Merge master into staging-next

24 files changed, 597 insertions, 371 deletions

diff --git a/pkgs/applications/editors/vscode/extensions/README.md b/pkgs/applications/editors/vscode/extensions/README.md
new file mode 100644
index 0000000000000..656ea1bdb3ae0
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/README.md
@@ -0,0 +1,37 @@
+# Visual Studio Code Extensions
+
+## Conventions for adding new extensions
+
+* Extensions are named in the **lowercase** version of the extension's unique identifier. Which is found on the marketplace extension page, and is the name under which the extension is installed by VSCode under `~/.vscode`.
+  Extension location should be: ${lib.strings.toLower mktplcRef.publisher}.${lib.string.toLower mktplcRef.name}
+
+* Move extension to a discrete directory whenever the extension needs extra parameters/packages (at top of the file) or other files (such as patches, update script, components). Global index file parameters/packages should be utilities shared by many extensions. Extension specific parameters/packages should not be in the global index page.
+
+* Currently `nixfmt-rfc-style` formatter is being used to format the VSCode extensions.
+
+* Respect `alphabetical order` whenever adding extensions. On disorder, please, kindly open a PR re-establishing the order.
+
+* Avoid [unnecessary](https://nix.dev/guides/best-practices.html#with-scopes) use of `with`, particularly `nested with`.
+
+* Use `hash` instead of `sha256`.
+
+* On `meta` field:
+  - add a `changelog`.
+  - `description` should mention it is a Visual Studio Code extension.
+  - `downloadPage` is the VSCode marketplace URL.
+  - `homepage` is the source-code URL.
+  - verify `license` in upstream.
+
+* On commit messages:
+  - Naming convention for:
+    - Adding a new extension:
+
+      > vscode-extensions.publisher.extension-name: init 1.2.3
+      >
+      > Release: https://github.com/owner/project/releases/tag/1.2.3
+    - Updating an extension:
+
+      > vscode-extensions.publisher.extension-name: 1.2.3 -> 2.3.4
+      >
+      > Release: https://github.com/owner/project/releases/tag/2.3.4
+  - Multiple extensions can be added in a single PR, but each extension requires it's own commit.
diff --git a/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/default.nix
new file mode 100644
index 0000000000000..7ab6bb7ce0c62
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/asciidoctor.asciidoctor-vscode/default.nix
@@ -0,0 +1,27 @@
+{
+  asciidoctor,
+  lib,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "asciidoctor-vscode";
+    publisher = "asciidoctor";
+    version = "2.8.9";
+    sha256 = "1xkxx5i3nhd0dzqhhdmx0li5jifsgfhv0p5h7xwsscz3gzgsdcyb";
+  };
+
+  postPatch = ''
+    substituteInPlace dist/src/text-parser.js \
+      --replace "get('asciidoctor_command', 'asciidoctor')" \
+                "get('asciidoctor_command', '${asciidoctor}/bin/asciidoctor')"
+    substituteInPlace dist/src/commands/exportAsPDF.js \
+      --replace "get('asciidoctorpdf_command', 'asciidoctor-pdf')" \
+                "get('asciidoctorpdf_command', '${asciidoctor}/bin/asciidoctor-pdf')"
+  '';
+
+  meta = {
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/azdavis.millet/default.nix b/pkgs/applications/editors/vscode/extensions/azdavis.millet/default.nix
new file mode 100644
index 0000000000000..af1e8c3df0f35
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/azdavis.millet/default.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  jq,
+  moreutils,
+  millet,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "Millet";
+    publisher = "azdavis";
+    version = "0.13.5";
+    hash = "sha256-sWM7N+axgu1zOGWexR4JVupVmYhZrd4cZz3pmLxRj8Q=";
+  };
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."millet.server.path".default = "${millet}/bin/millet-ls"' package.json | sponge package.json
+  '';
+  meta = {
+    description = "Standard ML support for VS Code";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=azdavis.millet";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.smasher164 ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/b4dm4n.vscode-nixpkgs-fmt/default.nix b/pkgs/applications/editors/vscode/extensions/b4dm4n.vscode-nixpkgs-fmt/default.nix
new file mode 100644
index 0000000000000..6edcaea67a7d9
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/b4dm4n.vscode-nixpkgs-fmt/default.nix
@@ -0,0 +1,27 @@
+{
+  vscode-utils,
+  jq,
+  lib,
+  moreutils,
+  nixpkgs-fmt,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "nixpkgs-fmt";
+    publisher = "B4dM4n";
+    version = "0.0.1";
+    hash = "sha256-vz2kU36B1xkLci2QwLpl/SBEhfSWltIDJ1r7SorHcr8=";
+  };
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."nixpkgs-fmt.path".default = "${nixpkgs-fmt}/bin/nixpkgs-fmt"' package.json | sponge package.json
+  '';
+  meta = {
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/betterthantomorrow.calva/default.nix b/pkgs/applications/editors/vscode/extensions/betterthantomorrow.calva/default.nix
new file mode 100644
index 0000000000000..4fc5c16eb7fdf
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/betterthantomorrow.calva/default.nix
@@ -0,0 +1,27 @@
+{
+  clojure-lsp,
+  jq,
+  lib,
+  moreutils,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "calva";
+    publisher = "betterthantomorrow";
+    version = "2.0.374";
+    hash = "sha256-VwdHOkduSSIrcOvrcVf7K8DSp3N1u9fvbaCVDCxp+bk=";
+  };
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration[0].properties."calva.clojureLspPath".default = "${clojure-lsp}/bin/clojure-lsp"' package.json | sponge package.json
+  '';
+  meta = {
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 6171fd701b34b..92bb828f8df4b 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1,28 +1,17 @@
+# Before adding a new extension, read ./README.md
+
 { config
 , lib
 , fetchurl
 , callPackage
 , vscode-utils
-, asciidoctor
-, nodePackages
 , python3Packages
 , jdk
 , llvmPackages
 , llvmPackages_14
-, nixpkgs-fmt
 , protobuf
 , jq
-, shellcheck
 , moreutils
-, racket
-, clojure-lsp
-, alejandra
-, millet
-, craftos-pc
-, shfmt
-, tinymist
-, typst-lsp
-, typst-preview
 , autoPatchelfHook
 , zlib
 , stdenv
@@ -31,15 +20,6 @@
 let
   inherit (vscode-utils) buildVscodeMarketplaceExtension;
 
