about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--maintainers/maintainer-list.nix13
-rw-r--r--nixos/modules/services/misc/gitlab.nix18
-rw-r--r--nixos/modules/services/networking/ssh/sshd.nix3
-rw-r--r--nixos/modules/services/networking/tailscale.nix2
-rw-r--r--nixos/modules/system/boot/grow-partition.nix2
-rw-r--r--nixos/modules/system/boot/systemd/initrd.nix4
-rw-r--r--nixos/modules/tasks/filesystems/zfs.nix231
-rw-r--r--pkgs/applications/audio/spotify/linux.nix6
-rw-r--r--pkgs/applications/editors/android-studio/default.nix8
-rw-r--r--pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix6
-rw-r--r--pkgs/applications/misc/zathura/default.nix31
-rw-r--r--pkgs/applications/misc/zathura/wrapper.nix13
-rw-r--r--pkgs/applications/networking/cluster/glooctl/default.nix6
-rw-r--r--pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix6
-rw-r--r--pkgs/applications/networking/ktailctl/default.nix14
-rw-r--r--pkgs/applications/office/calligra/default.nix93
-rw-r--r--pkgs/applications/version-management/git-annex-remote-googledrive/default.nix9
-rw-r--r--pkgs/applications/version-management/git-workspace/default.nix6
-rw-r--r--pkgs/by-name/ch/chess-clock/package.nix7
-rw-r--r--pkgs/by-name/cy/cyme/package.nix6
-rw-r--r--pkgs/by-name/do/dokieli/package.json104
-rw-r--r--pkgs/by-name/do/dokieli/package.nix58
-rw-r--r--pkgs/by-name/fa/fabric-ai/package.nix6
-rw-r--r--pkgs/by-name/fe/fedimint/package.nix6
-rw-r--r--pkgs/by-name/fi/files-cli/package.nix6
-rw-r--r--pkgs/by-name/ga/gamescope/package.nix4
-rw-r--r--pkgs/by-name/ga/gate/package.nix6
-rw-r--r--pkgs/by-name/gr/grafana-alloy/package.nix13
-rw-r--r--pkgs/by-name/hr/hred/package.nix (renamed from pkgs/development/tools/hred/default.nix)6
-rw-r--r--pkgs/by-name/li/lime3ds/package.nix4
-rw-r--r--pkgs/by-name/li/limine/package.nix112
-rw-r--r--pkgs/by-name/mi/minijinja/package.nix6
-rw-r--r--pkgs/by-name/no/nodemon/package.nix4
-rw-r--r--pkgs/by-name/or/orchard/package.nix6
-rw-r--r--pkgs/by-name/pa/pantheon-tweaks/package.nix24
-rw-r--r--pkgs/by-name/ph/phraze/package.nix6
-rw-r--r--pkgs/by-name/qq/qq/sources.nix12
-rw-r--r--pkgs/by-name/ra/raspberrypi-eeprom/package.nix4
-rw-r--r--pkgs/by-name/re/renode-unstable/package.nix4
-rw-r--r--pkgs/by-name/sa/sasquatch-v4be/package.nix3
-rw-r--r--pkgs/by-name/sa/sasquatch/darwin.patch357
-rw-r--r--pkgs/by-name/sa/sasquatch/package.nix72
-rw-r--r--pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix18
-rw-r--r--pkgs/by-name/ti/tippecanoe/package.nix4
-rw-r--r--pkgs/by-name/to/tor-browser/package.nix6
-rw-r--r--pkgs/by-name/ze/zed-editor/Cargo.lock2
-rw-r--r--pkgs/by-name/ze/zed-editor/package.nix4
-rw-r--r--pkgs/data/icons/numix-icon-theme/default.nix4
-rw-r--r--pkgs/data/misc/v2ray-domain-list-community/default.nix4
-rw-r--r--pkgs/desktops/mate/mate-notification-daemon/default.nix4
-rw-r--r--pkgs/development/python-modules/aiowithings/default.nix31
-rw-r--r--pkgs/development/python-modules/atlassian-python-api/default.nix4
-rw-r--r--pkgs/development/python-modules/cffi/default.nix9
-rw-r--r--pkgs/development/python-modules/dbt-adapters/default.nix4
-rw-r--r--pkgs/development/python-modules/isal/default.nix4
-rw-r--r--pkgs/development/python-modules/mobly/default.nix4
-rw-r--r--pkgs/development/python-modules/publicsuffixlist/default.nix4
-rw-r--r--pkgs/development/python-modules/pulsectl/default.nix4
-rw-r--r--pkgs/development/python-modules/pycaption/default.nix4
-rw-r--r--pkgs/development/python-modules/pypck/default.nix4
-rw-r--r--pkgs/development/python-modules/tencentcloud-sdk-python/default.nix4
-rw-r--r--pkgs/development/python-modules/zlib-ng/default.nix4
-rw-r--r--pkgs/development/tools/build-managers/moon/default.nix6
-rw-r--r--pkgs/development/tools/continuous-integration/buildbot/master.nix4
-rw-r--r--pkgs/development/tools/continuous-integration/buildbot/plugins.nix22
-rw-r--r--pkgs/development/tools/ejson/Gemfile4
-rw-r--r--pkgs/development/tools/ejson/Gemfile.lock54
-rw-r--r--pkgs/development/tools/ejson/default.nix38
-rw-r--r--pkgs/development/tools/ejson/gemset.nix188
-rw-r--r--pkgs/development/tools/language-servers/nixd/default.nix4
-rw-r--r--pkgs/development/tools/sentry-cli/default.nix6
-rw-r--r--pkgs/kde/default.nix1
-rw-r--r--pkgs/kde/misc/calligra/default.nix76
-rw-r--r--pkgs/servers/monitoring/grafana-agent/default.nix6
-rw-r--r--pkgs/tools/filesystems/sasquatch/default.nix76
-rw-r--r--pkgs/tools/inputmethods/keyd/default.nix14
-rw-r--r--pkgs/tools/misc/tmux/default.nix28
-rw-r--r--pkgs/top-level/aliases.nix1
-rw-r--r--pkgs/top-level/all-packages.nix16
79 files changed, 1151 insertions, 826 deletions
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d1690081b374a..9a1c2bba950ed 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1016,6 +1016,12 @@
     githubId = 50754358;
     name = "Alex Winter";
   };
+  alfarel = {
+    email = "alfarelcynthesis@proton.me";
+    github = "alfarelcynthesis";
+    githubId = 104072649;
+    name = "Cynth";
+  };
   algram = {
     email = "aliasgram@gmail.com";
     github = "Algram";
@@ -18703,6 +18709,13 @@
     githubId = 34161949;
     keys = [ { fingerprint = "155C F413 0129 C058 9A5F  5524 3658 73F2 F0C6 153B"; } ];
   };
+  sanana = {
+    email = "asya@waifu.club";
+    github = "AsyaTheAbove";
+    githubId = 40492846;
+    keys = [ { fingerprint = "B766 7717 1644 5ABC DE82  94AA 4679 BF7D CC04 4783"; } ];
+    name = "sanana the skenana";
+  };
   sander = {
     email = "s.vanderburg@tudelft.nl";
     github = "svanderburg";
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 9fd6014f2c71c..ecbc087f739fd 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -1127,6 +1127,11 @@ in {
 
     environment.systemPackages = [ gitlab-rake gitlab-rails cfg.packages.gitlab-shell ];
 
+    systemd.slices.system-gitlab = {
+      description = "GitLab DevOps Platform Slice";
+      documentation = [ "https://docs.gitlab.com/" ];
+    };
+
     systemd.targets.gitlab = {
       description = "Common target for all GitLab services.";
       wantedBy = [ "multi-user.target" ];
@@ -1197,6 +1202,7 @@ in {
       '';
 
       serviceConfig = {
+        Slice = "system-gitlab.slice";
         User = pgsql.superUser;
         Type = "oneshot";
         RemainAfterExit = true;
@@ -1220,6 +1226,9 @@ in {
       unitConfig = {
         ConditionPathExists = "!${cfg.registry.certFile}";
       };
+      serviceConfig = {
+        Slice = "system-gitlab.slice";
+      };
     };
 
     # Ensure Docker Registry launches after the certificate generation job
@@ -1308,6 +1317,7 @@ in {
         TimeoutSec = "infinity";
         Restart = "on-failure";
         WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab";
+        Slice = "system-gitlab.slice";
         RemainAfterExit = true;
 
         ExecStartPre = let
@@ -1424,6 +1434,7 @@ in {
         TimeoutSec = "infinity";
         Restart = "on-failure";
         WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab";
+        Slice = "system-gitlab.slice";
         RemainAfterExit = true;
 
         ExecStart = pkgs.writeShellScript "gitlab-db-config" ''
@@ -1480,6 +1491,7 @@ in {
         TimeoutSec = "infinity";
         Restart = "always";
         WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab";
+        Slice = "system-gitlab.slice";
         ExecStart = utils.escapeSystemdExecArgs (
           [
             "${cfg.packages.gitlab}/share/gitlab/bin/sidekiq-cluster"
@@ -1512,6 +1524,7 @@ in {
         Restart = "on-failure";
         WorkingDirectory = gitlabEnv.HOME;
         RuntimeDirectory = "gitaly";
+        Slice = "system-gitlab.slice";
         ExecStart = "${cfg.packages.gitaly}/bin/gitaly ${gitalyToml}";
       };
     };
@@ -1573,6 +1586,7 @@ in {
             WorkingDirectory = gitlabEnv.HOME;
             RuntimeDirectory = "gitlab-pages";
             RuntimeDirectoryMode = "0700";
+            Slice = "system-gitlab.slice";
           };
         };
 
@@ -1596,6 +1610,7 @@ in {
         TimeoutSec = "infinity";
         Restart = "on-failure";
         WorkingDirectory = gitlabEnv.HOME;
+        Slice = "system-gitlab.slice";
         ExecStartPre = pkgs.writeShellScript "gitlab-workhorse-pre-start" ''
           set -o errexit -o pipefail -o nounset
           shopt -s dotglob nullglob inherit_errexit
@@ -1637,6 +1652,7 @@ in {
         Group = cfg.group;
         ExecStart = "${cfg.packages.gitlab.rubyEnv}/bin/bundle exec mail_room -c ${cfg.statePath}/config/mail_room.yml";
         WorkingDirectory = gitlabEnv.HOME;
+        Slice = "system-gitlab.slice";
       };
     };
 
@@ -1671,6 +1687,7 @@ in {
         TimeoutSec = "infinity";
         Restart = "on-failure";
         WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab";
+        Slice = "system-gitlab.slice";
         ExecStart = concatStringsSep " " [
           "${cfg.packages.gitlab.rubyEnv}/bin/bundle" "exec" "puma"
           "-e production"
@@ -1695,6 +1712,7 @@ in {
       serviceConfig = {
         User = cfg.user;
         Group = cfg.group;
+        Slice = "system-gitlab.slice";
         ExecStart = "${gitlab-rake}/bin/gitlab-rake gitlab:backup:create";
       };
     };
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index 0d127a6544c05..26ca39f73d390 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -585,7 +585,8 @@ in
                       if ! [ -h "${k.path}" ]; then
                           rm -f "${k.path}"
                       fi
-                      mkdir -m 0755 -p "$(dirname '${k.path}')"
+                      mkdir -p "$(dirname '${k.path}')"
+                      chmod 0755 "$(dirname '${k.path}')"
                       ssh-keygen \
                         -t "${k.type}" \
                         ${lib.optionalString (k ? bits) "-b ${toString k.bits}"} \
diff --git a/nixos/modules/services/networking/tailscale.nix b/nixos/modules/services/networking/tailscale.nix
index 6804165cd8c26..859da5be81dd8 100644
--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@@ -115,8 +115,10 @@ in {
     environment.systemPackages = [ cfg.package ]; # for the CLI
     systemd.packages = [ cfg.package ];
     systemd.services.tailscaled = {
+      after = lib.mkIf (config.networking.networkmanager.enable) [ "NetworkManager-wait-online.service" ];
       wantedBy = [ "multi-user.target" ];
       path = [
+        (builtins.dirOf config.security.wrapperDir) # for `su` to use taildrive with correct access rights
         pkgs.procps     # for collecting running services (opt-in feature)
         pkgs.getent     # for `getent` to look up user shells
         pkgs.kmod       # required to pass tailscale's v6nat check
diff --git a/nixos/modules/system/boot/grow-partition.nix b/nixos/modules/system/boot/grow-partition.nix
index 4f8a2273a7ace..1910ff52eac8f 100644
--- a/nixos/modules/system/boot/grow-partition.nix
+++ b/nixos/modules/system/boot/grow-partition.nix
@@ -43,7 +43,7 @@ with lib;
         while [ "''${parentDevice%[0-9]}" != "''${parentDevice}" ]; do
           parentDevice="''${parentDevice%[0-9]}";
         done
-        partNum="''${rootDevice#''${parentDevice}}"
+        partNum="''${rootDevice#"''${parentDevice}"}"
         if [ "''${parentDevice%[0-9]p}" != "''${parentDevice}" ] && [ -b "''${parentDevice%p}" ]; then
           parentDevice="''${parentDevice%p}"
         fi
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index 6cf358a4d4d6a..fc2e5ddab1595 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -523,7 +523,7 @@ in {
           for o in $(< /proc/cmdline); do
               case $o in
                   init=*)
-                      IFS== read -r -a initParam <<< "$o"
+                      IFS="=" read -r -a initParam <<< "$o"
                       closure="''${initParam[1]}"
                       ;;
               esac
@@ -559,7 +559,7 @@ in {
 
           # Initialize the system
           export IN_NIXOS_SYSTEMD_STAGE1=true
-          exec chroot /sysroot $closure/prepare-root
+          exec chroot /sysroot "$closure/prepare-root"
         '';
       };
 
diff --git a/nixos/modules/tasks/filesystems/zfs.nix b/nixos/modules/tasks/filesystems/zfs.nix
index 1bcfd6ccba934..03b67438d7b62 100644
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@@ -1,14 +1,10 @@
-{ config, lib, options, pkgs, utils, ... }:
+{ config, lib, pkgs, utils, ... }:
 #
 # TODO: zfs tunables
 
-with utils;
-with lib;
-
 let
 
   cfgZfs = config.boot.zfs;
-  optZfs = options.boot.zfs;
   cfgExpandOnBoot = config.services.zfs.expandOnBoot;
   cfgSnapshots = config.services.zfs.autoSnapshot;
   cfgSnapFlags = cfgSnapshots.flags;
@@ -17,7 +13,7 @@ let
   cfgZED = config.services.zfs.zed;
 
   selectModulePackage = package: config.boot.kernelPackages.${package.kernelModuleAttribute};
-  clevisDatasets = attrNames (filterAttrs (device: _: any (e: e.fsType == "zfs" && (fsNeededForBoot e) && (e.device == device || hasPrefix "${device}/" e.device)) config.system.build.fileSystems) config.boot.initrd.clevis.devices);
+  clevisDatasets = lib.attrNames (lib.filterAttrs (device: _: lib.any (e: e.fsType == "zfs" && (utils.fsNeededForBoot e) && (e.device == device || lib.hasPrefix "${device}/" e.device)) config.system.build.fileSystems) config.boot.initrd.clevis.devices);
 
   inInitrd = config.boot.initrd.supportedFilesystems.zfs or false;
   inSystem = config.boot.supportedFilesystems.zfs or false;
@@ -28,17 +24,17 @@ let
 
   zfsAutoSnap = "${autosnapPkg}/bin/zfs-auto-snapshot";
 
-  datasetToPool = x: elemAt (splitString "/" x) 0;
+  datasetToPool = x: lib.elemAt (lib.splitString "/" x) 0;
 
   fsToPool = fs: datasetToPool fs.device;
 
-  zfsFilesystems = filter (x: x.fsType == "zfs") config.system.build.fileSystems;
+  zfsFilesystems = lib.filter (x: x.fsType == "zfs") config.system.build.fileSystems;
 
-  allPools = unique ((map fsToPool zfsFilesystems) ++ cfgZfs.extraPools);
+  allPools = lib.unique ((map fsToPool zfsFilesystems) ++ cfgZfs.extraPools);
 
-  rootPools = unique (map fsToPool (filter fsNeededForBoot zfsFilesystems));
+  rootPools = lib.unique (map fsToPool (lib.filter utils.fsNeededForBoot zfsFilesystems));
 
-  dataPools = unique (filter (pool: !(elem pool rootPools)) allPools);
+  dataPools = lib.unique (lib.filter (pool: !(lib.elem pool rootPools)) allPools);
 
   snapshotNames = [ "frequent" "hourly" "daily" "weekly" "monthly" ];
 
@@ -89,7 +85,7 @@ let
   '';
 
   getPoolFilesystems = pool:
-    filter (x: x.fsType == "zfs" && (fsToPool x) == pool) config.system.build.fileSystems;
+    lib.filter (x: x.fsType == "zfs" && (fsToPool x) == pool) config.system.build.fileSystems;
 
   getPoolMounts = prefix: pool:
     let
@@ -98,36 +94,36 @@ let
       # Remove the "/" suffix because even though most mountpoints
       # won't have it, the "/" mountpoint will, and we can't have the
       # trailing slash in "/sysroot/" in stage 1.
-      mountPoint = fs: escapeSystemdPath (prefix + (lib.removeSuffix "/" fs.mountPoint));
+      mountPoint = fs: utils.escapeSystemdPath (prefix + (lib.removeSuffix "/" fs.mountPoint));
 
       hasUsr = lib.any (fs: fs.mountPoint == "/usr") poolFSes;
     in
       map (x: "${mountPoint x}.mount") poolFSes
       ++ lib.optional hasUsr "sysusr-usr.mount";
 
