Merge master into staging-next

2024-04-17 12:01:02 +00:00 · 2024-04-17 12:01:02 +00:00 · bd26da84da
commit bd26da84da
parent 73f2b40dfc d84b5d7735
75 changed files with 5288 additions and 3731 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -10207,6 +10207,11 @@
    githubId = 6544084;
    name = "Kai Harries";
  };
+  kai-tub = {
+    name = "Kai Norman Clasen";
+    github = "kai-tub";
+    githubId = 46302524;
+  };
  kalbasit = {
    email = "wael.nasreddine@gmail.com";
    matrix = "@kalbasit:matrix.org";
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -37,6 +37,10 @@ In addition to numerous new and upgraded packages, this release has the followin
 Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for PipeWire and
 `services.pipewire.wireplumber.configPackages` for WirePlumber instead."

+- `teleport` has been upgraded from major version 14 to major version 15.
+  Refer to upstream [upgrade instructions](https://goteleport.com/docs/management/operations/upgrading/)
+  and release notes for [v15](https://goteleport.com/docs/changelog/#1500-013124).
+
 - A new option `systemd.sysusers.enable` was added. If enabled, users and
  groups are created with systemd-sysusers instead of with a custom perl script.

@ -419,6 +423,14 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

  - `nomad_1_4` has been removed, as it is now unsupported upstream.

+- Dwarf Fortress has been updated to version 50, and its derivations continue to menace with spikes of Nix and bash. Version 50 is identical to the version on Steam, but without the paid elements like tilepacks.
+  dfhack and Dwarf Therapist still work, and older versions are still packaged in case you'd like to roll back. Note that DF 50 saves will not be compatible with DF 0.47 and earlier.
+  See [Bay 12 Games](http://www.bay12games.com/dwarves/) for more details on what's new in Dwarf Fortress.
+
+  - Running an earlier version can be achieved through an override: `dwarf-fortress-packages.dwarf-fortress-full.override { dfVersion = "0.47.5"; }`
+
+  - Ruby plugin support has been disabled in DFHack. Many of the Ruby plugins have been converted to Lua, and support was removed upstream due to frequent crashes.
+
 - The `livebook` package is now built as a `mix release` instead of an `escript`.
  This means that configuration now has to be done using [environment variables](https://hexdocs.pm/livebook/readme.html#environment-variables) instead of command line arguments.
  This has the further implication that the `livebook` service configuration has changed:
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@ -153,11 +153,10 @@ in
        '';
      type = configType;
      description = ''
-        The configuration of the Nix Packages collection.  (For
-        details, see the Nixpkgs documentation.)  It allows you to set
-        package configuration options.
+        Global configuration for Nixpkgs.
+        The complete list of [Nixpkgs configuration options](https://nixos.org/manual/nixpkgs/unstable/#sec-config-options-reference) is in the [Nixpkgs manual section on global configuration](https://nixos.org/manual/nixpkgs/unstable/#chap-packageconfig).

-        Ignored when `nixpkgs.pkgs` is set.
+        Ignored when {option}`nixpkgs.pkgs` is set.
      '';
    };

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -265,6 +265,7 @@
  ./programs/skim.nix
  ./programs/slock.nix
  ./programs/sniffnet.nix
+  ./programs/soundmodem.nix
  ./programs/spacefm.nix
  ./programs/ssh.nix
  ./programs/starship.nix
@ -286,8 +287,8 @@
  ./programs/virt-manager.nix
  ./programs/wavemon.nix
  ./programs/wayland/cardboard.nix
-  ./programs/wayland/labwc.nix
  ./programs/wayland/hyprland.nix
+  ./programs/wayland/labwc.nix
  ./programs/wayland/river.nix
  ./programs/wayland/sway.nix
  ./programs/wayland/waybar.nix
--- a/nixos/modules/programs/soundmodem.nix
+++ b/nixos/modules/programs/soundmodem.nix
@ -0,0 +1,34 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.soundmodem;
+in
+{
+  options = {
+    programs.soundmodem = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Whether to add Soundmodem to the global environment and configure a
+          wrapper for 'soundmodemconfig' for users in the 'soundmodem' group.
+        '';
+      };
+      package = mkPackageOption pkgs "soundmodem" { };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ soundmodem ];
+    users.groups.soundmodem = { };
+
+    security.wrappers.soundmodemconfig = {
+      source = "${cfg.package}/bin/soundmodemconfig";
+      owner = "root";
+      group = "soundmodem";
+      permissions = "u+rx,g+x";
+    };
+  };
+}
--- a/nixos/modules/services/misc/ollama.nix
+++ b/nixos/modules/services/misc/ollama.nix
@ -85,7 +85,7 @@ in
      };
      serviceConfig = {
        ExecStart = "${lib.getExe ollamaPackage} serve";
-        WorkingDirectory = "%S/ollama";
+        WorkingDirectory = cfg.home;
        StateDirectory = [ "ollama" ];
        DynamicUser = true;
      };
--- a/nixos/modules/services/networking/shadowsocks.nix
+++ b/nixos/modules/services/networking/shadowsocks.nix
@ -136,10 +136,16 @@ in
  ###### implementation

  config = mkIf cfg.enable {
-    assertions = singleton
-      { assertion = cfg.password == null || cfg.passwordFile == null;
-        message = "Cannot use both password and passwordFile for shadowsocks-libev";
-      };
+    assertions = [
+      {
+        # xor, make sure either password or passwordFile be set.
+        # shadowsocks-libev not support plain/none encryption method
+        # which indicated that password must set.
+        assertion = let noPasswd = cfg.password == null; noPasswdFile = cfg.passwordFile == null;
+          in (noPasswd && !noPasswdFile) || (!noPasswd && noPasswdFile);
+        message = "Option `password` or `passwordFile` must be set and cannot be set simultaneously";
+      }
+    ];

    systemd.services.shadowsocks-libev = {
      description = "shadowsocks-libev Daemon";
--- a/nixos/tests/teleport.nix
+++ b/nixos/tests/teleport.nix
@ -9,8 +9,8 @@ with import ../lib/testing-python.nix { inherit system pkgs; };
 let
  packages = with pkgs; {
    "default" = teleport;
-    "12" = teleport_12;
    "13" = teleport_13;
+    "14" = teleport_14;
  };

  minimal = package: {
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -11111,6 +11111,18 @@ final: prev:
    meta.homepage = "https://github.com/Pocco81/true-zen.nvim/";
  };