-  #
-  # Unless there is a good reason not to, we attempt to use the lowercase
-  # version of the extension's unique identifier. The unique identifier can be
-  # found on the marketplace extension page, and is the name under which the
-  # extension is installed by VSCode under `~/.vscode`.
-  #
-  # This means an extension should be located at
-  # ${lib.strings.toLower mktplcRef.publisher}.${lib.string.toLower mktplcRef.name}
-  #
   baseExtensions = self: lib.mapAttrs (_n: lib.recurseIntoAttrs)
     {
       "13xforever".language-x86-64-assembly = buildVscodeMarketplaceExtension {
@@ -368,27 +348,7 @@ let
         };
       };
 
-      asciidoctor.asciidoctor-vscode = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "asciidoctor-vscode";
-          publisher = "asciidoctor";
-          version = "2.8.9";
-          sha256 = "1xkxx5i3nhd0dzqhhdmx0li5jifsgfhv0p5h7xwsscz3gzgsdcyb";
-        };
-
-        postPatch = ''
-          substituteInPlace dist/src/text-parser.js \
-            --replace "get('asciidoctor_command', 'asciidoctor')" \
-                      "get('asciidoctor_command', '${asciidoctor}/bin/asciidoctor')"
-          substituteInPlace dist/src/commands/exportAsPDF.js \
-            --replace "get('asciidoctorpdf_command', 'asciidoctor-pdf')" \
-                      "get('asciidoctorpdf_command', '${asciidoctor}/bin/asciidoctor-pdf')"
-        '';
-
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
+      asciidoctor.asciidoctor-vscode = callPackage ./asciidoctor.asciidoctor-vscode { };
 
       asdine.cue = buildVscodeMarketplaceExtension {
         mktplcRef = {
@@ -458,42 +418,9 @@ let
         };
       };
 
-      azdavis.millet = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "Millet";
-          publisher = "azdavis";
-          version = "0.13.5";
-          hash = "sha256-sWM7N+axgu1zOGWexR4JVupVmYhZrd4cZz3pmLxRj8Q=";
-        };
-        nativeBuildInputs = [ jq moreutils ];
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."millet.server.path".default = "${millet}/bin/millet-ls"' package.json | sponge package.json
-        '';
-        meta = {
-          description = "Standard ML support for VS Code";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=azdavis.millet";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.smasher164 ];
-        };
-      };
+      azdavis.millet = callPackage ./azdavis.millet { };
 
-      b4dm4n.vscode-nixpkgs-fmt = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "nixpkgs-fmt";
-          publisher = "B4dM4n";
-          version = "0.0.1";
-          hash = "sha256-vz2kU36B1xkLci2QwLpl/SBEhfSWltIDJ1r7SorHcr8=";
-        };
-        nativeBuildInputs = [ jq moreutils ];
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."nixpkgs-fmt.path".default = "${nixpkgs-fmt}/bin/nixpkgs-fmt"' package.json | sponge package.json
-        '';
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
+      b4dm4n.vscode-nixpkgs-fmt = callPackage ./b4dm4n.vscode-nixpkgs-fmt { };
 
       baccata.scaladex-search = buildVscodeMarketplaceExtension {
         mktplcRef = {
@@ -595,24 +522,9 @@ let
         };
       };
 
-      betterthantomorrow.calva = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "calva";
-          publisher = "betterthantomorrow";
-          version = "2.0.374";
-          hash = "sha256-VwdHOkduSSIrcOvrcVf7K8DSp3N1u9fvbaCVDCxp+bk=";
-        };
-        nativeBuildInputs = [ jq moreutils ];
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration[0].properties."calva.clojureLspPath".default = "${clojure-lsp}/bin/clojure-lsp"' package.json | sponge package.json
-        '';
-        meta = {
-          license = lib.licenses.mit;
-        };
-      };
+      betterthantomorrow.calva = callPackage ./betterthantomorrow.calva { };
 
-       bierner.docs-view = buildVscodeMarketplaceExtension {
+      bierner.docs-view = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "docs-view";
           publisher = "bierner";
@@ -1634,27 +1546,7 @@ let
         };
       };
 
-      eugleo.magic-racket = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "magic-racket";
-          publisher = "evzen-wybitul";
-          version = "0.6.4";
-          hash = "sha256-Hxa4VPm3QvJICzpDyfk94fGHu1hr+YN9szVBwDB8X4U=";
-        };
-        nativeBuildInputs = [ jq moreutils ];
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."magicRacket.general.racketPath".default = "${racket}/bin/racket"' package.json | sponge package.json
-          jq '.contributes.configuration.properties."magicRacket.general.racoPath".default = "${racket}/bin/raco"' package.json | sponge package.json
-        '';
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/evzen-wybitul.magic-racket/changelog";
-          description = "The best coding experience for Racket in VS Code";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=evzen-wybitul.magic-racket";
-          homepage = "https://github.com/Eugleo/magic-racket";
-          license = lib.licenses.agpl3Only;
-        };
-      };
+      eugleo.magic-racket = callPackage ./eugleo.magic-racket { };
 
