Merge master into staging-next

2024-02-07 00:02:01 +00:00 · 2024-02-07 00:02:01 +00:00 · 9824e51195
commit 9824e51195
parent 175f7054d5 0b9427cf71
66 changed files with 4837 additions and 5889 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -19163,6 +19163,7 @@
  tomasajt = {
    github = "TomaSajt";
    githubId = 62384384;
+    matrix = "@tomasajt:matrix.org";
    name = "TomaSajt";
    keys = [{
      fingerprint = "8CA9 8016 F44D B717 5B44  6032 F011 163C 0501 22A1";
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -219,6 +219,7 @@
  ./programs/msmtp.nix
  ./programs/mtr.nix
  ./programs/nano.nix
+  ./programs/nautilus-open-any-terminal.nix
  ./programs/nbd.nix
  ./programs/neovim.nix
  ./programs/nethoscope.nix
--- a/nixos/modules/services/cluster/kubernetes/pki.nix
+++ b/nixos/modules/services/cluster/kubernetes/pki.nix
@ -174,9 +174,8 @@ in
      '')
      (optionalString cfg.genCfsslAPIToken ''
        if [ ! -f "${cfsslAPITokenPath}" ]; then
-          head -c ${toString (cfsslAPITokenLength / 2)} /dev/urandom | od -An -t x | tr -d ' ' >"${cfsslAPITokenPath}"
+          install -u cfssl -m 400 <(head -c ${toString (cfsslAPITokenLength / 2)} /dev/urandom | od -An -t x | tr -d ' ') "${cfsslAPITokenPath}"
        fi
-        chown cfssl "${cfsslAPITokenPath}" && chmod 400 "${cfsslAPITokenPath}"
      '')]);

    systemd.services.kube-certmgr-bootstrap = {
@ -194,7 +193,7 @@ in
        if [ -f "${cfsslAPITokenPath}" ]; then
          ln -fs "${cfsslAPITokenPath}" "${certmgrAPITokenPath}"
        else
-          touch "${certmgrAPITokenPath}" && chmod 600 "${certmgrAPITokenPath}"
+          install -m 600 /dev/null "${certmgrAPITokenPath}"
        fi
      ''
      (optionalString (cfg.pkiTrustOnBootstrap) ''
@ -297,8 +296,7 @@ in
          exit 1
        fi

-        echo $token > ${certmgrAPITokenPath}
-        chmod 600 ${certmgrAPITokenPath}
+        install -m 0600 <(echo $token) ${certmgrAPITokenPath}

        echo "Restarting certmgr..." >&1
        systemctl restart certmgr
--- a/nixos/modules/services/video/frigate.nix
+++ b/nixos/modules/services/video/frigate.nix
@ -17,7 +17,7 @@ let

  cfg = config.services.frigate;

-  format = pkgs.formats.yaml {};
+  format = pkgs.formats.yaml { };

  filteredConfig = lib.converge (lib.filterAttrsRecursive (_: v: ! lib.elem v [ null ])) cfg.settings;

@ -112,7 +112,7 @@ in
          };
        };
      };
-      default = {};
+      default = { };
      description = mdDoc ''
        Frigate configuration as a nix attribute set.

@ -125,7 +125,7 @@ in

  config = mkIf cfg.enable {
    services.nginx = {
-      enable =true;
+      enable = true;
      additionalModules = with pkgs.nginxModules; [
        secure-token
        rtmp
@ -133,31 +133,64 @@ in
      ];
      recommendedProxySettings = mkDefault true;
      recommendedGzipSettings = mkDefault true;
+      mapHashBucketSize = mkDefault 128;
      upstreams = {
        frigate-api.servers = {
-          "127.0.0.1:5001" = {};
+          "127.0.0.1:5001" = { };
        };
        frigate-mqtt-ws.servers = {
-          "127.0.0.1:5002" = {};
+          "127.0.0.1:5002" = { };
        };
        frigate-jsmpeg.servers = {
-          "127.0.0.1:8082" = {};
+          "127.0.0.1:8082" = { };
        };
        frigate-go2rtc.servers = {
-          "127.0.0.1:1984" = {};
+          "127.0.0.1:1984" = { };
        };
      };
-      # Based on https://github.com/blakeblackshear/frigate/blob/v0.12.0/docker/rootfs/usr/local/nginx/conf/nginx.conf
+      proxyCachePath."frigate" = {
+        enable = true;
+        keysZoneSize = "10m";
+        keysZoneName = "frigate_api_cache";
+        maxSize = "10m";
+        inactive = "1m";
+        levels = "1:2";
+      };
+      # Based on https://github.com/blakeblackshear/frigate/blob/v0.13.1/docker/main/rootfs/usr/local/nginx/conf/nginx.conf
      virtualHosts."${cfg.hostname}" = {
        locations = {
          "/api/" = {
            proxyPass = "http://frigate-api/";
+            extraConfig = ''
+              proxy_cache frigate_api_cache;
+              proxy_cache_lock on;
+              proxy_cache_use_stale updating;
+              proxy_cache_valid 200 5s;
+              proxy_cache_bypass $http_x_cache_bypass;
+              proxy_no_cache $should_not_cache;
+              add_header X-Cache-Status $upstream_cache_status;
+
+              location /api/vod/ {
+                  proxy_pass http://frigate-api/vod/;
+                  proxy_cache off;
+              }
+
+              location /api/stats {
+                  access_log off;
+                  rewrite ^/api/(.*)$ $1 break;
+                  proxy_pass http://frigate-api;
+              }
+
+              location /api/version {
+                  access_log off;
+                  rewrite ^/api/(.*)$ $1 break;
+                  proxy_pass http://frigate-api;
+              }
+            '';
          };
          "~* /api/.*\.(jpg|jpeg|png)$" = {
            proxyPass = "http://frigate-api";
            extraConfig = ''
-              add_header 'Access-Control-Allow-Origin' '*';
-              add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
              rewrite ^/api/(.*)$ $1 break;
            '';
          };
@ -169,10 +202,6 @@ in
              secure_token $args;
              secure_token_types application/vnd.apple.mpegurl;

-              add_header Access-Control-Allow-Headers '*';
-              add_header Access-Control-Expose-Headers 'Server,range,Content-Length,Content-Range';
-              add_header Access-Control-Allow-Methods 'GET, HEAD, OPTIONS';
-              add_header Access-Control-Allow-Origin '*';
              add_header Cache-Control "no-store";
              expires off;
            '';
@ -192,27 +221,64 @@ in
            proxyPass = "http://frigate-go2rtc/";
            proxyWebsockets = true;
          };
+          # frigate lovelace card uses this path
+          "/live/mse/api/ws" = {
+            proxyPass = "http://frigate-go2rtc/api/ws";
+            proxyWebsockets = true;
+            extraConfig = ''
+              limit_except GET {
+                  deny  all;
+              }
+            '';
+          };
          "/live/webrtc/" = {
            proxyPass = "http://frigate-go2rtc/";
            proxyWebsockets = true;
          };
+          "/live/webrtc/api/ws" = {
+            proxyPass = "http://frigate-go2rtc/api/ws";
+            proxyWebsockets = true;
+            extraConfig = ''
+              limit_except GET {
+                  deny  all;
+              }
+            '';
+          };
+          # pass through go2rtc player
+          "/live/webrtc/webrtc.html" = {
+            proxyPass = "http://frigate-go2rtc/webrtc.html";
+            proxyWebsockets = true;
+            extraConfig = ''
+              limit_except GET {
+                  deny  all;
+              }
+            '';
+          };
+          "/api/go2rtc/api" = {
+            proxyPass = "http://frigate-go2rtc/api";
+            proxyWebsockets = true;
+            extraConfig = ''
+              limit_except GET {
+                  deny  all;
+              }
+            '';
+          };
+          # integrationn uses this to add webrtc candidate
+          "/api/go2rtc/webrtc" = {
+            proxyPass = "http://frigate-go2rtc/api/webrtc";
+            proxyWebsockets = true;
+            extraConfig = ''
+              limit_except GET {
+                  deny  all;
+              }
+            '';
+          };
          "/cache/" = {
            alias = "/var/cache/frigate/";
          };
          "/clips/" = {
            root = "/var/lib/frigate";
            extraConfig = ''
-              add_header 'Access-Control-Allow-Origin' "$http_origin" always;
-              add_header 'Access-Control-Allow-Credentials' 'true';
-              add_header 'Access-Control-Expose-Headers' 'Content-Length';
-              if ($request_method = 'OPTIONS') {
-                  add_header 'Access-Control-Allow-Origin' "$http_origin";
-                  add_header 'Access-Control-Max-Age' 1728000;
-                  add_header 'Content-Type' 'text/plain charset=UTF-8';
-                  add_header 'Content-Length' 0;
-                  return 204;
-              }
-
              types {
                  video/mp4 mp4;
                  image/jpeg jpg;
@ -224,17 +290,6 @@ in
          "/recordings/" = {
            root = "/var/lib/frigate";
            extraConfig = ''
-              add_header 'Access-Control-Allow-Origin' "$http_origin" always;
-              add_header 'Access-Control-Allow-Credentials' 'true';
-              add_header 'Access-Control-Expose-Headers' 'Content-Length';
-              if ($request_method = 'OPTIONS') {
-                  add_header 'Access-Control-Allow-Origin' "$http_origin";
-                  add_header 'Access-Control-Max-Age' 1728000;
-                  add_header 'Content-Type' 'text/plain charset=UTF-8';
-                  add_header 'Content-Length' 0;
-                  return 204;
-              }
-
              types {
                  video/mp4 mp4;
              }
@ -315,6 +370,12 @@ in
            }
        }
      '';
+      appendHttpConfig = ''
+        map $sent_http_content_type $should_not_cache {
+          'application/json' 0;
+          default 1;
+        }
+      '';
    };

    systemd.services.nginx.serviceConfig.SupplementaryGroups = [
@ -325,7 +386,7 @@ in
      isSystemUser = true;
      group = "frigate";
    };
-    users.groups.frigate = {};
+    users.groups.frigate = { };

    systemd.services.frigate = {
      after = [
--- a/nixos/modules/services/web-apps/photoprism.nix
+++ b/nixos/modules/services/web-apps/photoprism.nix
@ -21,7 +21,7 @@ let
      eval "$(${config.systemd.package}/bin/systemctl show -pUID,MainPID photoprism.service | ${pkgs.gnused}/bin/sed "s/UID/ServiceUID/")"
      exec ${pkgs.util-linux}/bin/nsenter \
        -t $MainPID -m -S $ServiceUID -G $ServiceUID --wdns=${cfg.storagePath} \
-      exec ${cfg.package}/bin/photoprism "$@"
+        ${cfg.package}/bin/photoprism "$@"
    '';
 in
 {
--- a/nixos/tests/frigate.nix
+++ b/nixos/tests/frigate.nix
@ -41,6 +41,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
        serviceConfig = {
          DynamicUser = true;
          ExecStart = "${lib.getBin pkgs.ffmpeg-headless}/bin/ffmpeg -re -f lavfi -i smptebars=size=800x600:rate=10 -f mpegts -listen 1 http://0.0.0.0:8080";
+          Restart = "always";
        };
      };
    };
@ -51,10 +52,14 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :

    machine.wait_for_unit("frigate.service")