-  getKeyLocations = pool: if isBool cfgZfs.requestEncryptionCredentials then {
+  getKeyLocations = pool: if lib.isBool cfgZfs.requestEncryptionCredentials then {
     hasKeys = cfgZfs.requestEncryptionCredentials;
     command = "${cfgZfs.package}/sbin/zfs list -rHo name,keylocation,keystatus -t volume,filesystem ${pool}";
   } else let
-    keys = filter (x: datasetToPool x == pool) cfgZfs.requestEncryptionCredentials;
+    keys = lib.filter (x: datasetToPool x == pool) cfgZfs.requestEncryptionCredentials;
   in {
     hasKeys = keys != [];
     command = "${cfgZfs.package}/sbin/zfs list -Ho name,keylocation,keystatus -t volume,filesystem ${toString keys}";
   };
 
   createImportService = { pool, systemd, force, prefix ? "" }:
-    nameValuePair "zfs-import-${pool}" {
+    lib.nameValuePair "zfs-import-${pool}" {
       description = "Import ZFS pool \"${pool}\"";
       # We wait for systemd-udev-settle to ensure devices are available,
       # but don't *require* it, because mounts shouldn't be killed if it's stopped.
       # In the future, hopefully someone will complete this:
       # https://github.com/zfsonlinux/zfs/pull/4943
-      wants = [ "systemd-udev-settle.service" ] ++ optional (config.boot.initrd.clevis.useTang) "network-online.target";
+      wants = [ "systemd-udev-settle.service" ] ++ lib.optional (config.boot.initrd.clevis.useTang) "network-online.target";
       after = [
         "systemd-udev-settle.service"
         "systemd-modules-load.service"
         "systemd-ask-password-console.service"
-      ] ++ optional (config.boot.initrd.clevis.useTang) "network-online.target";
+      ] ++ lib.optional (config.boot.initrd.clevis.useTang) "network-online.target";
       requiredBy = getPoolMounts prefix pool ++ [ "zfs-import.target" ];
       before = getPoolMounts prefix pool ++ [ "shutdown.target" "zfs-import.target" ];
       conflicts = [ "shutdown.target" ];
@@ -138,7 +134,7 @@ let
         Type = "oneshot";
         RemainAfterExit = true;
       };
-      environment.ZFS_FORCE = optionalString force "-f";
+      environment.ZFS_FORCE = lib.optionalString force "-f";
       script = let
         keyLocations = getKeyLocations pool;
       in (importLib {
@@ -157,10 +153,10 @@ let
           poolImported "${pool}" || poolImport "${pool}"  # Try one last time, e.g. to import a degraded pool.
         fi
         if poolImported "${pool}"; then
-        ${optionalString config.boot.initrd.clevis.enable (concatMapStringsSep "\n" (elem: "clevis decrypt < /etc/clevis/${elem}.jwe | zfs load-key ${elem} || true ") (filter (p: (elemAt (splitString "/" p) 0) == pool) clevisDatasets))}
+        ${lib.optionalString config.boot.initrd.clevis.enable (lib.concatMapStringsSep "\n" (elem: "clevis decrypt < /etc/clevis/${elem}.jwe | zfs load-key ${elem} || true ") (lib.filter (p: (lib.elemAt (lib.splitString "/" p) 0) == pool) clevisDatasets))}
 
 
-          ${optionalString keyLocations.hasKeys ''
+          ${lib.optionalString keyLocations.hasKeys ''
             ${keyLocations.command} | while IFS=$'\t' read ds kl ks; do
               {
               if [[ "$ks" != unavailable ]]; then
@@ -193,15 +189,15 @@ let
       '';
     };
 
-  zedConf = generators.toKeyValue {
-    mkKeyValue = generators.mkKeyValueDefault {
+  zedConf = lib.generators.toKeyValue {
+    mkKeyValue = lib.generators.mkKeyValueDefault {
       mkValueString = v:
-        if isInt           v then toString v
-        else if isString   v then "\"${v}\""
+        if lib.isInt           v then toString v
+        else if lib.isString   v then "\"${v}\""
         else if true  ==   v then "1"
         else if false ==   v then "0"
-        else if isList     v then "\"" + (concatStringsSep " " v) + "\""
-        else err "this value is" (toString v);
+        else if lib.isList     v then "\"" + (lib.concatStringsSep " " v) + "\""
+        else lib.err "this value is" (toString v);
     } "=";
   } cfgZED.settings;
 in
@@ -209,38 +205,38 @@ in
 {
 
   imports = [
-    (mkRemovedOptionModule [ "boot" "zfs" "enableLegacyCrypto" ] "The corresponding package was removed from nixpkgs.")
-    (mkRemovedOptionModule [ "boot" "zfs" "enableUnstable" ] "Instead set `boot.zfs.package = pkgs.zfs_unstable;`")
+    (lib.mkRemovedOptionModule [ "boot" "zfs" "enableLegacyCrypto" ] "The corresponding package was removed from nixpkgs.")
+    (lib.mkRemovedOptionModule [ "boot" "zfs" "enableUnstable" ] "Instead set `boot.zfs.package = pkgs.zfs_unstable;`")
   ];
 
   ###### interface
 
   options = {
     boot.zfs = {
-      package = mkOption {
-        type = types.package;
+      package = lib.mkOption {
+        type = lib.types.package;
         default = pkgs.zfs;
-        defaultText = literalExpression "pkgs.zfs";
+        defaultText = lib.literalExpression "pkgs.zfs";
         description = "Configured ZFS userland tools package, use `pkgs.zfs_unstable` if you want to track the latest staging ZFS branch.";
       };
 
-      modulePackage = mkOption {
+      modulePackage = lib.mkOption {
         internal = true; # It is supposed to be selected automatically, but can be overridden by expert users.
         default = selectModulePackage cfgZfs.package;
-        type = types.package;
+        type = lib.types.package;
         description = "Configured ZFS kernel module package.";
       };
 
-      enabled = mkOption {
+      enabled = lib.mkOption {
         readOnly = true;
-        type = types.bool;
+        type = lib.types.bool;
         default = inInitrd || inSystem;
-        defaultText = literalMD "`true` if ZFS filesystem support is enabled";
+        defaultText = lib.literalMD "`true` if ZFS filesystem support is enabled";
         description = "True if ZFS filesystem support is enabled";
       };
 
-      allowHibernation = mkOption {
-        type = types.bool;
+      allowHibernation = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Allow hibernation support, this may be a unsafe option depending on your
@@ -248,8 +244,8 @@ in
         '';
       };
 
-      extraPools = mkOption {
-        type = types.listOf types.str;
+      extraPools = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [];
         example = [ "tank" "data" ];
         description = ''
@@ -267,8 +263,8 @@ in
         '';
       };
 
-      devNodes = mkOption {
-        type = types.path;
+      devNodes = lib.mkOption {
+        type = lib.types.path;
         default = "/dev/disk/by-id";
         description = ''
           Name of directory from which to import ZFS devices.
@@ -278,8 +274,8 @@ in
         '';
       };
 
-      forceImportRoot = mkOption {
-        type = types.bool;
+      forceImportRoot = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Forcibly import the ZFS root pool(s) during early boot.
@@ -296,8 +292,8 @@ in
         '';
       };
 
-      forceImportAll = mkOption {
-        type = types.bool;
+      forceImportAll = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Forcibly import all ZFS pool(s).
@@ -309,8 +305,8 @@ in
         '';
       };
 
-      requestEncryptionCredentials = mkOption {
-        type = types.either types.bool (types.listOf types.str);
+      requestEncryptionCredentials = lib.mkOption {
+        type = lib.types.either lib.types.bool (lib.types.listOf lib.types.str);
         default = true;
         example = [ "tank" "data" ];
         description = ''
@@ -321,8 +317,8 @@ in
         '';
       };
 
-      passwordTimeout = mkOption {
-        type = types.int;
+      passwordTimeout = lib.mkOption {
+        type = lib.types.int;
         default = 0;
         description = ''
           Timeout in seconds to wait for password entry for decrypt at boot.
@@ -332,7 +328,7 @@ in
       };
 
       removeLinuxDRM = lib.mkOption {
-        type = types.bool;
+        type = lib.types.bool;
         default = false;
         description = ''
           Patch the kernel to change symbols needed by ZFS from
@@ -345,9 +341,9 @@ in
     };
 
     services.zfs.autoSnapshot = {
-      enable = mkOption {
+      enable = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = ''
           Enable the (OpenSolaris-compatible) ZFS auto-snapshotting service.
           Note that you must set the `com.sun:auto-snapshot`
@@ -360,10 +356,10 @@ in
         '';
       };
 
-      flags = mkOption {
+      flags = lib.mkOption {
         default = "-k -p";
         example = "-k -p --utc";
-        type = types.str;
+        type = lib.types.str;
         description = ''
           Flags to pass to the zfs-auto-snapshot command.
 
@@ -379,41 +375,41 @@ in
         '';
       };
 
-      frequent = mkOption {
+      frequent = lib.mkOption {
         default = 4;
-        type = types.int;
+        type = lib.types.int;
         description = ''
           Number of frequent (15-minute) auto-snapshots that you wish to keep.
         '';
       };
 
-      hourly = mkOption {
+      hourly = lib.mkOption {
         default = 24;
-        type = types.int;
+        type = lib.types.int;
         description = ''
           Number of hourly auto-snapshots that you wish to keep.
         '';
       };
 
-      daily = mkOption {
+      daily = lib.mkOption {
         default = 7;
-        type = types.int;
+        type = lib.types.int;
         description = ''
           Number of daily auto-snapshots that you wish to keep.
         '';
       };
 
-      weekly = mkOption {
+      weekly = lib.mkOption {
         default = 4;
-        type = types.int;
+        type = lib.types.int;
         description = ''
           Number of weekly auto-snapshots that you wish to keep.
         '';
       };
 
-      monthly = mkOption {
+      monthly = lib.mkOption {
         default = 12;
-        type = types.int;
+        type = lib.types.int;
         description = ''
           Number of monthly auto-snapshots that you wish to keep.
         '';
@@ -421,16 +417,16 @@ in
     };
 
     services.zfs.trim = {
-      enable = mkOption {
+      enable = lib.mkOption {
         description = "Whether to enable periodic TRIM on all ZFS pools.";
         default = true;
         example = false;
-        type = types.bool;
+        type = lib.types.bool;
       };
 
-      interval = mkOption {
+      interval = lib.mkOption {
         default = "weekly";
-        type = types.str;
+        type = lib.types.str;
         example = "daily";
         description = ''
           How often we run trim. For most desktop and server systems
@@ -441,9 +437,9 @@ in
         '';
       };
 
-      randomizedDelaySec = mkOption {
+      randomizedDelaySec = lib.mkOption {
         default = "6h";
-        type = types.str;
+        type = lib.types.str;
         example = "12h";
         description = ''
           Add a randomized delay before each ZFS trim.
@@ -455,11 +451,11 @@ in
     };
 
     services.zfs.autoScrub = {
-      enable = mkEnableOption "periodic scrubbing of ZFS pools";
+      enable = lib.mkEnableOption "periodic scrubbing of ZFS pools";
 
-      interval = mkOption {
+      interval = lib.mkOption {
         default = "monthly";
-        type = types.str;
+        type = lib.types.str;
         example = "quarterly";
         description = ''
           Systemd calendar expression when to scrub ZFS pools. See
@@ -467,9 +463,9 @@ in
         '';
       };
 
-      randomizedDelaySec = mkOption {
+      randomizedDelaySec = lib.mkOption {
         default = "6h";
-        type = types.str;
+        type = lib.types.str;
         example = "12h";
         description = ''
           Add a randomized delay before each ZFS autoscrub.
@@ -479,9 +475,9 @@ in
         '';
       };
 
-      pools = mkOption {
+      pools = lib.mkOption {
         default = [];
-        type = types.listOf types.str;
+        type = lib.types.listOf lib.types.str;
         example = [ "tank" ];
         description = ''
           List of ZFS pools to periodically scrub. If empty, all pools
@@ -490,8 +486,8 @@ in
       };
     };
 
-    services.zfs.expandOnBoot = mkOption {
-      type = types.either (types.enum [ "disabled" "all" ]) (types.listOf types.str);
+    services.zfs.expandOnBoot = lib.mkOption {
+      type = lib.types.either (lib.types.enum [ "disabled" "all" ]) (lib.types.listOf lib.types.str);
       default = "disabled";
       example = [ "tank" "dozer" ];
       description = ''
@@ -508,10 +504,10 @@ in
     };
 
     services.zfs.zed = {
-      enableMail = mkOption {
-        type = types.bool;
+      enableMail = lib.mkOption {
+        type = lib.types.bool;
         default = config.services.mail.sendmailSetuidWrapper != null;
-        defaultText = literalExpression ''
+        defaultText = lib.literalExpression ''
           config.services.mail.sendmailSetuidWrapper != null
         '';
         description = ''
@@ -519,9 +515,9 @@ in
         '';
       };
 
-      settings = mkOption {
-        type = with types; attrsOf (oneOf [ str int bool (listOf str) ]);
-        example = literalExpression ''
+      settings = lib.mkOption {
+        type = let t = lib.types; in t.attrsOf (t.oneOf [ t.str t.int t.bool (t.listOf t.str) ]);
+        example = lib.literalExpression ''
           {
             ZED_DEBUG_LOG = "/tmp/zed.debug.log";
 
@@ -549,8 +545,8 @@ in
 
   ###### implementation
 
-  config = mkMerge [
-    (mkIf cfgZfs.enabled {
+  config = lib.mkMerge [
+    (lib.mkIf cfgZfs.enabled {
       assertions = [
         {
           assertion = cfgZfs.modulePackage.version == cfgZfs.package.version;
@@ -569,7 +565,7 @@ in
           message = "boot.zfs.allowHibernation while force importing is enabled will cause data corruption";
         }
         {
-          assertion = !(elem "" allPools);
+          assertion = !(lib.elem "" allPools);
           message = ''
             Automatic pool detection found an empty pool name, which can't be used.
             Hint: for `fileSystems` entries with `fsType = zfs`, the `device` attribute
@@ -591,11 +587,10 @@ in
         ];
       };
 
-      boot.initrd = mkIf inInitrd {
-        # spl has been removed in ≥ 2.2.0.
-        kernelModules = [ "zfs" ] ++ lib.optional (lib.versionOlder "2.2.0" version) "spl";
+      boot.initrd = lib.mkIf inInitrd {
+        kernelModules = [ "zfs" ];
         extraUtilsCommands =
-          mkIf (!config.boot.initrd.systemd.enable) ''
+          lib.mkIf (!config.boot.initrd.systemd.enable) ''
             copy_bin_and_libs ${cfgZfs.package}/sbin/zfs
             copy_bin_and_libs ${cfgZfs.package}/sbin/zdb
             copy_bin_and_libs ${cfgZfs.package}/sbin/zpool
@@ -603,12 +598,12 @@ in
             copy_bin_and_libs ${cfgZfs.package}/lib/udev/zvol_id
           '';
         extraUtilsCommandsTest =
-          mkIf (!config.boot.initrd.systemd.enable) ''
+          lib.mkIf (!config.boot.initrd.systemd.enable) ''
             $out/bin/zfs --help >/dev/null 2>&1
             $out/bin/zpool --help >/dev/null 2>&1
           '';
-        postResumeCommands = mkIf (!config.boot.initrd.systemd.enable) (concatStringsSep "\n" ([''
-            ZFS_FORCE="${optionalString cfgZfs.forceImportRoot "-f"}"
+        postResumeCommands = lib.mkIf (!config.boot.initrd.systemd.enable) (lib.concatStringsSep "\n" ([''
+            ZFS_FORCE="${lib.optionalString cfgZfs.forceImportRoot "-f"}"
           ''] ++ [(importLib {
             # See comments at importLib definition.
             zpoolCmd = "zpool";
@@ -630,21 +625,21 @@ in
               poolImported "${pool}" || poolImport "${pool}"  # Try one last time, e.g. to import a degraded pool.
             fi
 
-            ${optionalString config.boot.initrd.clevis.enable (concatMapStringsSep "\n" (elem: "clevis decrypt < /etc/clevis/${elem}.jwe | zfs load-key ${elem}") (filter (p: (elemAt (splitString "/" p) 0) == pool) clevisDatasets))}
+            ${lib.optionalString config.boot.initrd.clevis.enable (lib.concatMapStringsSep "\n" (elem: "clevis decrypt < /etc/clevis/${elem}.jwe | zfs load-key ${elem}") (lib.filter (p: (lib.elemAt (lib.splitString "/" p) 0) == pool) clevisDatasets))}
 
-            ${if isBool cfgZfs.requestEncryptionCredentials
-              then optionalString cfgZfs.requestEncryptionCredentials ''
+            ${if lib.isBool cfgZfs.requestEncryptionCredentials
+              then lib.optionalString cfgZfs.requestEncryptionCredentials ''
                 zfs load-key -a
               ''
-              else concatMapStrings (fs: ''
-                zfs load-key -- ${escapeShellArg fs}
-              '') (filter (x: datasetToPool x == pool) cfgZfs.requestEncryptionCredentials)}
+              else lib.concatMapStrings (fs: ''
+                zfs load-key -- ${lib.escapeShellArg fs}
+              '') (lib.filter (x: datasetToPool x == pool) cfgZfs.requestEncryptionCredentials)}
         '') rootPools)));
 
         # Systemd in stage 1
-        systemd = mkIf config.boot.initrd.systemd.enable {
+        systemd = lib.mkIf config.boot.initrd.systemd.enable {
           packages = [cfgZfs.package];
-          services = listToAttrs (map (pool: createImportService {
+          services = lib.listToAttrs (map (pool: createImportService {
             inherit pool;
             systemd = config.boot.initrd.systemd.package;
             force = cfgZfs.forceImportRoot;
@@ -671,18 +666,18 @@ in
       systemd.shutdownRamfs.storePaths = ["${cfgZfs.package}/bin/zpool"];
 
       # TODO FIXME See https://github.com/NixOS/nixpkgs/pull/99386#issuecomment-798813567. To not break people's bootloader and as probably not everybody would read release notes that thoroughly add inSystem.
-      boot.loader.grub = mkIf (inInitrd || inSystem) {
+      boot.loader.grub = lib.mkIf (inInitrd || inSystem) {
         zfsSupport = true;
         zfsPackage = cfgZfs.package;
       };
 
       services.zfs.zed.settings = {
-        ZED_EMAIL_PROG = mkIf cfgZED.enableMail (mkDefault (
+        ZED_EMAIL_PROG = lib.mkIf cfgZED.enableMail (lib.mkDefault (
           config.security.wrapperDir + "/" +
           config.services.mail.sendmailSetuidWrapper.program
         ));
         # subject in header for sendmail
-        ZED_EMAIL_OPTS = mkIf cfgZED.enableMail (mkDefault "@ADDRESS@");
+        ZED_EMAIL_OPTS = lib.mkIf cfgZED.enableMail (lib.mkDefault "@ADDRESS@");
 
         PATH = lib.makeBinPath [
           cfgZfs.package
@@ -701,7 +696,7 @@ in
         ACTION=="add|change", KERNEL=="sd[a-z]*[0-9]*|mmcblk[0-9]*p[0-9]*|nvme[0-9]*n[0-9]*p[0-9]*", ENV{ID_FS_TYPE}=="zfs_member", ATTR{../queue/scheduler}="none"
       '';
 