       ExiaHuang.dictionary = buildVscodeMarketplaceExtension {
         mktplcRef = {
@@ -1775,28 +1667,7 @@ let
         };
       };
 
-      foxundermoon.shell-format = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "shell-format";
-          publisher = "foxundermoon";
-          version = "7.2.5";
-          hash = "sha256-kfpRByJDcGY3W9+ELBzDOUMl06D/vyPlN//wPgQhByk=";
-        };
-
-        nativeBuildInputs = [ jq moreutils ];
-
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."shellformat.path".default = "${shfmt}/bin/shfmt"' package.json | sponge package.json
-        '';
-
-        meta = {
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=foxundermoon.shell-format";
-          homepage = "https://github.com/foxundermoon/vs-shell-format";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.dbirks ];
-        };
-      };
+      foxundermoon.shell-format = callPackage ./foxundermoon.shell-format { };
 
       freebroccolo.reasonml = buildVscodeMarketplaceExtension {
         meta = {
@@ -2297,38 +2168,7 @@ let
         };
       };
 
-      jackmacwindows.craftos-pc = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "craftos-pc";
-          publisher = "jackmacwindows";
-          version = "1.2.2";
-          hash = "sha256-A+MNroXv0t9Mw/gr0Fyov3cXyF/GGzwRLKrIxQ2tKCE=";
-        };
-        nativeBuildInputs = [ jq moreutils ];
-        postInstall = ''
-          cd "$out/$installPrefix"
-
-          jq -e '
-            .contributes.configuration.properties."craftos-pc.executablePath.linux".default =
-              "${lib.meta.getExe craftos-pc}" |
-            .contributes.configuration.properties."craftos-pc.executablePath.mac".default =
-              "${lib.meta.getExe craftos-pc}" |
-            .contributes.configuration.properties."craftos-pc.executablePath.windows".default =
-              "${lib.meta.getExe craftos-pc}"
-          ' \
-          < package.json \
-          | sponge package.json
-        '';
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/jackmacwindows.craftos-pc/changelog";
-          description = "A Visual Studio Code extension for opening a CraftOS-PC window";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=jackmacwindows.craftos-pc";
-          homepage = "https://www.craftos-pc.cc/docs/extension";
-          license = lib.licenses.mit;
-          maintainers = with lib.maintainers; [ tomodachi94 ];
-          platforms = craftos-pc.meta.platforms;
-        };
-      };
+      jackmacwindows.craftos-pc = callPackage ./jackmacwindows.craftos-pc { };
 
       james-yu.latex-workshop = buildVscodeMarketplaceExtension {
         mktplcRef = {
@@ -2447,8 +2287,8 @@ let
         mktplcRef = {
           name = "nix-ide";
           publisher = "jnoortheen";
-          version = "0.2.2";
-          hash = "sha256-jwOM+6LnHyCkvhOTVSTUZvgx77jAg6hFCCpBqY8AxIg=";
+          version = "0.3.1";
+          hash = "sha256-05oMDHvFM/dTXB6T3rcDK3EiNG2T0tBN9Au9b+Bk7rI=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/jnoortheen.nix-ide/changelog";
@@ -2546,33 +2386,7 @@ let
         };
       };
 
-      kamadorueda.alejandra = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "alejandra";
-          publisher = "kamadorueda";
-          version = "1.0.0";
-          hash = "sha256-COlEjKhm8tK5XfOjrpVUDQ7x3JaOLiYoZ4MdwTL8ktk=";
-        };
-        nativeBuildInputs = [ jq moreutils ];
-        postInstall = ''
-          cd "$out/$installPrefix"
-
-          jq -e '
-            .contributes.configuration.properties."alejandra.program".default =
-              "${alejandra}/bin/alejandra" |
-            .contributes.configurationDefaults."alejandra.program" =
-              "${alejandra}/bin/alejandra"
-          ' \
-          < package.json \
-          | sponge package.json
-        '';
-        meta = {
-          description = "The Uncompromising Nix Code Formatter";
-          homepage = "https://github.com/kamadorueda/alejandra";
-          license = lib.licenses.unlicense;
-          maintainers = [ lib.maintainers.kamadorueda ];
-        };
-      };
+      kamadorueda.alejandra = callPackage ./kamadorueda.alejandra { };
 
       kamikillerto.vscode-colorize = buildVscodeMarketplaceExtension {
         mktplcRef = {
@@ -2797,35 +2611,7 @@ let
         };
       };
 
-      # Keep pkgs/by-name/ty/typst-preview/package.nix in sync with this
-      # extension
-      mgt19937.typst-preview = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "typst-preview";
-          publisher = "mgt19937";
-          version = "0.11.4";
-          hash = "sha256-GwlzFphZmP87pLys01+PWTv13imcdGjunCMH6atz9xs=";
-        };
-
-        buildInputs = [
-          typst-preview
-        ];
-
-        nativeBuildInputs = [ jq moreutils ];
-
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."typst-preview.executable".default = "${lib.getExe typst-preview}"' package.json | sponge package.json
-        '';
-
-        meta = {
-          description = "Typst Preview is an extension for previewing your Typst files in vscode instantly";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=mgt19937.typst-preview";
-          homepage = "https://github.com/Enter-tainer/typst-preview-vscode";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.drupol ];
-        };
-      };
+      mgt19937.typst-preview = callPackage ./mgt19937.typst-preview { };
 
       mhutchie.git-graph = buildVscodeMarketplaceExtension {
         mktplcRef = {
@@ -2867,10 +2653,9 @@ let
         mktplcRef = {
           name = "direnv";
           publisher = "mkhl";
-          version = "0.16.0";
-          hash = "sha256-u2AFjvhm3zio1ygW9yD9ZwbywLrEssd0O7/0AtfCvMo=";
+          version = "0.17.0";
+          hash = "sha256-9sFcfTMeLBGw2ET1snqQ6Uk//D/vcD9AVsZfnUNrWNg=";
         };
-
         meta = {
           description = "direnv support for Visual Studio Code";
           license = lib.licenses.bsd0;
@@ -2979,25 +2764,7 @@ let
 
       ms-python.python = callPackage ./ms-python.python { };
 