+    # Frigate startup
    machine.wait_for_open_port(5001)

-    machine.succeed("curl http://localhost:5001")
+    # nginx startup
+    machine.wait_for_open_port(80)

-    machine.wait_for_file("/var/cache/frigate/test-*.mp4")
+    machine.succeed("curl http://localhost")
+
+    machine.wait_for_file("/var/cache/frigate/test@*.mp4")
  '';
 })
--- a/pkgs/applications/blockchains/sumokoin/default.nix
+++ b/pkgs/applications/blockchains/sumokoin/default.nix
@ -43,6 +43,8 @@ stdenv.mkDerivation rec {
    zeromq
  ];

+  env.CXXFLAGS = "-include cstdint";
+
  # cc1: error: '-Wformat-security' ignored without '-Wformat' [-Werror=format-security]
  hardeningDisable = [ "format" ];

--- a/pkgs/applications/networking/browsers/microsoft-edge/default.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
@ -1,20 +1,20 @@
 {
  stable = import ./browser.nix {
    channel = "stable";
-    version = "121.0.2277.98";
+    version = "121.0.2277.106";
    revision = "1";
-    hash = "sha256-vm0aBWiGtjdSu55nCNuhbqn4XVI6l/BxwmpTlTHWt/M=";
+    hash = "sha256-D0bHpz85J6R6LNWr8zaMt9vyolHYkmo9Bi4VaXCkH1U=";
  };
  beta = import ./browser.nix {
    channel = "beta";
-    version = "122.0.2365.8";
+    version = "122.0.2365.16";
    revision = "1";
-    hash = "sha256-1qM61lO7LyX7CuLrKsEuciud7BuDxRKNyQahdFJhq+g=";
+    hash = "sha256-SeLX7UibXd1nOhxWwMuUTCKK4GkN2TmJPesWhLwCD6A=";
  };
  dev = import ./browser.nix {
    channel = "dev";
-    version = "122.0.2365.3";
+    version = "123.0.2380.1";
    revision = "1";
-    hash = "sha256-O2SxGzcvNloxLbexDjA0C28w7EJi1Fl9IUnI1zc1S6Y=";
+    hash = "sha256-SBlHXURiPoC5Q7wi67tgnuV2PUw4ffniGq6kmOZtIf0=";
  };
 }
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "helm-unittest";
-  version = "0.3.5";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-RgEYFTI1uaW1aTr+/lpKQ39o5CLsj/p0JeSTUXti/IM=";
+    hash = "sha256-8rGYFoBhNPJnsZsRXJ7Z9a/KOV4d2ZIVLSdYCpf3IMs=";
  };

-  vendorHash = "sha256-P0PVzgaUN9X9x77v1psV13vNl06HrHbdlA1YHCq/eCo=";
+  vendorHash = "sha256-wD4FxJ/+8iw2qAz+s0G/8/PKt7X0MZn+roWtc/wTWmw=";

  # NOTE: Remove the install and upgrade hooks.
  postPatch = ''
--- a/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_28/versions.nix
@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.28.5+k3s1";
-  k3sCommit = "5b2d1271a6a00a8d71981cc968bc0f822620b9d8";
-  k3sRepoSha256 = "0bxgzcv83d6kg8knsxrfzpscihw8wj3i7knlm23zzw4n98p4s29y";
-  k3sVendorHash = "sha256-iBw2lHDAi3wIxaK9LX6tzV7DtNllq6kDLJBH3kVqfqQ=";
+  k3sVersion = "1.28.6+k3s1";
+  k3sCommit = "39a0001575780fffa6aae0271f4cb4ce7413aac8";
+  k3sRepoSha256 = "1bhbpbgs02gh5y7pgn6vmanacrz3p0b2gq3w2kqpb11bijp2alld";
+  k3sVendorHash = "sha256-Mo+gZ+NOZqd3CP/Z02LfO4dHyEuRhabZVAU60GofOMo=";
  chartVersions = import ./chart-versions.nix;
  k3sRootVersion = "0.12.2";
  k3sRootSha256 = "1gjynvr350qni5mskgm7pcc7alss4gms4jmkiv453vs8mmma9c9k";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -1098,6 +1098,15 @@
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
+  "slack": {
+    "hash": "sha256-efYNaDvy9cQmR4VhUABF+ozAh6M3y+em8bQtHlU7A2o=",
+    "homepage": "https://registry.terraform.io/providers/pablovarela/slack",
+    "owner": "pablovarela",
+    "repo": "terraform-provider-slack",
+    "rev": "v1.2.2",
+    "spdx": "GPL-3.0",
+    "vendorHash": "sha256-F1AuO/dkldEDRvkwrbq2EjByxjg3K2rohZAM4DzKPUw="
+  },
  "snowflake": {
    "hash": "sha256-uMXU/0LqOMBRaIOw1hxCdWuogrkWW9r/28YHniOxCbA=",
    "homepage": "https://registry.terraform.io/providers/Snowflake-Labs/snowflake",
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@ -64,14 +64,14 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "telegram-desktop";
-  version = "4.14.9";
+  version = "4.14.13";

  src = fetchFromGitHub {
    owner = "telegramdesktop";
    repo = "tdesktop";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-VqLCkGav6qtam9qk2MsjCdyVSj3630FGQg50Mv0OBNE=";
+    hash = "sha256-JcW/gXSgtzxv/37V13brHsa4XcVyB5ZCiPj4slMFdro=";
  };

  patches = [
@ -87,13 +87,16 @@ stdenv.mkDerivation rec {

  postPatch = lib.optionalString stdenv.isLinux ''
    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioInputALSA.cpp \
-      --replace '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
+      --replace-fail '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioOutputALSA.cpp \
-      --replace '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
+      --replace-fail '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioPulse.cpp \
-      --replace '"libpulse.so.0"' '"${libpulseaudio}/lib/libpulse.so.0"'
+      --replace-fail '"libpulse.so.0"' '"${libpulseaudio}/lib/libpulse.so.0"'
    substituteInPlace Telegram/lib_webview/webview/platform/linux/webview_linux_webkitgtk_library.cpp \
-      --replace '"libwebkitgtk-6.0.so.4"' '"${webkitgtk_6_0}/lib/libwebkitgtk-6.0.so.4"'
+      --replace-fail '"libwebkitgtk-6.0.so.4"' '"${webkitgtk_6_0}/lib/libwebkitgtk-6.0.so.4"'
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace Telegram/lib_webrtc/webrtc/platform/mac/webrtc_environment_mac.mm \
+      --replace-fail kAudioObjectPropertyElementMain kAudioObjectPropertyElementMaster
  '';

  # We want to run wrapProgram manually (with additional parameters)
--- a/pkgs/applications/science/math/eigenmath/default.nix
+++ b/pkgs/applications/science/math/eigenmath/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "eigenmath";
-  version = "unstable-2024-01-23";
+  version = "unstable-2024-02-04";

  src = fetchFromGitHub {
    owner = "georgeweigt";
    repo = pname;
-    rev = "1d55696b742fee0b4ef8e39b7a420c00c2f1e329";
-    hash = "sha256-AQdCFKDUWfNKxZoWp82DdxUA2GiMGWyuyh7Fkofm9kc=";
+    rev = "3e37263611e181e2927d63b97b7656790c7f4fe1";
+    hash = "sha256-gjmz9Ma7OLQyIry6i2HMNy4Ai5Wh5NUzDKPO2a9Hp+s=";
  };

  checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''
--- a/pkgs/applications/science/misc/openrefine/default.nix
+++ b/pkgs/applications/science/misc/openrefine/default.nix
@ -132,5 +132,6 @@ in maven'.buildMavenPackage {
      binaryBytecode  # maven dependencies
    ];
    broken = stdenv.isDarwin;  # builds, doesn't run
+    mainProgram = "refine";
  };
 }
--- a/pkgs/applications/science/misc/snakemake/default.nix
+++ b/pkgs/applications/science/misc/snakemake/default.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "snakemake";
-  version = "8.3.2";
+  version = "8.4.4";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "snakemake";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-urC8IVfliVzyWu7zqZN5EI6d3vXz80vHPhQaKBzTEVA=";
+    hash = "sha256-d3pUVhn9oi1ILDR4sfRh6HypbDn2JZMha27h0twixPc=";
    # https://github.com/python-versioneer/python-versioneer/issues/217
    postFetch = ''
      sed -i "$out"/snakemake/_version.py -e 's#git_refnames = ".*"#git_refnames = " (tag: v${version})"#'
--- a/pkgs/applications/video/frigate/default.nix
+++ b/pkgs/applications/video/frigate/default.nix
@ -3,20 +3,19 @@
 , python3
 , fetchFromGitHub
 , fetchurl
-, fetchpatch
 , frigate
 , nixosTests
 }:

 let
-  version = "0.12.1";
+  version = "0.13.1";

  src = fetchFromGitHub {
    #name = "frigate-${version}-source";
    owner = "blakeblackshear";
    repo = "frigate";
    rev = "refs/tags/v${version}";
-    hash = "sha256-kNvYsHoObi6b9KT/LYhTGK4uJ/uAHnYhyoQkiXIA/s8=";
+    hash = "sha256-2J7DhnYDX9ubbsk0qhji/vIKDouy9IqQztzbdPj2kxo=";
  };

  frigate-web = callPackage ./web.nix {
@ -35,7 +34,7 @@ let
  };

  # Tensorflow Lite models
-  # https://github.com/blakeblackshear/frigate/blob/v0.12.0/Dockerfile#L88-L91
+  # https://github.com/blakeblackshear/frigate/blob/v0.13.0/docker/main/Dockerfile#L96-L97
  tflite_cpu_model = fetchurl {
    url = "https://github.com/google-coral/test_data/raw/release-frogfish/ssdlite_mobiledet_coco_qat_postprocess.tflite";
    hash = "sha256-kLszpjTgQZFMwYGapd+ZgY5sOWxNLblSwP16nP/Eck8=";
@ -46,7 +45,7 @@ let
  };

