Merge master into staging-next

44 files changed, 946 insertions, 194 deletions

diff --git a/pkgs/by-name/ca/cargo-swift/package.nix b/pkgs/by-name/ca/cargo-swift/package.nix
index 1cdfb0f46466d..18b2cecbd5cc2 100644
--- a/pkgs/by-name/ca/cargo-swift/package.nix
+++ b/pkgs/by-name/ca/cargo-swift/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-swift";
-  version = "0.6.1";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "antoniusnaumann";
     repo = "cargo-swift";
     rev = "v${version}";
-    hash = "sha256-hTlgIPXXdhxFtK/acXITwitIg1DGgF4cCVaAxogWPrk=";
+    hash = "sha256-2jKu1Hl+2HnlZWu+mLmrhrhzH1Q/S9ej+SJyjeMr4CI=";
   };
 
-  cargoHash = "sha256-6F4CX9uiCfPbgFRZ0hC/s5xT42S2V5ZgGQ+O2bHb9vg=";
+  cargoHash = "sha256-PQkV2Gz1whIM772bGAEC0TQO9w4DaWSrtCejgVCFTpA=";
 
   meta = with lib; {
     description = "Cargo plugin to easily build Swift packages from Rust code";
diff --git a/pkgs/by-name/cd/cdecl/package.nix b/pkgs/by-name/cd/cdecl/package.nix
index d75f6d994b024..1535dc0bfd0dd 100644
--- a/pkgs/by-name/cd/cdecl/package.nix
+++ b/pkgs/by-name/cd/cdecl/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cdecl";
-  version = "17.0";
+  version = "17.0.1";
 
   src = fetchFromGitHub {
     owner = "paul-j-lucas";
     repo = "cdecl";
     rev = "refs/tags/cdecl-${finalAttrs.version}";
-    hash = "sha256-ElMmsFD4VXF6BFjFuuWmgFJaqCPCxpQB7S9tLkeGmMY=";
+    hash = "sha256-hzsTtUlxyG5dKmKZKR9lxPHczI0jd06d1RGvb9crbyE=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/co/codeium/package.nix b/pkgs/by-name/co/codeium/package.nix
index bac7f7d8ce2a6..651791803e946 100644
--- a/pkgs/by-name/co/codeium/package.nix
+++ b/pkgs/by-name/co/codeium/package.nix
@@ -13,10 +13,10 @@ let
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-38ESKfQXHqHdP+vu/ynCByIPYHcvt8w8SJ/NTmCpm8o=";
-    aarch64-linux = "sha256-W00MyiBPQa8vClIjDynDgYEeigjWtBuDfNzZKMEzifg=";
-    x86_64-darwin = "sha256-CkKuEuYfq/vUv8uc4mhKpjqAfGM/B8goJ5EPAsA1gnI=";
-    aarch64-darwin = "sha256-aX70EfrRzEz2DJIcSEXrd0T0ptHzie21CQx4g6dU7g0=";
+    x86_64-linux = "sha256-uihbLR6JEhj99jz4++7E5z1INBtCskGmZjsTucGznlQ=";
+    aarch64-linux = "sha256-N/YklwW8T2+Go9kQDZPdGYmgiHHEs4yoOmdPEoH8iqU=";
+    x86_64-darwin = "sha256-NLv4lZCQ5jFvQdS9c37/bXcCANzXrIsobhZEWxeK4XY=";
+    aarch64-darwin = "sha256-mLcvgVe9VF9eta7m/jrGgDQx56uDDsOKPTi5Pp6nS3g=";
   }.${system} or throwSystem;
 
   bin = "$out/bin/codeium_language_server";
@@ -24,7 +24,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "codeium";
-  version = "1.8.61";
+  version = "1.8.69";
   src = fetchurl {
     name = "${finalAttrs.pname}-${finalAttrs.version}.gz";
     url = "https://github.com/Exafunction/codeium/releases/download/language-server-v${finalAttrs.version}/language_server_${plat}.gz";
diff --git a/pkgs/by-name/fi/firefoxpwa/package.nix b/pkgs/by-name/fi/firefoxpwa/package.nix
index f79c09c8d37cc..25a9cccf58341 100644
--- a/pkgs/by-name/fi/firefoxpwa/package.nix
+++ b/pkgs/by-name/fi/firefoxpwa/package.nix
@@ -8,15 +8,18 @@
   rustPlatform,
 
   cups,
+  ffmpeg,
   firefox-unwrapped,
   libcanberra-gtk3,
   libglvnd,
   libnotify,
+  libpulseaudio,
   libva,
   mesa,
   nixosTests,
   openssl,
   pciutils,
+  pipewire,
   pkg-config,
   stdenv,
   udev,
@@ -68,11 +71,14 @@ rustPlatform.buildRustPackage rec {
       libs =
         lib.optionals stdenv.isLinux [
           cups
+          ffmpeg
           libglvnd
           libnotify
+          libpulseaudio
           libva
           mesa
           pciutils
+          pipewire
           udev
           xorg.libXScrnSaver
         ]
diff --git a/pkgs/by-name/ig/igir/package.nix b/pkgs/by-name/ig/igir/package.nix
index 95f00111825a8..a1eba93894edd 100644
--- a/pkgs/by-name/ig/igir/package.nix
+++ b/pkgs/by-name/ig/igir/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "igir";
-  version = "2.7.0";
+  version = "2.8.2";
 
   src = fetchFromGitHub {
     owner = "emmercm";
     repo = "igir";
     rev = "v${version}";
-    hash = "sha256-tfwXvLUcueGnImzmfUTV7l00+peLlJsxhreejoSVPPo=";
+    hash = "sha256-EKY9vzN4JYq+ydcjNZPHSqh5Tf6bLeDh1bwkPw01oK8=";
   };
 
-  npmDepsHash = "sha256-MpTGG/ySZ6xw+bW+AEFQqEFbN2FutopkLXtx0VlqmjE=";
+  npmDepsHash = "sha256-7d/aMaKo3gsQ8PI8pSqRrv07k8+xBIpaHL+DPxAGTio=";
 
   # I have no clue why I have to do this
   postPatch = ''
diff --git a/pkgs/by-name/je/jellyfin-web/package.nix b/pkgs/by-name/je/jellyfin-web/package.nix
index 8eae2d9addb82..c80bf01ab799c 100644
--- a/pkgs/by-name/je/jellyfin-web/package.nix
+++ b/pkgs/by-name/je/jellyfin-web/package.nix
@@ -27,7 +27,7 @@ let
 in
 buildNpmPackage' rec {
   pname = "jellyfin-web";
-  version = "10.9.6";
+  version = "10.9.7";
 
   src =
     assert version == jellyfin.version;
@@ -35,10 +35,10 @@ buildNpmPackage' rec {
       owner = "jellyfin";
       repo = "jellyfin-web";
       rev = "v${version}";
-      hash = "sha256-cKMKcT2roah35Pv36KJqYIhwoYXaT1yYfvOsxbt+EfE=";
+      hash = "sha256-vjp96NTcSY1Uj1PeEOPIdZuMFNcO3ZyjRvYYT0AQCrk=";
     };
 
-  npmDepsHash = "sha256-9uAFWlbzDzd8f8G/v/eLWJ3Is4aO5mqEd4o/YZXDkTQ=";
+  npmDepsHash = "sha256-CKUssg4YWZd2Gzz7FtO5zA4ngQeLXkFu0VskXrFNwjM=";
 
   npmBuildScript = [ "build:production" ];
 
diff --git a/pkgs/by-name/je/jellyfin/package.nix b/pkgs/by-name/je/jellyfin/package.nix
index 0360ff53e367f..8ab7526eebceb 100644
--- a/pkgs/by-name/je/jellyfin/package.nix
+++ b/pkgs/by-name/je/jellyfin/package.nix
@@ -13,13 +13,13 @@
 
 buildDotnetModule rec {
   pname = "jellyfin";
-  version = "10.9.6"; # ensure that jellyfin-web has matching version
+  version = "10.9.7"; # ensure that jellyfin-web has matching version
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin";
     rev = "v${version}";
-    sha256 = "sha256-Ze1KO+Rx4sz8qdKa1U2g096Ck/Qc+JdQj4MNqaJRhb8=";
+    sha256 = "sha256-jxOFbmYrgxP6jbjnWubajqXInLXu7TO4vssU4E1oeoc=";
   };
 
   propagatedBuildInputs = [ sqlite ];
diff --git a/pkgs/by-name/le/leetgo/package.nix b/pkgs/by-name/le/leetgo/package.nix
index 64d19fda9d7b0..1b2b8e33767e8 100644
--- a/pkgs/by-name/le/leetgo/package.nix
+++ b/pkgs/by-name/le/leetgo/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "leetgo";
-  version = "1.4.1";
+  version = "1.4.7";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "leetgo";
     rev = "v${version}";
-    hash = "sha256-LbY7GGPu2ZwcclCmsE9V421FUi+foR7CXyFHF7GrjQo=";
+    hash = "sha256-K/PaQakX0ZLu2Uh906kZ4p8J+GV7ewAeSVFMMQiKYBA=";
   };
 