-      ms-python.vscode-pylance = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "vscode-pylance";
-          publisher = "MS-python";
-          version = "2023.8.50";
-          hash = "sha256-xJU/j5r/Idp/0VorEfciT4SFKRBpMCv9Z0LKO/++1Gk=";
-        };
-
-        buildInputs = [ nodePackages.pyright ];
-
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/ms-python.vscode-pylance/changelog";
-          description = "A performant, feature-rich language server for Python in VS Code";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.vscode-pylance";
-          homepage = "https://github.com/microsoft/pylance-release";
-          license = lib.licenses.unfree;
-          maintainers = [ lib.maintainers.ericthemagician ];
-        };
-      };
+      ms-python.vscode-pylance = callPackage ./ms-python.vscode-pylance { };
 
       ms-toolsai.datawrangler = buildVscodeMarketplaceExtension {
         mktplcRef = {
@@ -3269,36 +3036,7 @@ let
         };
       };
 
-      myriad-dreamin.tinymist = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "tinymist";
-          publisher = "myriad-dreamin";
-          # Please update the corresponding binary (tinymist) when updating
-          # this extension.
-          version = "0.11.3";
-          hash = "sha256-b5aD4gz4j+QAEPmYaNnaputbYTPoFxVFih76HmznUP8=";
-        };
-
-        nativeBuildInputs = [ jq moreutils ];
-
-        buildInputs = [
-          tinymist
-        ];
-
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."tinymist.serverPath".default = "${lib.getExe tinymist}"' package.json | sponge package.json
-        '';
-
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/myriad-dreamin.tinymist/changelog";
-          description = "A VSCode extension for providing an integration solution for Typst";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=myriad-dreamin.tinymist";
-          homepage = "https://github.com/myriad-dreamin/tinymist";
-          license = lib.licenses.asl20;
-          maintainers = [ lib.maintainers.drupol ];
-        };
-      };
+      myriad-dreamin.tinymist = callPackage ./myriad-dreamin.tinymist { };
 
       naumovs.color-highlight = buildVscodeMarketplaceExtension {
         mktplcRef = {
@@ -3383,36 +3121,7 @@ let
         };
       };
 
-      nvarner.typst-lsp = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "typst-lsp";
-          publisher = "nvarner";
-          # Please update the corresponding binary (typst-lsp) when updating
-          # this extension.
-          version = "0.12.1";
-          hash = "sha256-JcfFaR1wU5XwapH8vnfVy7Cb7DfUWVeoLfBV3wEtCpE=";
-        };
-
-        nativeBuildInputs = [ jq moreutils ];
-
-        buildInputs = [
-          typst-lsp
-        ];
-
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."typst-lsp.serverPath".default = "${lib.getExe typst-lsp}"' package.json | sponge package.json
-        '';
-
-        meta = {
-          changelog = "https://marketplace.visualstudio.com/items/nvarner.typst-lsp/changelog";
-          description = "A VSCode extension for providing a language server for Typst";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=nvarner.typst-lsp";
-          homepage = "https://github.com/nvarner/typst-lsp";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.drupol ];
-        };
-      };
+      nvarner.typst-lsp = callPackage ./nvarner.typst-lsp { };
 
       ocamllabs.ocaml-platform = buildVscodeMarketplaceExtension {
         meta = {
@@ -3901,6 +3610,23 @@ let
         };
       };
 
+      signageos.signageos-vscode-sops = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "signageos-vscode-sops";
+          publisher = "signageos";
+          version = "0.9.1";
+          hash = "sha256-b1Gp+tL5/e97xMuqkz4EvN0PxI7cJOObusEkcp+qKfM=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/signageos.signageos-vscode-sops/changelog";
+          description = "A Visual Studio Code extension for SOPS support";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=signageos.signageos-vscode-sops";
+          homepage = "https://github.com/signageos/vscode-sops";
+          license = lib.licenses.unfree;
+          maintainers = [ lib.maintainers.superherointj ];
+        };
+      };
+
       silofy.hackthebox = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "hackthebox";
@@ -4324,26 +4050,7 @@ let
         };
       };
 