+  trust-vim = buildVimPlugin {
+    pname = "trust.vim";
+    version = "2022-04-14";
+    src = fetchFromGitHub {
+      owner = "tesaguri";
+      repo = "trust.vim";
+      rev = "3e17b29ff13f862eeda269d7ce0260571dab6cb7";
+      sha256 = "1zvxjgyzzhnza2gv528dvyp7m1nvsz5gjn0qp65jn0k7y4gh3nnl";
+    };
+    meta.homepage = "https://github.com/tesaguri/trust.vim/";
+  };
+
  tslime-vim = buildVimPlugin {
    pname = "tslime.vim";
    version = "2020-09-09";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -933,6 +933,7 @@ https://github.com/tremor-rs/tremor-vim/,,
 https://github.com/cappyzawa/trim.nvim/,,
 https://github.com/folke/trouble.nvim/,,
 https://github.com/Pocco81/true-zen.nvim/,,
+https://github.com/tesaguri/trust.vim/,HEAD,
 https://github.com/jgdavey/tslime.vim/,,
 https://github.com/Quramy/tsuquyomi/,,
 https://github.com/folke/twilight.nvim/,,
--- a/pkgs/applications/misc/tiramisu/default.nix
+++ b/pkgs/applications/misc/tiramisu/default.nix
@ -2,13 +2,15 @@

 stdenv.mkDerivation rec {
  pname = "tiramisu";
-  version = "2.0.20211107";
+  # FIXME: once a newer release in upstream is available
+  version = "2.0-unstable-2023-03-29";

  src = fetchFromGitHub {
    owner = "Sweets";
-    repo = pname;
-    rev = version;
-    sha256 = "1n1x1ybbwbanibw7b90k7v4cadagl41li17hz2l8s2sapacvq3mw";
+    repo = "tiramisu";
+    # FIXME: use the current HEAD commit as upstream has no releases since 2021
+    rev = "5dddd83abd695bfa15640047a97a08ff0a8d9f9b";
+    hash = "sha256-owYk/YFwJbqO6/dbGKPE8SnmmH4KvH+o6uWptqQtpfI=";
  };

  buildInputs = [ glib ];
--- a/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/pkgs/applications/networking/cluster/nomad/default.nix
@ -82,9 +82,9 @@ rec {

  nomad_1_7 = generic {
    buildGoModule = buildGo121Module;
-    version = "1.7.6";
-    sha256 = "sha256-rEWXQwkW/muX3D0An3WmHCoboPACFCrSG7Tyzor2wnQ=";
-    vendorHash = "sha256-95yUtNfN/50LjWHHReaB4/riUqy8J67099bP8Ua7gRw=";
+    version = "1.7.7";
+    sha256 = "sha256-4nuRheidR6rIoytrnDQdIP69f+sBLJ3Ias5DvqVaLFc=";
+    vendorHash = "sha256-ZuaD8iDsT+/eW0QUavf485R804Jtjl76NcQWYHA8QII=";
    license = lib.licenses.bsl11;
    passthru.tests.nomad = nixosTests.nomad;
    preCheck = ''
--- a/pkgs/applications/networking/feedreaders/newsboat/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsboat/default.nix
@ -3,16 +3,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "newsboat";
-  version = "2.34";
+  version = "2.35";

  src = fetchFromGitHub {
    owner = "newsboat";
    repo = "newsboat";
    rev = "r${version}";
-    hash = "sha256-knF+N/HHL/E6C973t+ww5XTLV2thwy7lMAeqTyXspHY=";
+    hash = "sha256-WbicKP46N8MVjUeerYUdcHJO5Qf7rQFyYCpxexd2wDY=";
  };

-  cargoHash = "sha256-IsDym+tqF040SxCJF575OPm45IROYMFsCrxJcM1SAJ4=";
+  cargoHash = "sha256-B6U+DxIRm9Sn4x+dZCfNKENNDsTUVZFT6i0Yz47gjTs=";

  # TODO: Check if that's still needed
  postPatch = lib.optionalString stdenv.isDarwin ''
--- a/pkgs/applications/radio/soundmodem/default.nix
+++ b/pkgs/applications/radio/soundmodem/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, alsa-lib, audiofile, gtk2, libxml2 }:
+{ lib, stdenv, fetchurl, pkg-config, alsa-lib, audiofile, gtk2, libxml2, copyDesktopItems, makeDesktopItem }:

 stdenv.mkDerivation rec {
  pname = "soundmodem";
@ -9,13 +9,26 @@ stdenv.mkDerivation rec {
    sha256 = "156l3wjnh5rcisxb42kcmlf74swf679v4xnj09zy5j74rd4h721z";
  };

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+    copyDesktopItems
+  ];
  buildInputs = [ alsa-lib audiofile gtk2 libxml2 ];

  patches = [ ./matFix.patch ];

  doCheck = true;

+  desktopItems = [
+    (makeDesktopItem {
+      name = "SoundmodemConfig";
+      exec = "soundmodemconfig";
+      desktopName = "SoundModemConfig";
+      comment = "Audio based modem for ham radio supporting ax.25";
+      categories = [ "Audio" ];
+    })
+  ];
+
  meta = with lib; {
    description = "Audio based modem for ham radio supporting ax.25";
    longDescription = ''
--- a/pkgs/applications/version-management/git-mit/default.nix
+++ b/pkgs/applications/version-management/git-mit/default.nix
@ -10,7 +10,7 @@
 }:

 let
-  version = "5.12.194";
+  version = "5.12.196";
 in
 rustPlatform.buildRustPackage {
  pname = "git-mit";
@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
    owner = "PurpleBooth";
    repo = "git-mit";
    rev = "v${version}";
-    hash = "sha256-9ITy2VPLIunSLSNx4EXbvxZ7V/Kr+DwmjzDVj/QVGHs=";
+    hash = "sha256-vv60+8H6WQes+xVJRsgLppwQ/DkQbfNC6tRx2TB/4HQ=";
  };