-  vendorHash = "sha256-GG9IfM50uVhsQVjXhUrYxuEbPlbsEsFubmUUSMr5SD4=";
+  vendorHash = "sha256-4QSfZzYLjPdGKLySP57fK9n6WXdCYzb3sWibfP85jLE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ma/makejinja/package.nix b/pkgs/by-name/ma/makejinja/package.nix
index cc53732ae3d64..c571e198c68e4 100644
--- a/pkgs/by-name/ma/makejinja/package.nix
+++ b/pkgs/by-name/ma/makejinja/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "makejinja";
-  version = "2.6.0";
+  version = "2.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mirkolenz";
     repo = "makejinja";
-    rev = "v${version}";
-    hash = "sha256-sH4m+rcHA6nW21xEJon10lS7e5QiFwUyvV49NZ3UY+s=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-F56y+TxDD/B67ncnBTOd0FZGmXO/zjXitwbk/5aiekM=";
   };
 
   build-system = with python3Packages; [ poetry-core ];
diff --git a/pkgs/by-name/me/mercure/package.nix b/pkgs/by-name/me/mercure/package.nix
index b66483d29ae25..7e2f34ed57929 100644
--- a/pkgs/by-name/me/mercure/package.nix
+++ b/pkgs/by-name/me/mercure/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "mercure";
-  version = "0.16.0";
+  version = "0.16.2";
 
   src = fetchFromGitHub {
     owner = "dunglas";
     repo = "mercure";
     rev = "v${version}";
-    hash = "sha256-HHErk1KX8HgAt4UrBuchK6ysNsxEsrf5uBzzvSNz+to=";
+    hash = "sha256-HqeF/Wr5ngf6hpFrZAL8kdHcMuxUslWsjtlOq4+C48s=";
   };
 
   sourceRoot = "${src.name}/caddy";
 
-  vendorHash = "sha256-aO0EvxZNOCAaqEWN1VIdPpS+y8KcsuXo7o8msicspNE=";
+  vendorHash = "sha256-mRyzih46M635uQ9kIQ1vIe/ToN92xlvUcxQ7Bw/Qxiw=";
 
   subPackages = [ "mercure" ];
   excludedPackages = [ "../cmd/mercure" ];
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index e1ad7fb280188..5e79e29ee4586 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.377";
+  version = "0.0.380";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-GQPur1Rc0o7WyCNwXLiu7w3sntQQ/B7WhKHCKVmqH/8=";
+    hash = "sha256-DAOSkWT+fe0av0EpjK8HxgIei6urgFJrNeMdZfrDqDM=";
   };
 
-  vendorHash = "sha256-72cHswoTZszo42NOrPNuokDlqoJ3/YEhGe+rQSKvgAw=";
+  vendorHash = "sha256-y+mXUzkY5w2hYECtfcBBUCWsRwhip6IhX617lRX698Q=";
 
   subPackages = ["cmd/nsc" "cmd/ns" "cmd/docker-credential-nsc"];
 
