
     opencv
+    opencv.cxxdev
     pcl
     liblapack
     xorg.libSM