-      timonwong.shellcheck = buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          name = "shellcheck";
-          publisher = "timonwong";
-          version = "0.37.0";
-          sha256 = "1d0blynn6c2hz4y9fk7b5wsa3x168gxyycr5d05zqp0rx520m5wc";
-        };
-        nativeBuildInputs = [ jq moreutils ];
-        postInstall = ''
-          cd "$out/$installPrefix"
-          jq '.contributes.configuration.properties."shellcheck.executablePath".default = "${shellcheck}/bin/shellcheck"' package.json | sponge package.json
-        '';
-        meta = {
-          description = "Integrates ShellCheck into VS Code, a linter for Shell scripts";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=timonwong.shellcheck";
-          homepage = "https://github.com/vscode-shellcheck/vscode-shellcheck";
-          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.raroh73 ];
-        };
-      };
+      timonwong.shellcheck = callPackage ./timonwong.shellcheck { };
 
       tobiasalthoff.atom-material-theme = buildVscodeMarketplaceExtension {
         mktplcRef = {
@@ -4495,12 +4202,12 @@ let
         mktplcRef = {
           name = "errorlens";
           publisher = "usernamehw";
-          version = "3.14.0";
-          sha256 = "0k70f5f4hcv3jl3a04736ml8amx8w7wb3mb8f6l5gngnvq9fj528";
+          version = "3.16.0";
+          hash = "sha256-Y3M/A5rYLkxQPRIZ0BUjhlkvixDae+wIRUsBn4tREFw=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/usernamehw.errorlens/changelog";
-          description = "Improve highlighting of errors, warnings and other language diagnostics.";
+          description = "A Visual Studio Code extension that improves highlighting of errors, warnings and other language diagnostics";
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=usernamehw.errorlens";
           homepage = "https://github.com/usernamehw/vscode-error-lens";
           license = lib.licenses.mit;
diff --git a/pkgs/applications/editors/vscode/extensions/eugleo.magic-racket/default.nix b/pkgs/applications/editors/vscode/extensions/eugleo.magic-racket/default.nix
new file mode 100644
index 0000000000000..81b0520a53d71
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/eugleo.magic-racket/default.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  jq,
+  moreutils,
+  racket,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "magic-racket";
+    publisher = "evzen-wybitul";
+    version = "0.6.4";
+    hash = "sha256-Hxa4VPm3QvJICzpDyfk94fGHu1hr+YN9szVBwDB8X4U=";
+  };
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."magicRacket.general.racketPath".default = "${racket}/bin/racket"' package.json | sponge package.json
+    jq '.contributes.configuration.properties."magicRacket.general.racoPath".default = "${racket}/bin/raco"' package.json | sponge package.json
+  '';
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/evzen-wybitul.magic-racket/changelog";
+    description = "The best coding experience for Racket in VS Code";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=evzen-wybitul.magic-racket";
+    homepage = "https://github.com/Eugleo/magic-racket";
+    license = lib.licenses.agpl3Only;
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/foxundermoon.shell-format/default.nix b/pkgs/applications/editors/vscode/extensions/foxundermoon.shell-format/default.nix
new file mode 100644
index 0000000000000..51824f34ff6e9
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/foxundermoon.shell-format/default.nix
@@ -0,0 +1,33 @@
+{
+  jq,
+  lib,
+  moreutils,
+  shfmt,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "shell-format";
+    publisher = "foxundermoon";
+    version = "7.2.5";
+    hash = "sha256-kfpRByJDcGY3W9+ELBzDOUMl06D/vyPlN//wPgQhByk=";
+  };
+
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."shellformat.path".default = "${shfmt}/bin/shfmt"' package.json | sponge package.json
+  '';
+
+  meta = {
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=foxundermoon.shell-format";
+    homepage = "https://github.com/foxundermoon/vs-shell-format";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.dbirks ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/jackmacwindows.craftos-pc/default.nix b/pkgs/applications/editors/vscode/extensions/jackmacwindows.craftos-pc/default.nix
new file mode 100644
index 0000000000000..005f78f4f4ae9
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/jackmacwindows.craftos-pc/default.nix
@@ -0,0 +1,43 @@
+{
+  vscode-utils,
+  craftos-pc,
+  jq,
+  lib,
+  moreutils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "craftos-pc";
+    publisher = "jackmacwindows";
+    version = "1.2.2";
+    hash = "sha256-A+MNroXv0t9Mw/gr0Fyov3cXyF/GGzwRLKrIxQ2tKCE=";
+  };
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+  postInstall = ''
+    cd "$out/$installPrefix"
+
+    jq -e '
+      .contributes.configuration.properties."craftos-pc.executablePath.linux".default =
+        "${lib.meta.getExe craftos-pc}" |
+      .contributes.configuration.properties."craftos-pc.executablePath.mac".default =
+        "${lib.meta.getExe craftos-pc}" |
+      .contributes.configuration.properties."craftos-pc.executablePath.windows".default =
+        "${lib.meta.getExe craftos-pc}"
+    ' \
+    < package.json \
+    | sponge package.json
+  '';
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/jackmacwindows.craftos-pc/changelog";
+    description = "A Visual Studio Code extension for opening a CraftOS-PC window";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=jackmacwindows.craftos-pc";
+    homepage = "https://www.craftos-pc.cc/docs/extension";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tomodachi94 ];
+    platforms = craftos-pc.meta.platforms;
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/kamadorueda.alejandra/default.nix b/pkgs/applications/editors/vscode/extensions/kamadorueda.alejandra/default.nix
new file mode 100644
index 0000000000000..a3658346147e3
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/kamadorueda.alejandra/default.nix
@@ -0,0 +1,38 @@
+{
+  alejandra,
+  jq,
+  lib,
+  moreutils,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "alejandra";
+    publisher = "kamadorueda";
+    version = "1.0.0";
+    hash = "sha256-COlEjKhm8tK5XfOjrpVUDQ7x3JaOLiYoZ4MdwTL8ktk=";
+  };
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+  postInstall = ''