diff --git a/pkgs/by-name/na/nanopb/generator-out.nix b/pkgs/by-name/na/nanopb/generator-out.nix
new file mode 100644
index 0000000000000..a9e179d902988
--- /dev/null
+++ b/pkgs/by-name/na/nanopb/generator-out.nix
@@ -0,0 +1,59 @@
+{ stdenv
+, cmake
+, python3
+, writeTextFile
+, protobuf
+, src
+, version
+}:
+let
+  pyproject_toml = writeTextFile {
+    name = "pyproject.toml";
+    text = ''
+      [build-system]
+      requires = ["setuptools"]
+      build-backend = "setuptools.build_meta"
+
+      [tool.setuptools]
+      include-package-data = true
+
+      [tool.setuptools.packages.find]
+      where = ["src"]
+
+      [tool.setuptools.package-data]
+      "*" = ["nanopb.proto"]
+
+      [project]
+      name = "nanopb"
+      version = "${version}"
+      dependencies = [
+        "setuptools",
+        "protobuf",
+        "six"
+      ]
+    '';
+  };
+in
+stdenv.mkDerivation {
+  pname = "nanopb-generator-out";
+  inherit src version;
+
+  nativeBuildInputs = [ cmake protobuf python3 ];
+
+  cmakeFlags = [
+    "-Dnanopb_BUILD_RUNTIME=OFF"
+    "-Dnanopb_BUILD_GENERATOR=ON"
+    "-Dnanopb_PYTHON_INSTDIR_OVERRIDE=$out/lib/python/site-packages"
+  ];
+
+  preConfigure = ''
+    cmakeFlags+=" -Dnanopb_PYTHON_INSTDIR_OVERRIDE=$out/lib/python/site-packages"
+  '';
+
+  postInstall = ''
+    rm -rf $out/include
+    rm -rf $out/lib/cmake
+    ln -s $out/lib/python/site-packages $out/src
+    ln -s ${pyproject_toml} $out/pyproject.toml
+  '';
+}
diff --git a/pkgs/by-name/na/nanopb/generator.nix b/pkgs/by-name/na/nanopb/generator.nix
new file mode 100644
index 0000000000000..15d4e0605b80e
--- /dev/null
+++ b/pkgs/by-name/na/nanopb/generator.nix
@@ -0,0 +1,27 @@
+{ python3
+, stdenvNoCC
+, protobuf
+, version
+, generator-out
+}:
+stdenvNoCC.mkDerivation {
+  pname = "nanopb-generator";
+  inherit version;
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [ python3.pkgs.wrapPython ];
+
+  propagatedBuildInputs = [
+    protobuf
+    python3.pkgs.nanopb-proto
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp ${generator-out}/bin/protoc-gen-nanopb $out/bin/
+    cp ${generator-out}/bin/nanopb_generator $out/bin/
+    wrapPythonPrograms
+    cp ${generator-out}/bin/nanopb_generator.py $out/bin/
+  '';
+}
diff --git a/pkgs/by-name/na/nanopb/package.nix b/pkgs/by-name/na/nanopb/package.nix
new file mode 100644
index 0000000000000..bd14e9d8c75bb
--- /dev/null
+++ b/pkgs/by-name/na/nanopb/package.nix
@@ -0,0 +1,122 @@
+{ stdenvNoCC
+, callPackage
+, fetchFromGitHub
+, buildPackages
+, lib
+, enableMalloc ? false
+, noPackedStructs ? false
+, maxRequiredFields ? null
+, field32bit ? false
+, noErrmsg ? false
+, bufferOnly ? false
+, systemHeader ? null
+, without64bit ? false
+, encodeArraysUnpacked ? false
+, convertDoubleFloat ? false
+, validateUtf8 ? false
+, littleEndian8bit ? false
+, c99StaticAssert ? false
+, noStaticAssert ? false
+}:
+stdenvNoCC.mkDerivation (self:
+let
+  generator-out = buildPackages.callPackage ./generator-out.nix { inherit (self) src version; };
+  python-module = buildPackages.callPackage ./python-module.nix {
+    inherit (self) version;
+    inherit (self.passthru) generator-out;
+  };
+  python3 = buildPackages.python3.override {
+    packageOverrides = _: _: {
+      nanopb-proto = self.passthru.python-module;
+    };
+  };
+  generator = buildPackages.callPackage ./generator.nix {
+    inherit python3;
+    inherit (self) version;
+    inherit (self.passthru) generator-out;
+  };
+  runtime = callPackage ./runtime.nix {
+    inherit python3;
+    inherit (self) src version;
+    inherit
+      enableMalloc
+      noPackedStructs
+      maxRequiredFields
+      field32bit
+      noErrmsg
+      bufferOnly
+      systemHeader
+      without64bit
+      encodeArraysUnpacked
+      convertDoubleFloat
+      validateUtf8
+      littleEndian8bit
+      c99StaticAssert
+      noStaticAssert;
+  };
+in
+{
+  pname = "nanopb";
+  version = "0.4.8";
+
+  src = fetchFromGitHub {
+    owner = "nanopb";
+    repo = "nanopb";
+    rev = self.version;
+    hash = "sha256-LfARVItT+7dczg2u08RlXZLrLR7ScvC44tgmcy/Zv48=";
+  };
+
+  dontPatch = true;
+  dontUnpack = true;
+
+  propagatedNativeBuildInputs = [ generator ];
+
+  propagatedBuildInputs = [ runtime ];
+
+  postInstall = ''
+    mkdir $out
+    ln -s ${generator}/bin $out/bin
+    ln -s ${runtime}/include $out/include
+    ln -s ${runtime}/lib $out/lib
+    mkdir -p $out/share/nanopb/generator/proto
+    ln -s ${self.src}/generator/proto/nanopb.proto $out/share/nanopb/generator/proto/nanopb.proto
+  '';
+
+  passthru = {
+    inherit runtime generator-out python-module generator;
+    tests = {
+      simple-proto2 = callPackage ./test-simple-proto2 { };
+      simple-proto3 = callPackage ./test-simple-proto3 { };
+      message-with-annotations = callPackage ./test-message-with-annotations { };
+      message-with-options = callPackage ./test-message-with-options { };
+    };
+  };
+
+  meta = with lib; {
+    platforms = platforms.all;
+
+    description = "Protocol Buffers with small code size";
+    homepage = "https://jpa.kapsi.fi/nanopb/";
+    license = licenses.zlib;
+    maintainers = with maintainers; [ kalbasit liarokapisv ];
+
+    longDescription = ''
+      Nanopb is a small code-size Protocol Buffers implementation in ansi C. It
+      is especially suitable for use in microcontrollers, but fits any memory
+      restricted system.
+
+      - Homepage: jpa.kapsi.fi/nanopb
+      - Documentation: jpa.kapsi.fi/nanopb/docs
+      - Downloads: jpa.kapsi.fi/nanopb/download
+      - Forum: groups.google.com/forum/#!forum/nanopb
+
+      In order to use the nanopb options in your proto files, you'll need to
+      tell protoc where to find the nanopb.proto file.
+      You can do so with the --proto_path (-I) option to add the directory
+      ''${nanopb}/share/nanopb/generator/proto like so:
+
+      protoc --proto_path=. --proto_path=''${nanopb}/share/nanopb/generator/proto --plugin=protoc-gen-nanopb=''${nanopb}/bin/protoc-gen-nanopb --nanopb_out=out file.proto
+    '';
+  };
+})
+
diff --git a/pkgs/by-name/na/nanopb/python-module.nix b/pkgs/by-name/na/nanopb/python-module.nix
new file mode 100644
index 0000000000000..f58c955307d84
--- /dev/null
+++ b/pkgs/by-name/na/nanopb/python-module.nix
@@ -0,0 +1,16 @@
+{ python3
+, version
+, generator-out
+}:
+python3.pkgs.buildPythonPackage {
+  pname = "nanopb-python-module";
+  inherit version;
+  src = generator-out;
+  pyproject = true;
+  pythonImportsCheck = [ "nanopb" ];
+  propagatedBuildInputs = with python3.pkgs; [
+    setuptools
+    protobuf
+    six
+  ];
+}
diff --git a/pkgs/by-name/na/nanopb/runtime.nix b/pkgs/by-name/na/nanopb/runtime.nix
new file mode 100644
index 0000000000000..2af7d2cedd5d7
--- /dev/null
+++ b/pkgs/by-name/na/nanopb/runtime.nix
@@ -0,0 +1,69 @@
+{ cmake
+, lib
+, stdenv
+, protobuf
+, python3
+, src
+, version
+, enableMalloc
+, noPackedStructs
+, maxRequiredFields
+, field32bit
+, noErrmsg
+, bufferOnly
+, systemHeader
+, without64bit
+, encodeArraysUnpacked
+, convertDoubleFloat
+, validateUtf8
+, littleEndian8bit
+, c99StaticAssert
+, noStaticAssert
+}:
+
+stdenv.mkDerivation
+  ({
+    pname = "nanopb-runtime";
+    inherit src version;
+
+    nativeBuildInputs = [ cmake protobuf python3 ];
+
+    patchPhase =
+      let
+        compile_definitions = target: ''
+          target_compile_definitions(${target}
+            PUBLIC
+            ${lib.concatStringsSep "\n\t" (map (x: "PB_${x.flag}")
+          (builtins.filter (x: x.cond) [
+            { cond = enableMalloc; flag = "ENABLE_MALLOC=1"; }
+            { cond = noPackedStructs; flag = "NO_PACKED_STRUCTS=1"; }
+            { cond = maxRequiredFields != null; flag = "MAX_REQUIRED_FIELDS=${maxRequiredFields}"; }
+            { cond = field32bit; flag = "FIELD_32BIT=1"; }
+            { cond = noErrmsg; flag = "NO_ERRMSG=1"; }
+            { cond = bufferOnly; flag = "BUFFER_ONLY=1"; }
+            { cond = systemHeader != null; flag = "SYSTEM_HEADER=${systemHeader}"; }
+            { cond = without64bit; flag = "WITHOUT_64BIT=1"; }
+            { cond = encodeArraysUnpacked; flag = "ENCODE_ARRAYS_UNPACKED=1"; }
+            { cond = convertDoubleFloat; flag = "CONVERT_DOUBLE_FLOAT=1"; }
+            { cond = validateUtf8; flag = "VALIDATE_UTF8=1"; }
+            { cond = littleEndian8bit; flag = "LITTLE_ENDIAN_8BIT=1"; }
+            { cond = c99StaticAssert; flag = "C99_STATIC_ASSERT=1"; }
+            { cond = noStaticAssert; flag = "NO_STATIC_ASSERT=1"; }
+          ]))}
+          )
+        '';
+      in
+      ''
+        cat << EOF >> CMakeLists.txt
+          ${compile_definitions "protobuf-nanopb"}
+          ${compile_definitions "protobuf-nanopb-static"}
+        EOF
+      '';
+
+    cmakeFlags = [
+      "-DBUILD_SHARED_LIBS=ON"
+      "-DBUILD_STATIC_LIBS=ON"
+      "-Dnanopb_BUILD_GENERATOR=OFF"
+      "-Dnanopb_BUILD_RUNTIME=ON"
+    ];
+  })
diff --git a/pkgs/by-name/na/nanopb/test-message-with-annotations/default.nix b/pkgs/by-name/na/nanopb/test-message-with-annotations/default.nix
new file mode 100644
index 0000000000000..5e53e72c62e63
--- /dev/null
+++ b/pkgs/by-name/na/nanopb/test-message-with-annotations/default.nix
@@ -0,0 +1,32 @@
+{ lib, stdenv, nanopb }:
+
+stdenv.mkDerivation {
+  name = "nanopb-test-message-with-annotations";
+  meta.timeout = 60;
+  src = lib.fileset.toSource {
+    root = ./.;
+    fileset = lib.fileset.unions [ ./withannotations.proto ];
+  };
+
+  buildInputs = [ nanopb ];
+
+  # protoc requires any .proto file to be compiled to reside within it's
+  # proto_path. By default the current directory is automatically added to the
+  # proto_path. I tried using --proto_path ${./.} ${./simple.proto} and it did
+  # not work because they end up in the store at different locations.
+  dontInstall = true;
+  buildPhase = ''
+    mkdir $out
+
+    protoc --proto_path=. --proto_path=${nanopb}/share/nanopb/generator/proto --plugin=protoc-gen-nanopb=${nanopb}/bin/protoc-gen-nanopb --nanopb_out=$out withannotations.proto
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    grep -q WithAnnotations $out/withannotations.pb.c || (echo "error: WithAnnotations not found in $out/withannotations.pb.c"; exit 1)
+    grep -q WithAnnotations $out/withannotations.pb.h || (echo "error: WithAnnotations not found in $out/withannotations.pb.h"; exit 1)
+    grep -q "pb_byte_t uuid\[16\]" $out/withannotations.pb.h || (echo "error: uuid is not of type pb_byte_t and of size 16 in $out/withannotations.pb.h"; exit 1)
+    grep -q "FIXED_LENGTH_BYTES, uuid" $out/withannotations.pb.h || (echo "error: uuid is not of fixed lenght bytes in $out/withannotations.pb.h"; exit 1)
+    grep -q "#define WithAnnotations_size" $out/withannotations.pb.h || (echo "error: the size of WithAnnotations is not known in $out/withannotations.pb.h"; exit 1)
+  '';
+}
diff --git a/pkgs/by-name/na/nanopb/test-message-with-annotations/withannotations.proto b/pkgs/by-name/na/nanopb/test-message-with-annotations/withannotations.proto
new file mode 100644
index 0000000000000..d8109e877d68b
--- /dev/null
+++ b/pkgs/by-name/na/nanopb/test-message-with-annotations/withannotations.proto
@@ -0,0 +1,7 @@
+syntax = "proto3";
+
+import "nanopb.proto";
+
+message WithAnnotations {
+  bytes uuid = 1 [(nanopb).max_size = 16, (nanopb).fixed_length = true];
+}
diff --git a/pkgs/by-name/na/nanopb/test-message-with-options/default.nix b/pkgs/by-name/na/nanopb/test-message-with-options/default.nix
new file mode 100644
index 0000000000000..78be532d569d7
--- /dev/null
+++ b/pkgs/by-name/na/nanopb/test-message-with-options/default.nix
@@ -0,0 +1,35 @@
+{ lib, stdenv, nanopb }:
+
+stdenv.mkDerivation {
+  name = "nanopb-test-message-with-options";
+  meta.timeout = 60;
+  src = lib.fileset.toSource {
+    root = ./.;
+    fileset = lib.fileset.unions [
+      ./withoptions.proto
+      ./withoptions.options
+    ];
+  };
+
+  buildInputs = [ nanopb ];
+
+  # protoc requires any .proto file to be compiled to reside within it's
+  # proto_path. By default the current directory is automatically added to the
+  # proto_path. I tried using --proto_path ${./.} ${./simple.proto} and it did
+  # not work because they end up in the store at different locations.
+  dontInstall = true;
+  buildPhase = ''
+    mkdir $out
+
+    protoc --plugin=protoc-gen-nanopb=${nanopb}/bin/protoc-gen-nanopb --nanopb_out=$out withoptions.proto
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    grep -q WithOptions $out/withoptions.pb.c || (echo "error: WithOptions not found in $out/withoptions.pb.c"; exit 1)
+    grep -q WithOptions $out/withoptions.pb.h || (echo "error: WithOptions not found in $out/withoptions.pb.h"; exit 1)
+    grep -q "pb_byte_t uuid\[16\]" $out/withoptions.pb.h || (echo "error: uuid is not of type pb_byte_t and of size 16 in $out/withoptions.pb.h"; exit 1)
+    grep -q "FIXED_LENGTH_BYTES, uuid" $out/withoptions.pb.h || (echo "error: uuid is not of fixed lenght bytes in $out/withoptions.pb.h"; exit 1)
+    grep -q "#define WithOptions_size" $out/withoptions.pb.h || (echo "error: the size of WithOptions is not known in $out/withoptions.pb.h"; exit 1)
+  '';
+}
diff --git a/pkgs/by-name/na/nanopb/test-message-with-options/withoptions.options b/pkgs/by-name/na/nanopb/test-message-with-options/withoptions.options
new file mode 100644
index 0000000000000..ecf98a2173678
--- /dev/null
+++ b/pkgs/by-name/na/nanopb/test-message-with-options/withoptions.options
@@ -0,0 +1 @@
+ WithOptions.uuid max_size:16 fixed_length:true
diff --git a/pkgs/by-name/na/nanopb/test-message-with-options/withoptions.proto b/pkgs/by-name/na/nanopb/test-message-with-options/withoptions.proto
new file mode 100644
index 0000000000000..5a5da3a1c9732
--- /dev/null
+++ b/pkgs/by-name/na/nanopb/test-message-with-options/withoptions.proto
@@ -0,0 +1,5 @@
+syntax = "proto3";
+
+message WithOptions {
+  bytes uuid = 1;
+}
diff --git a/pkgs/by-name/na/nanopb/test-simple-proto2/default.nix b/pkgs/by-name/na/nanopb/test-simple-proto2/default.nix
new file mode 100644
index 0000000000000..5896679567486
--- /dev/null
+++ b/pkgs/by-name/na/nanopb/test-simple-proto2/default.nix
@@ -0,0 +1,29 @@
+{ lib, stdenv, nanopb }:
+
+stdenv.mkDerivation {
+  name = "nanopb-test-simple-proto2";
+  meta.timeout = 60;
+  src = lib.fileset.toSource {
+    root = ./.;
+    fileset = lib.fileset.unions [ ./simple.proto ];
+  };
+
+  buildInputs = [ nanopb ];
+
+  # protoc requires any .proto file to be compiled to reside within it's
+  # proto_path. By default the current directory is automatically added to the
+  # proto_path. I tried using --proto_path ${./.} ${./simple.proto} and it did
+  # not work because they end up in the store at different locations.
+  dontInstall = true;
+  buildPhase = ''
+    mkdir $out
+
+    protoc --plugin=protoc-gen-nanopb=${nanopb}/bin/protoc-gen-nanopb --nanopb_out=$out simple.proto
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    grep -q SimpleMessage $out/simple.pb.c || (echo "ERROR: SimpleMessage not found in $out/simple.pb.c"; exit 1)
+    grep -q SimpleMessage $out/simple.pb.h || (echo "ERROR: SimpleMessage not found in $out/simple.pb.h"; exit 1)
+  '';
+}
diff --git a/pkgs/by-name/na/nanopb/test-simple-proto2/simple.proto b/pkgs/by-name/na/nanopb/test-simple-proto2/simple.proto
new file mode 100644
index 0000000000000..b02936b1ae267
--- /dev/null
+++ b/pkgs/by-name/na/nanopb/test-simple-proto2/simple.proto
@@ -0,0 +1,5 @@
+syntax = "proto2";
+
+message SimpleMessage {
+  required int32 lucky_number = 1;
+}
diff --git a/pkgs/by-name/na/nanopb/test-simple-proto3/default.nix b/pkgs/by-name/na/nanopb/test-simple-proto3/default.nix
new file mode 100644
index 0000000000000..6276126131c86
--- /dev/null
+++ b/pkgs/by-name/na/nanopb/test-simple-proto3/default.nix
@@ -0,0 +1,29 @@
+{ lib, stdenv, nanopb }:
+
+stdenv.mkDerivation {
+  name = "nanopb-test-simple-proto3";
+  meta.timeout = 60;
+  src = lib.fileset.toSource {
+    root = ./.;
+    fileset = lib.fileset.unions [ ./simple.proto ];
+  };
+
+  buildInputs = [ nanopb ];
+
+  # protoc requires any .proto file to be compiled to reside within it's
+  # proto_path. By default the current directory is automatically added to the
+  # proto_path. I tried using --proto_path ${./.} ${./simple.proto} and it did
+  # not work because they end up in the store at different locations.
+  dontInstall = true;
+  buildPhase = ''
+    mkdir $out
+
+    protoc --plugin=protoc-gen-nanopb=${nanopb}/bin/protoc-gen-nanopb --nanopb_out=$out simple.proto
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    grep -q SimpleMessage $out/simple.pb.c || (echo "ERROR: SimpleMessage not found in $out/simple.pb.c"; exit 1)
+    grep -q SimpleMessage $out/simple.pb.h || (echo "ERROR: SimpleMessage not found in $out/simple.pb.h"; exit 1)
+  '';
+}
diff --git a/pkgs/by-name/na/nanopb/test-simple-proto3/simple.proto b/pkgs/by-name/na/nanopb/test-simple-proto3/simple.proto
new file mode 100644
index 0000000000000..6b99cdb5daa7c
--- /dev/null
+++ b/pkgs/by-name/na/nanopb/test-simple-proto3/simple.proto
@@ -0,0 +1,5 @@
+syntax = "proto3";
+
+message SimpleMessage {
+  int32 lucky_number = 1;
+}
diff --git a/pkgs/by-name/oe/oelint-adv/package.nix b/pkgs/by-name/oe/oelint-adv/package.nix
index efadd6e13f5a9..7f212aef833d3 100644
--- a/pkgs/by-name/oe/oelint-adv/package.nix
+++ b/pkgs/by-name/oe/oelint-adv/package.nix
@@ -6,13 +6,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "oelint-adv";
-  version = "5.6.0";
+  version = "5.7.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "oelint_adv";
-    hash = "sha256-8y+7FUxsw5nxyCYdukigyQDkCgcHYLFSoIVmr0P/IVs=";
+    hash = "sha256-Ivlab7l+aNojHICAHHAhojx8RXI8h3jMnl7ehFDkLW0=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/oo/oo7/Cargo.lock b/pkgs/by-name/oo/oo7/Cargo.lock
index 25dabd4253ba0..ac9873cac466d 100644
--- a/pkgs/by-name/oo/oo7/Cargo.lock
+++ b/pkgs/by-name/oo/oo7/Cargo.lock
@@ -76,9 +76,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle-query"
-version = "1.0.3"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a64c907d4e79225ac72e2a354c9ce84d50ebb4586dee56c82b3ee73004f537f5"
+checksum = "ad186efb764318d35165f1758e7dcef3b10628e26d41a44bc5550652e6804391"
 dependencies = [
  "windows-sys 0.52.0",
 ]
@@ -95,12 +95,12 @@ dependencies = [
 