  # OpenVino models
-  # https://github.com/blakeblackshear/frigate/blob/v0.12.0/Dockerfile#L92-L95
+  # https://github.com/blakeblackshear/frigate/blob/v0.13.0/docker/main/Dockerfile#L101
  openvino_model = fetchurl {
    url = "https://github.com/openvinotoolkit/open_model_zoo/raw/master/data/dataset_classes/coco_91cl_bkgr.txt";
    hash = "sha256-5Cj2vEiWR8Z9d2xBmVoLZuNRv4UOuxHSGZQWTJorXUQ=";
@ -59,14 +58,6 @@ python.pkgs.buildPythonApplication rec {

  inherit src;

-  patches = [
-    (fetchpatch {
-      # numpy 1.24 compat
-      url = "https://github.com/blakeblackshear/frigate/commit/cb73d0cd392990448811c7212bc5f09be411fc69.patch";
-      hash = "sha256-Spt7eRosmTN8zyJ2uVme5HPVy2TKgBtvbQ6tp6PaNac=";
-    })
-  ];
-
  postPatch = ''
    echo 'VERSION = "${version}"' > frigate/version.py

@ -75,58 +66,59 @@ python.pkgs.buildPythonApplication rec {

    substituteInPlace frigate/const.py \
      --replace "/media/frigate" "/var/lib/frigate" \
-      --replace "/tmp/cache" "/var/cache/frigate/"
+      --replace "/tmp/cache" "/var/cache/frigate" \
+      --replace "/config" "/var/lib/frigate" \
+      --replace "{CONFIG_DIR}/model_cache" "/var/cache/frigate/model_cache"

    substituteInPlace frigate/http.py \
-      --replace "/opt/frigate" "${placeholder "out"}/${python.sitePackages}" \
-      --replace "/tmp/cache/" "/var/cache/frigate/"
+      --replace "/opt/frigate" "${placeholder "out"}/${python.sitePackages}"

    substituteInPlace frigate/output.py \
      --replace "/opt/frigate" "${placeholder "out"}/${python.sitePackages}"

-    substituteInPlace frigate/record.py \
-      --replace "/tmp/cache" "/var/cache/frigate"
-
    substituteInPlace frigate/detectors/detector_config.py \
      --replace "/labelmap.txt" "${placeholder "out"}/share/frigate/labelmap.txt"

-    substituteInPlace frigate/detectors/plugins/edgetpu_tfl.py \
+    substituteInPlace frigate/config.py \
+      --replace "/cpu_model.tflite" "${tflite_cpu_model}" \
      --replace "/edgetpu_model.tflite" "${tflite_edgetpu_model}"

-    substituteInPlace frigate/detectors/plugins/cpu_tfl.py \
-      --replace "/cpu_model.tflite" "${tflite_cpu_model}"
-
-    substituteInPlace frigate/ffmpeg_presets.py --replace \
-       '"-timeout" if os.path.exists(BTBN_PATH) else "-stimeout"' \
-       '"-timeout"'
+    substituteInPlace frigate/test/test_config.py \
+      --replace "(MODEL_CACHE_DIR" "('/build/model_cache'" \
+      --replace "/config/model_cache" "/build/model_cache"
  '';

  dontBuild = true;

  propagatedBuildInputs = with python.pkgs; [
-    # requirements.txt
+    # docker/main/requirements.txt
    scikit-build
-    # requirements-wheel.txt
+    # docker/main/requirements-wheel.txt
    click
    flask
    imutils
    matplotlib
+    norfair
    numpy
+    onvif-zeep
    opencv4
    openvino
    paho-mqtt
    peewee
    peewee-migrate
    psutil
+    py3nvml
    pydantic
+    pytz
    pyyaml
    requests
+    ruamel-yaml
    scipy
    setproctitle
    tensorflow
    tzlocal
+    unidecode
    ws4py
-    zeroconf
  ];

  installPhase = ''
@ -144,10 +136,15 @@ python.pkgs.buildPythonApplication rec {
    runHook postInstall
  '';

-  checkInputs = with python.pkgs; [
+  nativeCheckInputs = with python.pkgs; [
    pytestCheckHook
  ];

+  disabledTests = [
+    # Test needs network access
+    "test_plus_labelmap"
+  ];
+
  passthru = {
    web = frigate-web;
    inherit python;
--- a/pkgs/applications/video/frigate/web.nix
+++ b/pkgs/applications/video/frigate/web.nix
@ -11,14 +11,14 @@ buildNpmPackage {

  postPatch = ''
    substituteInPlace package.json \
-      --replace "--base=/BASE_PATH/" ""
+      --replace-fail "--base=/BASE_PATH/" ""

    substituteInPlace src/routes/Storage.jsx \
-      --replace "/media/frigate" "/var/lib/frigate" \
-      --replace "/tmp/cache" "/var/cache/frigate"
+      --replace-fail "/media/frigate" "/var/lib/frigate" \
+      --replace-fail "/tmp/cache" "/var/cache/frigate"
  '';

-  npmDepsHash = "sha256-fvRxpQjSEzd2CnoEOVgQcB6MJJ4dcjN8bOaacHjCdwU=";
+  npmDepsHash = "sha256-+36quezGArqIM9dM+UihwcIgmE3EVmJQThuicLgDW4A=";

  installPhase = ''
    cp -rv dist/ $out
--- a/pkgs/by-name/ca/cadzinho/package.nix
+++ b/pkgs/by-name/ca/cadzinho/package.nix
@ -0,0 +1,45 @@
+{ lib, stdenv, fetchFromGitHub, SDL2, glew, lua5_4, desktopToDarwinBundle }:
+
+stdenv.mkDerivation rec {
+  pname = "cadzinho";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "zecruel";
+    repo = "CadZinho";
+    rev = version;
+    hash = "sha256-6/sBNxQb52FFO2fWLVs6YDOmJLEbSOA5mwdMdJDjEDM=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/gui_config.c --replace "/usr/share/cadzinho" "$out/share/cadzinho"
+  '';
+
+  nativeBuildInputs = lib.optional stdenv.isDarwin desktopToDarwinBundle;
+
+  buildInputs = [ SDL2 glew lua5_4 ];
+
+  makeFlags = [ "CC:=$(CC)" ];
+
+  # https://github.com/llvm/llvm-project/issues/62254
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-fno-builtin-strrchr";
+
+  hardeningDisable = [ "format" ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 cadzinho -t $out/bin
+    install -Dm644 lang/*.lua -t $out/share/cadzinho/lang
+    cp -r linux/CadZinho/share/* $out/share
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Minimalist computer aided design (CAD) software";
+    homepage = "https://github.com/zecruel/CadZinho";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.unix;
+    mainProgram = "cadzinho";
+  };
+}
--- a/pkgs/by-name/ce/celeste64/deps.nix
+++ b/pkgs/by-name/ce/celeste64/deps.nix
@ -1,8 +1,9 @@
+# This file was automatically generated by passthru.fetch-deps.
+# Please dont edit it manually, your changes might get overwritten!
+
 { fetchNuGet }: [
-  (fetchNuGet { pname = "FosterFramework"; version = "0.1.15-alpha"; sha256 = "0pzsdfbsfx28xfqljcwy100xhbs6wyx0z1d5qxgmv3l60di9xkll"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "8.0.1"; sha256 = "1gjz379y61ag9whi78qxx09bwkwcznkx2mzypgycibxk61g11da1"; })
+  (fetchNuGet { pname = "FosterFramework"; version = "0.1.18-alpha"; sha256 = "0jglck1ffdyp48sqmadlsxdddlyq45ydfzlxbrqdhszzi92ipq7a"; })
  (fetchNuGet { pname = "Microsoft.NET.ILLink.Tasks"; version = "8.0.1"; sha256 = "1drbgqdcvbpisjn8mqfgba1pwb6yri80qc4mfvyczqwrcsj5k2ja"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "8.0.1"; sha256 = "1g5b30f4l8a1zjjr3b8pk9mcqxkxqwa86362f84646xaj4iw3a4d"; })
  (fetchNuGet { pname = "SharpGLTF.Core"; version = "1.0.0-alpha0031"; sha256 = "0ln78mkhbcxqvwnf944hbgg24vbsva2jpih6q3x82d3h7rl1pkh6"; })
  (fetchNuGet { pname = "SharpGLTF.Runtime"; version = "1.0.0-alpha0031"; sha256 = "0lvb3asi3v0n718qf9y367km7qpkb9wci38y880nqvifpzllw0jg"; })
  (fetchNuGet { pname = "Sledge.Formats"; version = "1.2.2"; sha256 = "1y0l66m9rym0p1y4ifjlmg3j9lsmhkvbh38frh40rpvf1axn2dyh"; })
--- a/pkgs/by-name/ce/celeste64/package.nix
+++ b/pkgs/by-name/ce/celeste64/package.nix
@ -8,7 +8,6 @@
  SDL2,
  libGL,
  mesa,
-  fmodex,
  systemd,
  libpulseaudio,
  libselinux,
@ -19,15 +18,16 @@
  libdrm,
  withSELinux ? false,
 }:
+
 buildDotnetModule rec {
  pname = "celeste64";
-  version = "0-unstable-2024-02-02";
+  version = "1.1.1";

  src = fetchFromGitHub {
    repo = "Celeste64";
    owner = "ExOK";
-    rev = "e7130d376deed9ddf17a6631cf06d89d19a702c6";
-    hash = "sha256-KCCgjplAk+Nhjxk/p6Omt4GxN36kAgvg/OPbed2Ey+4=";
+    rev = "v${version}";
+    hash = "sha256-XRAjDYIqYaQYCWNNT7UuLDKDBgq3vqxtCzay7pGICtA=";
  };
  projectFile = "Celeste64.csproj";
  dotnet-sdk = dotnetCorePackages.sdk_8_0;
@ -41,7 +41,6 @@ buildDotnetModule rec {
      libdecor
      libGL
      SDL2
-      fmodex
      systemd
      libpulseaudio
      wayland
@ -79,7 +78,7 @@ buildDotnetModule rec {