-      environment.etc = genAttrs
+      environment.etc = lib.genAttrs
         (map
           (file: "zfs/zed.d/${file}")
           [
@@ -726,7 +721,7 @@ in
 
       system.fsPackages = [ cfgZfs.package ]; # XXX: needed? zfs doesn't have (need) a fsck
       environment.systemPackages = [ cfgZfs.package ]
-        ++ optional cfgSnapshots.enable autosnapPkg; # so the user can run the command to see flags
+        ++ lib.optional cfgSnapshots.enable autosnapPkg; # so the user can run the command to see flags
 
       services.udev.packages = [ cfgZfs.package ]; # to hook zvol naming, etc.
       systemd.packages = [ cfgZfs.package ];
@@ -741,7 +736,7 @@ in
         # This forces a sync of any ZFS pools prior to poweroff, even if they're set
         # to sync=disabled.
         createSyncService = pool:
-          nameValuePair "zfs-sync-${pool}" {
+          lib.nameValuePair "zfs-sync-${pool}" {
             description = "Sync ZFS pool \"${pool}\"";
             wantedBy = [ "shutdown.target" ];
             unitConfig = {
@@ -757,12 +752,12 @@ in
           };
 
         createZfsService = serv:
-          nameValuePair serv {
+          lib.nameValuePair serv {
             after = [ "systemd-modules-load.service" ];
             wantedBy = [ "zfs.target" ];
           };
 
-      in listToAttrs (map createImportService' dataPools ++
+      in lib.listToAttrs (map createImportService' dataPools ++
                       map createSyncService allPools ++
                       map createZfsService [ "zfs-mount" "zfs-share" "zfs-zed" ]);
 
@@ -771,7 +766,7 @@ in
       systemd.targets.zfs.wantedBy = [ "multi-user.target" ];
     })
 
-    (mkIf (cfgZfs.enabled && cfgExpandOnBoot != "disabled") {
+    (lib.mkIf (cfgZfs.enabled && cfgExpandOnBoot != "disabled") {
       systemd.services."zpool-expand@" = {
         description = "Expand ZFS pools";
         after = [ "zfs.target" ];
@@ -824,7 +819,7 @@ in
         };
     })
 
-    (mkIf (cfgZfs.enabled && cfgSnapshots.enable) {
+    (lib.mkIf (cfgZfs.enabled && cfgSnapshots.enable) {
       systemd.services = let
                            descr = name: if name == "frequent" then "15 mins"
                                     else if name == "hourly" then "hour"
@@ -862,7 +857,7 @@ in
                             }) snapshotNames);
     })
 
-    (mkIf (cfgZfs.enabled && cfgScrub.enable) {
+    (lib.mkIf (cfgZfs.enabled && cfgScrub.enable) {
       systemd.services.zfs-scrub = {
         description = "ZFS pools scrubbing";
         after = [ "zfs-import.target" ];
@@ -872,7 +867,7 @@ in
         script = ''
           ${cfgZfs.package}/bin/zpool scrub -w ${
             if cfgScrub.pools != [] then
-              (concatStringsSep " " cfgScrub.pools)
+              (lib.concatStringsSep " " cfgScrub.pools)
             else
               "$(${cfgZfs.package}/bin/zpool list -H -o name)"
             }
@@ -890,7 +885,7 @@ in
       };
     })
 
-    (mkIf (cfgZfs.enabled && cfgTrim.enable) {
+    (lib.mkIf (cfgZfs.enabled && cfgTrim.enable) {
       systemd.services.zpool-trim = {
         description = "ZFS pools trim";
         after = [ "zfs-import.target" ];
diff --git a/pkgs/applications/audio/spotify/linux.nix b/pkgs/applications/audio/spotify/linux.nix
index 1f0ef0760112a..3383e47cb8fe6 100644
--- a/pkgs/applications/audio/spotify/linux.nix
+++ b/pkgs/applications/audio/spotify/linux.nix
@@ -14,14 +14,14 @@ let
   # If an update breaks things, one of those might have valuable info:
   # https://aur.archlinux.org/packages/spotify/
   # https://community.spotify.com/t5/Desktop-Linux
-  version = "1.2.42.290.g242057a2";
+  version = "1.2.45.454.gc16ec9f6";
   # To get the latest stable revision:
   # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
   # To get general information:
   # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
   # More examples of api usage:
   # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "78";
+  rev = "79";
 
   deps = [
     alsa-lib
@@ -88,7 +88,7 @@ stdenv.mkDerivation {
   src = fetchurl {
     name = "spotify-${version}-${rev}.snap";
     url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
-    hash = "sha512-3kT7SA2Q1OxgDa5duivIiHaxcROBAFjDnTx6rw2ya6o5yOVygseS02zBgWg2Qd8jq0721KbYC83u9M+MWtWhhA==";
+    hash = "sha512-F1Npz/oKCsMKaQx2M5dm1dhWhaSlt8422tpRWnwuk2yjwLWrOYDY2uKYph8YFXfOdS3mV6u5yVlzgFdDqAFmCQ==";
   };
 
   nativeBuildInputs = [ wrapGAppsHook3 makeShellWrapper squashfsTools ];
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index a053707f76125..223e3c469bced 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -9,16 +9,16 @@ let
     inherit tiling_wm;
   };
   stableVersion = {
-    version = "2024.1.2.12"; # "Android Studio Koala Feature Drop | 2024.1.2"
-    sha256Hash = "sha256-dFFogg6YmpCF/4QtR85UFAfbCd97irIHcPbqieQabpI=";
+    version = "2024.1.2.13"; # "Android Studio Koala Feature Drop | 2024.1.2 Patch 1"
+    sha256Hash = "sha256-aIxlXCMPKYZ6Eq44LMJuxnBr9/ML1Nl/LxXI+WDLG5s=";
   };
   betaVersion = {
     version = "2024.2.1.7"; # "Android Studio Ladybug | 2024.2.1 Beta 2"
     sha256Hash = "sha256-YNUtRsKwXHfb7McJmTTT39/wW1rHjzw4kFQRwa12kJE=";
   };
   latestVersion = {
-    version = "2024.2.2.2"; # "Android Studio Ladybug Feature Drop | 2024.2.2 Canary 2"
-    sha256Hash = "sha256-TSjKJ4gAqZlycMP1or8MV+Il+KOQJL/F1kUKQr6/rSw=";
+    version = "2024.2.2.4"; # "Android Studio Ladybug Feature Drop | 2024.2.2 Canary 4"
+    sha256Hash = "sha256-Rw+smKU2F11ZpK6lWb3VyLGTKt3qWFoUqnfcs5OXBcU=";
   };
 in {
   # Attributes are named by their corresponding release channels
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
index cf4614caec3a3..e34f1fd725cbb 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix
@@ -29,13 +29,13 @@ let
 in
 melpaBuild {
   pname = "lsp-bridge";
-  version = "0-unstable-2024-09-11";
+  version = "0-unstable-2024-09-27";
 
   src = fetchFromGitHub {
     owner = "manateelazycat";
     repo = "lsp-bridge";
-    rev = "fb64891c2585f9fc0b7f2062cc2b98321aa4e4ca";
-    hash = "sha256-ChpZhFEKvN+1oYHbQKBUMbTjk/U++kCDnImMVtcYVBc=";
+    rev = "f9d540ff451d9a0ee92819b84472820f16be15d5";
+    hash = "sha256-YqUC2Z24ORwIMNZUsAJrAnSaDovccnGMg2OSYY1mYoQ=";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/zathura/default.nix b/pkgs/applications/misc/zathura/default.nix
index dd8c9b143a662..88241856632dc 100644
--- a/pkgs/applications/misc/zathura/default.nix
+++ b/pkgs/applications/misc/zathura/default.nix
@@ -1,14 +1,21 @@
 {
   config,
-  pkgs,
+  lib,
+  stdenv,
+  newScope,
+  gtk3,
   useMupdf ? true,
 }:
 
-let
-  callPackage = pkgs.newScope self;
+lib.makeScope newScope (
+  self:
+  let
+    callPackage = self.callPackage;
+  in
+  {
+    inherit useMupdf;
 
-  self = rec {
-    gtk = pkgs.gtk3;
+    gtk = gtk3;
 
     zathura_core = callPackage ./core { };
 
@@ -22,14 +29,6 @@ let
 
     zathura_cb = callPackage ./cb { };
 
-    zathuraWrapper = callPackage ./wrapper.nix {
-      plugins = [
-        zathura_djvu
-        zathura_ps
-        zathura_cb
-        (if useMupdf then zathura_pdf_mupdf else zathura_pdf_poppler)
-      ];
-    };
-  };
-in
-self
+    zathuraWrapper = callPackage ./wrapper.nix { };
+  }
+)
diff --git a/pkgs/applications/misc/zathura/wrapper.nix b/pkgs/applications/misc/zathura/wrapper.nix
index 5d60c48222123..4290fff26bcf6 100644
--- a/pkgs/applications/misc/zathura/wrapper.nix
+++ b/pkgs/applications/misc/zathura/wrapper.nix
@@ -3,8 +3,19 @@
   lib,
   makeWrapper,
   zathura_core,
+  zathura_djvu,
+  zathura_ps,
+  zathura_cb,
+  zathura_pdf_mupdf,
+  zathura_pdf_poppler,
   file,
-  plugins ? [ ],
+  useMupdf,
+  plugins ? [
+    zathura_djvu
+    zathura_ps
+    zathura_cb
+    (if useMupdf then zathura_pdf_mupdf else zathura_pdf_poppler)
+  ],
 }:
 symlinkJoin {
   name = "zathura-with-plugins-${zathura_core.version}";
diff --git a/pkgs/applications/networking/cluster/glooctl/default.nix b/pkgs/applications/networking/cluster/glooctl/default.nix
index 2cadbd5530389..65009e7d4de68 100644
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.17.8";
+  version = "1.17.10";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-xHAxrAhKrGyH10yOmXRUnR8iI/Bapjx1XKUfklTZKzw=";
+    hash = "sha256-p917jiPvWjLRoH2y81TvILc9WYZ6n1y1UQy8hIO93jM=";
   };
 
-  vendorHash = "sha256-zT6AVDYzDf+8DuPoJxu0RZ4djVIOq9dZDTHcjldE95Y=";
+  vendorHash = "sha256-rAObw4J0ATle1gq5Z1MsrGy/iqQDHjnMPAEIPBgtY3g=";
 
   subPackages = [ "projects/gloo/cli/cmd" ];
 
diff --git a/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix b/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
index 8390d77934585..41c27ed7c19ca 100644
--- a/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix
@@ -8,17 +8,17 @@
 let
 
   pname = "mattermost-desktop";
-  version = "5.8.1";
+  version = "5.9.0";
 
   srcs = {
     "x86_64-linux" = {
       url = "https://releases.mattermost.com/desktop/${version}/${pname}-${version}-linux-x64.tar.gz";
-      hash = "sha256-VuYHF5ALdbsKxBI7w5UhcqKYLV8BHZncWSDeuCy/SW0=";
+      hash = "sha256-zLKdfu5p7TyJOw8vJX7i/uu4j0PrUf2/BDmb1kdqqMc=";
     };
 
     "aarch64-linux" = {
       url = "https://releases.mattermost.com/desktop/${version}/${pname}-${version}-linux-arm64.tar.gz";
-      hash = "sha256-b+sVzMX/NDavshR+WsQyVgYyLkIPSuUlZGqK6/ZjLFs=";
+      hash = "sha256-JljK7d4KLAn1+NwF+VcedL/7hEsp/9LzLdzROa1fgJA=";
     };
   };
 
diff --git a/pkgs/applications/networking/ktailctl/default.nix b/pkgs/applications/networking/ktailctl/default.nix
index d66e8586a6e35..ae8e63b0da2f2 100644
--- a/pkgs/applications/networking/ktailctl/default.nix
+++ b/pkgs/applications/networking/ktailctl/default.nix
@@ -1,11 +1,11 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, buildGoModule
+, buildGo123Module
 , cmake
 , extra-cmake-modules
 , git
-, go
+, go_1_23
 , wrapQtAppsHook
 , qtbase
 , qtdeclarative
@@ -23,20 +23,20 @@
 }:
 
 let
-  version = "0.17.2";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "f-koehler";
     repo = "KTailctl";
     rev = "v${version}";
-    hash = "sha256-jACcTRIdzYiSLy7zw5QuDu9tZfee9ufhlEecbTbSr+4=";
+    hash = "sha256-tZnwn94qZyQ8JAC6Y1dDTmc7Cob+kMZnEaP7+EytbH8=";
   };
 
-  goDeps = (buildGoModule {
+  goDeps = (buildGo123Module {
     pname = "ktailctl-go-wrapper";
     inherit src version;
     modRoot = "src/wrapper";
-    vendorHash = "sha256-V4Bn5/VaoFOZlNGBedA4Ly8Kocw0BWyfIHv8IU6Eay4=";
+    vendorHash = "sha256-KdkvAPLnoC7DccRVIz7t/Ns71dnG59DpO5qwOhJk7qc=";
   }).goModules;
 in
 stdenv.mkDerivation {
@@ -61,7 +61,7 @@ stdenv.mkDerivation {
     cmake
     extra-cmake-modules
     git
-    go
+    go_1_23
     wrapQtAppsHook
   ];
 
diff --git a/pkgs/applications/office/calligra/default.nix b/pkgs/applications/office/calligra/default.nix
deleted file mode 100644
index 611336b8a908e..0000000000000
--- a/pkgs/applications/office/calligra/default.nix
+++ /dev/null
@@ -1,93 +0,0 @@
-{ mkDerivation, lib, fetchpatch, fetchurl, extra-cmake-modules, kdoctools
-, boost, qtwebkit, qtx11extras, shared-mime-info
-, breeze-icons, kactivities, karchive, kcodecs, kcompletion, kconfig, kconfigwidgets
-, kcoreaddons, kdbusaddons, kdiagram, kguiaddons, khtml, ki18n
-, kiconthemes, kitemviews, kjobwidgets, kcmutils, kdelibs4support, kio, kross
-, knotifications, knotifyconfig, kparts, ktextwidgets, kwallet, kwidgetsaddons
-, kwindowsystem, kxmlgui, sonnet, threadweaver
-, kcontacts, akonadi, akonadi-calendar, akonadi-contacts
-, eigen, git, gsl, ilmbase, kproperty, kreport, lcms2, marble, pcre, libgit2, libodfgen
-, librevenge, libvisio, libwpd, libwpg, libwps, okular, openexr, openjpeg, phonon
-, poppler, pstoedit, qca-qt5, vc, fontconfig
-# TODO: package Spnav, m2mml LibEtonyek, Libqgit2
-}:
-
-mkDerivation rec {
-  pname = "calligra";
-  version = "3.2.1";
-
-  src = fetchurl {
-    url = "mirror://kde/stable/${pname}/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0iqi6z6gkck2afgy200dacgcspq7i7887alcj0pklm08hbmsdy5i";
-  };
-
-  patches = [
-    # Fix fontconfig underlinking: https://github.com/NixOS/nixpkgs/issues/137794
-    # Can be dropped on next release.
-    (fetchpatch {
-      name = "fix-fontconfig-linking.patch";
-      url = "https://github.com/KDE/calligra/commit/62f510702ef9c34ac50f8d8601a4290ab558464c.patch";
-      sha256 = "11dzrp9q05dmvnwp4vk4ihcibqcf4xyr0ijscpi716cyy730flma";
-      excludes = [ "CMakeLists.txt" ];
-    })
-    # Fixes for building calligra with gcc11/c++17
-    (fetchpatch {
-      name = "build_c++17_poppler.patch";
-      url = "https://github.com/archlinux/svntogit-packages/raw/bbbe35f97eb1033798f1cf95d427890168598199/trunk/068cd9ae.patch";
-      sha256 = "sha256-d9/ILwSeW+ov11DF191hzIaUafO/rjQrAeONwqDSKbA=";
-    })
-    # Fixes for building calligra with modern poppler[-qt5]
-    (fetchpatch {
-      name = "calligra-poppler-22.03.patch";
-      url = "https://invent.kde.org/office/calligra/-/commit/236bacbe13739414e919de868283b0caf2df5d8a.patch";
-      sha256 = "sha256-9DmKPCvEFy2Cs3g7350iOCF5Vrx1HL+/8jr+Tb44CyE=";
-    })
-    (fetchpatch {
-      name = "calligra-poppler-22.04.patch";
-      url = "https://invent.kde.org/office/calligra/-/commit/6b75bec784c9835c78993349845d8c2ef22ec3de.patch";
-      sha256 = "sha256-z9/4he4x0WN2K/ZGrDAAtHF/W5X1PAtpeO6s7fgL/fA=";
-    })
-  ];
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace 'CMAKE_CXX_STANDARD 11' 'CMAKE_CXX_STANDARD 17'
-  '';
-
-  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
-
-  buildInputs = [
-    boost qtwebkit qtx11extras shared-mime-info
-    kactivities karchive kcodecs kcompletion kconfig kconfigwidgets kcoreaddons
-    kdbusaddons kdiagram kguiaddons khtml ki18n kiconthemes kitemviews
-    kjobwidgets kcmutils kdelibs4support kio kross knotifications knotifyconfig kparts
-    ktextwidgets kwallet kwidgetsaddons kwindowsystem kxmlgui sonnet threadweaver
-    kcontacts akonadi akonadi-calendar akonadi-contacts
-    eigen git gsl ilmbase kproperty kreport lcms2 marble pcre libgit2 libodfgen librevenge
-    libvisio libwpd libwpg libwps okular openexr openjpeg phonon poppler qca-qt5 vc
-    fontconfig
-  ];
-
-  propagatedUserEnvPkgs = [ kproperty ];
-
-  env.NIX_CFLAGS_COMPILE = "-I${ilmbase.dev}/include/OpenEXR";
-
-  qtWrapperArgs = [
-    "--prefix PATH : ${lib.getBin pstoedit}/bin"
-    "--prefix XDG_DATA_DIRS : ${breeze-icons}/share"
-  ];
-
-  meta = with lib; {
-    description = "Suite of productivity applications";
-    longDescription = ''
-      Calligra Suite is a set of applications written to help
-      you to accomplish your work. Calligra includes efficient
-      and capable office components: Words for text processing,
-      Sheets for computations, Plan for planning, and Karbon for
-      vector graphics.
-    '';
-    homepage = "https://www.calligra.org/";
-    maintainers = with maintainers; [ ebzzry zraexy ];
-    platforms = platforms.linux;
-    license = with licenses; [ gpl2 lgpl2 ];
-  };
-}
diff --git a/pkgs/applications/version-management/git-annex-remote-googledrive/default.nix b/pkgs/applications/version-management/git-annex-remote-googledrive/default.nix
index 72c0e48275ca4..03bd655adcdc8 100644
--- a/pkgs/applications/version-management/git-annex-remote-googledrive/default.nix
+++ b/pkgs/applications/version-management/git-annex-remote-googledrive/default.nix
@@ -6,24 +6,29 @@
 , gitpython
 , humanfriendly
 , tenacity
+, setuptools
+, distutils
 }:
 
 buildPythonApplication rec {
   pname = "git-annex-remote-googledrive";
   version = "1.3.2";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "0rwjcdvfgzdlfgrn1rrqwwwiqqzyh114qddrbfwd46ld5spry6r1";
   };
 