+    cd "$out/$installPrefix"
+
+    jq -e '
+      .contributes.configuration.properties."alejandra.program".default =
+        "${alejandra}/bin/alejandra" |
+      .contributes.configurationDefaults."alejandra.program" =
+        "${alejandra}/bin/alejandra"
+    ' \
+    < package.json \
+    | sponge package.json
+  '';
+  meta = {
+    description = "The Uncompromising Nix Code Formatter";
+    homepage = "https://github.com/kamadorueda/alejandra";
+    license = lib.licenses.unlicense;
+    maintainers = [ lib.maintainers.kamadorueda ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/mgt19937.typst-preview/default.nix b/pkgs/applications/editors/vscode/extensions/mgt19937.typst-preview/default.nix
new file mode 100644
index 0000000000000..156e35ab06a01
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/mgt19937.typst-preview/default.nix
@@ -0,0 +1,38 @@
+# Keep pkgs/by-name/ty/typst-preview/package.nix in sync with this extension
+
+{
+  vscode-utils,
+  lib,
+  jq,
+  moreutils,
+  typst-preview,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "typst-preview";
+    publisher = "mgt19937";
+    version = "0.11.4";
+    hash = "sha256-GwlzFphZmP87pLys01+PWTv13imcdGjunCMH6atz9xs=";
+  };
+
+  buildInputs = [ typst-preview ];
+
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."typst-preview.executable".default = "${lib.getExe typst-preview}"' package.json | sponge package.json
+  '';
+
+  meta = {
+    description = "Typst Preview is an extension for previewing your Typst files in vscode instantly";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=mgt19937.typst-preview";
+    homepage = "https://github.com/Enter-tainer/typst-preview-vscode";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.drupol ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
new file mode 100644
index 0000000000000..b06922a90c5bb
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
@@ -0,0 +1,25 @@
+{
+  lib,
+  nodePackages,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "vscode-pylance";
+    publisher = "MS-python";
+    version = "2023.8.50";
+    hash = "sha256-xJU/j5r/Idp/0VorEfciT4SFKRBpMCv9Z0LKO/++1Gk=";
+  };
+
+  buildInputs = [ nodePackages.pyright ];
+
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/ms-python.vscode-pylance/changelog";
+    description = "A performant, feature-rich language server for Python in VS Code";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=ms-python.vscode-pylance";
+    homepage = "https://github.com/microsoft/pylance-release";
+    license = lib.licenses.unfree;
+    maintainers = [ lib.maintainers.ericthemagician ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
new file mode 100644
index 0000000000000..5e7c3f59f1982
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@@ -0,0 +1,39 @@
+{
+  jq,
+  lib,
+  moreutils,
+  tinymist,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "tinymist";
+    publisher = "myriad-dreamin";
+    # Please update the corresponding binary (tinymist) when updating
+    # this extension.
+    version = "0.11.4";
+    hash = "sha256-VR+vl6mctwq9oSIgnfutvPFwfGUdEco8fCOjzMvPtII=";
+  };
+
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+
+  buildInputs = [ tinymist ];
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."tinymist.serverPath".default = "${lib.getExe tinymist}"' package.json | sponge package.json
+  '';
+
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/myriad-dreamin.tinymist/changelog";
+    description = "A VSCode extension for providing an integration solution for Typst";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=myriad-dreamin.tinymist";
+    homepage = "https://github.com/myriad-dreamin/tinymist";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.drupol ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/nvarner.typst-lsp/default.nix b/pkgs/applications/editors/vscode/extensions/nvarner.typst-lsp/default.nix
new file mode 100644
index 0000000000000..ec054521240de
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/nvarner.typst-lsp/default.nix
@@ -0,0 +1,39 @@
+{
+  jq,
+  lib,
+  moreutils,
+  typst-lsp,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "typst-lsp";
+    publisher = "nvarner";
+    # Please update the corresponding binary (typst-lsp) when updating
+    # this extension.
+    version = "0.12.1";
+    hash = "sha256-JcfFaR1wU5XwapH8vnfVy7Cb7DfUWVeoLfBV3wEtCpE=";
+  };
+
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+
+  buildInputs = [ typst-lsp ];
+
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."typst-lsp.serverPath".default = "${lib.getExe typst-lsp}"' package.json | sponge package.json
+  '';
+
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/nvarner.typst-lsp/changelog";
+    description = "A VSCode extension for providing a language server for Typst";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=nvarner.typst-lsp";
+    homepage = "https://github.com/nvarner/typst-lsp";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.drupol ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/timonwong.shellcheck/default.nix b/pkgs/applications/editors/vscode/extensions/timonwong.shellcheck/default.nix
new file mode 100644
index 0000000000000..6e93e51bf1e4d
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/timonwong.shellcheck/default.nix
@@ -0,0 +1,31 @@
+{
+  jq,
+  lib,
+  moreutils,
+  shellcheck,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "shellcheck";
+    publisher = "timonwong";
+    version = "0.37.0";
+    sha256 = "1d0blynn6c2hz4y9fk7b5wsa3x168gxyycr5d05zqp0rx520m5wc";
+  };
+  nativeBuildInputs = [
+    jq
+    moreutils
+  ];
+  postInstall = ''
+    cd "$out/$installPrefix"
+    jq '.contributes.configuration.properties."shellcheck.executablePath".default = "${shellcheck}/bin/shellcheck"' package.json | sponge package.json
+  '';
+  meta = {
+    description = "Integrates ShellCheck into VS Code, a linter for Shell scripts";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=timonwong.shellcheck";
+    homepage = "https://github.com/vscode-shellcheck/vscode-shellcheck";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.raroh73 ];
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
index ad7fd06cb020c..b6e47094d57a9 100644
--- a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
@@ -27,8 +27,14 @@ let
 