  meta = {
    license = with lib.licenses; [ unfree mit ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" "armv7l-linux" ];
    maintainers = with lib.maintainers; [ lychee ];
    mainProgram = "Celeste64";
    homepage = "https://github.com/ExOK/Celeste64";
--- a/pkgs/by-name/gc/gcli/package.nix
+++ b/pkgs/by-name/gc/gcli/package.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "gcli";
-  version = "2.1.0";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "herrhotzenplotz";
    repo = "gcli";
    rev = version;
-    hash = "sha256-JZL0AcbrGYBceQ6ctspgnbzlVD4pg95deg9BWUFQCv8=";
+    hash = "sha256-extVTaTWVFXSTiXlZ/MtiiFdc/KZEDkc+A7xxylJaM4=";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config byacc flex ];
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@ -31,13 +31,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "2050";
+  version = "2074";

  src = fetchFromGitHub {
    owner = "ggerganov";
    repo = "llama.cpp";
    rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-Wli9dZ5Aa4Xk/c9e2DqcernyfXaT3hd8qRo0GzrnxZU=";
+    hash = "sha256-i5I0SsjnDSo+/EzKQzCLV/SNMlLdvY+h9jKN+KlN6L4=";
  };

  postPatch = ''
--- a/pkgs/by-name/nr/nrf-command-line-tools/package.nix
+++ b/pkgs/by-name/nr/nrf-command-line-tools/package.nix
@ -0,0 +1,76 @@
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, udev
+, libusb1
+, segger-jlink
+}:
+
+let
+  supported = {
+    x86_64-linux = {
+      name = "linux-amd64";
+      hash = "sha256-zL9tXl2HsO8JZXEGsjg4+lDJJz30StOMH96rU7neDsg=";
+    };
+    aarch64-linux = {
+      name = "linux-arm64";
+      hash = "sha256-ACy3rXsvBZNVXdVkpP2AqrsoqKPliw6m9UUWrFOCBzs=";
+    };
+    armv7l-linux = {
+      name = "linux-armhf";
+      hash = "sha256-nD1pHL/SQqC7OlxuovWwvtnXKMmhfx5qFaF4ti8gh8g=";
+    };
+  };
+
+  platform = supported.${stdenv.system} or (throw "unsupported platform ${stdenv.system}");
+
+  version = "10.23.2";
+
+  url = let
+    versionWithDashes = builtins.replaceStrings ["."] ["-"] version;
+  in "https://nsscprodmedia.blob.core.windows.net/prod/software-and-other-downloads/desktop-software/nrf-command-line-tools/sw/versions-${lib.versions.major version}-x-x/${versionWithDashes}/nrf-command-line-tools-${version}_${platform.name}.tar.gz";
+
+in stdenv.mkDerivation {
+  pname = "nrf-command-line-tools";
+  inherit version;
+
+  src = fetchurl {
+    inherit url;
+    inherit (platform) hash;
+  };
+
+  runtimeDependencies = [
+    segger-jlink
+  ];
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    udev
+    libusb1
+  ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    rm -rf ./python
+    mkdir -p $out
+    cp -r * $out
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Nordic Semiconductor nRF Command Line Tools";
+    homepage = "https://www.nordicsemi.com/Products/Development-tools/nRF-Command-Line-Tools";
+    license = licenses.unfree;
+    platforms = attrNames supported;
+    maintainers = with maintainers; [ stargate01 ];
+  };
+}
--- a/pkgs/by-name/nr/nrfconnect/package.nix
+++ b/pkgs/by-name/nr/nrfconnect/package.nix
@ -0,0 +1,44 @@
+{ lib
+, fetchurl
+, appimageTools
+}:
+
+let
+  pname = "nrfconnect";
+  version = "4.3.0";
+
+  src = fetchurl {
+    url = "https://nsscprodmedia.blob.core.windows.net/prod/software-and-other-downloads/desktop-software/nrf-connect-for-desktop/${lib.versions.major version}-${lib.versions.minor version}-${lib.versions.patch version}/nrfconnect-${version}-x86_64.appimage";
+    hash = "sha256-G8//dZqPxn6mR8Bjzf/bAn9Gv7t2AFWIF9twCGbqMd8=";
+    name = "${pname}-${version}.AppImage";
+  };
+
+  appimageContents = appimageTools.extractType2 {
+    inherit pname version src;
+  };
+
+in appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraPkgs = pkgs: with pkgs; [
+    segger-jlink
+  ];
+
+  extraInstallCommands = ''
+    mv $out/bin/nrfconnect-* $out/bin/nrfconnect
+    install -Dm444 ${appimageContents}/nrfconnect.desktop -t $out/share/applications
+    install -Dm444 ${appimageContents}/usr/share/icons/hicolor/512x512/apps/nrfconnect.png \
+      -t $out/share/icons/hicolor/512x512/apps
+    substituteInPlace $out/share/applications/nrfconnect.desktop \
+      --replace 'Exec=AppRun' 'Exec=nrfconnect'
+  '';
+
+  meta = with lib; {
+    description = "Nordic Semiconductor nRF Connect for Desktop";
+    homepage = "https://www.nordicsemi.com/Products/Development-tools/nRF-Connect-for-desktop";
+    license = licenses.unfree;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ stargate01 ];
+    mainProgram = "nrfconnect";
+  };
+}
--- a/pkgs/by-name/se/segger-jlink/package.nix
+++ b/pkgs/by-name/se/segger-jlink/package.nix
@ -0,0 +1,228 @@
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, udev
+, config
+, acceptLicense ? config.segger-jlink.acceptLicense or false
+, fontconfig
+, xorg
+, makeDesktopItem
+, copyDesktopItems
+}:
+
+let
+  supported = {
+    x86_64-linux = {
+      name = "x86_64";
+      hash = "sha256-WGEDvB6TJ8Y2Xl1VUB1JWVMK54OevvPoVGris3I27t4=";
+    };
+    i686-linux = {
+      name = "i386";
+      hash = "sha256-BOQ4yExDRGKuUvsPUUswElrps0SpXcDCHxy2tmGbV/I=";
+    };
+    aarch64-linux = {
+      name = "arm64";
+      hash = "sha256-ZWzaWCUgV4x5Fbz+jphj771kIyLyeoRZKjgf8rmbFxQ=";
+    };
+    armv7l-linux = {
+      name = "arm";
+      hash = "sha256-Qjb5P1XH/CoiLP9iqWyEX0YHUjDIuSdw5ej1bE61T48=";
+    };
+  };
+
+  platform = supported.${stdenv.system} or (throw "unsupported platform ${stdenv.system}");
+
+  version = "794a";
+
+  url = "https://www.segger.com/downloads/jlink/JLink_Linux_V${version}_${platform.name}.tgz";
+
+  src =
+    assert !acceptLicense -> throw ''
+      Use of the "SEGGER JLink Software and Documentation pack" requires the
+      acceptance of the following licenses:
+
+        - SEGGER Downloads Terms of Use [1]
+        - SEGGER Software Licensing [2]
+
+      You can express acceptance by setting acceptLicense to true in your
+      configuration. Note that this is not a free license so it requires allowing
+      unfree licenses as well.
+
+      configuration.nix:
+        nixpkgs.config.allowUnfree = true;
+        nixpkgs.config.segger-jlink.acceptLicense = true;
+
+      config.nix:
+        allowUnfree = true;
+        segger-jlink.acceptLicense = true;
+
+      [1]: ${url}
+      [2]: https://www.segger.com/purchase/licensing/
+    '';
+      fetchurl {
+        inherit url;
+        inherit (platform) hash;
+        curlOpts = "--data accept_license_agreement=accepted";
+      };
+
+  qt4-bundled = stdenv.mkDerivation {
+    pname = "segger-jlink-qt4";
+    inherit src version;
+
+    nativeBuildInputs = [
+      autoPatchelfHook
+    ];
+
+    buildInputs = [
+      stdenv.cc.cc.lib
+      fontconfig
+      xorg.libXrandr
+      xorg.libXfixes
+      xorg.libXcursor
+      xorg.libSM
+      xorg.libICE
+      xorg.libX11
+    ];
+
+    dontConfigure = true;
+    dontBuild = true;
+
+    installPhase = ''
+      runHook preInstall
+
+      # Install libraries
+      mkdir -p $out/lib
+      mv libQt* $out/lib
+
+      runHook postInstall
+    '';
+
+    meta = with lib; {
+      description = "Bundled QT4 libraries for the J-Link Software and Documentation pack";
+      homepage = "https://www.segger.com/downloads/jlink/#J-LinkSoftwareAndDocumentationPack";
+      license = licenses.lgpl21;
+      maintainers = with maintainers; [ stargate01 ];
+      knownVulnerabilities = [
+        "This bundled version of Qt 4 has reached its end of life after 2015. See https://github.com/NixOS/nixpkgs/pull/174634"
+        "CVE-2023-43114"
+        "CVE-2023-38197"
+        "CVE-2023-37369"
+        "CVE-2023-34410"
+        "CVE-2023-32763"
+        "CVE-2023-32762"
+        "CVE-2023-32573"
+        "CVE-2022-25634"
+        "CVE-2020-17507"
+        "CVE-2020-0570"
+        "CVE-2018-21035"
+        "CVE-2018-19873"
+        "CVE-2018-19871"
+        "CVE-2018-19870"
+        "CVE-2018-19869"
+        "CVE-2015-1290"
+        "CVE-2014-0190"
+        "CVE-2013-0254"
+        "CVE-2012-6093"
+        "CVE-2012-5624"
+        "CVE-2009-2700"
+      ];
+    };
+  };
+
+in stdenv.mkDerivation {
+  pname = "segger-jlink";
+  inherit src version;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    qt4-bundled
+  ];
+
+  # Udev is loaded late at runtime
+  appendRunpaths = [
+    "${udev}/lib"
+  ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  desktopItems = map (entry:
+    (makeDesktopItem {
+      name = entry;
+      exec = entry;
+      icon = "applications-utilities";
+      desktopName = entry;
+      genericName = "SEGGER ${entry}";
+      categories = [ "Development" ];
+      type = "Application";
+      terminal = false;
+      startupNotify = false;
+    })
+  ) [
+    "JFlash"
+    "JFlashLite"
+    "JFlashSPI"
+    "JLinkConfig"
+    "JLinkGDBServer"
+    "JLinkLicenseManager"
+    "JLinkRTTViewer"
+    "JLinkRegistration"
+    "JLinkRemoteServer"
+    "JLinkSWOViewer"
+    "JLinkUSBWebServer"
+    "JMem"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    # Install binaries and runtime files into /opt/
+    mkdir -p $out/opt
+    mv J* ETC GDBServer Firmwares $out/opt
+
+    # Link executables into /bin/
+    mkdir -p $out/bin
+    for binr in $out/opt/*Exe; do
+      binrlink=''${binr#"$out/opt/"}
+      ln -s $binr $out/bin/$binrlink
+      # Create additional symlinks without "Exe" suffix
+      binrlink=''${binrlink/%Exe}
+      ln -s $binr $out/bin/$binrlink
+    done
+
+    # Copy special alias symlinks
+    for slink in $(find $out/opt/. -type l); do
+      cp -P -n $slink $out/bin || true
+      rm $slink
+    done
+
+    # Install libraries
+    install -Dm444 libjlinkarm.so* -t $out/lib
+    for libr in $out/lib/libjlinkarm.*; do
+      ln -s $libr $out/opt
+    done
+
+    # Install docs and examples
+    mkdir -p $out/share
+    mv Doc $out/share/docs
+    mv Samples $out/share/examples
+
+    # Install udev rules
+    install -Dm444 99-jlink.rules -t $out/lib/udev/rules.d/
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "J-Link Software and Documentation pack";
+    homepage = "https://www.segger.com/downloads/jlink/#J-LinkSoftwareAndDocumentationPack";
+    license = licenses.unfree;
+    platforms = attrNames supported;
+    maintainers = with maintainers; [ FlorianFranzen stargate01 ];
+  };
+}
--- a/pkgs/by-name/si/signal-export/package.nix
+++ b/pkgs/by-name/si/signal-export/package.nix
@ -6,12 +6,12 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "signal-export";
-  version = "1.8.0";
+  version = "1.8.1";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-ZGF6vT+fjmBL3SGrZ/E6bvcxToTlbAcxspQAnR/Aboo=";
+    sha256 = "sha256-v4civFGu+CLRTGicQAMSei+k6Iyz0GAznTLEr7ylx24=";
  };