 [[package]]
 name = "async-broadcast"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "258b52a1aa741b9f09783b2d86cf0aeeb617bbf847f6933340a39644227acbdb"
+checksum = "20cd0e2e25ea8e5f7e9df04578dc6cf5c83577fd09b1a46aaf5c85e1c33f2a7e"
 dependencies = [
- "event-listener 5.3.1",
- "event-listener-strategy 0.5.2",
+ "event-listener",
+ "event-listener-strategy",
  "futures-core",
  "pin-project-lite",
 ]
@@ -112,7 +112,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "89b47800b0be77592da0afd425cc03468052844aff33b84e33cc696f64e77b6a"
 dependencies = [
  "concurrent-queue",
- "event-listener-strategy 0.5.2",
+ "event-listener-strategy",
  "futures-core",
  "pin-project-lite",
 ]
@@ -143,9 +143,9 @@ dependencies = [
 
 [[package]]
 name = "async-io"
-version = "2.3.2"
+version = "2.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcccb0f599cfa2f8ace422d3555572f47424da5648a4382a9dd0310ff8210884"
+checksum = "0d6baa8f0178795da0e71bc42c9e5d13261aac7ee549853162e66a241ba17964"
 dependencies = [
  "async-lock",
  "cfg-if",
@@ -162,20 +162,31 @@ dependencies = [
 
 [[package]]
 name = "async-lock"
-version = "3.3.0"
+version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d034b430882f8381900d3fe6f0aaa3ad94f2cb4ac519b429692a1bc2dda4ae7b"
+checksum = "ff6e472cdea888a4bd64f342f09b3f50e1886d32afe8df3d663c01140b811b18"
 dependencies = [
- "event-listener 4.0.3",
- "event-listener-strategy 0.4.0",
+ "event-listener",
+ "event-listener-strategy",
  "pin-project-lite",
 ]
 
 [[package]]
+name = "async-net"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b948000fad4873c1c9339d60f2623323a0cfd3816e5181033c6a5cb68b2accf7"
+dependencies = [
+ "async-io",
+ "blocking",
+ "futures-lite",
+]
+
+[[package]]
 name = "async-process"
-version = "2.2.2"
+version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a53fc6301894e04a92cb2584fedde80cb25ba8e02d9dc39d4a87d036e22f397d"
+checksum = "f7eda79bbd84e29c2b308d1dc099d7de8dcc7035e48f4bf5dc4a531a44ff5e2a"
 dependencies = [
  "async-channel",
  "async-io",
@@ -184,7 +195,7 @@ dependencies = [
  "async-task",
  "blocking",
  "cfg-if",
- "event-listener 5.3.1",
+ "event-listener",
  "futures-lite",
  "rustix",
  "tracing",
@@ -204,9 +215,9 @@ dependencies = [
 
 [[package]]
 name = "async-signal"
-version = "0.2.6"
+version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "afe66191c335039c7bb78f99dc7520b0cbb166b3a1cb33a03f53d8a1c6f2afda"
+checksum = "794f185324c2f00e771cd9f1ae8b5ac68be2ca7abb129a87afd6e86d228bc54d"
 dependencies = [
  "async-io",
  "async-lock",
@@ -251,9 +262,9 @@ checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
 
 [[package]]
 name = "backtrace"
-version = "0.3.72"
+version = "0.3.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17c6a35df3749d2e8bb1b7b21a976d82b15548788d2735b9d82f329268f71a11"
+checksum = "5cc23269a4f8976d0a4d2e7109211a419fe30e8d88d677cd60b6bc79c5732e0a"
 dependencies = [
  "addr2line",
  "cc",
@@ -330,9 +341,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.98"
+version = "1.0.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41c270e7540d725e65ac7f1b212ac8ce349719624d7bcff99f8e2e488e8cf03f"
+checksum = "96c51067fd44124faa7f870b4b1c969379ad32b2ba805aa959430ceaa384f695"
 