+  build-system = [ setuptools ];
+
   propagatedBuildInputs = [
     annexremote
     drivelib
     gitpython
     tenacity
     humanfriendly
+    distutils
   ];
 
   # while git-annex does come with a testremote command that *could* be used,
@@ -36,7 +41,7 @@ buildPythonApplication rec {
 
   meta = with lib; {
     description = "Git-annex special remote for Google Drive";
-    homepage = "https://pypi.org/project/git-annex-remote-googledrive/";
+    homepage = "https://github.com/Lykos153/git-annex-remote-googledrive";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ gravndal ];
     mainProgram = "git-annex-remote-googledrive";
diff --git a/pkgs/applications/version-management/git-workspace/default.nix b/pkgs/applications/version-management/git-workspace/default.nix
index 8ed00127fdbbe..c7af04adcb9ff 100644
--- a/pkgs/applications/version-management/git-workspace/default.nix
+++ b/pkgs/applications/version-management/git-workspace/default.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-workspace";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "orf";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-qAJv4iCw9gkO9yPVQUqla7UWpNkPjPBa4IGQfOyd8k0=";
+    sha256 = "sha256-Xf3uR+MG8vRBcad5n5k9NKyfC6v0y3BCz0CfDORsy/Q=";
   };
 
-  cargoHash = "sha256-p+mZN0TXxntT22vp6uBRc6kBTzVN3/Oy7D4v3ihwV8Y=";
+  cargoHash = "sha256-oywwbDwg6O4pdqRJAM+IAt65DV6IkpMec8v4PY1RoZU=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ch/chess-clock/package.nix b/pkgs/by-name/ch/chess-clock/package.nix
index 9e36fc97d00a8..2074e5404c414 100644
--- a/pkgs/by-name/ch/chess-clock/package.nix
+++ b/pkgs/by-name/ch/chess-clock/package.nix
@@ -15,14 +15,14 @@
 
 stdenv.mkDerivation rec {
   pname = "chess-clock";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-wwNOop2V84vZO3JV0+VZ+52cKPx8xJg2rLkjfgc/+n4=";
+    hash = "sha256-XDOCHFZC3s3b/4kD1ZkhWar3kozW3vXc0pk7O6oQfiE=";
   };
 
   nativeBuildInputs = [
@@ -45,10 +45,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Time games of over-the-board chess";
-    mainProgram = "chess-clock";
     homepage = "https://gitlab.gnome.org/World/chess-clock";
-    changelog = "https://gitlab.gnome.org/World/chess-clock/-/releases/v${version}";
     license = licenses.gpl3Plus;
+    mainProgram = "chess-clock";
     maintainers = with maintainers; [ michaelgrahamevans ];
   };
 }
diff --git a/pkgs/by-name/cy/cyme/package.nix b/pkgs/by-name/cy/cyme/package.nix
index f1a1ca496bf80..341fa8b0dfa29 100644
--- a/pkgs/by-name/cy/cyme/package.nix
+++ b/pkgs/by-name/cy/cyme/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cyme";
-  version = "1.8.3";
+  version = "1.8.4";
 
   src = fetchFromGitHub {
     owner = "tuna-f1sh";
     repo = "cyme";
     rev = "v${version}";
-    hash = "sha256-DFO12ylrUIPxxOf3+sSXf/MN918U/IUeUfr72Lbnxvc=";
+    hash = "sha256-5433lq3u+s4LiC9089Ul7wGJiouQdVDoM3RT0QSiAnU=";
   };
 
-  cargoHash = "sha256-uw+Z0F2NoU1BFGwsNaIKT9hWclhqmJK2se5mm0xUQyc=";
+  cargoHash = "sha256-EW4M072qWCghg4UlhjMBR6DVzKsu/foE+j4MOSiHqNk=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/do/dokieli/package.json b/pkgs/by-name/do/dokieli/package.json
new file mode 100644
index 0000000000000..39198309b8127
--- /dev/null
+++ b/pkgs/by-name/do/dokieli/package.json
@@ -0,0 +1,104 @@
+{
+  "name": "dokieli",
+  "version": "0.3.1417",
+  "description": "dokieli is a clientside editor for decentralised article publishing, annotations, and social interactions.",
+  "main": "./src/dokieli.js",
+  "type": "module",
+  "scripts": {
+    "build-dist": "webpack --progress --color",
+    "build": "yarn build-dist",
+    "test": "TZ=UTC node --experimental-vm-modules node_modules/jest/bin/jest.js --silent",
+    "test:e2e": "playwright test",
+    "watch": "webpack --progress --color --watch",
+    "minify": "webpack --progress --color --env minimize",
+    "postinstall": "patch-package",
+    "lint": "eslint ."
+  },
+  "repository": "https://github.com/linkeddata/dokieli",
+  "keywords": [
+    "activitystreams",
+    "activitypub",
+    "annotations",
+    "authoring",
+    "decentralized",
+    "editor",
+    "knowledge graph",
+    "linked data",
+    "notifications",
+    "publishing",
+    "social web",
+    "web standards"
+  ],
+  "author": "dokieli team",
+  "license": "Apache-2.0",
+  "bugs": {
+    "url": "https://github.com/linkeddata/dokieli/issues"
+  },
+  "homepage": "https://dokie.li/",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "buffer": "^6.0.3",
+    "d3-force": "^3.0.0",
+    "d3-selection": "^3.0.0",
+    "diff": "^5.2.0",
+    "dompurify": "^3.1.5",
+    "fs": "^0.0.1-security",
+    "http-link-header": "^1.1.3",
+    "leaflet": "^1.9.4",
+    "leaflet-gpx": "^1.7.0",
+    "medium-editor": "^5.23.3",
+    "medium-editor-tables": "^0.6.1",
+    "micromark": "^4.0.0",
+    "micromark-extension-gfm": "^3.0.0",
+    "micromark-extension-gfm-tagfilter": "^2.0.0",
+    "rdf-parser-rdfa": "https://github.com/rdf-ext/rdf-parser-rdfa.git#master",
+    "rdf-store-ldp": "^0.3.1",
+    "shower": "https://github.com/shower/core.git#main",
+    "simplerdf": "^0.2.14",
+    "simplerdf-parse": "^0.1.3",
+    "solid-auth-client": "^2.5.6"
+  },
+  "devDependencies": {
+    "@axe-core/playwright": "^4.9.1",
+    "@playwright/test": "^1.44.1",
+    "babel-eslint": "^10.1.0",
+    "dotenv": "^16.4.5",
+    "eslint": "^9.10.0",
+    "eslint-plugin-jest": "^27.9.0",
+    "husky": "^9.0.11",
+    "jest": "^29.0.3",
+    "jest-environment-jsdom": "^29.0.3",
+    "patch-package": "^8.0.0",
+    "process": "^0.11.10",
+    "terser-webpack-plugin": "^5.3.3",
+    "webpack": "5.94.0",
+    "webpack-cli": "^5.0.1"
+  },
+  "resolutions": {
+    "ansi-regex": "^5.0.0",
+    "xmldom": "https://github.com/xmldom/xmldom.git#master",
+    "green-turtle": "https://github.com/csarven/green-turtle#master",
+    "json5": "^1.0.2",
+    "http-cache-semantics": "^4.1.1",
+    "jsonld": "^5.0.0",
+    "xml2js": "^0.6.2",
+    "semver": "^7.6.2",
+    "lru-cache": "^8.0.0",
+    "micromatch": "^4.0.8"
+  },
+  "standard": {
+    "globals": [
+      "DO",
+      "SimpleRDF",
+      "ld",
+      "describe",
+      "it",
+      "before",
+      "beforeEach",
+      "after",
+      "afterEach"
+    ]
+  }
+}
diff --git a/pkgs/by-name/do/dokieli/package.nix b/pkgs/by-name/do/dokieli/package.nix
new file mode 100644
index 0000000000000..882f863ef97ae
--- /dev/null
+++ b/pkgs/by-name/do/dokieli/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  mkYarnPackage,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  makeWrapper,
+  nodejs,
+  xsel,
+}:
+
+mkYarnPackage rec {
+  pname = "dokieli";
+  version = "0-unstable-2024-09-23";
+
+  src = fetchFromGitHub {
+    owner = "linkeddata";
+    repo = "dokieli";
+    rev = "40ebbc60ba48d8b08f763b07befba96382c5f027";
+    hash = "sha256-lc96jOR8uXLcZFhN3wpSd9O5cUdKxllB8WWCh2oWuEw=";
+  };
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = src + "/yarn.lock";
+    hash = "sha256-TEXCCLFhpwHZJ8zRGsC7J6EwNaFpIi+CZ3L5uilebK4=";
+  };
+
+  packageJSON = ./package.json;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -r * $out
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postFixup = ''
+    makeWrapper ${nodejs}/bin/npx $out/bin/dokieli           \
+      --prefix PATH : ${
+        lib.makeBinPath ([
+          nodejs
+          xsel
+        ])
+      }   \
+      --add-flags serve                                      \
+      --chdir $out/deps/dokieli
+  '';
+
+  doDist = false;
+
+  meta = {
+    description = "dokieli is a clientside editor for decentralised article publishing, annotations and social interactions";
+    homepage = "https://github.com/linkeddata/dokieli";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ shogo ];
+    mainProgram = "dokieli";
+  };
+}
diff --git a/pkgs/by-name/fa/fabric-ai/package.nix b/pkgs/by-name/fa/fabric-ai/package.nix
index 8b25b890e24d7..9622ac2c598f8 100644
--- a/pkgs/by-name/fa/fabric-ai/package.nix
+++ b/pkgs/by-name/fa/fabric-ai/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "fabric-ai";
-  version = "1.4.14";
+  version = "1.4.26";
 
   src = fetchFromGitHub {
     owner = "danielmiessler";
     repo = "fabric";
     rev = "v${version}";
-    hash = "sha256-syQVGtEFCC7ZVcs6ZIJgH0EXItclV2rPO7xTfsG2g7Q=";
+    hash = "sha256-KoGulBnQDLpRWB+Bogu+bvXDJ98ImyzTZrvoEaVh5BQ=";
   };
 
-  vendorHash = "sha256-CHgeHumWtNt8SrbzzCWqBdLxTmmyDD2bfLkriPeez2E=";
+  vendorHash = "sha256-uWq+S6J/RInAaQOO0T3LkpQ89mHq0Wj+wXw+Tioxy70=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fe/fedimint/package.nix b/pkgs/by-name/fe/fedimint/package.nix
index f282b70c4ded9..ca91966bbefad 100644
--- a/pkgs/by-name/fe/fedimint/package.nix
+++ b/pkgs/by-name/fe/fedimint/package.nix
@@ -24,16 +24,16 @@ let
 in
 buildRustPackage rec {
   pname = "fedimint";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "fedimint";
     repo = "fedimint";
     rev = "v${version}";
-    hash = "sha256-ih1ZwH8uItplMJU2/XkQseFlYUsf8/TkX8lGyRl7/KU=";
+    hash = "sha256-NUr1ZpYJozWIej46Oqlf/7feJ4kztYYvX3TEzQ5VoWo=";
   };
 
-  cargoHash = "sha256-scfgUFuS/b4EFfPuhl6uFlTZi4gyTqtEso2a5jhrxno=";
+  cargoHash = "sha256-sky0Blh2fjP82UgFUfBH0vAIdBzHOfVGAfOW0rwNH00=";
 
   nativeBuildInputs = [
     protobuf
diff --git a/pkgs/by-name/fi/files-cli/package.nix b/pkgs/by-name/fi/files-cli/package.nix
index 483bb48324e79..133cecf2d86f8 100644
--- a/pkgs/by-name/fi/files-cli/package.nix
+++ b/pkgs/by-name/fi/files-cli/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "files-cli";
-  version = "2.13.136";
+  version = "2.13.141";
 
   src = fetchFromGitHub {
     repo = "files-cli";
     owner = "files-com";
     rev = "v${version}";
-    hash = "sha256-F20cGZtPTaiZakRiw0xspS7Mxxwr9VDTcRjHeRaLAq0=";
+    hash = "sha256-UVD2zWas4QZD3W6Xro7tiGJDdbive60dYPDY1UTnl08=";
   };
 
-  vendorHash = "sha256-ftO+jt3MurZ4erNUmFlMEuVskVIbpRbpIWb7gZVr3jk=";
+  vendorHash = "sha256-4HkIwyRqvbk7qIzCjZNTzF7wDNupNaDpOiqqdlx9UIo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ga/gamescope/package.nix b/pkgs/by-name/ga/gamescope/package.nix
index 7619b43c6dc12..02451f7774807 100644
--- a/pkgs/by-name/ga/gamescope/package.nix
+++ b/pkgs/by-name/ga/gamescope/package.nix
@@ -47,14 +47,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gamescope";
-  version = "3.15.9";
+  version = "3.15.11";
 
   src = fetchFromGitHub {
     owner = "ValveSoftware";
     repo = "gamescope";
     rev = "refs/tags/${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-+BRinPyh8t9HboT0uXPEu+sSJz9qCZshlfzDfZDA41Q=";
+    hash = "sha256-O2pxaPDwEr9ko7Zplv65qRUDzIk1Q54Q7Rgs94VkTII=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ga/gate/package.nix b/pkgs/by-name/ga/gate/package.nix
index 150a27c81ba71..da55f8db87698 100644
--- a/pkgs/by-name/ga/gate/package.nix
+++ b/pkgs/by-name/ga/gate/package.nix
@@ -5,7 +5,7 @@
 
 let
   pname = "gate";
-  version = "0.40.0";
+  version = "0.41.0";
 in
 buildGoModule {
   inherit pname version;
@@ -14,10 +14,10 @@ buildGoModule {
     owner = "minekube";
     repo = "gate";
     rev = "refs/tags/v${version}";
-    hash = "sha256-zEbkt38/K4LVLVXXqaLU83mX94vI/dbZ+JqOjn2u0/c=";
+    hash = "sha256-tQO1ClfZasRdnazFOMOWeqnXaEda84lQMQKw5640YCI=";
   };
 
-  vendorHash = "sha256-W3YBIbxblxO5Rirso+b20h4cwUzfj8rG/Owh1KyJ0mM=";
+  vendorHash = "sha256-Nl6NGz+sEdwcTzbL+OwHuaQzi2lHX/cN2lE6HNi1uJQ=";
 
   ldflags = [ "-s" "-w" ];
 
diff --git a/pkgs/by-name/gr/grafana-alloy/package.nix b/pkgs/by-name/gr/grafana-alloy/package.nix
index c09e7725b9ce6..e465a4f66eba6 100644
--- a/pkgs/by-name/gr/grafana-alloy/package.nix
+++ b/pkgs/by-name/gr/grafana-alloy/package.nix
@@ -16,17 +16,17 @@
 
 buildGoModule rec {
   pname = "grafana-alloy";
-  version = "1.3.1";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "grafana";
     repo = "alloy";
-    hash = "sha256-6YjQUIHZmuguzqTeaLgkrM/WdBPZu/KUXUDOmEB7rNQ=";
+    hash = "sha256-/LCp4PUt85HR+ig0/v7KlS1cFcFGpI8TXHk3IlcEkvk=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-eMtwmADYbvpIm4FHTHieQ1i4xCty5xCwsZ/JD9r94/8=";
+  vendorHash = "sha256-fhUoQGNRoWNbU5U21X45s+eJ8XjCkvYULTRShyq0f3E=";
 
   nativeBuildInputs = [ fixup-yarn-lock yarn nodejs installShellFiles ];
 
@@ -55,9 +55,14 @@ buildGoModule rec {
     "."
   ];
 
+  # Skip building the frontend in the goModules FOD
+  overrideModAttrs = (_: {
+    preBuild = null;
+  });
+
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${src}/internal/web/ui/yarn.lock";
-    hash = "sha256-Jk+zqR/+NBde9ywncIEJM4kgavqiDvcIAjxJCSMrZDc=";
+    hash = "sha256-Y0WcmjFtiNXue2kcJGlvHVBGmMLewGICISoRHnBPHGw=";
   };
 
   preBuild = ''
diff --git a/pkgs/development/tools/hred/default.nix b/pkgs/by-name/hr/hred/package.nix
index 8de5ec2a5f636..b7c77d3ecdda9 100644
--- a/pkgs/development/tools/hred/default.nix
+++ b/pkgs/by-name/hr/hred/package.nix
@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "hred";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "danburzo";
     repo = "hred";
     rev = "v${version}";
-    hash = "sha256-rnobJG9Z1lXEeFm+c0f9OsbiTzxeP3+zut5LYpGzWfc=";
+    hash = "sha256-+0+WQRI8rdIMbPN0eBUdsWUMWDCxZhTRLiFo1WRd2xc=";
   };
 