  nativeBuildInputs = with python3.pkgs; [
--- a/pkgs/by-name/sr/srm-cuarzo/package.nix
+++ b/pkgs/by-name/sr/srm-cuarzo/package.nix
@ -14,9 +14,9 @@
 }:
 stdenv.mkDerivation (self: {
  pname = "srm-cuarzo";
-  version = "0.4.0-1";
+  version = "0.5.0-1";
  rev = "v${self.version}";
-  hash = "sha256-PWtDSBYw62sfyN2lpd7NY8SbqDrt5IN1rdLZRtDfals=";
+  hash = "sha256-q3pMWryiBR8BEPHvZ/g/jK2hIBTd15RxyU7uocSJsZ8=";

  src = fetchFromGitHub {
    inherit (self) rev hash;
--- a/pkgs/desktops/lomiri/development/lomiri-app-launch/default.nix
+++ b/pkgs/desktops/lomiri/development/lomiri-app-launch/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitLab
+, fetchpatch
 , gitUpdater
 , testers
 , cmake
@ -46,6 +47,15 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-vuu6tZ5eDJN2rraOpmrDddSl1cIFFBSrILKMJqcUDVc=";
  };

+  patches = [
+    # Remove when https://gitlab.com/ubports/development/core/lomiri-app-launch/-/merge_requests/57 merged & in release
+    (fetchpatch {
+      name = "0001-lomiri-app-launch-Fix-typelib-gir-dependency.patch";
+      url = "https://gitlab.com/ubports/development/core/lomiri-app-launch/-/commit/0419b2592284f43ee5e76060948ea3d5f1c991fd.patch";
+      hash = "sha256-11pEhFi39Cvqb9Hg47kT8+5hq+bz6WmySqaIdwt1MVk=";
+    })
+  ];
+
  postPatch = ''
    patchShebangs tests/{desktop-hook-test.sh.in,repeat-until-pass.sh}

@ -100,6 +110,14 @@ stdenv.mkDerivation (finalAttrs: {
  cmakeFlags = [
    (lib.cmakeBool "ENABLE_MIRCLIENT" false)
    (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" (lib.concatStringsSep ";" [
+      # Exclude tests
+      "-E" (lib.strings.escapeShellArg "(${lib.concatStringsSep "|" [
+        # Flaky, randomly hangs
+        # https://gitlab.com/ubports/development/core/lomiri-app-launch/-/issues/19
+        "^helper-handshake-test"
+      ]})")
+    ]))
  ];

  postBuild = lib.optionalString withDocumentation ''
--- a/pkgs/development/compilers/llvm/common/lldb.nix
+++ b/pkgs/development/compilers/llvm/common/lldb.nix
@ -5,7 +5,8 @@
 , cmake
 , zlib
 , ncurses
-, swig
+, swig3
+, swig4
 , which
 , libedit
 , libxml2
@ -34,6 +35,11 @@ let
        cp -r ${monorepoSrc}/cmake "$out"
        cp -r ${monorepoSrc}/lldb "$out"
      '' else src;
+  vscodeExt = {
+    name = if lib.versionAtLeast release_version "18" then "lldb-dap" else "lldb-vscode";
+    version = if lib.versionAtLeast release_version "18" then "0.2.0" else "0.1.0";
+  };
+  swig = if lib.versionAtLeast release_version "18" then swig4 else swig3;
 in

 stdenv.mkDerivation (rec {
@ -58,7 +64,10 @@ stdenv.mkDerivation (rec {
    lua5_3
  ] ++ lib.optionals enableManpages [
    python3.pkgs.sphinx
+  ] ++ lib.optionals (lib.versionOlder release_version "18" && enableManpages) [
    python3.pkgs.recommonmark
+  ] ++ lib.optionals (lib.versionAtLeast release_version "18" && enableManpages) [
+    python3.pkgs.myst-parser
  ] ++ lib.optionals (lib.versionAtLeast release_version "14") [
    ninja
  ];
@ -154,14 +163,14 @@ stdenv.mkDerivation (rec {

    # Editor support
    # vscode:
-    install -D ../tools/lldb-vscode/package.json $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/package.json
-    mkdir -p $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
-    ln -s $out/bin/*-vscode $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/bin
+    install -D ../tools/${vscodeExt.name}/package.json $out/share/vscode/extensions/llvm-org.${vscodeExt.name}-${vscodeExt.version}/package.json
+    mkdir -p $out/share/vscode/extensions/llvm-org.${vscodeExt.name}-${vscodeExt.version}/bin
+    ln -s $out/bin/*${if lib.versionAtLeast release_version "18" then vscodeExt.name else "-vscode"} $out/share/vscode/extensions/llvm-org.${vscodeExt.name}-${vscodeExt.version}/bin
  '';

-  passthru.vscodeExtName = "lldb-vscode";
+  passthru.vscodeExtName = vscodeExt.name;
  passthru.vscodeExtPublisher = "llvm";
-  passthru.vscodeExtUniqueId = "llvm-org.lldb-vscode-0.1.0";
+  passthru.vscodeExtUniqueId = "llvm-org.${vscodeExt.name}-${vscodeExt.version}";

  meta = llvm_meta // {
    homepage = "https://lldb.llvm.org/";
--- a/pkgs/development/compilers/llvm/git/clang/default.nix
+++ b/pkgs/development/compilers/llvm/git/clang/default.nix
@ -21,6 +21,7 @@ let
    sourceRoot = "${src.name}/${pname}";

    nativeBuildInputs = [ cmake ninja python3 ]
+      ++ lib.optional (lib.versionAtLeast version "18" && enableManpages) python3.pkgs.myst-parser
      ++ lib.optional enableManpages python3.pkgs.sphinx
      ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;

@ -70,7 +71,7 @@ let
      ln -sv $out/bin/clang $out/bin/cpp

      mkdir -p $lib/lib/clang
-      mv $lib/lib/18 $lib/lib/clang/18
+      mv $lib/lib/${lib.versions.major version} $lib/lib/clang/${lib.versions.major version}

      # Move libclang to 'lib' output
      moveToOutput "lib/libclang.*" "$lib"
--- a/pkgs/development/compilers/llvm/git/clang/purity.patch
+++ b/pkgs/development/compilers/llvm/git/clang/purity.patch
@ -4,26 +4,22 @@ Date: Thu, 18 May 2017 11:56:12 -0500
 Subject: [PATCH] "purity" patch for 5.0

 ---
- lib/Driver/ToolChains/Gnu.cpp | 7 -------
- 1 file changed, 7 deletions(-)
+ lib/Driver/ToolChains/Gnu.cpp | 3 ---
+ 1 file changed, 3 deletions(-)

 diff --git a/lib/Driver/ToolChains/Gnu.cpp b/lib/Driver/ToolChains/Gnu.cpp
 index fe3c0191bb..c6a482bece 100644
 --- a/lib/Driver/ToolChains/Gnu.cpp
 +++ b/lib/Driver/ToolChains/Gnu.cpp
-@@ -487,13 +487,7 @@ void tools::gnutools::Linker::ConstructJob(Compilation &C, const JobAction &JA,
-   } else {
-     if (Args.hasArg(options::OPT_rdynamic))
-       CmdArgs.push_back("-export-dynamic");
-
-    if (!Args.hasArg(options::OPT_shared) && !IsStaticPIE &&
-        !Args.hasArg(options::OPT_r)) {
+@@ -446,9 +446,6 @@ void tools::gnutools::Linker::ConstructJob(Compilation &C, const JobAction &JA,
+                            ToolChain.isPIEDefault(Args));
+       if (IsPIE)
+         CmdArgs.push_back("-pie");
 -      CmdArgs.push_back("-dynamic-linker");
 -      CmdArgs.push_back(Args.MakeArgString(Twine(D.DyldPrefix) +
 -                                           ToolChain.getDynamicLinker(Args)));
-    }
+     }
   }
 