 [[package]]
 name = "cfg-if"
@@ -371,9 +382,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.4"
+version = "4.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bc066a67923782aa8515dbaea16946c5bcc5addbd668bb80af688e53e548a0"
+checksum = "5db83dced34638ad474f39f250d7fea9598bdd239eaced1bdf45d597da0f433f"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -381,9 +392,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.2"
+version = "4.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
+checksum = "f7e204572485eb3fbf28f871612191521df159bc3e15a9f5064c66dba3a8c05f"
 dependencies = [
  "anstream",
  "anstyle",
@@ -393,9 +404,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.4"
+version = "4.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "528131438037fd55894f62d6e9f068b8f45ac57ffa77517819645d10aed04f64"
+checksum = "c780290ccf4fb26629baa7a1081e68ced113f1d3ec302fa5948f1c381ebf06c6"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -405,9 +416,9 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98cc8fbded0c607b7ba9dd60cd98df59af97e84d24e49c8557331cfc26d301ce"
+checksum = "4b82cf0babdbd58558212896d1a4272303a57bdb245c2bf1147185fb45640e70"
 
 [[package]]
 name = "colorchoice"
@@ -475,9 +486,9 @@ checksum = "a3d8a32ae18130a3c84dd492d4215c3d913c3b07c6b63c2eb3eb7ff1101ab7bf"
 
 [[package]]
 name = "enumflags2"
-version = "0.7.9"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3278c9d5fb675e0a51dabcf4c0d355f692b064171535ba72361be1528a9d8e8d"
+checksum = "d232db7f5956f3f14313dc2f87985c58bd2c695ce124c8cdd984e08e15ac133d"
 dependencies = [
  "enumflags2_derive",
  "serde",
@@ -485,9 +496,9 @@ dependencies = [
 
 [[package]]
 name = "enumflags2_derive"
-version = "0.7.9"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c785274071b1b420972453b306eeca06acf4633829db4223b58a2a8c5953bc4"
+checksum = "de0d48a183585823424a4ce1aa132d174a6a81bd540895822eb4c8373a8e49e8"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -512,17 +523,6 @@ dependencies = [
 
 [[package]]
 name = "event-listener"
-version = "4.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b215c49b2b248c855fb73579eb1f4f26c38ffdc12973e20e07b91d78d5646e"
-dependencies = [
- "concurrent-queue",
- "parking",
- "pin-project-lite",
-]
-
-[[package]]
-name = "event-listener"
 version = "5.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6032be9bd27023a771701cc49f9f053c751055f71efb2e0ae5c15809093675ba"
@@ -534,21 +534,11 @@ dependencies = [
 
 [[package]]
 name = "event-listener-strategy"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "958e4d70b6d5e81971bebec42271ec641e7ff4e170a6fa605f2b8a8b65cb97d3"
-dependencies = [
- "event-listener 4.0.3",
- "pin-project-lite",
-]
-
-[[package]]
-name = "event-listener-strategy"
 version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0f214dc438f977e6d4e3500aaa277f5ad94ca83fbbd9b1a15713ce2344ccc5a1"
 dependencies = [
- "event-listener 5.3.1",
+ "event-listener",
  "pin-project-lite",
 ]
 
@@ -693,6 +683,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
 
 [[package]]
+name = "hermit-abi"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fbf6a919d6cf397374f7dfeeea91d974c7c0a7221d0d0f4f20d859d329e53fcc"
+
+[[package]]
 name = "hex"
 version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -819,9 +815,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.7.2"
+version = "2.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
 
 [[package]]
 name = "memoffset"
@@ -834,9 +830,9 @@ dependencies = [
 
 [[package]]
 name = "miniz_oxide"
-version = "0.7.3"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87dfd01fe195c66b572b37921ad8803d010623c0aca821bea2302239d155cdae"
+checksum = "b8a240ddb74feaf34a79a7add65a741f3167852fba007066dcac1ca548d89c08"
 dependencies = [
  "adler",
 ]
@@ -972,15 +968,15 @@ version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
 dependencies = [
- "hermit-abi",
+ "hermit-abi 0.3.9",
  "libc",
 ]
 
 [[package]]
 name = "object"
-version = "0.35.0"
+version = "0.36.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8ec7ab813848ba4522158d5517a6093db1ded27575b070f4177b8d12b41db5e"
+checksum = "576dfe1fc8f9df304abb159d767a29d0476f7750fbf8aa7ad07816004a207434"
 dependencies = [
  "memchr",
 ]
@@ -993,12 +989,13 @@ checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
 
 [[package]]
 name = "oo7"
-version = "0.3.2"
+version = "0.3.3"
 dependencies = [
  "aes",
  "async-fs",
  "async-io",
  "async-lock",
+ "async-net",
  "blocking",
  "cbc",
  "cipher",
@@ -1027,7 +1024,7 @@ dependencies = [
 
 [[package]]
 name = "oo7-cli"
-version = "0.3.2"
+version = "0.3.3"
 dependencies = [
  "chrono",
  "clap",
@@ -1038,7 +1035,7 @@ dependencies = [
 
 [[package]]
 name = "oo7-portal"
-version = "0.3.2"
+version = "0.3.3"
 dependencies = [
  "futures-channel",
  "futures-util",
@@ -1137,9 +1134,9 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "piper"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "464db0c665917b13ebb5d453ccdec4add5658ee1adc7affc7677615356a8afaf"
+checksum = "ae1d5c74c9876f070d3e8fd503d748c7d974c3e48da8f41350fa5222ef9b4391"
 dependencies = [
  "atomic-waker",
  "fastrand",
@@ -1154,13 +1151,13 @@ checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
 
 [[package]]
 name = "polling"
-version = "3.7.0"
+version = "3.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "645493cf344456ef24219d02a768cf1fb92ddf8c92161679ae3d91b91a637be3"
+checksum = "a3ed00ed3fbf728b5816498ecd316d1716eecaced9c0c8d2c5a6740ca214985b"
 dependencies = [
  "cfg-if",
  "concurrent-queue",
- "hermit-abi",
+ "hermit-abi 0.4.0",
  "pin-project-lite",
  "rustix",
  "tracing",
@@ -1184,9 +1181,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.84"
+version = "1.0.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec96c6a92621310b51366f1e28d05ef11489516e93be030060e5fc12024a49d6"
+checksum = "22244ce15aa966053a896d1accb3a6e68469b97c7f33f284b99f0d576879fc23"
 dependencies = [
  "unicode-ident",
 ]
@@ -1455,9 +1452,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.37.0"
+version = "1.38.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1adbebffeca75fcfd058afa480fb6c0b81e165a0323f9c9d39c9697e37c46787"
+checksum = "ba4f4a02a7a80d6f274636f0aa95c7e383b912d41fe721a31f29e29698585a4a"
 dependencies = [
  "backtrace",
  "bytes",
@@ -1474,9 +1471,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
+checksum = "5f5ae998a069d4b5aba8ee9dad856af7d520c3699e6159b185c2acd48155d39a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1588,9 +1585,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "utf8parse"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "valuable"
@@ -1851,19 +1848,19 @@ dependencies = [
 
 [[package]]
 name = "xdg-home"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21e5a325c3cb8398ad6cf859c1135b25dd29e186679cf2da7581d9679f63b38e"
+checksum = "ca91dcf8f93db085f3a0a29358cd0b9d670915468f4290e8b85d118a34211ab8"
 dependencies = [
  "libc",
- "winapi",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "zbus"
-version = "4.2.2"
+version = "4.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "989c3977a7aafa97b12b9a35d21cdcff9b0d2289762b14683f45d66b1ba6c48f"
+checksum = "23915fcb26e7a9a9dc05fd93a9870d336d6d032cd7e8cebf1c5c37666489fdd5"
 dependencies = [
  "async-broadcast",
  "async-executor",
@@ -1876,7 +1873,7 @@ dependencies = [
  "async-trait",
  "blocking",
  "enumflags2",
- "event-listener 5.3.1",
+ "event-listener",
  "futures-core",
  "futures-sink",
  "futures-util",
@@ -1900,9 +1897,9 @@ dependencies = [
 
 [[package]]
 name = "zbus_macros"
-version = "4.2.2"
+version = "4.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fe9de53245dcf426b7be226a4217dd5e339080e5d46e64a02d6e5dcbf90fca1"
+checksum = "02bcca0b586d2f8589da32347b4784ba424c4891ed86aa5b50d5e88f6b2c4f5d"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
diff --git a/pkgs/by-name/oo/oo7/package.nix b/pkgs/by-name/oo/oo7/package.nix
index 8054daa560889..a126a27fd1079 100644
--- a/pkgs/by-name/oo/oo7/package.nix
+++ b/pkgs/by-name/oo/oo7/package.nix
@@ -1,22 +1,23 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-, nix-update-script
-, oo7
-, openssl
-, pkg-config
-, testers
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  oo7,
+  openssl,
+  pkg-config,
+  testers,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "oo7";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "bilelmoussaoui";
     repo = "oo7";
     rev = version;
-    hash = "sha256-oNzDjPMPM8opINSHC8T4ivQ6mfRVmN2VXPZAFkBZS8U=";
+    hash = "sha256-KoceqJCxb61EF29Fw9UU2LCHxDR0ExR3lnt85Nqg6tg=";
   };
 
   cargoLock = {
@@ -27,13 +28,9 @@ rustPlatform.buildRustPackage rec {
     ln -s ${./Cargo.lock} Cargo.lock
   '';
 