-  cargoHash = "sha256-6R+T0BSgT6IivugkXXsX5xJ2c3/J3FnLY3ZvcfYW53E=";
+  cargoHash = "sha256-jK2GTI+T7Ie5cdQQQHh2aj6Egb/5BxsfJkFrSo+z7Pc=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/version-management/gitui/default.nix
+++ b/pkgs/applications/version-management/gitui/default.nix
@ -1,55 +0,0 @@
-{ lib
-, stdenv
-, rustPlatform
-, fetchFromGitHub
-, libiconv
-, openssl
-, pkg-config
-, xclip
-, AppKit
-, Security
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "gitui";
-  version = "0.25.2";
-
-  src = fetchFromGitHub {
-    owner = "extrawurst";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-1sBuyY6lpxb/Vlpy6pi7YP69HZID6D97ZkVLbPEZ4Qw=";
-  };
-
-  cargoHash = "sha256-S8Oy5DII05430nkRJmMgZsb4fUIks2zliDea9RycH3E=";
-
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [ openssl ]
-    ++ lib.optional stdenv.isLinux xclip
-    ++ lib.optionals stdenv.isDarwin [ libiconv Security AppKit ];
-
-  # Needed to get openssl-sys to use pkg-config.
-  OPENSSL_NO_VENDOR = 1;
-
-  # The cargo config overrides linkers for some targets, breaking the build
-  # on e.g. `aarch64-linux`. These overrides are not required in the Nix
-  # environment: delete them.
-  postPatch = "rm .cargo/config";
-
-
-  # Getting app_config_path fails with a permission denied
-  checkFlags = [
-    "--skip=keys::key_config::tests::test_symbolic_links"
-  ];
-
-
-  meta = with lib; {
-    description = "Blazing fast terminal-ui for Git written in Rust";
-    homepage = "https://github.com/extrawurst/gitui";
-    changelog = "https://github.com/extrawurst/gitui/blob/v${version}/CHANGELOG.md";
-    mainProgram = "gitui";
-    license = licenses.mit;
-    maintainers = with maintainers; [ Br1ght0ne yanganto mfrw ];
-  };
-}
--- a/pkgs/by-name/at/atac/package.nix
+++ b/pkgs/by-name/at/atac/package.nix
@ -0,0 +1,46 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  oniguruma,
+  stdenv,
+  darwin,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "atac";
+  version = "0.11.3";
+
+  src = fetchFromGitHub {
+    owner = "Julien-cpsn";
+    repo = "ATAC";
+    rev = "v${version}";
+    hash = "sha256-nYPqj3Wa5itw83s08qsEu30v/2NwkLwGE0LlNY9Msok=";
+  };
+
+  cargoHash = "sha256-Beh5out4Ess+FP+Dg601ZqyXotEfujqNX16Vupp5WRc=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs =
+    [
+      oniguruma
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.Security
+    ];
+
+  env = {
+    RUSTONIG_SYSTEM_LIBONIG = true;
+  };
+
+  meta = with lib; {
+    description = "A simple API client (postman like) in your terminal";
+    homepage = "https://github.com/Julien-cpsn/ATAC";
+    license = licenses.mit;
+    maintainers = with maintainers; [vinnymeller];
+    mainProgram = "atac";
+  };
+}
--- a/pkgs/by-name/ca/castero/package.nix
+++ b/pkgs/by-name/ca/castero/package.nix
@ -0,0 +1,67 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "castero";
+  version = "0.9.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "xgi";
+    repo = "castero";
+    rev = "v${version}";
+    hash = "sha256-6/7oCKBMEcQeJ8PaFP15Xef9sQRYCpigtzINv2M6GUY=";
+  };
+
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+    wheel
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    requests
+    grequests
+    cjkwrap
+    pytz
+    beautifulsoup4
+    lxml
+    mpv
+    python-vlc
+  ];
+
+  nativeCheckInputs = with python3.pkgs; [
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "tests"
+  ];
+
+  disabledTests = [ "test_datafile_download" ];
+
+  pythonImportCheck = [
+    "castero"
+  ];
+
+  # Resolve configuration tests, which access $HOME
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  # Satisfy the python-mpv depedency, which is mpv within NixOS
+  postPatch = ''
+    substituteInPlace setup.py --replace-fail "python-mpv" "mpv"
+  '';
+
+  # VLC currently doesn't support Darwin on NixOS
+  meta = with lib; {
+    mainProgram = "castero";
+    description = "TUI podcast client for the terminal";
+    homepage = "https://github.com/xgi/castero";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ keto ];
+  };
+}
--- a/pkgs/by-name/gi/gitui/package.nix
+++ b/pkgs/by-name/gi/gitui/package.nix
@ -0,0 +1,63 @@
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, libiconv
+, openssl
+, pkg-config
+, xclip
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "gitui";
+  version = "0.26.1";
+
+  src = fetchFromGitHub {
+    owner = "extrawurst";
+    repo = "gitui";
+    rev = "v${version}";
+    hash = "sha256-JqxZbxjZrrdsXWhpYu0E9F18gMldtOLrAYd+uiY8IcQ=";
+  };
+
+  cargoHash = "sha256-zEoNyIiHQT6HBNSe+H7pz229K4eD0WMhp3I/6zJQHuU=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ]
+    ++ lib.optional stdenv.isLinux xclip
+    ++ lib.optionals stdenv.isDarwin [
+         libiconv
+         darwin.apple_sdk.frameworks.Security
+         darwin.apple_sdk.frameworks.AppKit
+       ];
+
+  postPatch = ''
+    # The cargo config overrides linkers for some targets, breaking the build
+    # on e.g. `aarch64-linux`. These overrides are not required in the Nix
+    # environment: delete them.
+    rm .cargo/config
+
+    # build script tries to get version information from git
+    rm build.rs
+    substituteInPlace Cargo.toml --replace-fail 'build = "build.rs"' ""
+  '';
+
+  GITUI_BUILD_NAME = version;
+  # Needed to get openssl-sys to use pkg-config.
+  OPENSSL_NO_VENDOR = 1;
+
+  # Getting app_config_path fails with a permission denied
+  checkFlags = [
+    "--skip=keys::key_config::tests::test_symbolic_links"
+  ];
+
+  meta = {
+    description = "Blazing fast terminal-ui for Git written in Rust";
+    homepage = "https://github.com/extrawurst/gitui";
+    changelog = "https://github.com/extrawurst/gitui/blob/v${version}/CHANGELOG.md";
+    mainProgram = "gitui";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ Br1ght0ne yanganto mfrw ];
+  };
+}
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.124.1";
+  version = "0.125.0";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = "hugo";
    rev = "refs/tags/v${version}";
-    hash = "sha256-ueosu4mUqI9TH3nlOEjZBkejeo3WEfPqzLRNbj1B2Ec=";
+    hash = "sha256-aPBS/8m57Dn8Uvem58KzaCZJ1Hn8doL1BsDdF7w5nJc=";
  };

-  vendorHash = "sha256-LQLrbFJUW3X4F6L7JxQJRmkQFvuFraHJRBoGLt/ObSg=";
+  vendorHash = "sha256-jGCHlAE5mSDKpZVWgjCEN51sL+3GR/C5ROI9065OhRU=";

  doCheck = false;