-  npmDepsHash = "sha256-POxlGWK0TJMwNWDpiK5+OXLGtAx4lFJO3imoe/h+7Sc=";
+  npmDepsHash = "sha256-kNNvSxZqN6cDZIG+lvqxgjAVCJUJrCvZThxrur5kozU=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/li/lime3ds/package.nix b/pkgs/by-name/li/lime3ds/package.nix
index 87a0a895fab7b..8dae667a6b548 100644
--- a/pkgs/by-name/li/lime3ds/package.nix
+++ b/pkgs/by-name/li/lime3ds/package.nix
@@ -41,11 +41,11 @@
   inherit (lib) optional optionals cmakeBool optionalString getLib makeLibraryPath;
 in stdenv.mkDerivation (finalAttrs: {
   pname = "lime3ds";
-  version = "2118";
+  version = "2118.2";
 
   src = fetchzip {
     url = "https://github.com/Lime3DS/Lime3DS/releases/download/${finalAttrs.version}/lime3ds-unified-source-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Dt0YKWj+yLUic1F7uOxfWPYlPda3snTUPwFbn23i2rY=";
+    hash = "sha256-DovVkk5QolOizV3mfxtMNMeIJWYs3xAu96icrTcQN68=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index 92d62030ae793..7a891bcf107aa 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -1,67 +1,115 @@
-# Builds limine with all available features.
-
+# Derivation containing the Limine host tool and the compiled bootloader
 {
-  # Helpers
-  stdenv
-, fetchurl
-, lib
-, # Dependencies
-  llvmPackages
-, mtools
-, nasm
+  fetchurl,
+  lib,
+  llvmPackages_18,
+  mtools,
+  nasm,
+  # The following options map to configure flags.
+  enableAll ? false,
+  buildCDs ? false,
+  targets ? [ ],
+  # x86 specific flags
+  biosSupport ? false,
+  pxeSupport ? false,
 }:
 
 let
-  version = "7.9.1";
+  llvmPackages = llvmPackages_18;
+  stdenv = llvmPackages.stdenv;
+
+  version = "8.0.13";
+
+  hasI686 =
+    (if targets == [ ] then stdenv.hostPlatform.isx86_32 else (builtins.elem "i686" targets))
+    || enableAll;
+
+  hasX86_64 =
+    (if targets == [ ] then stdenv.hostPlatform.isx86_64 else (builtins.elem "x86_64" targets))
+    || enableAll;
+
+  uefiFlags =
+    target:
+    {
+      aarch64 = [ "--enable-uefi-aarch64" ];
+      i686 = [ "--enable-uefi-ia32" ];
+      loongarch64 = [ "--enable-uefi-loongarch64" ];
+      riscv64 = [ "--enable-uefi-riscv64" ];
+      x86_64 = [ "--enable-uefi-x86-64" ];
+    }
+    .${target} or (throw "Unsupported target ${target}");
+
+  configureFlags =
+    lib.optionals enableAll [ "--enable-all" ]
+    ++ lib.optionals biosSupport [ "--enable-bios" ]
+    ++ lib.optionals (buildCDs && biosSupport) [ "--enable-bios-cd" ]
+    ++ lib.optionals buildCDs [ "--enable-uefi-cd" ]
+    ++ lib.optionals pxeSupport [ "--enable-bios-pxe" ]
+    ++ lib.concatMap uefiFlags (
+      if targets == [ ] then [ stdenv.hostPlatform.parsed.cpu.name ] else targets
+    );
 in
+
+assert lib.assertMsg (!(biosSupport && !hasI686)) "BIOS builds are possible only for x86";
+
+assert lib.assertMsg (!(pxeSupport && !hasI686)) "PXE builds are possible only for x86";
+
 # The output of the derivation is a tool to create bootable images using Limine
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation {
-  inherit version;
+  inherit version configureFlags;
   pname = "limine";
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://github.com/limine-bootloader/limine/releases/download/v${version}/limine-${version}.tar.gz";
-    hash = "sha256-cR6ilV5giwvbqUoOGbnXQnqZzUz/oL7OGZPYNoFKvy0=";
+    hash = "sha256-pg0tAn4YlfEzpyxb9QAAR0PApYmtnafMbIXfhHw+w3k=";
   };
 
-  nativeBuildInputs = [
-    llvmPackages.bintools
-    # gcc is used for the host tool, while clang is used for the bootloader.
-    llvmPackages.clang
-    llvmPackages.lld
-    mtools
-    nasm
-  ];
-
-  configureFlags = [
-    "--enable-all"
+  hardeningDisable = [
+    # clang doesn't support this for RISC-V target
+    "zerocallusedregs"
   ];
 
-  installFlags = [ "destdir=$out" "manprefix=/share" ];
+  nativeBuildInputs =
+    [
+      llvmPackages.libllvm
+      llvmPackages.lld
+    ]
+    ++ lib.optionals (enableAll || buildCDs) [
+      mtools
+    ]
+    ++ lib.optionals (hasI686 || hasX86_64) [ nasm ];
 
-  outputs = [ "out" "doc" "dev" "man" ];
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+    "man"
+  ];
 
   meta = with lib; {
     homepage = "https://limine-bootloader.org/";
     description = "Limine Bootloader";
+    mainProgram = "limine";
+    # The platforms on that the Limine binary and helper tools can run, not
+    # necessarily the platforms for that bootable images can be created.
+    platforms = platforms.unix;
+    badPlatforms = platforms.darwin;
     # Caution. Some submodules have different licenses.
     license = [
-      licenses.bsd2 # limine, flanterm
-      licenses.bsd0 # freestanding-toolchain, freestanding-headers
       licenses.asl20 # cc-runtime
+      licenses.bsd0 # freestanding-toolchain, freestanding-headers
+      licenses.bsd2 # limine, flanterm
       licenses.mit # limine-efi, stb
       licenses.zlib # tinf
     ];
-    # The platforms on that the Liminine binary and helper tools can run, not
-    # necessarily the platforms for that bootable images can be created.
-    platforms = platforms.unix;
-    badPlatforms = platforms.darwin;
     maintainers = [
       maintainers._48cf
       maintainers.phip1611
+      maintainers.sanana
+      maintainers.surfaceflinger
     ];
   };
 }
diff --git a/pkgs/by-name/mi/minijinja/package.nix b/pkgs/by-name/mi/minijinja/package.nix
index 9f4eabc4886e0..f88c314b693ff 100644
--- a/pkgs/by-name/mi/minijinja/package.nix
+++ b/pkgs/by-name/mi/minijinja/package.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "minijinja";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "minijinja";
     rev = version;
-    hash = "sha256-SZWVvj/tGpoC740An/sgdPVg+uV39QBj7qbjK0lSYdo=";
+    hash = "sha256-fASPxNSkSQtg05hmSK48AAEd9MpcoFqCt5hkk2vIR2A=";
   };
 
-  cargoHash = "sha256-OVpqfwu5x/XfqgB8xJY+qZYQUgsa2QO9FZ+/KVYZxgE=";
+  cargoHash = "sha256-dPNWeuBAWV7ynh9t+DEaR0xb0cAa27Pp44Hm68mWTwI=";
 
   # The tests relies on the presence of network connection
   doCheck = false;
diff --git a/pkgs/by-name/no/nodemon/package.nix b/pkgs/by-name/no/nodemon/package.nix
index 03e432628f650..cc51b9263fc8b 100644
--- a/pkgs/by-name/no/nodemon/package.nix
+++ b/pkgs/by-name/no/nodemon/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage rec {
   pname = "nodemon";
-  version = "3.1.4";
+  version = "3.1.7";
 
   src = fetchFromGitHub {
     owner = "remy";
     repo = "nodemon";
     rev = "v${version}";
-    hash = "sha256-bAsq1eoeQ03VhNYgdYJQnZRCxyvt46C+3scihGp+9GU=";
+    hash = "sha256-1hwkPXCPBLYPsg9WwWxId/9v5KF0Iu13qWHRzYJUh+E=";
   };
 
   npmDepsHash = "sha256-cZHfaUWhKZYKRe4Foc2UymZ8hTPrGLzlcXe1gMsW1pU=";
diff --git a/pkgs/by-name/or/orchard/package.nix b/pkgs/by-name/or/orchard/package.nix
index dd55bf187963a..bf6f04f6a4062 100644
--- a/pkgs/by-name/or/orchard/package.nix
+++ b/pkgs/by-name/or/orchard/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "orchard";
-  version = "0.23.2";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = version;
-    hash = "sha256-hsYIIA2JA+LT+qaootOkHVN4JD+msO1grYQq4Z6ipYU=";
+    hash = "sha256-N54wkqe05Hm9o+kQmWTJREoU+0GnivaVTJngtBDL8+U=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -19,7 +19,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-HphNpli6hYvmeIJlkkSzOZDbdqFL4XI+koUK9RvWfw8=";
+  vendorHash = "sha256-R4KsR00VAq0fUxHM48212GWy8KJoIOM0R8ycVjjjMO4=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/pa/pantheon-tweaks/package.nix b/pkgs/by-name/pa/pantheon-tweaks/package.nix
index fc49c062d907b..ab266b16c43a2 100644
--- a/pkgs/by-name/pa/pantheon-tweaks/package.nix
+++ b/pkgs/by-name/pa/pantheon-tweaks/package.nix
@@ -5,47 +5,47 @@
 , meson
 , ninja
 , pkg-config
-, python3
+, sassc
 , vala
-, wrapGAppsHook3
-, gtk3
+, wrapGAppsHook4
+, gtk4
 , libgee
+, pango
 , pantheon
 }:
 
 stdenv.mkDerivation rec {
   pname = "pantheon-tweaks";
-  version = "2.0.2";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "pantheon-tweaks";
     repo = pname;
     rev = version;
-    hash = "sha256-7a6maEpvmIS+Raawr9ec44nCbuj83EUnd+8RqYgWy24=";
+    hash = "sha256-NrDBr7Wtfxf9UA/sbi9ilgrlxK6QGQAopuz3TV2ITjs=";
   };
 
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
-    python3
+    sassc
     vala
-    wrapGAppsHook3
+    wrapGAppsHook4
   ];
 
   buildInputs = [
-    gtk3
+    gtk4
     libgee
+    pango
   ] ++ (with pantheon; [
     elementary-files # settings schemas
     elementary-terminal # settings schemas
-    granite
+    granite7
+    switchboard
   ]);
 
   postPatch = ''
-    chmod +x meson/post_install.py
-    patchShebangs meson/post_install.py
-
     substituteInPlace src/Settings/ThemeSettings.vala \
       --replace-fail "/usr/share/" "/run/current-system/sw/share/"
   '';
diff --git a/pkgs/by-name/ph/phraze/package.nix b/pkgs/by-name/ph/phraze/package.nix
index 8f5664d5c2a5d..aba0a4013b406 100644
--- a/pkgs/by-name/ph/phraze/package.nix
+++ b/pkgs/by-name/ph/phraze/package.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "phraze";
-  version = "0.3.14";
+  version = "0.3.15";
 
   src = fetchFromGitHub {
     owner = "sts10";
     repo = "phraze";
     rev = "v${version}";
-    hash = "sha256-wfvnzKoxFgIizbPrt8v9na6n/qjnjS368P1iOEh5VNw=";
+    hash = "sha256-gpdXgR7TK3xJHHXcZdfMZApA3SvtNmCroi/5ChfrQOs=";
   };
 
   doCheck = true;
 
-  cargoHash = "sha256-HEsXGlNpr/1NiJobjtwftI8HIfz0AnRtxMvh3Pf2gDo=";
+  cargoHash = "sha256-tYQ/kcwCNAcgEUmwrrdogLd1AugBnVfqaLX9fjjpOUE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/qq/qq/sources.nix b/pkgs/by-name/qq/qq/sources.nix
index d3bfb154a3e54..f3783a8ba5113 100644
--- a/pkgs/by-name/qq/qq/sources.nix
+++ b/pkgs/by-name/qq/qq/sources.nix
@@ -1,9 +1,9 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2024-09-06
+# Last updated: 2024-09-28
 {
-  version = "3.2.12-2024.9.2";
-  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.12_240902_amd64_01.deb";
-  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.12_240902_arm64_01.deb";
-  arm64_hash = "sha256-V+lsBgwhpvVNYGm1d0DD9x/wD7/+bIDON8DAAABA42c=";
-  amd64_hash = "sha256-NHK50KR2WuUm+HO//sFBUkhJPk6F45j5ShuaWksV1O4=";
+  version = "3.2.12-2024.9.27";
+  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.12_240927_amd64_01.deb";
+  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.12_240927_arm64_01.deb";
+  arm64_hash = "sha256-VfM+p2cTNkDZc7sTftfTuRSMKVWwE6TerW25pA1MIR0=";
+  amd64_hash = "sha256-xBGSSxXDu+qUwj203i3iAkfI97iLtGOuGMGfEU6kCyQ=";
 }
diff --git a/pkgs/by-name/ra/raspberrypi-eeprom/package.nix b/pkgs/by-name/ra/raspberrypi-eeprom/package.nix
index 5d4580e46f253..db4d4cac9296f 100644
--- a/pkgs/by-name/ra/raspberrypi-eeprom/package.nix
+++ b/pkgs/by-name/ra/raspberrypi-eeprom/package.nix
@@ -12,13 +12,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raspberrypi-eeprom";
-  version = "2024.09.10-2712";
+  version = "2024.09.23-2712";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "rpi-eeprom";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-SLPLZzSRsPDxGtFnFFu99z3HqGDLDNuMWbgUKdeJyuI=";
+    hash = "sha256-5qqcHMoRT5XfhIX392j4Q1DcKjYGq6NMqy1VrWxg5+4=";
   };
 
   buildInputs = [ python3 ];
diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index 5717f5905b1a2..5f2d0f79be040 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -5,11 +5,11 @@
 
 renode.overrideAttrs (finalAttrs: _: {
   pname = "renode-unstable";
-  version = "1.15.2+20240914gitcb658f346";
+  version = "1.15.3+20240927gitbb819bb49";
 
   src = fetchurl {
     url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-dotnet.tar.gz";
-    hash = "sha256-DkS635epflnbjYc/y4IgGgrIkRHKtuKxtebH6kdRYTw=";
+    hash = "sha256-IcQKAslgmN+ChYJLsS0umR1/FSAicWyP6Ek/v668+40=";
   };
 