-  nativeBuildInputs = [
-    pkg-config
-  ];
+  nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [
-    openssl
-  ];
+  buildInputs = [ openssl ];
 
   postInstall = ''
     install -Dm644 portal/data/oo7-portal.portal $out/share/xdg-desktop-portal/portals/oo7.portal
@@ -43,17 +40,21 @@ rustPlatform.buildRustPackage rec {
   '';
 
   passthru = {
-    tests.testVersion = testers.testVersion {
-      package = oo7;
-    };
-    updateScript = nix-update-script { };
+    tests.testVersion = testers.testVersion { package = oo7; };
+
+    # TODO: re-enable this when upstream adds a Cargo.lock
+    # updateScript = nix-update-script { };
   };
 
   meta = with lib; {
     description = "James Bond went on a new mission as a Secret Service provider";
     homepage = "https://github.com/bilelmoussaoui/oo7";
+    changelog = "https://github.com/bilelmoussaoui/oo7/releases/tag/${src.rev}";
     license = licenses.mit;
-    maintainers = with maintainers; [ getchoo Scrumplex ];
+    maintainers = with maintainers; [
+      getchoo
+      Scrumplex
+    ];
     platforms = platforms.linux;
     mainProgram = "oo7-cli";
   };
diff --git a/pkgs/by-name/or/orchard/package.nix b/pkgs/by-name/or/orchard/package.nix
index 5eb8ebe8bcba2..0d664860befd3 100644
--- a/pkgs/by-name/or/orchard/package.nix
+++ b/pkgs/by-name/or/orchard/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "orchard";
-  version = "0.19.1";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = version;
-    hash = "sha256-q1PKmC5sMBO7dJ1Ne9JWnnepFRr/Ty8K/gJIgachDeI=";
+    hash = "sha256-wmIC5Vzne0fe42lCBj+7kNIDG777meUuehJpgmYnPuw=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -19,7 +19,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-icV4MOVzPSCGhFTIixWA02Jcf/7qhQwG4sBx1kRoJks=";
+  vendorHash = "sha256-Irpqg+orQsDv9iof+tGC/Out6hIOmlf3sdHGY80zxdE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/pr/prismlauncher-unwrapped/package.nix b/pkgs/by-name/pr/prismlauncher-unwrapped/package.nix
new file mode 100644
index 0000000000000..2a08500693179
--- /dev/null
+++ b/pkgs/by-name/pr/prismlauncher-unwrapped/package.nix
@@ -0,0 +1,117 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  cmark,
+  darwin,
+  extra-cmake-modules,
+  gamemode,
+  ghc_filesystem,
+  jdk17,
+  kdePackages,
+  ninja,
+  nix-update-script,
+  stripJavaArchivesHook,
+  tomlplusplus,
+  zlib,
+
+  msaClientID ? null,
+  gamemodeSupport ? stdenv.isLinux,
+}:
+
+let
+  libnbtplusplus = fetchFromGitHub {
+    owner = "PrismLauncher";
+    repo = "libnbtplusplus";
+    rev = "a5e8fd52b8bf4ab5d5bcc042b2a247867589985f";
+    hash = "sha256-A5kTgICnx+Qdq3Fir/bKTfdTt/T1NQP2SC+nhN1ENug=";
+  };
+in
+
+assert lib.assertMsg (
+  gamemodeSupport -> stdenv.isLinux
+) "gamemodeSupport is only available on Linux.";
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "prismlauncher-unwrapped";
+  version = "8.4";
+
+  src = fetchFromGitHub {
+    owner = "PrismLauncher";
+    repo = "PrismLauncher";
+    rev = finalAttrs.version;
+    hash = "sha256-460hB91M2hZm+uU1tywJEj20oRd5cz/NDvya8/vJdSA=";
+  };
+
+  postUnpack = ''
+    rm -rf source/libraries/libnbtplusplus
+    ln -s ${libnbtplusplus} source/libraries/libnbtplusplus
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    extra-cmake-modules
+    jdk17
+    stripJavaArchivesHook
+  ];
+
+  buildInputs =
+    [
+      cmark
+      ghc_filesystem
+      kdePackages.qtbase
+      kdePackages.quazip
+      tomlplusplus
+      zlib
+    ]
+    ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ]
+    ++ lib.optional gamemodeSupport gamemode;
+
+  hardeningEnable = lib.optionals stdenv.isLinux [ "pie" ];
+
+  cmakeFlags =
+    [
+      # downstream branding
+      (lib.cmakeFeature "Launcher_BUILD_PLATFORM" "nixpkgs")
+    ]
+    ++ lib.optionals (msaClientID != null) [
+      (lib.cmakeFeature "Launcher_MSA_CLIENT_ID" (toString msaClientID))
+    ]
+    ++ lib.optionals (lib.versionOlder kdePackages.qtbase.version "6") [
+      (lib.cmakeFeature "Launcher_QT_VERSION_MAJOR" "5")
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      # we wrap our binary manually
+      (lib.cmakeFeature "INSTALL_BUNDLE" "nodeps")
+      # disable built-in updater
+      (lib.cmakeFeature "MACOSX_SPARKLE_UPDATE_FEED_URL" "''")
+      (lib.cmakeFeature "CMAKE_INSTALL_PREFIX" "${placeholder "out"}/Applications/")
+    ];
+
+  dontWrapQtApps = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Free, open source launcher for Minecraft";
+    longDescription = ''
+      Allows you to have multiple, separate instances of Minecraft (each with
+      their own mods, texture packs, saves, etc) and helps you manage them and
+      their associated options with a simple interface.
+    '';
+    homepage = "https://prismlauncher.org/";
+    changelog = "https://github.com/PrismLauncher/PrismLauncher/releases/tag/${finalAttrs.src.rev}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      minion3665
+      Scrumplex
+      getchoo
+    ];
+    mainProgram = "prismlauncher";
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/pr/prismlauncher/package.nix b/pkgs/by-name/pr/prismlauncher/package.nix
new file mode 100644
index 0000000000000..c6ff6894389d5
--- /dev/null
+++ b/pkgs/by-name/pr/prismlauncher/package.nix
@@ -0,0 +1,151 @@
+{
+  lib,
+  stdenv,
+  symlinkJoin,
+  prismlauncher-unwrapped,
+  addOpenGLRunpath,
+  flite,
+  gamemode,
+  glfw,
+  glfw-wayland-minecraft,
+  glxinfo,
+  jdk8,
+  jdk17,
+  jdk21,
+  kdePackages,
+  libGL,
+  libpulseaudio,
+  libusb1,
+  makeWrapper,
+  openal,
+  pciutils,
+  udev,
+  vulkan-loader,
+  xorg,
+
+  additionalLibs ? [ ],
+  additionalPrograms ? [ ],
+  controllerSupport ? stdenv.isLinux,
+  gamemodeSupport ? stdenv.isLinux,
+  jdks ? [
+    jdk21
+    jdk17
+    jdk8
+  ],
+  msaClientID ? null,
+  textToSpeechSupport ? stdenv.isLinux,
+
+  # Adds `glfw-wayland-minecraft` to `LD_LIBRARY_PATH`
+  # when launched on wayland, allowing for the game to be run natively.
+  # Make sure to enable "Use system installation of GLFW" in instance settings
+  # for this to take effect
+  #
+  # Warning: This build of glfw may be unstable, and the launcher
+  # itself can take slightly longer to start
+  withWaylandGLFW ? false,
+}:
+
+assert lib.assertMsg (
+  controllerSupport -> stdenv.isLinux
+) "controllerSupport only has an effect on Linux.";
+
+assert lib.assertMsg (
+  textToSpeechSupport -> stdenv.isLinux
+) "textToSpeechSupport only has an effect on Linux.";
+
+assert lib.assertMsg (
+  withWaylandGLFW -> stdenv.isLinux
+) "withWaylandGLFW is only available on Linux.";
+
+let
+  prismlauncher' = prismlauncher-unwrapped.override { inherit msaClientID gamemodeSupport; };
+in
+
+symlinkJoin {
+  name = "prismlauncher-${prismlauncher'.version}";
+
+  paths = [ prismlauncher' ];
+
+  nativeBuildInputs =
+    [ kdePackages.wrapQtAppsHook ]
+    # purposefully using a shell wrapper here for variable expansion
+    # see https://github.com/NixOS/nixpkgs/issues/172583
+    ++ lib.optional withWaylandGLFW makeWrapper;
+
+  buildInputs =
+    [
+      kdePackages.qtbase
+      kdePackages.qtsvg
+    ]
+    ++ lib.optional (
+      lib.versionAtLeast kdePackages.qtbase.version "6" && stdenv.isLinux
+    ) kdePackages.qtwayland;
+
+  env = {
+    waylandPreExec = lib.optionalString withWaylandGLFW ''
+      if [ -n "$WAYLAND_DISPLAY" ]; then
+        export LD_LIBRARY_PATH=${lib.getLib glfw-wayland-minecraft}/lib:"$LD_LIBRARY_PATH"
+      fi
+    '';
+  };
+
+  postBuild =
+    lib.optionalString withWaylandGLFW ''
+      qtWrapperArgs+=(--run "$waylandPreExec")
+    ''
+    + ''
+      wrapQtAppsHook
+    '';
+
+  qtWrapperArgs =
+    let
+      runtimeLibs =
+        [
+          # lwjgl
+          glfw
+          libpulseaudio
+          libGL
+          openal
+          stdenv.cc.cc.lib
+
+          vulkan-loader # VulkanMod's lwjgl
+
+          udev # oshi
+
+          xorg.libX11
+          xorg.libXext
+          xorg.libXcursor
+          xorg.libXrandr
+          xorg.libXxf86vm
+        ]
+        ++ lib.optional textToSpeechSupport flite
+        ++ lib.optional gamemodeSupport gamemode.lib
+        ++ lib.optional controllerSupport libusb1
+        ++ additionalLibs;
+
+      runtimePrograms = [
+        glxinfo
+        pciutils # need lspci
+        xorg.xrandr # needed for LWJGL [2.9.2, 3) https://github.com/LWJGL/lwjgl/issues/128
+      ] ++ additionalPrograms;
+
+    in
+    [ "--prefix PRISMLAUNCHER_JAVA_PATHS : ${lib.makeSearchPath "bin/java" jdks}" ]
+    ++ lib.optionals stdenv.isLinux [
+      "--set LD_LIBRARY_PATH ${addOpenGLRunpath.driverLink}/lib:${lib.makeLibraryPath runtimeLibs}"
+      "--prefix PATH : ${lib.makeBinPath runtimePrograms}"
+    ];
+
+  meta = {
+    inherit (prismlauncher'.meta)
+      description
+      longDescription
+      homepage
+      changelog
+      license
+      maintainers
+      mainProgram
+      platforms
+      ;
+  };
+}
diff --git a/pkgs/by-name/pr/proton-pass/package.nix b/pkgs/by-name/pr/proton-pass/package.nix
index 960eb6c64a934..1d22e7a5d5ba8 100644
--- a/pkgs/by-name/pr/proton-pass/package.nix
+++ b/pkgs/by-name/pr/proton-pass/package.nix
@@ -8,11 +8,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-pass";
-  version = "1.17.5";
+  version = "1.18.0";
 