--- a/pkgs/by-name/im/immich-go/package.nix
+++ b/pkgs/by-name/im/immich-go/package.nix
@ -0,0 +1,47 @@
+{ lib, buildGoModule, fetchFromGitHub, nix-update-script, testers, immich-go }:
+buildGoModule rec {
+  pname = "immich-go";
+  version = "0.13.2";
+
+  src = fetchFromGitHub {
+    owner = "simulot";
+    repo = "immich-go";
+    rev = "${version}";
+    hash = "sha256-zYqPPLDfBx4FLvZIo5E6nAeIiFfBCLI00xLieXFkMxs=";
+  };
+
+  vendorHash = "sha256-Y5BujN2mk662oKxQpenjFlxazST2GqWr9ug0sOsxKbY=";
+
+  # options used by upstream:
+  # https://github.com/simulot/immich-go/blob/0.13.2/.goreleaser.yaml
+  ldflags = [
+    "-s"
+    "-w"
+    "-extldflags=-static"
+    "-X main.version=${version}"
+    "-X main.commit=${version}"
+    "-X main.date=unknown"
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.versionTest = testers.testVersion {
+      package = immich-go;
+      command = "immich-go -h";
+      version = version;
+    };
+  };
+
+  meta = {
+    description = "Immich client tool for bulk-uploads";
+    longDescription = ''
+      Immich-Go is an open-source tool designed to streamline uploading
+      large photo collections to your self-hosted Immich server.
+    '';
+    homepage = "https://github.com/simulot/immich-go";
+    mainProgram = "immich-go";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ kai-tub ];
+    changelog = "https://github.com/simulot/immich-go/releases/tag/${version}";
+  };
+}
--- a/pkgs/by-name/ne/netscanner/package.nix
+++ b/pkgs/by-name/ne/netscanner/package.nix
@ -6,7 +6,7 @@
 }:
 let
  pname = "netscanner";
-  version = "0.4.1";
+  version = "0.4.2";
 in
 rustPlatform.buildRustPackage {
  inherit pname version;
@ -17,10 +17,10 @@ rustPlatform.buildRustPackage {
    owner = "Chleba";
    repo = "netscanner";
    rev = "refs/tags/v${version}";
-    hash = "sha256-E9WQpWqXWIhY1cq/5hqBbNBffe/nFLBelnFPW0tS5Ng=";
+    hash = "sha256-xdY3moWRmSMZ3PVyuHBnp8c9k5KxH+MoE5+s0QWSUM4=";
  };

-  cargoHash = "sha256-G2ePiVmHyZ7a4gn7ZGg5y4lhfbWoWGh4+fG9pMHZueg=";
+  cargoHash = "sha256-15BNkrr79KMyFcn7NJrGCj25RjH/a4WUOQAoMPzJieQ=";

  postFixup = ''
    wrapProgram $out/bin/netscanner \
--- a/pkgs/by-name/ne/neverest/package.nix
+++ b/pkgs/by-name/ne/neverest/package.nix
@ -0,0 +1,63 @@
+{ lib
+, rustPlatform
+, fetchFromSourcehut
+, stdenv
+, pkg-config
+, darwin
+, installShellFiles
+, installShellCompletions ? stdenv.hostPlatform == stdenv.buildPlatform
+, installManPages ? stdenv.hostPlatform == stdenv.buildPlatform
+, notmuch
+, buildNoDefaultFeatures ? false
+, buildFeatures ? []
+}:
+
+rustPlatform.buildRustPackage rec {
+  # Learn more about available cargo features at:
+  #  - <https://pimalaya.org/neverest/cli/latest/installation.html#cargo>
+  #  - <https://git.sr.ht/~soywod/neverest-cli/tree/master/item/Cargo.toml#L18>
+  inherit buildNoDefaultFeatures buildFeatures;
+
+  pname = "neverest";
+  version = "1.0.0-beta";
+
+  src = fetchFromSourcehut {
+    owner = "~soywod";
+    repo = "${pname}-cli";
+    rev = "v${version}";
+    hash = "sha256-3PSJyhxrOCiuHUeVHO77+NecnI5fN5EZfPhYizuYvtE=";
+  };
+
+  cargoSha256 = "i5or8oBtjGqOfTfwB7dYXn/OPgr5WEWNEvC0WdCCG+c=";
+
+  nativeBuildInputs = [ pkg-config ]
+    ++ lib.optional (installManPages || installShellCompletions) installShellFiles;
+
+  buildInputs = [ ]
+    ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ AppKit Cocoa Security ])
+    ++ lib.optional (builtins.elem "notmuch" buildFeatures) notmuch;
+
+  # TODO: unit tests temporarily broken, remove this line for the next
+  # beta.2 release
+  doCheck = false;
+
+  postInstall = lib.optionalString installManPages ''
+    mkdir -p $out/man
+    $out/bin/neverest man $out/man
+    installManPage $out/man/*
+  '' + lib.optionalString installShellCompletions ''
+    installShellCompletion --cmd neverest \
+      --bash <($out/bin/neverest completion bash) \
+      --fish <($out/bin/neverest completion fish) \
+      --zsh <($out/bin/neverest completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "CLI to synchronize, backup and restore emails";
+    mainProgram = "neverest";
+    homepage = "https://pimalaya.org/neverest/cli/v${version}/";
+    changelog = "https://git.sr.ht/~soywod/neverest-cli/tree/v${version}/item/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ soywod ];
+  };
+}
--- a/pkgs/by-name/ni/niri/package.nix
+++ b/pkgs/by-name/ni/niri/package.nix
@ -62,8 +62,6 @@ rustPlatform.buildRustPackage rec {
    libglvnd # For libEGL
  ];

-  LIBCLANG_PATH = "${libclang.lib}/lib";
-
  passthru.providedSessions = ["niri"];

  postPatch = ''
--- a/pkgs/by-name/ni/nix-inspect/package.nix
+++ b/pkgs/by-name/ni/nix-inspect/package.nix
@ -13,7 +13,7 @@
  src = fetchFromGitHub {
    owner = "bluskript";
    repo = "nix-inspect";
-    rev = "3d0fea2bb246130825548fce331093ee9cc9c20b";
+    rev = "74007c580b8282bd336130ddf354e71502b421a6";
    hash = "sha256-JichXRSfTLfy+7fhbTvA89rQLkqsY2eHgEAeAHWbA9s=";
  };

@ -21,7 +21,7 @@
    inherit src;

    pname = "nix-inspect-worker";
-    version = "0.1.0";
+    version = "0.1.1";
    sourceRoot = "source/worker";

    nativeBuildInputs = [meson ninja pkg-config];
@ -38,9 +38,9 @@ in
  rustPlatform.buildRustPackage {
    inherit src;
    pname = "nix-inspect";
-    version = "0.1.0";
+    version = "0.1.1";

-    cargoHash = "sha256-FdpHdw7bg/nEG4GjYhrdIDB4MJ4n5LoWnW4mTG2Lh5I=";
+    cargoHash = "sha256-l+R7BLgJvK9mQ89GVAdTyQX81VMoV11h5KFlMUqAH30=";

    buildInputs = [workerPackage];