   passthru.updateScript =
diff --git a/pkgs/by-name/sa/sasquatch-v4be/package.nix b/pkgs/by-name/sa/sasquatch-v4be/package.nix
new file mode 100644
index 0000000000000..10318b97045d6
--- /dev/null
+++ b/pkgs/by-name/sa/sasquatch-v4be/package.nix
@@ -0,0 +1,3 @@
+{ sasquatch }:
+
+sasquatch.override { bigEndian = true; }
diff --git a/pkgs/by-name/sa/sasquatch/darwin.patch b/pkgs/by-name/sa/sasquatch/darwin.patch
new file mode 100644
index 0000000000000..657971c5b0abb
--- /dev/null
+++ b/pkgs/by-name/sa/sasquatch/darwin.patch
@@ -0,0 +1,357 @@
+Patch based on commits by Dave Vasilevsky <dave@vasilevsky.ca> and
+Blake Riley <blake.riley@gmail.com>, squashed into a single patch,
+with BSD-specific changes omitted.
+
+See also https://github.com/plougher/squashfs-tools/pull/69.
+
+diff --git a/squashfs-tools/action.c b/squashfs-tools/action.c
+index ea2f604..9c979f8 100644
+--- a/squashfs-tools/action.c
++++ b/squashfs-tools/action.c
+@@ -39,6 +39,10 @@
+ #include <errno.h>
+ #include <ctype.h>
+ 
++#ifndef FNM_EXTMATCH /* glibc extension */
++	#define FNM_EXTMATCH 0
++#endif
++
+ #include "squashfs_fs.h"
+ #include "mksquashfs.h"
+ #include "action.h"
+@@ -2415,9 +2419,12 @@ static char *get_start(char *s, int n)
+ 
+ static int subpathname_fn(struct atom *atom, struct action_data *action_data)
+ {
+-	return fnmatch(atom->argv[0], get_start(strdupa(action_data->subpath),
++	char *path = strdup(action_data->subpath);
++	int is_match = fnmatch(atom->argv[0], get_start(path,
+ 		count_components(atom->argv[0])),
+ 		FNM_PATHNAME|FNM_EXTMATCH) == 0;
++	free(path);
++	return is_match;
+ }
+ 
+ /*
+diff --git a/squashfs-tools/info.c b/squashfs-tools/info.c
+index 216b979..eea2ec9 100644
+--- a/squashfs-tools/info.c
++++ b/squashfs-tools/info.c
+@@ -144,31 +144,22 @@ void dump_state()
+ void *info_thrd(void *arg)
+ {
+ 	sigset_t sigmask;
+-	struct timespec timespec = { .tv_sec = 1, .tv_nsec = 0 };
+-	int sig, waiting = 0;
++	int sig, err, waiting = 0;
+ 
+ 	sigemptyset(&sigmask);
+ 	sigaddset(&sigmask, SIGQUIT);
+ 	sigaddset(&sigmask, SIGHUP);
++	sigaddset(&sigmask, SIGALRM);
+ 
+ 	while(1) {
+-		if(waiting)
+-			sig = sigtimedwait(&sigmask, NULL, &timespec);
+-		else
+-			sig = sigwaitinfo(&sigmask, NULL);
++		err = sigwait(&sigmask, &sig);
+ 
+-		if(sig == -1) {
++		if(err == -1) {
+ 			switch(errno) {
+-			case EAGAIN:
+-				/* interval timed out */
+-				waiting = 0;
+-				/* FALLTHROUGH */
+ 			case EINTR:
+-				/* if waiting, the wait will be longer, but
+-				   that's OK */
+ 				continue;
+ 			default:
+-				BAD_ERROR("sigtimedwait/sigwaitinfo failed "
++				BAD_ERROR("sigwait failed "
+ 					"because %s\n", strerror(errno));
+ 			}
+ 		}
+@@ -179,8 +170,12 @@ void *info_thrd(void *arg)
+ 			/* set one second interval period, if ^\ received
+ 			   within then, dump queue and cache status */
+ 			waiting = 1;
+-		} else
++			alarm(1);
++		} else if (sig == SIGQUIT) {
+ 			dump_state();
++		} else if (sig == SIGALRM) {
++			waiting = 0;
++		}
+ 	}
+ }
+ 
+diff --git a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
+index 843f9f4..ed2c3a6 100644
+--- a/squashfs-tools/mksquashfs.c
++++ b/squashfs-tools/mksquashfs.c
+@@ -35,7 +35,12 @@
+ #include <stddef.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
++#ifndef linux
++#include <sys/sysctl.h>
++#else
++#include <sys/sysinfo.h>
+ #include <sys/sysmacros.h>
++#endif
+ #include <fcntl.h>
+ #include <errno.h>
+ #include <dirent.h>
+@@ -50,7 +55,10 @@
+ #include <sys/wait.h>
+ #include <limits.h>
+ #include <ctype.h>
+-#include <sys/sysinfo.h>
++
++#ifndef FNM_EXTMATCH /* glibc extension */
++	#define FNM_EXTMATCH 0
++#endif
+ 
+ #ifndef linux
+ #include <sys/sysctl.h>
+@@ -5064,6 +5072,7 @@ static void initialise_threads(int readq, int fragq, int bwriteq, int fwriteq,
+ 	sigemptyset(&sigmask);
+ 	sigaddset(&sigmask, SIGQUIT);
+ 	sigaddset(&sigmask, SIGHUP);
++	sigaddset(&sigmask, SIGALRM);
+ 	if(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) != 0)
+ 		BAD_ERROR("Failed to set signal mask in intialise_threads\n");
+ 
+@@ -5802,6 +5811,35 @@ static int get_physical_memory()
+ 	long long page_size = sysconf(_SC_PAGESIZE);
+ 	int phys_mem;
+ 
++#ifndef linux
++	#ifdef HW_MEMSIZE
++		#define SYSCTL_PHYSMEM HW_MEMSIZE
++	#elif defined(HW_PHYSMEM64)
++		#define SYSCTL_PHYSMEM HW_PHYSMEM64
++	#else
++		#define SYSCTL_PHYSMEM HW_PHYSMEM
++	#endif
++
++	int mib[2];
++	uint64_t sysctl_physmem = 0;
++	size_t sysctl_len = sizeof(sysctl_physmem);
++
++	mib[0] = CTL_HW;
++	mib[1] = SYSCTL_PHYSMEM;
++
++	if(sysctl(mib, 2, &sysctl_physmem, &sysctl_len, NULL, 0) == 0) {
++		/* some systems use 32-bit values, work with what we're given */
++		if (sysctl_len == 4)
++			sysctl_physmem = *(uint32_t*)&sysctl_physmem;
++		phys_mem = sysctl_physmem >> 20;
++	} else {
++		ERROR_START("Failed to get amount of available "
++			"memory.");
++		ERROR_EXIT("  Defaulting to least viable amount\n");
++		phys_mem = SQUASHFS_LOWMEM;
++	}
++  #undef SYSCTL_PHYSMEM
++#else
+ 	if(num_pages == -1 || page_size == -1) {
+ 		struct sysinfo sys;
+ 		int res = sysinfo(&sys);
+@@ -5814,6 +5852,7 @@ static int get_physical_memory()
+ 	}
+ 
+ 	phys_mem = num_pages * page_size >> 20;
++#endif
+ 
+ 	if(phys_mem < SQUASHFS_LOWMEM)
+ 		BAD_ERROR("Mksquashfs requires more physical memory than is "
+diff --git a/squashfs-tools/read_xattrs.c b/squashfs-tools/read_xattrs.c
+index 2067f80..ca8b7f4 100644
+--- a/squashfs-tools/read_xattrs.c
++++ b/squashfs-tools/read_xattrs.c
+@@ -31,13 +31,13 @@
+ #include <stdio.h>
+ #include <string.h>
+ 
++#include <stdlib.h>
++
+ #include "squashfs_fs.h"
+ #include "squashfs_swap.h"
+ #include "xattr.h"
+ #include "error.h"
+ 
+-#include <stdlib.h>
+-
+ extern int read_fs_bytes(int, long long, long long, void *);
+ extern int read_block(int, long long, long long *, int, void *);
+ 
+diff --git a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c
+index d434b42..1208e45 100644
+--- a/squashfs-tools/unsquashfs.c
++++ b/squashfs-tools/unsquashfs.c
+@@ -32,8 +32,12 @@
+ #include "stdarg.h"
+ #include "fnmatch_compat.h"
+ 
++#ifndef linux
++#include <sys/sysctl.h>
++#else
+ #include <sys/sysinfo.h>
+ #include <sys/sysmacros.h>
++#endif
+ #include <sys/types.h>
+ #include <sys/time.h>
+ #include <sys/resource.h>
+@@ -1182,7 +1186,7 @@ int create_inode(char *pathname, struct inode *i)
+ 			break;
+ 		case SQUASHFS_SYMLINK_TYPE:
+ 		case SQUASHFS_LSYMLINK_TYPE: {
+-			struct timespec times[2] = {
++			struct timeval times[2] = {
+ 				{ i->time, 0 },
+ 				{ i->time, 0 }
+ 			};
+@@ -1201,8 +1205,7 @@ int create_inode(char *pathname, struct inode *i)
+ 				goto failed;
+ 			}
+ 
+-			res = utimensat(AT_FDCWD, pathname, times,
+-					AT_SYMLINK_NOFOLLOW);
++			res = lutimes(pathname, times);
+ 			if(res == -1) {
+ 				EXIT_UNSQUASH_STRICT("create_inode: failed to"
+ 					" set time on %s, because %s\n",
+@@ -2687,6 +2690,7 @@ void initialise_threads(int fragment_buffer_size, int data_buffer_size, int cat_
+ 		sigemptyset(&sigmask);
+ 		sigaddset(&sigmask, SIGQUIT);
+ 		sigaddset(&sigmask, SIGHUP);
++		sigaddset(&sigmask, SIGALRM);
+ 		if(pthread_sigmask(SIG_BLOCK, &sigmask, NULL) != 0)
+ 			EXIT_UNSQUASH("Failed to set signal mask in initialise_threads\n");
+ 
+diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h
+index 1099678..5b6a038 100644
+--- a/squashfs-tools/unsquashfs.h
++++ b/squashfs-tools/unsquashfs.h
+@@ -46,6 +46,10 @@
+ #include <sys/ioctl.h>
+ #include <sys/time.h>
+ 
++#ifndef FNM_EXTMATCH /* glibc extension */
++	#define FNM_EXTMATCH 0
++#endif
++
+ #include "endian_compat.h"
+ #include "squashfs_fs.h"
+ #include "unsquashfs_error.h"
+diff --git a/squashfs-tools/unsquashfs_info.c b/squashfs-tools/unsquashfs_info.c
+index e906eaf..f1e68c2 100644
+--- a/squashfs-tools/unsquashfs_info.c
++++ b/squashfs-tools/unsquashfs_info.c
+@@ -96,31 +96,22 @@ void dump_state()
+ void *info_thrd(void *arg)
+ {
+ 	sigset_t sigmask;
+-	struct timespec timespec = { .tv_sec = 1, .tv_nsec = 0 };
+-	int sig, waiting = 0;
++	int sig, err, waiting = 0;
+ 
+ 	sigemptyset(&sigmask);
+ 	sigaddset(&sigmask, SIGQUIT);
+ 	sigaddset(&sigmask, SIGHUP);
++	sigaddset(&sigmask, SIGALRM);
+ 
+ 	while(1) {
+-		if(waiting)
+-			sig = sigtimedwait(&sigmask, NULL, &timespec);
+-		else
+-			sig = sigwaitinfo(&sigmask, NULL);
++		err = sigwait(&sigmask, &sig);
+ 
+-		if(sig == -1) {
++		if(err == -1) {
+ 			switch(errno) {
+-			case EAGAIN:
+-				/* interval timed out */
+-				waiting = 0;
+-				/* FALLTHROUGH */
+ 			case EINTR:
+-				/* if waiting, the wait will be longer, but
+-				   that's OK */
+ 				continue;
+ 			default:
+-				BAD_ERROR("sigtimedwait/sigwaitinfo failed "
++				BAD_ERROR("sigwait failed "
+ 					"because %s\n", strerror(errno));
+ 			}
+ 		}
+@@ -132,8 +123,12 @@ void *info_thrd(void *arg)
+ 			/* set one second interval period, if ^\ received
+ 			   within then, dump queue and cache status */
+ 			waiting = 1;
+-		} else
++			alarm(1);
++		} else if (sig == SIGQUIT) {
+ 			dump_state();
++		} else if (sig == SIGALRM) {
++			waiting = 0;
++		}
+ 	}
+ }
+ 
+diff --git a/squashfs-tools/unsquashfs_xattr.c b/squashfs-tools/unsquashfs_xattr.c
+index 61910e1..73e0090 100644
+--- a/squashfs-tools/unsquashfs_xattr.c
++++ b/squashfs-tools/unsquashfs_xattr.c
+@@ -27,6 +27,11 @@
+ 
+ #include <sys/xattr.h>
+ 
++#ifdef XATTR_NOFOLLOW /* Apple's xattrs */
++	#define lsetxattr(path_, name_, val_, sz_, flags_) \
++		setxattr(path_, name_, val_, sz_, 0, flags_ | XATTR_NOFOLLOW)
++#endif
++
+ #define NOSPACE_MAX 10
+ 
+ extern int root_process;
+diff --git a/squashfs-tools/xattr.c b/squashfs-tools/xattr.c
+index b1c0089..6d7ed98 100644
+--- a/squashfs-tools/xattr.c
++++ b/squashfs-tools/xattr.c
+@@ -22,6 +22,14 @@
+  * xattr.c
+  */
+ 
++#ifndef linux
++#define __BYTE_ORDER BYTE_ORDER
++#define __BIG_ENDIAN BIG_ENDIAN
++#define __LITTLE_ENDIAN LITTLE_ENDIAN
++#else
++#include <endian.h>
++#endif
++
+ #define TRUE 1
+ #define FALSE 0
+ 
+@@ -36,6 +44,13 @@
+ #include <stdlib.h>
+ #include <sys/xattr.h>
+ 
++#ifdef XATTR_NOFOLLOW /* Apple's xattrs */
++	#define llistxattr(path_, buf_, sz_) \
++		listxattr(path_, buf_, sz_, XATTR_NOFOLLOW)
++	#define lgetxattr(path_, name_, val_, sz_) \
++		getxattr(path_, name_, val_, sz_, 0, XATTR_NOFOLLOW)
++#endif
++
+ #include "squashfs_fs.h"
+ #include "squashfs_swap.h"
+ #include "mksquashfs.h"
+-- 
+2.35.1
+
diff --git a/pkgs/by-name/sa/sasquatch/package.nix b/pkgs/by-name/sa/sasquatch/package.nix
new file mode 100644
index 0000000000000..1c71a75452fba
--- /dev/null
+++ b/pkgs/by-name/sa/sasquatch/package.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  lz4,
+  lzo,
+  which,
+  xz,
+  zlib,
+  zstd,
+  bigEndian ? false,
+}:
+
+let
+  drv = stdenv.mkDerivation (finalAttrs: {
+    pname = "sasquatch";
+    version = "4.5.1-4";
+
+    src = fetchFromGitHub {
+      owner = "onekey-sec";
+      repo = "sasquatch";
+      rev = "sasquatch-v${finalAttrs.version}";
+      hash = "sha256-0itva+j5WMKvueiUaO253UQ1S6W29xgtFvV4i3yvMtU=";
+    };
+
+    patches = lib.optional stdenv.isDarwin ./darwin.patch;
+
+    strictDeps = true;
+    nativeBuildInputs = [ which ];
+    buildInputs = [
+      zlib
+      xz
+      zstd
+      lz4
+      lzo
+    ];
+
+    preBuild = ''
+      cd squashfs-tools
+    '';
+
+    installFlags = [
+      "INSTALL_DIR=${placeholder "out"}/bin"
+      "INSTALL_MANPAGES_DIR=${placeholder "out"}/share/man/man1"
+    ];
+
+    makeFlags = [
+      "GZIP_SUPPORT=1"
+      "LZ4_SUPPORT=1"
+      "LZMA_SUPPORT=1"
+      "LZO_SUPPORT=1"
+      "XZ_SUPPORT=1"
+      "ZSTD_SUPPORT=1"
+    ];
+
+    env.NIX_CFLAGS_COMPILE = lib.optionalString bigEndian "-DFIX_BE";
+
+    postInstall = lib.optionalString bigEndian ''
+      mv $out/bin/sasquatch{,-v4be}
+    '';
+
+    meta = {
+      homepage = "https://github.com/onekey-sec/sasquatch";
+      description = "Set of patches to the standard unsquashfs utility (part of squashfs-tools) that attempts to add support for as many hacked-up vendor-specific SquashFS implementations as possible";
+      license = lib.licenses.gpl2Plus;
+      maintainers = with lib.maintainers; [ vlaci ];
+      platforms = lib.platforms.unix;
+      mainProgram = if bigEndian then "sasquatch-v4be" else "sasquatch";
+    };
+  });
+in
+drv
diff --git a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
index 007a951265e4c..c86a5849ac256 100644
--- a/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
+++ b/pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
@@ -1,23 +1,23 @@
 {
-  version = "1.15.0";
+  version = "1.17.0";
 
   x86_64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.15.0/linux/amd64/sysdig-cli-scanner";
-    hash = "sha256-Mwpn8UWyR9gqLXq+buy9GaPUA0i6EOh6ymY4Ezv/vbs=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.17.0/linux/amd64/sysdig-cli-scanner";
+    hash = "sha256-ls5iOdSTFFj3j1pc9Qd2PYqS9YP/BPQBvvE6tVdR0HU=";
   };
 
   aarch64-linux = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.15.0/linux/arm64/sysdig-cli-scanner";
-    hash = "sha256-UeztxyqRtbnF2eRprjMOEO5gAG95sUfrS6ZScvRx/Ag=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.17.0/linux/arm64/sysdig-cli-scanner";
+    hash = "sha256-5R3wpYf+ooRLQbypVxKp7QNgSd/DHmEB+SmVo2qAbKA=";
   };
 
   x86_64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.15.0/darwin/amd64/sysdig-cli-scanner";
-    hash = "sha256-FjKfEtxwTPpMgepu3P0VeefSbhzAWUgb+8UFyQSjVPI=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.17.0/darwin/amd64/sysdig-cli-scanner";
+    hash = "sha256-E4HAxADxOS6t4XnGCeakMFd+zA/rBudlCysUYRv0ALE=";
   };
 
   aarch64-darwin = {
-    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.15.0/darwin/arm64/sysdig-cli-scanner";
-    hash = "sha256-neI+oSbFqIibupKMe2IR3SMMPtiQ7SQlRaxJld6qh6g=";
+    url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.17.0/darwin/arm64/sysdig-cli-scanner";
+    hash = "sha256-vcwWl0FgnwN4okIWDCHC86I82plJwOQbse/QfYCz8oQ=";
   };
 }
diff --git a/pkgs/by-name/ti/tippecanoe/package.nix b/pkgs/by-name/ti/tippecanoe/package.nix
index f869dd452325e..00e211a202776 100644
--- a/pkgs/by-name/ti/tippecanoe/package.nix
+++ b/pkgs/by-name/ti/tippecanoe/package.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tippecanoe";
-  version = "2.62.3";
+  version = "2.62.4";
 
   src = fetchFromGitHub {
     owner = "felt";
     repo = "tippecanoe";
     rev = finalAttrs.version;
-    hash = "sha256-1rj2nfp18EZL9aSiUs1ASJnAqHyM9lztsfkak7Ipy6o=";
+    hash = "sha256-mHeBzXJ4d60tJ1xAN8YldP94GCE8Ch1cvJqMD0ZaV34=";
   };
 
   buildInputs = [ sqlite zlib ];
diff --git a/pkgs/by-name/to/tor-browser/package.nix b/pkgs/by-name/to/tor-browser/package.nix
index c0b1dfb33d428..48d2070a0fbd7 100644
--- a/pkgs/by-name/to/tor-browser/package.nix
+++ b/pkgs/by-name/to/tor-browser/package.nix
@@ -101,7 +101,7 @@ lib.warnIf (useHardenedMalloc != null)
       ++ lib.optionals mediaSupport [ ffmpeg ]
   );
 
-  version = "13.5.4";
+  version = "13.5.5";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -111,7 +111,7 @@ lib.warnIf (useHardenedMalloc != null)
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-2gu/JzkLYvYveOM1XvDpyV3dLoixqKvfmyHGIAz8nis=";
+      hash = "sha256-5Gwr7gKI5HVyAymi04BjiKTAIrYSSLVmIBu882XZ7gw=";
     };
 
     i686-linux = fetchurl {
@@ -121,7 +121,7 @@ lib.warnIf (useHardenedMalloc != null)
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
       ];
-      hash = "sha256-BnJuKKwB6VqsHlRCU1cAuuaNdNu56oSE4z4wYXnyy/Q=";
+      hash = "sha256-kpRtPM7jTYm6wmYiFT89B4Ue7kbsWweUxqXzeNtLCdo=";
     };
   };
 
diff --git a/pkgs/by-name/ze/zed-editor/Cargo.lock b/pkgs/by-name/ze/zed-editor/Cargo.lock
index e7555dd91235f..44273cb00ba1a 100644
--- a/pkgs/by-name/ze/zed-editor/Cargo.lock
+++ b/pkgs/by-name/ze/zed-editor/Cargo.lock
@@ -14375,7 +14375,7 @@ dependencies = [
 
 [[package]]
 name = "zed"
-version = "0.154.2"
+version = "0.154.3"
 dependencies = [
  "activity_indicator",
  "anyhow",
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index a61683205a3fd..119f9148e6094 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -86,13 +86,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "zed-editor";
-  version = "0.154.2";
+  version = "0.154.3";
 
   src = fetchFromGitHub {
     owner = "zed-industries";
     repo = "zed";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DcSlsBwZW2RhzX74eNi0+VBwnxYLl22CbCbZrEOSiFQ=";
+    hash = "sha256-6W4YKtYeLUv1N51YJonb7I2BO4zEESgI8vmMhJVoLDI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/data/icons/numix-icon-theme/default.nix b/pkgs/data/icons/numix-icon-theme/default.nix
index fcf8436323288..88d2240408552 100644
--- a/pkgs/data/icons/numix-icon-theme/default.nix
+++ b/pkgs/data/icons/numix-icon-theme/default.nix
@@ -11,13 +11,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme";
-  version = "24.04.22";
+  version = "24.09.18";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-hFUsj0nODUVbzKyN6ud3HsaoTZBLGW+jjwc6kFFH02c=";
+    sha256 = "sha256-NcsrITf/uiAeCGVxILP7/duzBYTXs1b9Yztsruq1MJg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/data/misc/v2ray-domain-list-community/default.nix b/pkgs/data/misc/v2ray-domain-list-community/default.nix
index ef135367c9ffe..8170852020e23 100644
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@@ -3,12 +3,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20240914091803";
+    version = "20240920063125";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-nfw2gpI99hX3sgCdRST4IZ1RsUxPIMWGsTNuFnvOXkU=";
+      hash = "sha256-NNBC7Pd8mxPuC2LVmedZLtvsnw2LfbD+VEPwtTU5DQE=";
     };
     vendorHash = "sha256-NLh14rXRci4hgDkBJVJDIDvobndB7KYRKAX7UjyqSsg=";
     meta = with lib; {
diff --git a/pkgs/desktops/mate/mate-notification-daemon/default.nix b/pkgs/desktops/mate/mate-notification-daemon/default.nix
index 6ac2b8abaa5dd..eeb65991b605d 100644
--- a/pkgs/desktops/mate/mate-notification-daemon/default.nix
+++ b/pkgs/desktops/mate/mate-notification-daemon/default.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mate-notification-daemon";
-  version = "1.28.0";
+  version = "1.28.1";
 
   src = fetchurl {
     url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "pDEDSOrYZsvLm0xGP00mXMapahp4KpQRoIsjvWXbsuA=";
+    hash = "sha256-//71U76hW+z/XtQNZOGMI9O2ScRZnMHrHoL3BTOFOzQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aiowithings/default.nix b/pkgs/development/python-modules/aiowithings/default.nix
index e2794d241193a..85af5993d8e42 100644
--- a/pkgs/development/python-modules/aiowithings/default.nix
+++ b/pkgs/development/python-modules/aiowithings/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aiowithings";
-  version = "3.0.3";
+  version = "3.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "joostlek";
     repo = "python-withings";
     rev = "refs/tags/v${version}";
-    hash = "sha256-YM+7raD5Wp+pC+R4DV92QN5E+TlNoMnt5M+n6Ax0W9k=";
+    hash = "sha256-pTDHbnL5MfcsQFiaRnKTDAoJ1JwwxRUTB6fQsXjIFl0=";
   };
 
   postPatch = ''
@@ -31,9 +31,9 @@ buildPythonPackage rec {
       --replace "--cov" ""
   '';
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     yarl
   ];
@@ -47,6 +47,29 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "aiowithings" ];
 