     cargoHash = "sha256-e/Jki/4pCs0qzaBVR4iiUhdBFmWlTZYREQkuFSoWYFo=";
 
+    buildInputs = lib.optionals stdenv.isDarwin [ lldb ];
+
     nativeBuildInputs = [ makeWrapper ];
 
+    env = lib.optionalAttrs stdenv.isDarwin {
+      NIX_LDFLAGS = "-llldb -lc++abi";
+    };
+
     buildAndTestSubdir = "adapter";
 
     buildFeatures = [ "weak-linkage" ];
@@ -89,6 +95,15 @@ let
     '';
   };
 
+  # debugservers on macOS require the 'com.apple.security.cs.debugger'
+  # entitlement which nixpkgs' lldb-server does not yet provide; see
+  # <https://github.com/NixOS/nixpkgs/pull/38624> for details
+  lldbServer =
+    if stdenv.isDarwin then
+      "/Applications/Xcode.app/Contents/SharedFrameworks/LLDB.framework/Versions/A/Resources/debugserver"
+    else
+      "${lldb.out}/bin/lldb-server";
+
 in stdenv.mkDerivation {
   pname = "vscode-extension-${publisher}-${pname}";
   inherit src version vscodeExtUniqueId vscodeExtPublisher vscodeExtName;
@@ -107,6 +122,9 @@ in stdenv.mkDerivation {
 
   postConfigure = ''
     cp -r ${nodeDeps}/lib/node_modules .
+  '' + lib.optionalString stdenv.isDarwin ''
+    export HOME="$TMPDIR/home"
+    mkdir $HOME
   '';
 
   cmakeFlags = [
@@ -129,7 +147,8 @@ in stdenv.mkDerivation {
     mv -t $ext vsix-extracted/extension/*
     cp -t $ext/ -r ${adapter}/share/*
     wrapProgram $ext/adapter/codelldb \
-      --set-default LLDB_DEBUGSERVER_PATH "${lldb.out}/bin/lldb-server"
+      --prefix LD_LIBRARY_PATH : "$ext/lldb/lib" \
+      --set-default LLDB_DEBUGSERVER_PATH "${lldbServer}"
     # Mark that all components are installed.
     touch $ext/platform.ok
 
diff --git a/pkgs/applications/misc/vhs/default.nix b/pkgs/applications/misc/vhs/default.nix
index 43c3aea38e82f..5d9f87b2316ac 100644
--- a/pkgs/applications/misc/vhs/default.nix
+++ b/pkgs/applications/misc/vhs/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "vhs";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-4VQcIynkENScxpeM09IXrpMszqojlMuyjtXX2lbS9dg=";
+    hash = "sha256-CWurSAxEXAquWXEOyBWBF6JN9Pesm5hBS3jVNv56dvE=";
   };
 
-  vendorHash = "sha256-/XW5Gq9Yz+M7Al1hy6pow34e3Cn3q8aA0ByRdhWXUIQ=";
+  vendorHash = "sha256-Kh5Sy7URmhsyBF35I0TaDdpSLD96MnkwIS+96+tSyO0=";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
diff --git a/pkgs/applications/networking/browsers/palemoon/bin.nix b/pkgs/applications/networking/browsers/palemoon/bin.nix
index bc4235d82795b..5143b1746ca38 100644
--- a/pkgs/applications/networking/browsers/palemoon/bin.nix
+++ b/pkgs/applications/networking/browsers/palemoon/bin.nix
@@ -14,23 +14,15 @@
 , libpulseaudio
 , makeDesktopItem
 , wrapGAppsHook
+, writeScript
 , testers
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "palemoon-bin";
-  version = "33.0.0";
+  version = "33.0.2";
 
-  src = fetchzip {
-    urls = [
-      "https://rm-eu.palemoon.org/release/palemoon-${finalAttrs.version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz"
-      "https://rm-us.palemoon.org/release/palemoon-${finalAttrs.version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz"
-    ];
-    hash = if withGTK3 then
-      "sha256-qZX23dsKNg5AOIaBAAmTWT6VDEl3OGz3kb3idtvJElw="
-    else
-      "sha256-Lz1+5I8Rj0GrBUBTJoRsatpyzkqVHZuWbKARkuWFs5U=";
-  };
+  src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";
 
   preferLocalBuild = true;
 
@@ -155,8 +147,49 @@ stdenv.mkDerivation (finalAttrs: {
     wrapGApp $out/lib/palemoon/palemoon
   '';
 
-  passthru.tests.version = testers.testVersion {
-    package = finalAttrs.finalPackage;
+  passthru = {
+    sources = let
+      urlRegionVariants = buildVariant: map
+        (region: "https://rm-${region}.palemoon.org/release/palemoon-${finalAttrs.version}.linux-x86_64-${buildVariant}.tar.xz")
+        [
+          "eu"
+          "us"
+        ];
+    in {
+      gtk3 = fetchzip {
+        urls = urlRegionVariants "gtk3";
+        hash = "sha256-Kahnwlj9PIWB24lvH6h9cZK459NW2Vo2g6ckuv0Ax48=";
+      };
+      gtk2 = fetchzip {
+        urls = urlRegionVariants "gtk2";
+        hash = "sha256-XOiLGmU8O96clUpnp/OkzXmWR1PJ2AdzbVFj6adbcvY=";
+      };
+    };
+
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+    };
+
+    updateScript = writeScript "update-palemoon-bin" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts curl libxml2
+
+      set -eu -o pipefail
+
+      # Only release note announcement == finalized release
+      version="$(
+        curl -s 'http://www.palemoon.org/releasenotes.shtml' |
+        xmllint --html --xpath 'html/body/table/tbody/tr/td/h3/text()' - 2>/dev/null | head -n1 |
+        sed 's/v\(\S*\).*/\1/'
+      )"
+
+      for variant in gtk3 gtk2; do
+        # The script will not perform an update when the version attribute is up to date from previous platform run
+        # We need to clear it before each run
+        update-source-version palemoon-bin 0 "${lib.fakeHash}" --source-key="sources.$variant"
+        update-source-version palemoon-bin "$version" --source-key="sources.$variant"
+      done
+    '';
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/cluster/cni/default.nix b/pkgs/applications/networking/cluster/cni/default.nix
index 6fdeb802ea1cf..d5079b36886f9 100644
--- a/pkgs/applications/networking/cluster/cni/default.nix
+++ b/pkgs/applications/networking/cluster/cni/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "cni";
-  version = "1.1.2";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "containernetworking";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-g7fVeoqquxPa17AfTu6wnB6PQJDluJ21T3ETrcvWtWg=";
+    hash = "sha256-32rmfBjPtc9w+B8PIb8sFOIlzZ7PnS6XSZRNLreMVl4=";
   };
 