@ -50,7 +50,7 @@ in
    '';

    meta = with lib; {
-      description = "A Rust package for inspecting Nix expressions";
+      description = "Interactive TUI for inspecting nix configs and other expressions";
      homepage = "https://github.com/bluskript/nix-inspect";
      license = licenses.mit;
      maintainers = with maintainers; [blusk];
--- a/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery-datatransfer/default.nix
@ -1,30 +1,34 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, google-api-core
-, libcst
-, mock
-, proto-plus
-, protobuf
-, pytest-asyncio
-, pytestCheckHook
-, pythonOlder
-, pytz
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  google-api-core,
+  libcst,
+  mock,
+  proto-plus,
+  protobuf,
+  pytest-asyncio,
+  pytestCheckHook,
+  pythonOlder,
+  pytz,
+  setuptools,
 }:

 buildPythonPackage rec {
  pname = "google-cloud-bigquery-datatransfer";
-  version = "3.15.1";
-  format = "setuptools";
+  version = "3.15.2";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-2A0v6UBFHeP0fsU71e22Aau7HfQYnN4fo4bYD3G+p2I=";
+    hash = "sha256-oX4E3G3PB9qqCo5ZWt+p702oV5KUzlIdXNczthJ73Q0=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    google-api-core
    libcst
    proto-plus
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "langchain-core";
-  version = "0.1.42";
+  version = "0.1.43";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -25,7 +25,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "langchain_core";
    inherit version;
-    hash = "sha256-QHUb9g6l2OKy7+ZSkNtDRxfuODSHDAAuQOKBHwnYFOY=";
+    hash = "sha256-SZEz+two7899JDBiNlIVGAgLsQ/Yv290Jt5KK78q67U=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/msgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/msgraph-sdk/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "msgraph-sdk";
-  version = "1.2.0";
+  version = "1.3.0";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "microsoftgraph";
    repo = "msgraph-sdk-python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-UaGdusPGWlF7gTzpCq9WrF/evdDSK5srrkH8/Vz9O8M=";
+    hash = "sha256-RdjACxEB4w1Sbdf8lPHd12XcEMXBqaa84mF9XvavyHo=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/nptyping/default.nix
+++ b/pkgs/development/python-modules/nptyping/default.nix
@ -51,6 +51,8 @@ buildPythonPackage rec {
    "tests/test_typeguard.py"
    # tries to build wheel of package, broken/unnecessary under Nix:
    "tests/test_wheel.py"
+    # beartype fails a type check
+    "tests/test_beartype.py"
  ];

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "peaqevcore";
-  version = "19.7.14";
+  version = "19.7.15";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-yUGvY5sjt2eXWpu/wSWjxpDpwBEJoZg3nI28QbdfiII=";
+    hash = "sha256-joEAdYJ+W+yqiiAOypEdKkwZQrFfzGvAu6Xg77B4Pss=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/ray/binary-hashes.nix
+++ b/pkgs/development/python-modules/ray/binary-hashes.nix
@ -1,8 +1,8 @@
 {
  cp310 = {
-    hash = "sha256-u3lZbEScS6AnvJg5KZYX2Mh2saW2Hxah5AGqkBrUUYM=";
+    hash = "sha256-y3T30qpaIeX53LMVpPm96CIyjna6lc0Lo3DP2gmKZ/Q=";
  };
  cp311 = {
-    hash = "sha256-E8VV/nMPzjVXJuja56fWztvkcKfhJXSACOv8RLDFgn0=";
+    hash = "sha256-x9FDjLqHJuyaWclpZOAHtgoHKENmR/SMODIoaSwvLuA=";
  };
 }
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@ -52,7 +52,7 @@

 let
  pname = "ray";
-  version = "2.9.0";
+  version = "2.10.0";
 in
 buildPythonPackage rec {
  inherit pname version;
--- a/pkgs/development/python-modules/types-aiobotocore/default.nix
+++ b/pkgs/development/python-modules/types-aiobotocore/default.nix
--- a/pkgs/development/python-modules/types-awscrt/default.nix
+++ b/pkgs/development/python-modules/types-awscrt/default.nix
@ -1,13 +1,14 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, poetry-core
-, pythonOlder
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  poetry-core,
+  pythonOlder,
 }:

 buildPythonPackage rec {
  pname = "types-awscrt";
-  version = "0.20.5";
+  version = "0.20.9";
  pyproject = true;

  disabled = pythonOlder "3.7";
@ -15,16 +16,12 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "types_awscrt";
    inherit version;
-    hash = "sha256-YYEbv03pUkiTn5J2pDS+k9K5X2zP6KqU5WmZ6XeM/MI=";
+    hash = "sha256-ZImKL0okaPZiM8uMKcX2bekHz4C6HvW7E1mu8vgbtSE=";
  };

-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];

-  pythonImportsCheck = [
-    "awscrt-stubs"
-  ];
+  pythonImportsCheck = [ "awscrt-stubs" ];

  meta = with lib; {
    description = "Type annotations and code completion for awscrt";
--- a/pkgs/development/python-modules/yfinance/default.nix
+++ b/pkgs/development/python-modules/yfinance/default.nix
@ -1,35 +1,39 @@
-{ lib
-, appdirs
-, beautifulsoup4
-, buildPythonPackage
-, cryptography
-, fetchFromGitHub
-, frozendict
-, html5lib
-, multitasking
-, numpy
-, pandas
-, peewee
-, pythonOlder
-, requests
-, lxml
+{
+  lib,
+  appdirs,
+  beautifulsoup4,
+  buildPythonPackage,
+  cryptography,
+  fetchFromGitHub,
+  frozendict,
+  html5lib,
+  lxml,
+  multitasking,
+  numpy,
+  pandas,
+  peewee,
+  pythonOlder,
+  requests,
+  setuptools,
 }:

 buildPythonPackage rec {
  pname = "yfinance";
-  version = "0.2.37";
-  format = "setuptools";
+  version = "0.2.38";
+  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "ranaroussi";
-    repo = pname;
+    repo = "yfinance";
    rev = "refs/tags/${version}";
-    hash = "sha256-rptCZ4Yiz6VbV/woHN6JpRNsZL4SrqepoIw4tYpU4x0=";
+    hash = "sha256-ZGwtu2vLcE9pM73umhnFwSzjQnGjTOTtVF607ox7I6E=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    appdirs
    beautifulsoup4
    cryptography
@ -46,13 +50,10 @@ buildPythonPackage rec {
  # Tests require internet access
  doCheck = false;

-  pythonImportsCheck = [
-    "yfinance"
-  ];
+  pythonImportsCheck = [ "yfinance" ];

  meta = with lib; {
    description = "Module to doiwnload Yahoo! Finance market data";
-    mainProgram = "sample";
    homepage = "https://github.com/ranaroussi/yfinance";
    changelog = "https://github.com/ranaroussi/yfinance/blob/${version}/CHANGELOG.rst";
    license = licenses.asl20;
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "checkov";
-  version = "3.2.66";
+  version = "3.2.68";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = "checkov";
    rev = "refs/tags/${version}";
-    hash = "sha256-Wtpg3Fk3hxmbZ2Tz5XIjM2mdh8jq4O67nD2rxAGlcaY=";
+    hash = "sha256-6nOIVcPlVp49kqoH7EPI1VVTC85S4wqwx+aU+5wy758=";
  };

  patches = [ ./flake8-compat-5.x.patch ];
--- a/pkgs/games/dwarf-fortress/default.nix
+++ b/pkgs/games/dwarf-fortress/default.nix
@ -38,39 +38,38 @@ let
    getAttr
    importJSON
    listToAttrs
+    optionalAttrs
    recurseIntoAttrs
    replaceStrings
+    versionAtLeast
    ;

  callPackage = newScope self;