+  pytestFlagsArray = [ "--snapshot-update" ];
+
+  disabledTests = [
+    # Tests require network access
+    "test_creating_own_session"
+    "test_error_codes"
+    "test_get_activities"
+    "test_get_devices"
+    "test_get_goals"
+    "test_get_measurement"
+    "test_get_new_device"
+    "test_get_sleep_summary"
+    "test_get_sleep"
+    "test_get_workouts"
+    "test_list_all_subscriptions"
+    "test_list_subscriptions"
+    "test_putting_in_own_session"
+    "test_revoking"
+    "test_subscribing"
+    "test_timeout"
+    "test_unexpected_server_response"
+  ];
+
   meta = with lib; {
     description = "Module to interact with Withings";
     homepage = "https://github.com/joostlek/python-withings";
diff --git a/pkgs/development/python-modules/atlassian-python-api/default.nix b/pkgs/development/python-modules/atlassian-python-api/default.nix
index 5d1a308953820..20e01126b9745 100644
--- a/pkgs/development/python-modules/atlassian-python-api/default.nix
+++ b/pkgs/development/python-modules/atlassian-python-api/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "atlassian-python-api";
-  version = "3.41.15";
+  version = "3.41.16";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "atlassian-api";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-DnsDulCbkilfD51r8x/L3RJXTDclAi4gYNktfuQC0w8=";
+    hash = "sha256-HhFGM8EPGCT3WqVf6WP6VvwsppvzFvHg+ys7GhUUwW0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/cffi/default.nix b/pkgs/development/python-modules/cffi/default.nix
index 6f12d691c7d1b..9ddc6ba9cc63c 100644
--- a/pkgs/development/python-modules/cffi/default.nix
+++ b/pkgs/development/python-modules/cffi/default.nix
@@ -57,14 +57,13 @@ else
         --replace '/usr/include/libffi' '${lib.getDev libffi}/include'
     '';
 
-    nativeBuildInputs = [
-      pkg-config
-      setuptools
-    ];
+    nativeBuildInputs = [ pkg-config ];
+
+    build-system = [ setuptools ];
 
     buildInputs = [ libffi ];
 
-    propagatedBuildInputs = [ pycparser ];
+    dependencies = [ pycparser ];
 
     # The tests use -Werror but with python3.6 clang detects some unreachable code.
     env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument -Wno-unreachable-code -Wno-c++11-narrowing";
diff --git a/pkgs/development/python-modules/dbt-adapters/default.nix b/pkgs/development/python-modules/dbt-adapters/default.nix
index d39b68a3f7dfd..50a775edfa4e9 100644
--- a/pkgs/development/python-modules/dbt-adapters/default.nix
+++ b/pkgs/development/python-modules/dbt-adapters/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "dbt-adapters";
-  version = "1.6.1";
+  version = "1.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dbt-labs";
     repo = "dbt-adapters";
     rev = "refs/tags/v${version}";
-    hash = "sha256-i5sGgkFrW/37PH5XnH2bf/bTNgCZwEgNZT9IMbOJwLQ=";
+    hash = "sha256-I3A3rIMpT+MAq+ebid9RMr6I3W1l4ir78UmfeEr5U3U=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/isal/default.nix b/pkgs/development/python-modules/isal/default.nix
index 3a7ca9a07a2b6..0594330edaf84 100644
--- a/pkgs/development/python-modules/isal/default.nix
+++ b/pkgs/development/python-modules/isal/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "isal";
-  version = "1.7.0";
+  version = "1.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pycompression";
     repo = "python-isal";
     rev = "v${version}";
-    hash = "sha256-wasybbNWBa6Zd0JI2/lBNUkvEOY3/iBqsVWh/4WPM2s=";
+    hash = "sha256-KLnSE7QLM3q8DdoWnCEN6dOxsMr8eSH9k3FqFquZFlE=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/mobly/default.nix b/pkgs/development/python-modules/mobly/default.nix
index 046edf9a3da15..dc76a6d6ea095 100644
--- a/pkgs/development/python-modules/mobly/default.nix
+++ b/pkgs/development/python-modules/mobly/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "mobly";
-  version = "1.12.3";
+  version = "1.12.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "mobly";
     rev = "refs/tags/${version}";
-    hash = "sha256-hhI1jrHJk4wo49MK8J4VTS2dGmHG2kwzgZeSWBXdXkA=";
+    hash = "sha256-77wZK5dqxXUkOgWE7NBpGJBbbtYYxRCJwPbtwLIX09I=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index 3103506106dfd..f341ea7a4288f 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "1.0.2.20240920";
+  version = "1.0.2.20240927";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LZDAepnKR2/BfU/grBE1Aw3wXwt9atAPu3dfh9KZ9tE=";
+    hash = "sha256-nelIcgIsZNa7sqIT7AyA3eZqBpkSZisn/3osvqaBhNk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pulsectl/default.nix b/pkgs/development/python-modules/pulsectl/default.nix
index abdc439fd611e..756826b4500a5 100644
--- a/pkgs/development/python-modules/pulsectl/default.nix
+++ b/pkgs/development/python-modules/pulsectl/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "pulsectl";
-  version = "24.4.0";
+  version = "24.8.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-aX7VDn1FLnhniuOOKrk1hDAIvsRIlVKDzQ+zYoZ+MWU=";
+    hash = "sha256-sFFQbQ1z08xDV879PeF7uFnX7PAE6ZSw98+oeFG8cVY=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pycaption/default.nix b/pkgs/development/python-modules/pycaption/default.nix
index 0707726f58e94..c00712fdfaf90 100644
--- a/pkgs/development/python-modules/pycaption/default.nix
+++ b/pkgs/development/python-modules/pycaption/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pycaption";
-  version = "2.2.12";
+  version = "2.2.14";
 
   disabled = pythonOlder "3.8";
 
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "pbs";
     repo = "pycaption";
     rev = "refs/tags/${version}";
-    hash = "sha256-vdSoqNWEubK0np14EiI/hRbrEx0722qg6Ggcpmhz8FM=";
+    hash = "sha256-9COO8cJRxXiWWceh3XtasSMBq7E5Py0p+1b3sWMaMWE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pypck/default.nix b/pkgs/development/python-modules/pypck/default.nix
index e39adf256656f..a24b786a30c32 100644
--- a/pkgs/development/python-modules/pypck/default.nix
+++ b/pkgs/development/python-modules/pypck/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pypck";
-  version = "0.7.23";
+  version = "0.7.24";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "alengwenus";
     repo = "pypck";
     rev = "refs/tags/${version}";
-    hash = "sha256-CaDwmVx6otBRuPMVpQxaZH/wqkrLgMkq/OnbkkT+VcM=";
+    hash = "sha256-DWdQUnURL3WBi916vOTawtBqq+SHTu4iLViGczwAWQE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 43b815e61ce6b..48131db46a68f 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1240";
+  version = "3.0.1241";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-7ymzyQx59IrvI2GyrCYdNVU/3VLa/VzaFTvgfk4stnM=";
+    hash = "sha256-vL6FcD3M8M9RYJZt4LvQOD0Wr6i8KsAQSokjB/o4Lqw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/zlib-ng/default.nix b/pkgs/development/python-modules/zlib-ng/default.nix
index 697a8405ecbd0..77b3743c0137e 100644
--- a/pkgs/development/python-modules/zlib-ng/default.nix
+++ b/pkgs/development/python-modules/zlib-ng/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "zlib-ng";
-  version = "0.5.0";
+  version = "0.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pycompression";
     repo = "python-zlib-ng";
     rev = "v${version}";
-    hash = "sha256-H8Niz6BbmNCccNKHBfRma4SUt0RY846fCiHidEvcd5E=";
+    hash = "sha256-UsdZgpRI7h6GemT1+1g/cP/8uhLykZ//saH4JMwwlY4=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/build-managers/moon/default.nix b/pkgs/development/tools/build-managers/moon/default.nix
index f576caef09dfa..6204b78692687 100644
--- a/pkgs/development/tools/build-managers/moon/default.nix
+++ b/pkgs/development/tools/build-managers/moon/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "moon";
-  version = "1.28.2";
+  version = "1.28.3";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-T+fPQ9qQ3mdnf80E6L7VYtDQpiGNj209yH+IgmdAgug=";
+    hash = "sha256-X7O5F/gIkj0EOTMat6koKmCba2V/UiIUq0O46gNiCp8=";
   };
 
-  cargoHash = "sha256-PgeVoq0jS7i6WD0cZRHu86zWgxK8fRpJhHujsaFqRy0=";
+  cargoHash = "sha256-I4QLlvN1F4Ptq43A0KpRCnSIxavsvLGnkbJzbiTxjm4=";
 
   env = {
     RUSTFLAGS = "-C strip=symbols";
diff --git a/pkgs/development/tools/continuous-integration/buildbot/master.nix b/pkgs/development/tools/continuous-integration/buildbot/master.nix
index a9e3b01e07e6e..904c5af636d11 100644
--- a/pkgs/development/tools/continuous-integration/buildbot/master.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/master.nix
@@ -71,7 +71,7 @@ let
 in
 buildPythonApplication rec {
   pname = "buildbot";
-  version = "4.0.2";
+  version = "4.0.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -80,7 +80,7 @@ buildPythonApplication rec {
     owner = "buildbot";
     repo = "buildbot";
     rev = "v${version}";
-    hash = "sha256-0ctOInVRJqjmcqy67PTriRmqo3fz1qMEVV+K5lXvZ6k=";
+    hash = "sha256-4jxA8qvLX53cLooCpkn9hvcz4SFGc29TKxUah80Ufp4=";
   };
 
   build-system = [
diff --git a/pkgs/development/tools/continuous-integration/buildbot/plugins.nix b/pkgs/development/tools/continuous-integration/buildbot/plugins.nix
index 530b46d263378..94564ce368535 100644
--- a/pkgs/development/tools/continuous-integration/buildbot/plugins.nix
+++ b/pkgs/development/tools/continuous-integration/buildbot/plugins.nix
@@ -8,7 +8,7 @@
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
-      hash = "sha256-TU5/0KQQbNDpxuntIwQvxGp/7PvBb+iMiAOJA3EAAAA=";
+      hash = "sha256-wBwJXDR52jDRd+8efIjQ+ncWe708k1F21MuvBwhjEwc=";
     };
 
     # Remove unnecessary circular dependency on buildbot
@@ -35,7 +35,7 @@
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
-      hash = "sha256-EtG4vlsoyIDcfKWvkL7ei/BGVItF5wkWPhq4aHfmJ24=";
+      hash = "sha256-JJK1vmTdOImKIM1glrTjo2E0KnotU2QJVc2OIzVQQ1Y=";
     };
 
     # Remove unnecessary circular dependency on buildbot
@@ -62,7 +62,7 @@
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
-      hash = "sha256-gNei1LZXV7G+8u0AtNDSsj98LprsbyIFR94N4+AXO54=";
+      hash = "sha256-kzj4IPNn/cUW7nidOLyO7AD98uXxWcqvMxaOhXhFn74=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -84,7 +84,7 @@
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
-      hash = "sha256-CJ14Se4Wlpb7jt5u1VVmd0MnUdO2l7KfQyVQbO7hMhA=";
+      hash = "sha256-4quLblPknI/vrCNF7Frl5+UlY50vuspW0XmMJubvVXI=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -106,7 +106,7 @@
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
-      hash = "sha256-lY8ljjGaZ0i7aY1rR//7M7H83ZTSQj9CnTafWXner94=";
+      hash = "sha256-VC84rftiA7/x0X3lJfHTrEZve/ZDncVDuq6fisEI8nc=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -128,7 +128,7 @@
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
-      hash = "sha256-XZAInGgM/hm4Rxk0usH0NRiCuq19XJeYuwJNF2gtn3M=";
+      hash = "sha256-2HZBnVvxPhU6rLmG6l9hX51zm8pvA5amsjExGx65+OQ=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -150,7 +150,7 @@
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
-      hash = "sha256-RRdHvlm+98Cu+qiIhDMx6W65bQ30ULTKZrz05Xm32gg=";
+      hash = "sha256-IwTANqPNGon4lvT2ASpguEf8GcD1hz/7flNBml0NTdc=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -172,7 +172,7 @@
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
-      hash = "sha256-sg/40zP3YMF8e3GsL+A9gtCUlhoqKqHNeFUycQrQNJc=";
+      hash = "sha256-SQiaIcupEtNePr4LUzwYm3RRKT9xa7RnHUaiE8EaRzQ=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -194,7 +194,7 @@
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
-      hash = "sha256-pE6wDMLYGtDgaRjqv/SS9bm6F58molO9oQI3XklcWfg=";
+      hash = "sha256-dzK4WvBRxWoAfhsdKoYUnsG97OKmM8Jgr4Uv7NPpiVk=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -216,7 +216,7 @@
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
-      hash = "sha256-ZgnfiQtKCs1Ui9KiUMaSbtaMnCgSgH+IzJTXWYcG/fE=";
+      hash = "sha256-vytU7WRdXWHazc/LYZSWlslkOb3lnTitEW3UZQ/VmTU=";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -238,7 +238,7 @@
 
     src = fetchurl {
       url = "https://github.com/buildbot/buildbot/releases/download/v${version}/${pname}-${version}.tar.gz";
-      hash = "sha256-yxbLY3LiT0qmRiz7+/F/TuODiSnteq0891fxAGSU7yY=";
+      hash = "sha256-O71qB9uIigYcK/t2t+481oktHjF5up1nk1dS4eEMb3A=";
     };
 
     buildInputs = [ buildbot-pkg ];
diff --git a/pkgs/development/tools/ejson/Gemfile b/pkgs/development/tools/ejson/Gemfile
deleted file mode 100644
index f860fe5075d46..0000000000000
--- a/pkgs/development/tools/ejson/Gemfile
+++ /dev/null
@@ -1,4 +0,0 @@
-source 'https://rubygems.org'
-
-gem 'fpm'
-gem 'ronn'
diff --git a/pkgs/development/tools/ejson/Gemfile.lock b/pkgs/development/tools/ejson/Gemfile.lock
deleted file mode 100644
index d0a51c0a06238..0000000000000
--- a/pkgs/development/tools/ejson/Gemfile.lock
+++ /dev/null
@@ -1,54 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    arr-pm (0.0.10)
-      cabin (> 0)
-    backports (3.14.0)
-    cabin (0.9.0)
-    childprocess (0.9.0)
-      ffi (~> 1.0, >= 1.0.11)
-    clamp (1.0.1)
-    dotenv (2.7.2)
-    ffi (1.10.0)
-    fpm (1.11.0)
-      arr-pm (~> 0.0.10)
-      backports (>= 2.6.2)
-      cabin (>= 0.6.0)
-      childprocess (= 0.9.0)
-      clamp (~> 1.0.0)
-      ffi
-      json (>= 1.7.7, < 2.0)
-      pleaserun (~> 0.0.29)
-      ruby-xz (~> 0.2.3)
-      stud
-    hpricot (0.8.6)
-    insist (1.0.0)
-    io-like (0.3.0)
-    json (1.8.6)
-    mustache (0.99.8)
-    pleaserun (0.0.30)
-      cabin (> 0)
-      clamp
-      dotenv
-      insist
-      mustache (= 0.99.8)
-      stud
-    rdiscount (2.2.0.1)
-    ronn (0.7.3)
-      hpricot (>= 0.8.2)
-      mustache (>= 0.7.0)
-      rdiscount (>= 1.5.8)
-    ruby-xz (0.2.3)
-      ffi (~> 1.9)
-      io-like (~> 0.3)
-    stud (0.0.23)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  fpm
-  ronn
-
-BUNDLED WITH
-   2.1.4
diff --git a/pkgs/development/tools/ejson/default.nix b/pkgs/development/tools/ejson/default.nix
index 42e5e6cb33a52..9c4427dc4ea9e 100644
--- a/pkgs/development/tools/ejson/default.nix
+++ b/pkgs/development/tools/ejson/default.nix
@@ -1,38 +1,26 @@
-{ lib, bundlerEnv, ruby, buildGoModule, fetchFromGitHub }:
-let
-  # needed for manpage generation
-  gems = bundlerEnv {
-    name = "ejson-gems";
-    gemdir = ./.;
-    inherit ruby;
-  };
-in
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
 buildGoModule rec {
   pname = "ejson";
-  version = "1.3.3";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "Shopify";
     repo = "ejson";
     rev = "v${version}";
-    sha256 = "sha256-M2Gk+/l1tNlIAe1/fR1WLEOey+tjCUmMAujc76gmeZA=";
+    sha256 = "sha256-Pv0eoFf/E+PE/C+0wsSQxhVTlymOMAYk5UVQP2udpnA=";
   };
 
-  vendorHash = "sha256-9+x7HrbXRoS/7ZADWwhsbynQLr3SyCbcsp9QnSubov0=";
-
-  nativeBuildInputs = [ gems ];
-
-  ldflags = [ "-s" "-w" ];
-
-  # set HOME, otherwise bundler will insert stuff in the manpages
-  postBuild = ''
-    HOME=$PWD make man SHELL=$SHELL
-  '';
+  vendorHash = "sha256-N2vcj3STkaZO2eRr8VztZTWOBUTI+wOri0HYDJ1KiN8=";
 