   src = fetchurl {
     url = "https://proton.me/download/PassDesktop/linux/x64/ProtonPass_${finalAttrs.version}.deb";
-    hash = "sha256-2dnR/4LpLiQlJebv74/F7L/a5lYPh+AMPqQVIBHvxcg=";
+    hash = "sha256-dP6mXa5KOK35T3LCL/51/wi/dScqNj6bNYFOl4lCbcY=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/pr/protonmail-desktop/package.nix b/pkgs/by-name/pr/protonmail-desktop/package.nix
index 8d65ba26b294b..3a500fe0c7698 100644
--- a/pkgs/by-name/pr/protonmail-desktop/package.nix
+++ b/pkgs/by-name/pr/protonmail-desktop/package.nix
@@ -1,36 +1,63 @@
-{ lib
-, stdenv
-, fetchurl
-, makeWrapper
-, dpkg
-, electron
+{
+  lib,
+  stdenv,
+  fetchurl,
+  makeWrapper,
+  dpkg,
+  electron,
+  unzip,
 }:
 
 let
   mainProgram = "proton-mail";
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
   pname = "protonmail-desktop";
-  version = "1.0.3";
+  version = "1.0.4";
 
-  src = fetchurl {
-    url = "https://github.com/ProtonMail/inbox-desktop/releases/download/v${version}/proton-mail_${version}_amd64.deb";
-    hash = "sha256-opavVpXQmA/VDZ+K/k0NJFwQHUUJhg+bUm/w8Ertopw=";
-  };
+  src =
+    {
+      "x86_64-linux" = fetchurl {
+        url = "https://github.com/ProtonMail/inbox-desktop/releases/download/v${version}/proton-mail_${version}_amd64.deb";
+        hash = "sha256-KY/rjiJozOQW27FYljy5N1VKuKroJz3V485DPaH01JY=";
+      };
+      "x86_64-darwin" = fetchurl {
+        url = "https://github.com/ProtonMail/inbox-desktop/releases/download/v${version}/Proton.Mail-darwin-x64-${version}.zip";
+        hash = "sha256-I5Yj1JR3DaAmC6WKI4X/d/q9rvmsck9SE3Mx3AY6yvU=";
+      };
+      "aarch64-darwin" = fetchurl {
+        url = "https://github.com/ProtonMail/inbox-desktop/releases/download/v${version}/Proton.Mail-darwin-arm64-${version}.zip";
+        hash = "sha256-j1F8hhLSq/C1WQXGrYnvFK8nNz4qwoA1ohNzPsS3tiY=";
+      };
+    }
+    .${stdenv.hostPlatform.system};
+
+  sourceRoot = lib.optionalString stdenv.isDarwin ".";
 
   dontConfigure = true;
   dontBuild = true;
 
-  nativeBuildInputs = [ dpkg makeWrapper ];
+  nativeBuildInputs = [
+    makeWrapper
+  ] ++ lib.optional stdenv.isLinux dpkg ++ lib.optional stdenv.isDarwin unzip;
 
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out
-    cp -r usr/share/ $out/
-    cp -r usr/lib/proton-mail/resources/app.asar $out/share/
-    runHook postInstall
-  '';
+  installPhase =
+    lib.optionalString stdenv.isLinux ''
+      runHook preInstall
+      mkdir -p $out
+      cp -r usr/share/ $out/
+      cp -r usr/lib/proton-mail/resources/app.asar $out/share/
+      runHook postInstall
+    ''
+    + lib.optionalString stdenv.isDarwin ''
+      runHook preInstall
+      mkdir -p $out/{Applications,bin}
+      cp -r "Proton Mail.app" $out/Applications/
+      makeWrapper $out/Applications/"Proton Mail.app"/Contents/MacOS/Proton\ Mail $out/bin/protonmail-desktop
+      runHook postInstall
+    '';
 
-  preFixup = ''
+  preFixup = lib.optionalString stdenv.isLinux ''
     makeWrapper ${lib.getExe electron} $out/bin/${mainProgram} \
       --add-flags $out/share/app.asar \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
@@ -43,10 +70,13 @@ in stdenv.mkDerivation rec {
     description = "Desktop application for Mail and Calendar, made with Electron";
     homepage = "https://github.com/ProtonMail/inbox-desktop";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ rsniezek sebtm ];
-    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [
+      rsniezek
+      sebtm
+      matteopacini
+    ];
+    platforms = [ "x86_64-linux" ] ++ platforms.darwin;
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     inherit mainProgram;
   };
 }
-
diff --git a/pkgs/by-name/re/release-plz/package.nix b/pkgs/by-name/re/release-plz/package.nix
index 966a989d2b136..49c4703aabd7e 100644
--- a/pkgs/by-name/re/release-plz/package.nix
+++ b/pkgs/by-name/re/release-plz/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "release-plz";
-  version = "0.3.73";
+  version = "0.3.74";
 
   src = fetchFromGitHub {
     owner = "MarcoIeni";
     repo = "release-plz";
     rev = "release-plz-v${version}";
-    hash = "sha256-QRKXg/6hiF7P3yQ6wFZ5JG2aRaGX7rQU0DB2L97LKsg=";
+    hash = "sha256-6Cj23OlIVWnuJC4jpmd7o5L4pUSUkTycZbpu8CzSVM0=";
   };
 
-  cargoHash = "sha256-aDm4hWosaeAI21iw2Uo315u01kjXCK+LaBwt9jlwgYw=";
+  cargoHash = "sha256-YAijOHu59BWIsS5cYFYbG4zGG0l+x9cqHfEGu3oL5l0=";
 
   nativeBuildInputs = [ installShellFiles pkg-config perl ];
   buildInputs = [ openssl ];
diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index 6fb753a1cbadd..6b8d276895f5b 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -5,11 +5,11 @@
 
 renode.overrideAttrs (finalAttrs: _: {
   pname = "renode-unstable";
-  version = "1.15.1+20240615gitdd55f8ea4";
+  version = "1.15.1+20240623git05720ced1";
 
   src = fetchurl {
     url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-portable.tar.gz";
-    hash = "sha256-CxV92sGxRlITi0jhi/O0J/FwLGyJVS7niIzlO3s3pis=";
+    hash = "sha256-xqAkOBdG1tC7uFDxxG6DzQMs9NqG2QtBXACzEGN44u8=";
   };
 
   passthru.updateScript =
diff --git a/pkgs/by-name/se/sendme/package.nix b/pkgs/by-name/se/sendme/package.nix
index 7cda586708382..be13eff9da5fe 100644
--- a/pkgs/by-name/se/sendme/package.nix
+++ b/pkgs/by-name/se/sendme/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sendme";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "n0-computer";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-9ea0HZErwZ1PZwl1jlC3vafm/QnfhFRLYoFIOhxfY/g=";
+    hash = "sha256-hqhUtMZ3x4zePEjglHgQbzyqxijZX4q45Q4nsPwSeWc=";
   };
 