  # The latest Dwarf Fortress version. Maintainers: when a new version comes
  # out, ensure that (unfuck|dfhack|twbt) are all up to date before changing
-  # this.
-  latestVersion = "0.47.05";
+  # this. Note that unfuck and twbt are not required for 50.
+  latestVersion = "50.12";

  # Converts a version to a package name.
  versionToName = version: "dwarf-fortress_${replaceStrings ["."] ["_"] version}";

-  dwarf-therapist-original = libsForQt5.callPackage ./dwarf-therapist {
-    texlive = texliveBasic.withPackages (ps: with ps; [ float caption wrapfig adjmulticol sidecap preprint enumitem ]);
-  };
-
  # A map of names to each Dwarf Fortress package we know about.
  df-games = listToAttrs (map
    (dfVersion: {
      name = versionToName dfVersion;
      value =
        let
-          # I can't believe this syntax works. Spikes of Nix code indeed...
+          isAtLeast50 = versionAtLeast dfVersion "50.0";
+
+          dwarf-fortress-unfuck = optionalAttrs (!isAtLeast50) (callPackage ./unfuck.nix { inherit dfVersion; });
+
          dwarf-fortress = callPackage ./game.nix {
            inherit dfVersion;
            inherit dwarf-fortress-unfuck;
          };

-          dwarf-fortress-unfuck = callPackage ./unfuck.nix { inherit dfVersion; };
-
-          twbt = callPackage ./twbt { inherit dfVersion; };
+          twbt = optionalAttrs (!isAtLeast50) (callPackage ./twbt { inherit dfVersion; });

          dfhack = callPackage ./dfhack {
            inherit (perlPackages) XMLLibXML XMLLibXSLT;
@ -80,7 +79,13 @@ let

          dwarf-therapist = libsForQt5.callPackage ./dwarf-therapist/wrapper.nix {
            inherit dwarf-fortress;
-            dwarf-therapist = dwarf-therapist-original;
+            dwarf-therapist = (libsForQt5.callPackage ./dwarf-therapist {
+              texlive = texliveBasic.withPackages (ps: with ps; [ float caption wrapfig adjmulticol sidecap preprint enumitem ]);
+            }).override (optionalAttrs (!isAtLeast50) {
+              # 41.2.5 is the last version to support Dwarf Fortress 0.47.
+              version = "41.2.5";
+              hash = "sha256-xfYBtnO1n6OcliVt07GsQ9alDJIfWdVhtuyWwuvXSZs=";
+            });
          };
        in
        callPackage ./wrapper {
@ -97,7 +102,6 @@ let

    # Aliases for the latest Dwarf Fortress and the selected Therapist install
    dwarf-fortress = getAttr (versionToName latestVersion) df-games;
-    inherit dwarf-therapist-original;
    dwarf-therapist = dwarf-fortress.dwarf-therapist;
    dwarf-fortress-original = dwarf-fortress.dwarf-fortress;

--- a/pkgs/games/dwarf-fortress/df_permission/2010
+++ b/pkgs/games/dwarf-fortress/df_permission/2010
--- a/pkgs/games/dwarf-fortress/df_permission/2024
+++ b/pkgs/games/dwarf-fortress/df_permission/2024
@ -0,0 +1,57 @@
+From: Tarn Adams <tarn.adams@gmail.com>
+Date: Thu, 4 Apr 2024 20:18:35 -0700
+Subject: Re: Dwarf Fortress v50 Redistribution for NixOS
+To: Morgan <me@numin.it>
+
+Yeah, it's fine to continue redistributing the classic version as before.
+
+Ah, yeah, I'm aware of the command line issue.  Hopefully it can be cleaned
+up with some of the other missing functionality like legends mode image
+export.
+
+Tarn
+
+On Wed, Apr 3, 2024 at 1:26 AM Morgan <me@numin.it> wrote:
+
+> Tarn,
+>
+> I maintain the Dwarf Fortress package for NixOS (<https://nixos.org>),
+> and wanted to double check with you that packaging v50.x and later is
+> still okay. One of our maintainers previously received permission, but
+> that was 14(!) years ago:
+>
+>
+> https://github.com/NixOS/nixpkgs/blob/master/pkgs/games/dwarf-fortress/df_permission
+>
+> Users installing Dwarf Fortress using Nix automatically pull the
+> tar.bz2 classic builds from the Bay 12 Games site. The Nix package
+> recipes make minor changes to some of the executable files; namely,
+> patching paths to shared object files like SDL, ld-linux.so, and
+> libc++ using patchelf. Users who install Nix or run NixOS can run this
+> whole process automatically and have a working Dwarf Fortress with:
+>
+> `nix run nixpkgs#dwarf-fortress`
+>
+> We don't and can't distribute any of the files from Steam, though
+> users who buy the game can link the Steam game data directory into
+> their Nix Dwarf Fortress data directory and use the tile packs from
+> the Steam version, if they like.
+>
+> ~
+>
+> Enough of that formality: thanks for the game, it's a blast and a joy
+> for the imagination. I use it to make maps for large scale (50+
+> people) D&D campaigns in Southern California.
+>
+> BTW, automatic world generation mode using the command line seems to
+> be broken in v50.12. It navigates to the worldgen menu but doesn't get
+> farther. I'm hoping I can release some Nix scripts that people can use
+> to export world images and such in batch mode at some point, so I
+> don't have to even mess with extracting the game files to get
+> interesting map exports.
+>
+> Thanks,
+> Morgan Jones
+> ----
+> < We are failing in translating hyperreal concepts >  -The Board
+>
--- a/pkgs/games/dwarf-fortress/dfhack/default.nix
+++ b/pkgs/games/dwarf-fortress/dfhack/default.nix
@ -1,20 +1,27 @@
 { stdenv
-, buildEnv
 , lib
 , fetchFromGitHub
 , fetchpatch
 , cmake
+, ninja
 , writeScriptBin
 , perl
 , XMLLibXML
 , XMLLibXSLT
+, makeWrapper
 , zlib
-, ruby
 , enableStoneSense ? false
 , allegro5
 , libGLU
 , libGL
 , SDL
+, SDL2
+, coreutils
+, util-linux
+, ncurses
+, strace
+, binutils
+, gnused
 , dfVersion
 }:

@ -28,48 +35,60 @@ let
    optional
    optionals
    optionalString
-    platforms
    versionOlder
+    versionAtLeast
    ;

  dfhack-releases = {
    "0.44.10" = {
      dfHackRelease = "0.44.10-r2";
-      sha256 = "19bxsghxzw3bilhr8sm4axz7p7z8lrvbdsd1vdjf5zbg04rs866i";
+      hash = "sha256-0RikMwFv/eJk26Hptnam6J97flekapQhjWvw3+HTfaU=";
      xmlRev = "321bd48b10c4c3f694cc801a7dee6be392c09b7b";
-      prerelease = false;
    };
    "0.44.11" = {
      dfHackRelease = "0.44.11-beta2.1";
-      sha256 = "1jgwcqg9m1ybv3szgnklp6zfpiw5mswla464dlj2gfi5v82zqbv2";
+      hash = "sha256-Yi/8BdoluickbcQQRbmuhcfrvrl02vf12MuHmh5m/Mk=";
      xmlRev = "f27ebae6aa8fb12c46217adec5a812cd49a905c8";
      prerelease = true;
    };
    "0.44.12" = {
      dfHackRelease = "0.44.12-r1";
-      sha256 = "0j03lq6j6w378z6cvm7jspxc7hhrqm8jaszlq0mzfvap0k13fgyy";
+      hash = "sha256-3j83wgRXbfcrwPRrJVHFGcLD+tXy1M3MR2dwIw2mA0g=";
      xmlRev = "23500e4e9bd1885365d0a2ef1746c321c1dd5094";
-      prerelease = false;
    };
    "0.47.02" = {
      dfHackRelease = "0.47.02-alpha0";
-      sha256 = "19lgykgqm0si9vd9hx4zw8b5m9188gg8r1a6h25np2m2ziqwbjj9";
+      hash = "sha256-ScrFcfyiimuLgEaFjN5DKKRaFuKfdJjaTlGDit/0j6Y=";
      xmlRev = "23500e4e9bd1885365d0a2ef1746c321c1dd509a";
      prerelease = true;
    };
    "0.47.04" = {
      dfHackRelease = "0.47.04-r5";
-      sha256 = "sha256-0s+/LKbqsS/mrxKPDeniqykE5+Gy3ZzCa8yEDzMyssY=";
+      hash = "sha256-0s+/LKbqsS/mrxKPDeniqykE5+Gy3ZzCa8yEDzMyssY=";
      xmlRev = "be0444cc165a1abff053d5893dc1f780f06526b7";
-      prerelease = false;
    };
    "0.47.05" = {
      dfHackRelease = "0.47.05-r7";
-      sha256 = "sha256-vBKUTSjfCnalkBzfjaIKcxUuqsGGOTtoJC1RHJIDlNc=";
+      hash = "sha256-vBKUTSjfCnalkBzfjaIKcxUuqsGGOTtoJC1RHJIDlNc=";
      xmlRev = "f5019a5c6f19ef05a28bd974c3e8668b78e6e2a4";
-      prerelease = false;
    };
-
+    "50.10" = {
+      dfHackRelease = "50.10-r1.1";
+      hash = "sha256-k2j8G4kJ/RYE8W0YDOxcsRb5qjjn4El+rigf0v3AqZU=";
+      xmlRev = "041493b221e0799c106abeac1f86df4535ab80d3";
+      needsPatches = true;
+    };
+    "50.11" = {
+      dfHackRelease = "50.11-r7";
+      hash = "sha256-3KsFc0i4XkzoeRvcl5GUlx/fJB1HyqfZm+xL6T4oT/A=";
+      xmlRev = "cca87907c1cbfcf4af957b0bea3a961a345b1581";
+      needsPatches = true;
+    };
+    "50.12" = {
+      dfHackRelease = "50.12-r3";
+      hash = "sha256-2mO8DpNmZRCV7IRY0arf3SMvlO4Pxs61Kxfh3q3k3HU=";
+      xmlRev = "980b1af13acc31660dce632f913c968f52e2b275";
+    };
  };

  release =
@ -80,6 +99,8 @@ let
    else throw "[DFHack] Unsupported Dwarf Fortress version: ${dfVersion}";

  version = release.dfHackRelease;
+  isAtLeast50 = versionAtLeast version "50.0";
+  needs50Patches = isAtLeast50 && (release.needsPatches or false);

  # revision of library/xml submodule
  xmlRev = release.xmlRev;
@ -119,7 +140,7 @@ in
      owner = "DFHack";
      repo = "dfhack";
      rev = release.dfHackRelease;
-      sha256 = release.sha256;
+      inherit (release) hash;
      fetchSubmodules = true;
    };

@ -133,6 +154,14 @@ in
      name = "fix-protobuf.patch";
      url = "https://github.com/DFHack/dfhack/commit/7bdf958518d2892ee89a7173224a069c4a2190d8.patch";
      hash = "sha256-p+mKhmYbnhWKNiGPMjbYO505Gcg634n0nudqH0NX3KY=";
+    }) ++ optional needs50Patches (fetchpatch {
+      name = "use-system-sdl2.patch";
+      url = "https://github.com/DFHack/dfhack/commit/734fb730d72e53ebe67f4a041a24dd7c50307ee3.patch";
+      hash = "sha256-uLX0gdVSzKEVibyUc1UxcQzdYkRm6D8DF+1eSOxM+qU=";
+    }) ++ optional needs50Patches (fetchpatch {
+      name = "rename-lerp.patch";
+      url = "https://github.com/DFHack/dfhack/commit/389dcf5cfcdb8bfb8deeb05fa5756c9f4f5709d1.patch";
+      hash = "sha256-QuDtGURhP+nM+x+8GIKO5LrMcmBkl9JSHHIeqzqGIPQ=";
    });

    # gcc 11 fix
@ -150,27 +179,71 @@ in
      sed -i 's@cached_path = path_string.*@cached_path = getenv("DF_DIR");@' library/Process-linux.cpp
    '';

-    nativeBuildInputs = [ cmake perl XMLLibXML XMLLibXSLT fakegit ];
+    nativeBuildInputs = [ cmake ninja perl XMLLibXML XMLLibXSLT makeWrapper fakegit ];
+
    # We don't use system libraries because dfhack needs old C++ ABI.
-    buildInputs = [ zlib SDL ]
+    buildInputs = [ zlib ]
+      ++ optional isAtLeast50 SDL2
+      ++ optional (!isAtLeast50) SDL
      ++ optionals enableStoneSense [ allegro5 libGLU libGL ];

    preConfigure = ''
-      # Trick build system into believing we have .git
+      # Trick the build system into believing we have .git.
      mkdir -p .git/modules/library/xml
      touch .git/index .git/modules/library/xml/index
    '';