-  postInstall = ''
-    mkdir -p $out/share
-    cp -r build/man $out/share
-  '';
+  ldflags = [
+    "-s"
+    "-w"
+  ];
 
   meta = with lib; {
     description = "Small library to manage encrypted secrets using asymmetric encryption";
diff --git a/pkgs/development/tools/ejson/gemset.nix b/pkgs/development/tools/ejson/gemset.nix
deleted file mode 100644
index 93fa1131f2a7a..0000000000000
--- a/pkgs/development/tools/ejson/gemset.nix
+++ /dev/null
@@ -1,188 +0,0 @@
-{
-  arr-pm = {
-    dependencies = ["cabin"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "07yx1g1nh4zdy38i2id1xyp42fvj4vl6i196jn7szvjfm0jx98hg";
-      type = "gem";
-    };
-    version = "0.0.10";
-  };
-  backports = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "17j5pf0b69bkn043wi4xd530ky53jbbnljr4bsjzlm4k8bzlknfn";
-      type = "gem";
-    };
-    version = "3.14.0";
-  };
-  cabin = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0b3b8j3iqnagjfn1261b9ncaac9g44zrx1kcg81yg4z9i513kici";
-      type = "gem";
-    };
-    version = "0.9.0";
-  };
-  childprocess = {
-    dependencies = ["ffi"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0a61922kmvcxyj5l70fycapr87gz1dzzlkfpq85rfqk5vdh3d28p";
-      type = "gem";
-    };
-    version = "0.9.0";
-  };
-  clamp = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0jb6l4scp69xifhicb5sffdixqkw8wgkk9k2q57kh2y36x1px9az";
-      type = "gem";
-    };
-    version = "1.0.1";
-  };
-  dotenv = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "13cis6bf06hmz744xrsl163p6gb78xcm8g8q4pcabsy5ywyv6kag";
-      type = "gem";
-    };
-    version = "2.7.2";
-  };
-  ffi = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0j8pzj8raxbir5w5k6s7a042sb5k02pg0f8s4na1r5lan901j00p";
-      type = "gem";
-    };
-    version = "1.10.0";
-  };
-  fpm = {
-    dependencies = ["arr-pm" "backports" "cabin" "childprocess" "clamp" "ffi" "json" "pleaserun" "ruby-xz" "stud"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0khzsiqzswxpql6w2ws9dawb27zgv4nmgrjszydmm0xpv6h21jrm";
-      type = "gem";
-    };
-    version = "1.11.0";
-  };
-  hpricot = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1jn8x9ch79gqmnzgyz78kppavjh5lqx0y0r6frykga2b86rz9s6z";
-      type = "gem";
-    };
-    version = "0.8.6";
-  };
-  insist = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0bw3bdwns14mapbgb8cbjmr0amvwz8y72gyclq04xp43wpp5jrvg";
-      type = "gem";
-    };
-    version = "1.0.0";
-  };
-  io-like = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "04nn0s2wmgxij3k760h3r8m1dgih5dmd9h4v1nn085yi824i5z6k";
-      type = "gem";
-    };
-    version = "0.3.0";
-  };
-  json = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0qmj7fypgb9vag723w1a49qihxrcf5shzars106ynw2zk352gbv5";
-      type = "gem";
-    };
-    version = "1.8.6";
-  };
-  mustache = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1g5hplm0k06vwxwqzwn1mq5bd02yp0h3rym4zwzw26aqi7drcsl2";
-      type = "gem";
-    };
-    version = "0.99.8";
-  };
-  pleaserun = {
-    dependencies = ["cabin" "clamp" "dotenv" "insist" "mustache" "stud"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0hgnrl67zkqaxmfkwbyscawj4wqjm7h8khpbj58s6iw54wp3408p";
-      type = "gem";
-    };
-    version = "0.0.30";
-  };
-  rdiscount = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1arvk3k06prxasq1djbj065ixar4zl171340g7wr1ww4gj9makx3";
-      type = "gem";
-    };
-    version = "2.2.0.1";
-  };
-  ronn = {
-    dependencies = ["hpricot" "mustache" "rdiscount"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "07plsxxfx5bxdk72ii9za6km0ziqlq8jh3bicr4774dalga6zpw2";
-      type = "gem";
-    };
-    version = "0.7.3";
-  };
-  ruby-xz = {
-    dependencies = ["ffi" "io-like"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "11bgpvvk0098ghvlxr4i713jmi2izychalgikwvdwmpb452r3ndw";
-      type = "gem";
-    };
-    version = "0.2.3";
-  };
-  stud = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0qpb57cbpm9rwgsygqxifca0zma87drnlacv49cqs2n5iyi6z8kb";
-      type = "gem";
-    };
-    version = "0.0.23";
-  };
-}
diff --git a/pkgs/development/tools/language-servers/nixd/default.nix b/pkgs/development/tools/language-servers/nixd/default.nix
index b4736c0b61738..ffa06bb33933e 100644
--- a/pkgs/development/tools/language-servers/nixd/default.nix
+++ b/pkgs/development/tools/language-servers/nixd/default.nix
@@ -21,13 +21,13 @@
 
 let
   common = rec {
-    version = "2.3.2";
+    version = "2.4.0";
 
     src = fetchFromGitHub {
       owner = "nix-community";
       repo = "nixd";
       rev = version;
-      hash = "sha256-ffHLKHpqgVlYLGQ/Dc/6hW/inA98QdMJiv/fT2IrH7c=";
+      hash = "sha256-8F97zAu+icDC9ZYS7m+Y58oZQ7R3gVuXMvzAfgkVmJo=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/development/tools/sentry-cli/default.nix b/pkgs/development/tools/sentry-cli/default.nix
index 52e7927bb18a3..5ceb744d504fd 100644
--- a/pkgs/development/tools/sentry-cli/default.nix
+++ b/pkgs/development/tools/sentry-cli/default.nix
@@ -11,13 +11,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "2.36.1";
+  version = "2.36.3";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    sha256 = "sha256-kmrSoUrhBJPgIAcMg73Ne4r8Wkx+SXiiNXbtfVp0Q88=";
+    sha256 = "sha256-iqWOcGuDblFKla90w2J8gV2Fv8RjsgfG1VLuNDz4Poc=";
   };
   doCheck = false;
 
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices Security SystemConfiguration ];
   nativeBuildInputs = [ installShellFiles pkg-config ];
 
-  cargoHash = "sha256-fzQfU3xlRwV/GI69+sd7zz4okbNHbFAskJPgI1X0KQo=";
+  cargoHash = "sha256-TIAKUoiPWlNtcL0Iu/CGLSx8dm9x0GQCtxPCg+t9zyw=";
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd sentry-cli \
diff --git a/pkgs/kde/default.nix b/pkgs/kde/default.nix
index ee011c3a7ae8c..f5092b6da53d3 100644
--- a/pkgs/kde/default.nix
+++ b/pkgs/kde/default.nix
@@ -68,6 +68,7 @@ let
         selenium-webdriver-at-spi = null; # Used for integration tests that we don't run, stub
 
         alpaka = self.callPackage ./misc/alpaka { };
+        calligra = self.callPackage ./misc/calligra { };
         kdiagram = self.callPackage ./misc/kdiagram { };
         kdevelop-pg-qt = self.callPackage ./misc/kdevelop-pg-qt { };
         kdsoap-ws-discovery-client = self.callPackage ./misc/kdsoap-ws-discovery-client { };
diff --git a/pkgs/kde/misc/calligra/default.nix b/pkgs/kde/misc/calligra/default.nix
new file mode 100644
index 0000000000000..ff407e1a142f7
--- /dev/null
+++ b/pkgs/kde/misc/calligra/default.nix
@@ -0,0 +1,76 @@
+{
+  mkKdeDerivation,
+  lib,
+  fetchurl,
+  boost,
+  eigen,
+  imath,
+  libetonyek,
+  libgit2,
+  libodfgen,
+  librevenge,
+  libvisio,
+  libwpd,
+  libwpg,
+  libwps,
+  okular,
+  perl,
+  pkg-config,
+  poppler,
+  qtkeychain,
+  qtsvg,
+}:
+
+mkKdeDerivation rec {
+  pname = "calligra";
+  version = "4.0.1";
+
+  src = fetchurl {
+    url = "mirror://kde/stable/calligra/calligra-${version}.tar.xz";
+    hash = "sha256-1AH15z9PG9wLNUjqGlCwrBd4we3jCmozWUTtf72I2V8=";
+  };
+
+  extraBuildInputs = [
+    boost
+    eigen
+    imath
+    libetonyek
+    libgit2
+    libodfgen
+    librevenge
+    libvisio
+    libwpd
+    libwpg
+    libwps
+    okular
+    poppler
+    qtkeychain
+    qtsvg
+  ];
+
+  extraNativeBuildInputs = [
+    perl
+    pkg-config
+  ];
+
+  # Recommended by the upstream packaging instructions. RELEASE_BUILD disables
+  # unmaintained components, like Braindump, from being built, and KDE_NO_DEBUG_OUTPUT
+  # is supposed to improve performance in the finished package.
+  extraCmakeFlags = [
+    (lib.cmakeBool "RELEASE_BUILD" true)
+    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DKDE_NO_DEBUG_OUTPUT")
+  ];
+
+  meta = {
+    maintainers = with lib.maintainers; [
+      ebzzry
+      zraexy
+      sigmasquadron
+    ];
+    license = with lib.licenses; [
+      gpl2
+      lgpl2
+    ];
+    mainProgram = "calligralauncher";
+  };
+}
diff --git a/pkgs/servers/monitoring/grafana-agent/default.nix b/pkgs/servers/monitoring/grafana-agent/default.nix
index c45ea47bac92b..1382302def422 100644
--- a/pkgs/servers/monitoring/grafana-agent/default.nix
+++ b/pkgs/servers/monitoring/grafana-agent/default.nix
@@ -15,16 +15,16 @@
 
 buildGoModule rec {
   pname = "grafana-agent";
-  version = "0.43.0";
+  version = "0.43.3";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "agent";
     rev = "v${version}";
-    hash = "sha256-0pwsZONhouGuypGTP64oJd3+nq8VMlyulb/WUJj0qGw=";
+    hash = "sha256-10H3qcvjbmwKL06u+gCxfAdn1z6HaJ/8sWoVa2/ojnA=";
   };
 
-  vendorHash = "sha256-vz65gr56wj6PNiQwmfz1wg9SVmRUnrv7ZeWQkqdA4WI=";
+  vendorHash = "sha256-NtFdrdDnuLT5CSax81smNnZxe+I9OouwVyIANyTNzF8=";
   proxyVendor = true; # darwin/linux hash mismatch
 
   frontendYarnOfflineCache = fetchYarnDeps {
diff --git a/pkgs/tools/filesystems/sasquatch/default.nix b/pkgs/tools/filesystems/sasquatch/default.nix
deleted file mode 100644
index f8d66683fccbf..0000000000000
--- a/pkgs/tools/filesystems/sasquatch/default.nix
+++ /dev/null
@@ -1,76 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchurl
-, xz
-, lzo
-, zlib
-, zstd
-, lz4
-, lz4Support ? false
-}:
-
-let
-  patch = fetchFromGitHub
-    {
-      # NOTE: This uses my personal fork for now, until
-      # https://github.com/devttys0/sasquatch/pull/40 is merged.
-      # I, cole-h, will keep this fork available until that happens.
-      owner = "cole-h";
-      repo = "sasquatch";
-      rev = "6edc54705454c6410469a9cb5bc58e412779731a";
-      sha256 = "x+PuPYGD4Pd0fcJtlLWByGy/nggsmZkxwSXxJfPvUgo=";
-    } + "/patches/patch0.txt";
-in
-stdenv.mkDerivation rec {
-  pname = "sasquatch";
-  version = "4.4";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/squashfs/squashfs${version}.tar.gz";
-    sha256 = "qYGz8/IFS1ouZYhRo8BqJGCtBKmopkXgr+Bjpj/bsH4=";
-  };
-
-  buildInputs = [
-    xz
-    lzo
-    zlib
-    zstd
-  ]
-  ++ lib.optionals lz4Support [ lz4 ];
-
-  patches = [ patch ];
-  patchFlags = [ "-p0" ];
-
-  postPatch = ''
-    # Drop blanket -Werror to avoid build failure on fresh toolchains
-    # like gcc-11.
-    substituteInPlace squashfs-tools/Makefile --replace ' -Werror' ' '
-    cd squashfs-tools
-  '';
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: unsquashfs_xattr.o:/build/squashfs4.4/squashfs-tools/error.h:34: multiple definition of
-  #     `verbose'; unsquashfs.o:/build/squashfs4.4/squashfs-tools/error.h:34: first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-
-  installFlags = [ "INSTALL_DIR=\${out}/bin" ];
-
-  makeFlags = [
-    "XZ_SUPPORT=1"
-    "CC=${stdenv.cc.targetPrefix}cc"
-    "CXX=${stdenv.cc.targetPrefix}c++"
-    "AR=${stdenv.cc.targetPrefix}ar"
-  ]
-    ++ lib.optional lz4Support "LZ4_SUPPORT=1";
-
-  meta = with lib; {
-    homepage = "https://github.com/devttys0/sasquatch";
-    description = "Set of patches to the standard unsquashfs utility (part of squashfs-tools) that attempts to add support for as many hacked-up vendor-specific SquashFS implementations as possible";
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.pamplemousse ];
-    platforms = platforms.linux;
-    mainProgram = "sasquatch";
-  };
-}
diff --git a/pkgs/tools/inputmethods/keyd/default.nix b/pkgs/tools/inputmethods/keyd/default.nix
index d74cc15254990..7395c807389a1 100644
--- a/pkgs/tools/inputmethods/keyd/default.nix
+++ b/pkgs/tools/inputmethods/keyd/default.nix
@@ -8,13 +8,13 @@
 }:
 
 let
-  version = "2.4.3";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "rvaiya";
     repo = "keyd";
     rev = "v" + version;
-    hash = "sha256-NhZnFIdK0yHgFR+rJm4cW+uEhuQkOpCSLwlXNQy6jas=";
+    hash = "sha256-pylfQjTnXiSzKPRJh9Jli1hhin/MIGIkZxLKxqlReVo=";
   };
 
   pypkgs = python3.pkgs;
@@ -26,7 +26,7 @@ let
 
     postPatch = ''
       substituteInPlace scripts/${pname} \
-        --replace /bin/sh ${runtimeShell}
+        --replace-fail /bin/sh ${runtimeShell}
     '';
 
     propagatedBuildInputs = with pypkgs; [ xlib ];
@@ -47,10 +47,10 @@ stdenv.mkDerivation {
 
   postPatch = ''
     substituteInPlace Makefile \
-      --replace /usr ""
+      --replace-fail /usr/local ""
 
-    substituteInPlace keyd.service \
-      --replace /usr/bin $out/bin
+    substituteInPlace keyd.service.in \
+      --replace-fail @PREFIX@ $out
   '';
 
   installFlags = [ "DESTDIR=${placeholder "out"}" ];
@@ -72,7 +72,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Key remapping daemon for Linux";
     license = licenses.mit;
-    maintainers = with maintainers; [ peterhoeg ];
+    maintainers = with maintainers; [ alfarel ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/misc/tmux/default.nix b/pkgs/tools/misc/tmux/default.nix
index d8b40913c9c8e..e1b7d4dd6371f 100644
--- a/pkgs/tools/misc/tmux/default.nix
+++ b/pkgs/tools/misc/tmux/default.nix
@@ -27,7 +27,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tmux";
-  version = "3.4";
+  version = "3.5";
 
   outputs = [ "out" "man" ];
 
@@ -35,33 +35,9 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "tmux";
     repo = "tmux";
     rev = finalAttrs.version;
-    hash = "sha256-RX3RZ0Mcyda7C7im1r4QgUxTnp95nfpGgQ2HRxr0s64=";
+    hash = "sha256-8CRZj7UyBhuB5QO27Y+tHG62S/eGxPOHWrwvh1aBqq0=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/tmux/tmux/commit/2d1afa0e62a24aa7c53ce4fb6f1e35e29d01a904.diff";
-      hash = "sha256-mDt5wy570qrUc0clGa3GhZFTKgL0sfnQcWJEJBKAbKs=";
-    })
-    # this patch is designed for android but FreeBSD exhibits the same error for the same reason
-    (fetchpatch {
-      url = "https://github.com/tmux/tmux/commit/4f5a944ae3e8f7a230054b6c0b26f423fa738e71.patch";
-      hash = "sha256-HlUeU5ZicPe7Ya8A1HpunxfVOE2BF6jOHq3ZqTuU5RE=";
-    })
-    # https://github.com/tmux/tmux/issues/3983
-    # fix tmux crashing when neovim is used in a ssh session
-    (fetchpatch {
-      url = "https://github.com/tmux/tmux/commit/aa17f0e0c1c8b3f1d6fc8617613c74f07de66fae.patch";
-      hash = "sha256-jhWGnC9tsGqTTA5tU+i4G3wlwZ7HGz4P0UHl17dVRU4=";
-    })
-    # https://github.com/tmux/tmux/issues/3905
-    # fix tmux hanging on shutdown
-    (fetchpatch {
-      url = "https://github.com/tmux/tmux/commit/3823fa2c577d440649a84af660e4d3b0c095d248.patch";
-      hash = "sha256-FZDy/ZgVdwUAam8g5SfGBSnMhp2nlHHfrO9eJNIhVPo=";
-    })
-  ];
-
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index bcaf0dc28f39e..0a7102d039506 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -215,6 +215,7 @@ mapAliases {
 
   ### C ###
 
+  calligra = kdePackages.calligra; # Added 2024-09-27
   callPackage_i686 = pkgsi686Linux.callPackage;
   cadence = throw "cadence has been removed from nixpkgs, as it was archived upstream"; # Added 2023-10-28
   cask = emacs.pkgs.cask; # Added 2022-11-12
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3d80d39bedd7d..a64efcbc2472e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2186,15 +2186,7 @@ with pkgs;
     humanfriendly;
   };
 
-  git-annex-remote-googledrive = callPackage ../applications/version-management/git-annex-remote-googledrive {
-    inherit (python3Packages)
-    buildPythonApplication
-    annexremote
-    drivelib
-    gitpython
-    tenacity
-    humanfriendly;
-  };
+  git-annex-remote-googledrive = python3Packages.callPackage ../applications/version-management/git-annex-remote-googledrive { };
 
   git-annex-remote-rclone = callPackage ../applications/version-management/git-annex-remote-rclone { };
 
@@ -2417,8 +2409,6 @@ with pkgs;
 
   gut = callPackage ../applications/version-management/gut { };
 
-  hred = callPackage ../development/tools/hred { };
-
   hub = callPackage ../applications/version-management/hub { };
 
   hut = callPackage ../applications/version-management/hut { };
@@ -12142,8 +12132,6 @@ with pkgs;
 
   sanctity = callPackage ../tools/misc/sanctity { };
 
-  sasquatch = callPackage ../tools/filesystems/sasquatch { };
-
   sasview = libsForQt5.callPackage ../applications/science/misc/sasview { };
 
   sbs = callPackage ../tools/X11/sbs { };
@@ -28707,8 +28695,6 @@ with pkgs;
     calicoctl
     confd-calico;
 
-  calligra = libsForQt5.callPackage ../applications/office/calligra { };
-
   perkeep = callPackage ../applications/misc/perkeep { };
 
   canto-curses = callPackage ../applications/networking/feedreaders/canto-curses { };