-  vendorHash = "sha256-nH/myA/KdTeFXvmBymXITyx5fdCGnWRn6hNRinXc3/s=";
+  vendorHash = "sha256-JWaQacekMQGT710U5UgiIpmEYgyUCh1uks5eSV5nhWc=";
 
   subPackages = [
     "./cnitool"
diff --git a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
index 18c7713589f0d..037d27cf06602 100644
--- a/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "teams-for-linux";
-  version = "1.4.22";
+  version = "1.4.27";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-eNd12p9QvuYpiy9FaGaMSfQ3qVYzmYyO2/v/rdV3nN8=";
+    hash = "sha256-nUHiveS1XI+vC2Tj1DK/DS4CrKTLMg1IYgTPWXuLrAc=";
   };
 
   offlineCache = fetchYarnDeps {
diff --git a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
index 1784472f8b501..a7d12206720e4 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@@ -63,14 +63,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "telegram-desktop";
-  version = "4.16.6";
+  version = "4.16.7";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-1NRA8guTbDEraW1uXSo7q54d1e8/QnXwxkfb6k3e6b0=";
+    hash = "sha256-+BXuFHXGOgpmAX7wsGLxZxfzvNsntFLtd+Obhb339Yc=";
   };
 
   patches = [
diff --git a/pkgs/applications/version-management/git-machete/default.nix b/pkgs/applications/version-management/git-machete/default.nix
index a038435b8d60e..3c97c1e2024b2 100644
--- a/pkgs/applications/version-management/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-machete/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonApplication rec {
   pname = "git-machete";
-  version = "3.24.2";
+  version = "3.25.0";
 
   src = fetchFromGitHub {
     owner = "virtuslab";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-nxfSdgGF/hDFf7KIJ+tqCvxEi1GOjTAbpcJylIqhd/M=";
+    hash = "sha256-tLEuSwM8X0+oQDB9fmj5OQsC7iA906EQZz3yvB6rXfk=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/applications/virtualization/nixpacks/default.nix b/pkgs/applications/virtualization/nixpacks/default.nix
index acf7456c76abb..5bbb8b217525a 100644
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "1.21.2";
+  version = "1.21.3";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-GY5fwmwr2FAJB9SjTaghlC4GD6ECnect21VInTXseRE=";
+    sha256 = "sha256-niEuOsSOjHDP4KEax/OqQfxWC3XmTRUKB8k0DQ3Ybq0=";
   };
 
-  cargoHash = "sha256-kXfNWAloMwpykv6zJS5g6ng8RGn+NBNgYJmUg/I7dBg=";
+  cargoHash = "sha256-LMVYrxYpkwM9rdGkKaeLFKB+B2HI+AEDwrdBCAFLpJQ=";
 
   # skip test due FHS dependency
   doCheck = false;
diff --git a/pkgs/applications/window-managers/river/default.nix b/pkgs/applications/window-managers/river/default.nix
index 4c59222d31bb5..3d3008692922b 100644
--- a/pkgs/applications/window-managers/river/default.nix
+++ b/pkgs/applications/window-managers/river/default.nix
@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchFromGitHub
+, fetchFromGitea
 , libGL
 , libX11
 , libevdev
@@ -12,7 +12,7 @@
 , udev
 , wayland
 , wayland-protocols
-, wlroots_0_16
+, wlroots_0_17
 , xwayland
 , zig_0_11
 , withManpages ? true
@@ -21,16 +21,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "river";
-  version = "0.2.6";
+  version = "0.3.0";
 
   outputs = [ "out" ] ++ lib.optionals withManpages [ "man" ];
 
-  src = fetchFromGitHub {
-    owner = "riverwm";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "river";
     repo = "river";
     rev = "refs/tags/v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-JPb8l5ANxYCqinWNoQK5PAyn4CaiSj0e9mAhZwd9HOw=";
+    hash = "sha256-6LZuWx0sC6bW0K7D0PR8hJlVW6i6NIzOOORdMu3Gk5U=";
   };
 
   nativeBuildInputs = [
@@ -49,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     pixman
     udev
     wayland-protocols
-    wlroots_0_16
+    wlroots_0_17
   ] ++ lib.optional xwaylandSupport libX11;
 
   dontConfigure = true;
@@ -64,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.providedSessions = [ "river" ];
 
   meta = {
-    homepage = "https://github.com/ifreund/river";
+    homepage = "https://codeberg.org/river/river";
     description = "A dynamic tiling wayland compositor";
     longDescription = ''
       River is a dynamic tiling Wayland compositor with flexible runtime
@@ -79,7 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
       - Scriptable configuration and control through a custom Wayland protocol
         and separate riverctl binary implementing it.
     '';
-    changelog = "https://github.com/ifreund/river/releases/tag/v${finalAttrs.version}";
+    changelog = "https://codeberg.org/river/river/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       adamcstephens