-   CmdArgs.push_back("-o");
 -- 
 2.11.0
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@ -19,9 +19,9 @@
 # LLVM release information; specify one of these but not both:
 , gitRelease ? {
  version = "18.0.0";
-  rev = "6f44f87011cd52367626cac111ddbb2d25784b90";
-  rev-version = "18.0.0-unstable-2023-10-04";
-  sha256 = "sha256-CqsCDlzg8I2c9BybKP7B5nfHiQWktqgVavrfiYkjkx4=";
+  rev = "2fd7657b6609454af7adb75765d164ec7d1bb80b";
+  rev-version = "18.0.0-unstable-2023-12-13";
+  sha256 = "sha256-/sMQzzFid0tAnreOIV9SUm2H6QbEGhpNcizl3LDPM5s=";
 }
  # i.e.:
  # {
--- a/pkgs/development/compilers/llvm/git/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/git/llvm/default.nix
@ -86,10 +86,14 @@ stdenv.mkDerivation (rec {

  nativeBuildInputs = [ cmake ninja python ]
    ++ optionals enableManpages [
-      # Note: we intentionally use `python3Packages` instead of `python3.pkgs`;
-      # splicing does *not* work with the latter. (TODO: fix)
-      python3Packages.sphinx python3Packages.recommonmark
-    ];
+    # Note: we intentionally use `python3Packages` instead of `python3.pkgs`;
+    # splicing does *not* work with the latter. (TODO: fix)
+    python3Packages.sphinx
+  ] ++ optionals (lib.versionOlder version "18" && enableManpages) [
+    python3Packages.recommonmark
+  ] ++ optionals (lib.versionAtLeast version "18" && enableManpages) [
+    python3Packages.myst-parser
+  ];

  buildInputs = [ libxml2 libffi ]
    ++ optional enablePFM libpfm; # exegesis
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@ -71,7 +71,7 @@ let
        inherit executable luaversion;
        luaOnBuild = luaOnBuildForHost.override { inherit packageOverrides; self = luaOnBuild; };

-        tests = callPackage ./tests { inherit (luaPackages) wrapLua; };
+        tests = callPackage ./tests { lua = self; inherit (luaPackages) wrapLua; };

        inherit luaAttr;
  };
--- a/pkgs/development/interpreters/lua-5/tests/assert.sh
+++ b/pkgs/development/interpreters/lua-5/tests/assert.sh
@ -8,9 +8,14 @@ function fail() {
 }


-function assertStringEqual {
-
+function assertStringEqual() {
    if ! diff <(echo "$1") <(echo "$2") ; then
-        fail "Strings differ"
+        fail "expected \"$1\" to be equal to \"$2\""
+    fi
+}
+
+function assertStringContains() {
+    if ! echo "$1" | grep -q "$2" ; then
+        fail "expected \"$1\" to contain \"$2\""
    fi
 }
--- a/pkgs/development/interpreters/lua-5/tests/default.nix
+++ b/pkgs/development/interpreters/lua-5/tests/default.nix
@ -8,7 +8,7 @@
 let

  runTest = lua: { name, command }:
-    pkgs.runCommandLocal "test-${lua.name}" ({
+    pkgs.runCommandLocal "test-${lua.name}-${name}" ({
      nativeBuildInputs = [lua];
      meta.platforms = lua.meta.platforms;
    }) (''
@ -27,6 +27,10 @@ let
        wrapLuaPrograms
      '';
    });
+
+    luaWithModule = lua.withPackages(ps: [
+      ps.lua-cjson
+    ]);
 in
  pkgs.recurseIntoAttrs ({

@ -36,15 +40,29 @@ in
      generated=$(lua -e 'print(package.path)')
      golden_LUA_PATH='./share/lua/${lua.luaversion}/?.lua;./?.lua;./?/init.lua'

-      assertStringEqual "$generated" "$golden_LUA_PATH"
+      assertStringContains "$generated" "$golden_LUA_PATH"
      '';
  };

-  checkWrapping = pkgs.runCommandLocal "test-${lua.name}" ({
+  checkWrapping = pkgs.runCommandLocal "test-${lua.name}-wrapping" ({
    }) (''
      grep -- 'LUA_PATH=' ${wrappedHello}/bin/hello
      touch $out
    '');

-})
+  checkRelativeImports = pkgs.runCommandLocal "test-${lua.name}-relative-imports" ({
+    }) (''
+      source ${./assert.sh}

+      lua_vanilla_package_path="$(${lua}/bin/lua -e "print(package.path)")"
+      lua_with_module_package_path="$(${luaWithModule}/bin/lua -e "print(package.path)")"
+
+      assertStringContains "$lua_vanilla_package_path" "./?.lua"
+      assertStringContains "$lua_vanilla_package_path" "./?/init.lua"
+
+      assertStringContains "$lua_with_module_package_path" "./?.lua"
+      assertStringContains "$lua_with_module_package_path" "./?/init.lua"
+
+      touch $out
+    '');
+})
--- a/pkgs/development/libraries/ntbtls/default.nix
+++ b/pkgs/development/libraries/ntbtls/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ntbtls";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchurl {
    url = "mirror://gnupg/ntbtls/ntbtls-${version}.tar.bz2";
-    sha256 = "sha256-iSIYH+9SO3e3FiXlYuTWlTInjqu9GLx0V52+FBNXKbo=";
+    sha256 = "sha256-vfy5kCSs7JxsS5mK1juzkh30z+5KdyrWwMoyTbvysHw=";
  };

  outputs = [ "dev" "out" ];
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/node-packages/overrides.nix
+++ b/pkgs/development/node-packages/overrides.nix
@ -412,40 +412,40 @@ final: prev: {
        name = "_at_cloudflare_slash_workerd-linux-64";
        packageName = "@cloudflare/workerd-linux-64";
        # Should be same version as workerd
-        version = "1.20231030.0";
+        version = "1.20240129.0";
        src = fetchurl {
-          url = "https://registry.npmjs.org/@cloudflare/workerd-linux-64/-/workerd-linux-64-1.20231030.0.tgz";
-          sha512 = "2HUeRTvoCC17fxE0qdBeR7J9dO8j4A8ZbdcvY8pZxdk+zERU6+N03RTbk/dQMU488PwiDvcC3zZqS4gwLfVT8g==";
+          url = "https://registry.npmjs.org/@cloudflare/workerd-linux-64/-/workerd-linux-64-1.20240129.0.tgz";
+          sha512 = "sFV1uobHgDI+6CKBS/ZshQvOvajgwl6BtiYaH4PSFSpvXTmRx+A9bcug+6BnD+V4WgwxTiEO2iR97E1XuwDAVw==";
        };
      };
      linuxWorkerdArm = {
        name = "_at_cloudflare_slash_workerd-linux-arm64";
        packageName = "@cloudflare/workerd-linux-arm64";
        # Should be same version as workerd
-        version = "1.20231030.0";
+        version = "1.20240129.0";
        src = fetchurl {
-          url = "https://registry.npmjs.org/@cloudflare/workerd-linux-arm64/-/workerd-linux-arm64-1.20231030.0.tgz";
-          sha512 = "4/GK5zHh+9JbUI6Z5xTCM0ZmpKKHk7vu9thmHjUxtz+o8Ne9DoD7DlDvXQWgMF6XGaTubDWyp3ttn+Qv8jDFuQ==";
+          url = "https://registry.npmjs.org/@cloudflare/workerd-linux-arm64/-/workerd-linux-arm64-1.20240129.0.tgz";
+          sha512 = "O7q7htHaFRp8PgTqNJx1/fYc3+LnvAo6kWWB9a14C5OWak6AAZk42PNpKPx+DXTmGvI+8S1+futBGUeJ8NPDXg==";
        };
      };
      darwinWorkerd = {
        name = "_at_cloudflare_slash_workerd-darwin-64";
        packageName = "@cloudflare/workerd-darwin-64";
        # Should be same version as workerd
-        version = "1.20231030.0";
+        version = "1.20240129.0";
        src = fetchurl {
-          url = "https://registry.npmjs.org/@cloudflare/workerd-darwin-64/-/workerd-darwin-64-1.20231030.0.tgz";
-          sha512 = "0iy34j997llj3jl3l8dipnsyms89qv9nxkza9l2gxmcj6mqwv5m6c8cvgca78qfccl1f5zsrzj855q1fz631p91yydbri2gxgvd10r7";
+          url = "https://registry.npmjs.org/@cloudflare/workerd-darwin-64/-/workerd-darwin-64-1.20240129.0.tgz";
+          sha512 = "DfVVB5IsQLVcWPJwV019vY3nEtU88c2Qu2ST5SQxqcGivZ52imagLRK0RHCIP8PK4piSiq90qUC6ybppUsw8eg==";
        };
      };
      darwinWorkerdArm = {
        name = "_at_cloudflare_slash_workerd-darwin-arm64";
        packageName = "@cloudflare/workerd-darwin-arm64";
        # Should be same version as workerd
-        version = "1.20231030.0";
+        version = "1.20240129.0";
        src = fetchurl {
-          url = "https://registry.npmjs.org/@cloudflare/workerd-darwin-arm64/-/workerd-darwin-arm64-1.20231030.0.tgz";
-          sha512 = "WSJJjm11Del4hSneiNB7wTXGtBXI4QMCH9l5qf4iT5PAW8cESGcCmdHtWDWDtGAAGcvmLT04KNvmum92vRKKQQ==";
+          url = "https://registry.npmjs.org/@cloudflare/workerd-darwin-arm64/-/workerd-darwin-arm64-1.20240129.0.tgz";
+          sha512 = "t0q8ABkmumG1zRM/MZ/vIv/Ysx0vTAXnQAPy/JW5aeQi/tqrypXkO9/NhPc0jbF/g/hIPrWEqpDgEp3CB7Da7Q==";
        };
      };

--- a/pkgs/development/python-modules/aioapcaccess/default.nix
+++ b/pkgs/development/python-modules/aioapcaccess/default.nix
@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytest-asyncio
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "aioapcaccess";
+  version = "0.4.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "yuxincs";
+    repo = "aioapcaccess";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Ig9aQduM9wby3DzPjvbubihopwhdMXHovMo3Id47mRk=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "aioapcaccess"
+  ];
+
+  meta = with lib; {
+    description = "Module for working with apcaccess";
+    homepage = "https://github.com/yuxincs/aioapcaccess";
+    changelog = "https://github.com/yuxincs/aioapcaccess/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/cf-xarray/default.nix
+++ b/pkgs/development/python-modules/cf-xarray/default.nix
@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "cf-xarray";
-  version = "0.8.7";
+  version = "0.8.8";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "xarray-contrib";
    repo = "cf-xarray";
    rev = "refs/tags/v${version}";
-    hash = "sha256-ldnrEks6NkUkaRaev0X6aRHdOZHfsy9/Maihvq8xdSs=";
+    hash = "sha256-memz0VDhxnSHOFaEhFYy/sqRifcu905EGovGduS0YBQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/cloudflare/default.nix
+++ b/pkgs/development/python-modules/cloudflare/default.nix
@ -2,7 +2,6 @@
 , buildPythonPackage
 , fetchPypi
 , attrs
-, beautifulsoup4
 , requests
 , future
 , pyyaml
@ -12,19 +11,18 @@

 buildPythonPackage rec {
  pname = "cloudflare";
-  version = "2.14.2";
+  version = "2.17.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-HeSaiJKI2C3FwPKip0ZVKWe5nZYGP13zpXpwNkLiQLQ=";
+    hash = "sha256-B2jTIYRKrMu+PXf3zifxW5NW3/rIHqlPrgErObuO6D4=";
  };