-  cargoHash = "sha256-4SAvx1G5hBi0il7zmlXFSBAxzqLE7Vezo1ZuVccqhms=";
+  cargoHash = "sha256-Pux0Cqw9ZUrP98ydw7sI0vPZ7w7bcWKTM2FpDv3uzAQ=";
 
   buildInputs = lib.optionals stdenv.isDarwin (
     with darwin.apple_sdk.frameworks; [
diff --git a/pkgs/by-name/sp/sploitscan/package.nix b/pkgs/by-name/sp/sploitscan/package.nix
index 85477ba19b6d2..183832f099120 100644
--- a/pkgs/by-name/sp/sploitscan/package.nix
+++ b/pkgs/by-name/sp/sploitscan/package.nix
@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sploitscan";
-  version = "0.9.1";
+  version = "0.10.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xaitax";
     repo = "SploitScan";
     rev = "refs/tags/v${version}";
-    hash = "sha256-l2nLqQoM5TuOezobipBV+s/nXTw37xhop/xpipLL1Bs=";
+    hash = "sha256-UsCGmOjrfk5qsSsnWHEbS3boiC2RFb0Za++yBcCfdJY=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/tp/tpnote/package.nix b/pkgs/by-name/tp/tpnote/package.nix
index 1f3410a9e14a6..10e0aca8a0ac2 100644
--- a/pkgs/by-name/tp/tpnote/package.nix
+++ b/pkgs/by-name/tp/tpnote/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tpnote";
-  version = "1.24.2";
+  version = "1.24.4";
 
   src = fetchFromGitHub {
     owner = "getreu";
     repo = "tp-note";
     rev = "v${version}";
-    hash = "sha256-uNW1gb4zmLjOZFtxaBBEQGRGc9C2M8cSARZBa3+FC2k=";
+    hash = "sha256-otV00Lq3xen2kf90EonTbI4SPUob9M+el+5VaHeDPCw=";
   };
 
-  cargoHash = "sha256-pOiIQU/5z/g4NbdwoYaDdxTfTkxEdddVsmuH54pCOBM=";
+  cargoHash = "sha256-zkq1yho9K4WUyGbf8zsb5abP4jJPv1+RZi2kAlp9BCU=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/un/unciv/package.nix b/pkgs/by-name/un/unciv/package.nix
index 2f41aa57ecbac..4944fbb654168 100644
--- a/pkgs/by-name/un/unciv/package.nix
+++ b/pkgs/by-name/un/unciv/package.nix
@@ -33,11 +33,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "unciv";
-  version = "4.11.16";
+  version = "4.11.17";
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-hvWXqPT+GeMaBa7so0S1KjsH5fpnbcbEIWsq6KUbFTk=";
+    hash = "sha256-qKLRn9QmB8lZv8vGGX8JS72IRLEDJV5Zj1MVsPr+iSI=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/vc/vcpkg/package.nix b/pkgs/by-name/vc/vcpkg/package.nix
index 4a4aa3f3a11e4..ed2df2e36f767 100644
--- a/pkgs/by-name/vc/vcpkg/package.nix
+++ b/pkgs/by-name/vc/vcpkg/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "vcpkg";
-  version = "2024.05.24";
+  version = "2024.06.15";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vcpkg";
     rev = finalAttrs.version;
-    hash = "sha256-R9iQIEmraXOzPi6rOd7wVV9BMC/wDDEveLIRJmAVISI=";
+    hash = "sha256-eDpMGDtC44eh0elLWV0r1H/WbpVdZ5qMedKh7Ct50Cs=";
   };
 
   installPhase = let
diff --git a/pkgs/by-name/wa/wayidle/package.nix b/pkgs/by-name/wa/wayidle/package.nix
index e563137c1dffc..693459de045bc 100644
--- a/pkgs/by-name/wa/wayidle/package.nix
+++ b/pkgs/by-name/wa/wayidle/package.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wayidle";
-  version = "0.1.1";
+  version = "0.2.0";
 
   src = fetchFromSourcehut {
     owner = "~whynothugo";
     repo = "wayidle";
     rev = "v${version}";
-    hash = "sha256-6wULrwGnXLdrX/THanJThbykKjNKpGukw9dj0jX0/dM=";
+    hash = "sha256-7hFk/YGOQ5+gQy6pT5DRgMLThQ1vFAvUvdHekTyzIRU=";
   };
 
-  cargoHash = "sha256-zF2s3XSXnN7jVtv/0axzHiIJd/cb6wMYAOQILXp1U5U=";
+  cargoHash = "sha256-PohfLmUoK+2a7Glnje4Rbym2rvzydUJAYW+edOj7qeo=";
 
   meta = with lib; {
     description = "Execute a program when a Wayland compositor reports being N seconds idle";
diff --git a/pkgs/by-name/wi/wideriver/package.nix b/pkgs/by-name/wi/wideriver/package.nix
index cfe33006ee0ee..7608260856c8a 100644
--- a/pkgs/by-name/wi/wideriver/package.nix
+++ b/pkgs/by-name/wi/wideriver/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wideriver";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "alex-courtis";
     repo = "wideriver";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-Jn3DfflDlMSZMlSRBfzQeEUKgYLctd/PiQRWH8uwtlU=";
+    hash = "sha256-D1JHfMnq6u057FrBqgZ4UlfeOlkTWKkKzFYM29+vIJo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/xi/xivlauncher/deps.nix b/pkgs/by-name/xi/xivlauncher/deps.nix
index fa65ff3a7d1f3..4f8e95ba382f0 100644
--- a/pkgs/by-name/xi/xivlauncher/deps.nix
+++ b/pkgs/by-name/xi/xivlauncher/deps.nix
@@ -10,6 +10,8 @@
   (fetchNuGet { pname = "goaaats.Steamworks"; version = "2.3.4"; sha256 = "1khxkkjvh6af60rxc13bacxn85amdfzr8z0b9a6gfg6m1fnmlkss"; })
   (fetchNuGet { pname = "ImGui.NET"; version = "1.87.2"; sha256 = "0rv0n18fvz1gbh45crhzn1f8xw8zkc8qyiyj91vajjcry8mq1x7q"; })
   (fetchNuGet { pname = "KeySharp"; version = "1.0.5"; sha256 = "1ic10v0a174fw6w89iyg4yzji36bsj15573y676cj5n09n6s75d4"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Ref"; version = "6.0.31"; sha256 = "0hki4z9x60vzcg53s8cxnig4g1xnpqcj629r2cg5q1xw0sknfp5d"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.31"; sha256 = "050dzfy49c4jwcm8dfrz2lqbbyhmgnq485zdhpcnc3w08z0ppbs6"; })
   (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; sha256 = "15gqy2m14fdlvy1g59207h5kisznm355kbw010gy19vh47z8gpz3"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.3.3"; sha256 = "09m4cpry8ivm9ga1abrxmvw16sslxhy2k5sl14zckhqb1j164im6"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.BannedApiAnalyzers"; version = "3.3.3"; sha256 = "1z6x0d8lpcfjr3sxy25493i17vvcg5bsay6c03qan6mnj5aqzw2k"; })
@@ -20,6 +22,9 @@
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.0.1"; sha256 = "0zxc0apx1gcx361jlq8smc9pfdgmyjh6hpka8dypc9w23nlsh6yj"; })
   (fetchNuGet { pname = "Microsoft.DotNet.PlatformAbstractions"; version = "2.0.3"; sha256 = "020214swxm0hip1d9gjskrzmqzjnji7c6l5b3xcch8vp166066m9"; })
   (fetchNuGet { pname = "Microsoft.Extensions.DependencyModel"; version = "2.0.3"; sha256 = "0dpyjp0hy9kkvk2dd4dclfmb10yq5avsw2a6v8nra9g6ii2p1nla"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "6.0.31"; sha256 = "10s0p30qzfn9zibp1ldnqar87hqs47ni3rwqpvwx4jn3589cl9sn"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Ref"; version = "6.0.31"; sha256 = "19a4ainxj8jxij7ckglbmlnvrjxp72xfgx0r6lbglzh9dhsakwm7"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.31"; sha256 = "0pw2n3j6vbmbghda1cvkhi3c39a49xk0a4w059mfya017adl6kac"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; sha256 = "0ppdkwy6s9p7x9jix3v4402wb171cdiibq7js7i13nxpdky7074p"; })
diff --git a/pkgs/by-name/xi/xivlauncher/package.nix b/pkgs/by-name/xi/xivlauncher/package.nix
index cea9a6e32eccd..064bce81d8d9c 100644
--- a/pkgs/by-name/xi/xivlauncher/package.nix
+++ b/pkgs/by-name/xi/xivlauncher/package.nix
@@ -3,7 +3,7 @@
 , useSteamRun ? true }:
 
 let
-  rev = "1.0.8";
+  rev = "1.0.9";
 in
   buildDotnetModule rec {
     pname = "XIVLauncher";
@@ -13,7 +13,7 @@ in
       owner = "goatcorp";
       repo = "XIVLauncher.Core";
       inherit rev;
-      hash = "sha256-x4W5L4k+u0MYKDWJu82QcXARW0zjmqqwGiueR1IevMk=";
+      hash = "sha256-UOKJMQPule0swwm5p6OPcOt1SYHji2J4MWvN6nGkj/M=";
       fetchSubmodules = true;
     };
 
@@ -24,6 +24,10 @@ in
     projectFile = "src/XIVLauncher.Core/XIVLauncher.Core.csproj";
     nugetDeps = ./deps.nix; # File generated with `nix-build -A xivlauncher.passthru.fetch-deps`
 
+    # please do not unpin these even if they match the defaults, xivlauncher is sensitive to .NET versions
+    dotnet-sdk = dotnetCorePackages.sdk_8_0;
+    dotnet-runtime = dotnetCorePackages.runtime_6_0;
+
     dotnetFlags = [
       "-p:BuildHash=${rev}"
       "-p:PublishSingleFile=false"
@@ -31,7 +35,7 @@ in
 
     postPatch = ''
       substituteInPlace lib/FFXIVQuickLauncher/src/XIVLauncher.Common/Game/Patch/Acquisition/Aria/AriaHttpPatchAcquisition.cs \
-        --replace 'ariaPath = "aria2c"' 'ariaPath = "${aria2}/bin/aria2c"'
+        --replace-fail 'ariaPath = "aria2c"' 'ariaPath = "${aria2}/bin/aria2c"'
     '';
 
     postInstall = ''