  propagatedBuildInputs = [
    attrs
-    beautifulsoup4
    requests
    future
    pyyaml
--- a/pkgs/development/python-modules/lightgbm/default.nix
+++ b/pkgs/development/python-modules/lightgbm/default.nix
@ -38,14 +38,14 @@ assert cudaSupport -> gpuSupport != true;

 buildPythonPackage rec {
  pname = "lightgbm";
-  version = "4.2.0";
+  version = "4.3.0";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-ik0FHfKrIhiZihb3cS6EPunpbYsJ/7/MGFM9oSfg2gI=";
+    hash = "sha256-AG9XhKm87kPlp+lD3E8C3hui7np68e5fGQ04Pztsnr4=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/malduck/default.nix
+++ b/pkgs/development/python-modules/malduck/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "malduck";
-  version = "4.3.2";
+  version = "4.4.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "CERT-Polska";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-3joIfhQBJzKdoU3FNW/yAHsQa/lMMbw3wGEQTyOBrOQ=";
+    hash = "sha256-CXHbU1AudvOJrG9MKYDQXeEtwrJODRPQtK43dQzZASE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/motmetrics/default.nix
+++ b/pkgs/development/python-modules/motmetrics/default.nix
@ -0,0 +1,58 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+
+# build-system
+, setuptools
+
+# dependencies
+, numpy
+, pandas
+, scipy
+, xmltodict
+
+# tests
+, pytestCheckHook
+, pytest-benchmark
+}:
+
+buildPythonPackage rec {
+  pname = "motmetrics";
+  version = "1.4.0-unstable-20240130";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "cheind";
+    repo = "py-motmetrics";
+    # latest release is not compatible with pandas 2.0
+    rev = "7210fcce0be1b76c96a62f6fe4ddbc90d944eacb";
+    hash = "sha256-7LKLHXWgW4QpivAgzvWl6qEG0auVvpiZ6bfDViCKsFY=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+    pandas
+    scipy
+    xmltodict
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-benchmark
+  ];
+
+  pythonImportsCheck = [
+    "motmetrics"
+  ];
+
+  meta = with lib; {
+    description = "Bar_chart: Benchmark multiple object trackers (MOT) in Python";
+    homepage = "https://github.com/cheind/py-motmetrics";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
+  };
+}
--- a/pkgs/development/python-modules/norfair/default.nix
+++ b/pkgs/development/python-modules/norfair/default.nix
@ -0,0 +1,69 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, poetry-core
+, filterpy
+, importlib-metadata
+, numpy
+, rich
+, scipy
+, motmetrics
+, opencv4
+, pytestCheckHook
+, pythonRelaxDepsHook
+}:
+
+buildPythonPackage rec {
+  pname = "norfair";
+  version = "2.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "tryolabs";
+    repo = "norfair";
+    rev = "v${version}";
+    hash = "sha256-aKB5TYSLW7FOXIy9u2hK7px6eEmIQdKPrhChKaU1uYs=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "rich"
+  ];
+
+  propagatedBuildInputs = [
+    filterpy
+    importlib-metadata
+    numpy
+    rich
+    scipy
+  ];
+
+  passthru.optional-dependencies = {
+    metrics = [
+      motmetrics
+    ];
+    video = [
+      opencv4
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "norfair"
+  ];
+
+  meta = with lib; {
+    description = "Lightweight Python library for adding real-time multi-object tracking to any detector";
+    changelog = "https://github.com/tryolabs/norfair/releases/tag/v${version}";
+    homepage = "https://github.com/tryolabs/norfair";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ fleaz ];
+  };
+}
--- a/pkgs/development/python-modules/onvif-zeep/default.nix
+++ b/pkgs/development/python-modules/onvif-zeep/default.nix
@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, zeep
+}:
+
+buildPythonPackage rec {
+  pname = "onvif-zeep";
+  version = "0.2.12";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "onvif_zeep";
+    inherit version;
+    hash = "sha256-qou8Aqc+qlCJSwwY45+o0xilg6ZkxlvzWzyAKdHEC0k=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    zeep
+  ];
+
+  pythonImportsCheck = [
+    "onvif"
+  ];
+
+  # Tests require hardware
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Python Client for ONVIF Camera";
+    homepage = "https://github.com/quatanium/python-onvif";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fleaz ];
+  };
+}
--- a/pkgs/development/python-modules/pyvista/default.nix
+++ b/pkgs/development/python-modules/pyvista/default.nix
@ -8,13 +8,14 @@
 , pooch
 , pythonOlder
 , scooby
+, setuptools
 , vtk
 }:

 buildPythonPackage rec {
  pname = "pyvista";
-  version = "0.43.2";
-  format = "setuptools";
+  version = "0.43.3";
+  pyproject = true;

  disabled = pythonOlder "3.8";

@ -22,9 +23,13 @@ buildPythonPackage rec {
    owner = pname;
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-2gh5qpiHda611bWWZzRXu+tkiRk9x4qNehFP8MARtk0=";
+    hash = "sha256-yJEggiWK73zzUPvOsPucpalmSMxywinE9t2e2dqBM9M=";
  };

+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    imageio
    matplotlib
--- a/pkgs/development/python-modules/pyzipper/default.nix
+++ b/pkgs/development/python-modules/pyzipper/default.nix
@ -4,12 +4,13 @@
 , pythonOlder
 , pytestCheckHook
 , pycryptodomex
+, setuptools
 }:

 buildPythonPackage rec {
  pname = "pyzipper";
  version = "0.3.6";
-  format = "setuptools";
+  pyproject = true;

  disabled = pythonOlder "3.7";

@ -20,12 +21,16 @@ buildPythonPackage rec {
    hash = "sha256-+fZXoAUeB/bUI3LrIFlMTktJgn+GNFBiDHvH2Jgo0pg=";
  };

+  __darwinAllowLocalNetworking = true;
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
  propagatedBuildInputs = [
    pycryptodomex
  ];

-  __darwinAllowLocalNetworking = true;
-
  nativeCheckInputs = [
    pytestCheckHook
  ];
@ -45,6 +50,8 @@ buildPythonPackage rec {
    "test_main"
    "test_temp_dir__forked_child"
    "test_test_command"
+    # Test wants to import asyncore
+    "test_CleanImport"
  ];

  meta = with lib; {
--- a/pkgs/development/python-modules/qpsolvers/default.nix
+++ b/pkgs/development/python-modules/qpsolvers/default.nix
@ -14,14 +14,14 @@
 }:
 buildPythonPackage rec {
  pname = "qpsolvers";
-  version = "4.2.0";
-  format = "pyproject";
+  version = "4.3.1";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "qpsolvers";
    repo = "qpsolvers";
    rev = "refs/tags/v${version}";
-    hash = "sha256-brniRAGwN/areB7MnaGeF7CdNku7DG/Q+8TmCXY99iU=";
+    hash = "sha256-/HLc9dFf9F/6W7ux2Fj2yJuV/xCVeGyO6MblddwIGdM=";
  };

  pythonImportsCheck = [ "qpsolvers" ];
@ -42,6 +42,7 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
+    changelog = "https://github.com/qpsolvers/qpsolvers/blob/${src.rev}/CHANGELOG.md";
    description = "Quadratic programming solvers in Python with a unified API";
    homepage = "https://github.com/qpsolvers/qpsolvers";
    license = licenses.lgpl3Plus;
--- a/pkgs/development/python-modules/ring-doorbell/default.nix
+++ b/pkgs/development/python-modules/ring-doorbell/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "ring-doorbell";
-  version = "0.8.6";
+  version = "0.8.7";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -26,7 +26,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "ring_doorbell";
    inherit version;
-    hash = "sha256-sjGN1I/SeI5POkACYBcUA76Fyk7XJln7A6ofg11ygrw=";
+    hash = "sha256-Awi0Wa/ayzhpecTCKWRt+2bQvvvDxbjN+bIKAdorETs=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/scikit-rf/default.nix
+++ b/pkgs/development/python-modules/scikit-rf/default.nix
@ -32,7 +32,7 @@

 buildPythonPackage rec {
  pname = "scikit-rf";
-  version = "0.30.0";
+  version = "0.31.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -41,7 +41,7 @@ buildPythonPackage rec {
    owner = "scikit-rf";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-rJjuraiTvCmZgz8ysFBbYPowkLIuwt8RaFNl+gDSfLk=";
+    hash = "sha256-MSFlajXdNZ/BfTLuegy+T9iNFdXk/TWN8J3TcYbYLbI=";
  };

  buildInputs = [
--- a/pkgs/development/python-modules/sphinx-tabs/default.nix
+++ b/pkgs/development/python-modules/sphinx-tabs/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "sphinx-tabs";
-  version = "3.4.4";
+  version = "3.4.5";
  format = "pyproject";

  outputs = [ "out" "doc" ];
@ -27,13 +27,9 @@ buildPythonPackage rec {
    owner = "executablebooks";
    repo = "sphinx-tabs";
    rev = "refs/tags/v${version}";
-    hash = "sha256-RcCADGJfwXP/U7Uws/uX+huaJzRDRUabQOnc9gqMUzM=";
+    hash = "sha256-uFSnIhvnmg3ZURJGbSOUpLVx0EDUs/9SewspM7gtNRk=";
  };

-  postPatch = ''
-    substituteInPlace setup.py --replace 'docutils~=0.18.0' 'docutils'
-  '';
-
  nativeBuildInputs = [
    setuptools
    sphinxHook
--- a/pkgs/development/python-modules/stravalib/default.nix
+++ b/pkgs/development/python-modules/stravalib/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "stravalib";
-  version = "1.5";
+  version = "1.6";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -22,8 +22,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "stravalib";
    repo = "stravalib";
-    rev = "v${version}";
-    hash = "sha256-EQcLDU9id/DpUZKMI9prCJC9zEK1CuhOtSB4FAWLg/g=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-U+QlSrijvT77/m+yjhFxbcVTQe51J+PR4Kc8N+qG+wI=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/umap-learn/default.nix
+++ b/pkgs/development/python-modules/umap-learn/default.nix
@ -1,16 +1,24 @@
 { lib
+, bokeh
 , buildPythonPackage
+, colorcet
+, datashader
 , fetchFromGitHub
-, fetchpatch
-, keras
+, holoviews
+, matplotlib
 , numba
 , numpy
+, pandas
 , pynndescent
 , pytestCheckHook
 , pythonOlder
+, scikit-image
 , scikit-learn
 , scipy
+, seaborn
+, tbb
 , tensorflow
+, tensorflow-probability
 , tqdm
 }:

@ -19,7 +27,7 @@ buildPythonPackage rec {
  version = "0.5.5";
  format = "setuptools";

-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "lmcinnes";
@ -37,10 +45,32 @@ buildPythonPackage rec {
    tqdm
  ];

+  passthru.optional-dependencies = rec {
+    plot = [
+      bokeh
+      colorcet
+      datashader
+      holoviews
+      matplotlib
+      pandas
+      scikit-image
+      seaborn
+    ];
+
+    parametric_umap = [
+      tensorflow
+      tensorflow-probability
+    ];
+
+    tbb = [
+      tbb
+    ];
+
+    all = plot ++ parametric_umap ++ tbb;
+  };
+
  nativeCheckInputs = [
-    keras
    pytestCheckHook
-    tensorflow
  ];

  preCheck = ''
@ -50,8 +80,9 @@ buildPythonPackage rec {
  disabledTests = [
    # Plot functionality requires additional packages.
    # These test also fail with 'RuntimeError: cannot cache function' error.
-    "test_umap_plot_testability"
    "test_plot_runs_at_all"
+    "test_umap_plot_testability"
+    "test_umap_update_large"

    # Flaky test. Fails with AssertionError sometimes.
    "test_sparse_hellinger"
--- a/pkgs/development/python-modules/yolink-api/default.nix
+++ b/pkgs/development/python-modules/yolink-api/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "yolink-api";
-  version = "0.3.6";
+  version = "0.3.7";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "YoSmart-Inc";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-KqQUaPac0nv8L3mrGn+nlzlB6mzqa5uMAceHlVKS1Ew=";
+    hash = "sha256-P9Hu3JhoFDwKylTAZmXYX2AI2CPf/GbYhJCU4wX/aWY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/r-modules/patches/rhdf5.patch
+++ b/pkgs/development/r-modules/patches/rhdf5.patch
@ -35,11 +35,12 @@ index b326444..5d58b4a 100644
   /* return value of lock attempt */
   PROTECT(Rval = allocVector(INTSXP, 1));
 diff --git a/src/h5testLock.h b/src/h5testLock.h
-index 2c1c5e4..660c747 100644
+index 2c1c5e4..25914ff 100644
 --- a/src/h5testLock.h
 +++ b/src/h5testLock.h
-@@ -1,5 +1,4 @@
+@@ -1,5 +1,5 @@
 #include <fcntl.h>
+#include <unistd.h>
 #include "myhdf5.h"
 -#include <H5private.h>
 
--- a/pkgs/development/tools/kafkactl/default.nix
+++ b/pkgs/development/tools/kafkactl/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "kafkactl";
-  version = "3.5.1";
+  version = "4.0.0";

  src = fetchFromGitHub {
    owner = "deviceinsight";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-HGOLPns7kBq02hF5TVs0DdTdJ+16JGs996JZ66k83Os=";
+    hash = "sha256-GtveC2W9y/mBuiZjpxCXjCE6WO0ub4wX85Is6MUTvlw=";
  };

-  vendorHash = "sha256-jUuJBGEb4pSdyuRd3qHINyC8aRwqyJnsb/raM9nEh84=";
+  vendorHash = "sha256-B7kP1ksH7t/1PQrI8mSgIEGdH02RhgN4A1z4S0UJG/g=";

  doCheck = false;

--- a/pkgs/servers/asterisk/versions.json
+++ b/pkgs/servers/asterisk/versions.json
@ -1,14 +1,14 @@
 {
  "asterisk_18": {
-    "sha256": "7ee8499fc704e5fcae57c5f195f806f2ce4da7ae5f62faa43e73b3e6d218747f",
-    "version": "18.20.2"
+    "sha256": "31e1b544ece2bb75be93621e358e6765fc095f4b65e061d488d517177aeb9208",
+    "version": "18.21.0"
  },
  "asterisk_20": {
-    "sha256": "8f68e1789dfb8aa04b0eba87ea1d599a62e088ddd20926afc997f36b455e1859",
-    "version": "20.5.2"
+    "sha256": "d70109e9b4c52fba6d0080b20cadc0aaee4060a0ad28bff4e376bf8b393e9400",
+    "version": "20.6.0"
  },
  "asterisk_21": {
-    "sha256": "dd121d0614088567f8434aa241b17229acc6a3462989c9257ffbc171aaecf98f",
-    "version": "21.0.2"
+    "sha256": "488100fe1d5648f629e22b52c87d9133892bf556f0c544eea659185cea6e8a69",
+    "version": "21.1.0"
  }
 }
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -188,7 +188,8 @@
      aiokafka
    ];
    "apcupsd" = ps: with ps; [
-    ]; # missing inputs: aioapcaccess
+      aioapcaccess
+    ];
    "api" = ps: with ps; [
      aiohttp-cors
      aiohttp-fast-url-dispatcher
@ -5752,6 +5753,7 @@
    "anova"
    "anthemav"
    "apache_kafka"
+    "apcupsd"
    "api"
    "apple_tv"
    "application_credentials"
--- a/pkgs/servers/matrix-synapse/plugins/s3-storage-provider.nix
+++ b/pkgs/servers/matrix-synapse/plugins/s3-storage-provider.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "matrix-synapse-s3-storage-provider";
-  version = "1.2.1";
+  version = "1.3.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "matrix-org";
    repo = "synapse-s3-storage-provider";
    rev = "refs/tags/v${version}";
-    hash = "sha256-92Xkq54jrUE2I9uVOxI72V9imLNU6K4JqDdOZb+4f+Y=";
+    hash = "sha256-2mQjhZk3NsbjiGWoa/asGjhaKM3afXsCl633p6ZW0DY=";
  };

  postPatch = ''
--- a/pkgs/tools/X11/ckbcomp/default.nix
+++ b/pkgs/tools/X11/ckbcomp/default.nix
@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "ckbcomp";
-  version = "1.223";
+  version = "1.224";

  src = fetchFromGitLab {
    domain = "salsa.debian.org";
    owner = "installer-team";
    repo = "console-setup";
    rev = version;
-    sha256 = "sha256-B0wUMyYNpPddrE4feUaHoeTtoJdE+IS7nY8gOvPBYSU=";
+    sha256 = "sha256-oqpETbMc0J8AKqt251kmxYyA2wgXxI1V2t6oJC14MfM=";
  };

  buildInputs = [ perl ];
--- a/pkgs/tools/admin/uacme/default.nix
+++ b/pkgs/tools/admin/uacme/default.nix
@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "uacme";
-  version = "1.7.4";
+  version = "1.7.5";

  src = fetchFromGitHub {
    owner = "ndilieto";
    repo = "uacme";
    rev = "v${version}";
-    hash = "sha256-ywir6wLZCTgb7SurJ5S/1UIV1Lw4/Er1wwdgl630Eso=";
+    hash = "sha256-MaPMNAUuQmJAbl7qBqNCkzW4k6nkibezEMRaCho5I68=";
  };

  configureFlags = [ "--with-openssl" ];
@ -38,5 +38,7 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/ndilieto/uacme";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ malte-v ];
+    platforms = platforms.unix;
+    broken = stdenv.isDarwin;
  };
 }
--- a/pkgs/tools/networking/stunnel/default.nix
+++ b/pkgs/tools/networking/stunnel/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "stunnel";
-  version = "5.71";
+  version = "5.72";

  outputs = [ "out" "doc" "man" ];

  src = fetchurl {
    url = "https://www.stunnel.org/archive/${lib.versions.major finalAttrs.version}.x/stunnel-${finalAttrs.version}.tar.gz";
-    hash = "sha256-8COq6DfC0y3rkggxpe4QgeEceKXVc0D45vCCnwMQF/U=";
+    hash = "sha256-PVMpQSga41MxlzUUTkrbmuSJoQt+MJxYpIFX8I9C6Uk=";
    # please use the contents of "https://www.stunnel.org/downloads/stunnel-${version}.tar.gz.sha256",
    # not the output of `nix-prefetch-url`
  };
--- a/pkgs/top-level/java-packages.nix
+++ b/pkgs/top-level/java-packages.nix
@ -10,10 +10,8 @@ let
  openjfx20 = callPackage ../development/compilers/openjdk/openjfx/20.nix { };
  openjfx21 = callPackage ../development/compilers/openjdk/openjfx/21.nix { };

-  mavenfod = pkgs.maven.buildMavenPackage;
-
 in {
-  inherit mavenfod openjfx11 openjfx15 openjfx17 openjfx19 openjfx20 openjfx21;
+  inherit openjfx11 openjfx15 openjfx17 openjfx19 openjfx20 openjfx21;

  compiler = let

@ -242,3 +240,6 @@ in {
  inherit (pkgs.darwin.apple_sdk_11_0.callPackage ../development/java-modules/jogl { })
    jogl_2_4_0;
 }
+// lib.optionalAttrs config.allowAliases {
+  mavenfod = throw "'mavenfod' is renamed to/replaced by 'maven.buildMavenPackage'";
+}
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -153,6 +153,8 @@ self: super: with self; {

  aioambient = callPackage ../development/python-modules/aioambient { };

+  aioapcaccess = callPackage ../development/python-modules/aioapcaccess { };
+
  aioapns = callPackage ../development/python-modules/aioapns { };

  aiocron = callPackage ../development/python-modules/aiocron { };
@ -7276,6 +7278,8 @@ self: super: with self; {

  mortgage = callPackage ../development/python-modules/mortgage { };

+  motmetrics = callPackage ../development/python-modules/motmetrics { };
+
  motionblinds = callPackage ../development/python-modules/motionblinds { };

  motioneye-client = callPackage ../development/python-modules/motioneye-client { };
@ -8433,6 +8437,8 @@ self: super: with self; {

  noiseprotocol = callPackage ../development/python-modules/noiseprotocol { };

+  norfair = callPackage ../development/python-modules/norfair { };
+
  normality = callPackage ../development/python-modules/normality { };

  nose = callPackage ../development/python-modules/nose { };
@ -8683,6 +8689,8 @@ self: super: with self; {

  onnxruntime-tools = callPackage ../development/python-modules/onnxruntime-tools { };

+  onvif-zeep = callPackage ../development/python-modules/onvif-zeep { };
+
  onvif-zeep-async = callPackage ../development/python-modules/onvif-zeep-async { };

  oocsi = callPackage ../development/python-modules/oocsi { };