-    cmakeFlags = [ "-DDFHACK_BUILD_ARCH=${arch}" "-DDOWNLOAD_RUBY=OFF" ]
-      ++ optionals enableStoneSense [ "-DBUILD_STONESENSE=ON" "-DSTONESENSE_INTERNAL_SO=OFF" ];
+    cmakeFlags = [
+      # Race condition in `Generating codegen.out.xml and df/headers` that is fixed when using Ninja.
+      "-GNinja"
+      "-DDFHACK_BUILD_ARCH=${arch}"

-    # dfhack expects an unversioned libruby.so to be present in the hack
-    # subdirectory for ruby plugins to function.
-    postInstall = ''
-      ln -s ${ruby}/lib/libruby-*.so $out/hack/libruby.so
+      # Don't download anything.
+      "-DDOWNLOAD_RUBY=OFF"
+      "-DUSE_SYSTEM_SDL2=ON"
+
+      # Ruby support with dfhack is very spotty and was removed in version 50.
+      "-DBUILD_RUBY=OFF"
+    ] ++ optionals enableStoneSense [ "-DBUILD_STONESENSE=ON" "-DSTONESENSE_INTERNAL_SO=OFF" ];
+
+    NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-enum-enum-conversion" ]
+      ++ optionals (versionOlder version "0.47") [ "-fpermissive" ];
+
+    preFixup = ''
+      # Wrap dfhack scripts.
+      if [ -f $out/dfhack ]; then
+        wrapProgram $out/dfhack \
+          --inherit-argv0 \
+          --set-default SteamAppId 0 \
+          --set-default DFHACK_NO_RENAME_LIBSTDCXX 1 \
+          --suffix PATH : ${lib.makeBinPath [
+            coreutils util-linux strace gnused binutils ncurses
+          ]}
+      fi
+
+      if [ -f $out/dfhack-run ]; then
+        wrapProgram $out/dfhack-run \
+          --inherit-argv0 \
+          --suffix PATH : ${lib.makeBinPath [
+            coreutils
+          ]}
+      fi
+
+      # Create a dfhackrc that changes to the correct home directory.
+      cat <<EOF > $out/.dfhackrc
+      #!/usr/bin/env bash
+      # nixpkgs dfhackrc helper
+      if [ -d "\$NIXPKGS_DF_HOME" ]; then
+        cd "\$NIXPKGS_DF_HOME"
+        DF_DIR="\$NIXPKGS_DF_HOME"
+      fi
+      export DF_DIR
+      EOF
    '';

-    passthru = { inherit dfVersion; };
+    passthru = {
+      inherit dfVersion;
+    };

    meta = {
      description = "Memory hacking library for Dwarf Fortress and a set of tools that use it";
--- a/pkgs/games/dwarf-fortress/dwarf-therapist/default.nix
+++ b/pkgs/games/dwarf-fortress/dwarf-therapist/default.nix
@ -6,22 +6,29 @@
 , cmake
 , texlive
 , ninja
+, version ? "42.1.5"
+, hash ? "sha256-aUakfUjnIZWNDhCkG3A6u7BaaCG8kPMV/Fu2S73CoDg="
 }:

 stdenv.mkDerivation rec {
  pname = "dwarf-therapist";
-  version = "41.2.2";
+
+  inherit version;

  src = fetchFromGitHub {
    owner = "Dwarf-Therapist";
    repo = "Dwarf-Therapist";
    rev = "v${version}";
-    sha256 = "sha256-zsEG68ioSw64UfmqlTLO1i5sObg8C4zxvdPxdQGMhhU=";
+    inherit hash;
  };

  nativeBuildInputs = [ texlive cmake ninja ];
  buildInputs = [ qtbase qtdeclarative ];

+  enableParallelBuilding = true;
+
+  cmakeFlags = [ "-GNinja" ];
+
  installPhase =
    if stdenv.isDarwin then ''
      mkdir -p $out/Applications
@ -31,8 +38,8 @@ stdenv.mkDerivation rec {
  dontWrapQtApps = true;

  meta = with lib; {
-    description = "Tool to manage dwarves in a running game of Dwarf Fortress";
    mainProgram = "dwarftherapist";
+    description = "Tool to manage dwarves in a running game of Dwarf Fortress";
    maintainers = with maintainers; [ abbradar bendlas numinit jonringer ];
    license = licenses.mit;
    platforms = platforms.x86;
--- a/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
+++ b/pkgs/games/dwarf-fortress/dwarf-therapist/wrapper.nix
@ -1,10 +1,12 @@
-{ stdenv, dwarf-therapist, dwarf-fortress, substituteAll, coreutils, wrapQtAppsHook }:
+{ stdenv, dwarf-therapist, dwarf-fortress, substituteAll, coreutils, wrapQtAppsHook
+}:

 let
-  platformSlug =
-    if stdenv.hostPlatform.is32bit then
-      "linux32" else "linux64";
-  inifile = "linux/v0.${dwarf-fortress.baseVersion}.${dwarf-fortress.patchVersion}_${platformSlug}.ini";
+  platformSlug = let
+    prefix = if dwarf-fortress.baseVersion >= 50 then "-classic_" else "_";
+    base = if stdenv.hostPlatform.is32bit then "linux32" else "linux64";
+  in prefix + base;
+  inifile = "linux/v0.${builtins.toString dwarf-fortress.baseVersion}.${dwarf-fortress.patchVersion}${platformSlug}.ini";

 in

@ -40,8 +42,9 @@ stdenv.mkDerivation {
    wrapQtApp $out/bin/dwarftherapist

    # Fix up memory layouts
-    rm -rf $out/share/dwarftherapist/memory_layouts/linux
-    mkdir -p $out/share/dwarftherapist/memory_layouts/linux
+    ini_path="$out/share/dwarftherapist/memory_layouts/${inifile}"
+    rm -f "$ini_path"
+    mkdir -p "$(dirname -- "$ini_path")"
    orig_md5=$(cat "${dwarf-fortress}/hash.md5.orig" | cut -c1-8)
    patched_md5=$(cat "${dwarf-fortress}/hash.md5" | cut -c1-8)
    input_file="${dwarf-therapist}/share/dwarftherapist/memory_layouts/${inifile}"
@ -53,7 +56,7 @@ stdenv.mkDerivation {
    echo "  Output:  $output_file"
    echo "  Replace: $patched_md5"

-    substitute "$input_file" "$output_file" --replace "$orig_md5" "$patched_md5"
+    substitute "$input_file" "$output_file" --replace-fail "$orig_md5" "$patched_md5"
  '';

  preferLocalBuild = true;
--- a/pkgs/games/dwarf-fortress/game.json
+++ b/pkgs/games/dwarf-fortress/game.json
@ -135,5 +135,14 @@
    "legacy_s": "1rb7h8lzlsjs08rvhhl3nwbrpj54zijijp4y0qdp4vyzsig6nisk",
    "legacy32": "0ayw09x9smihh8qp5pdvr6vvhwkvcqz36h3lh4g1b5kzxj7g9cyf",
    "legacy32_s": "10gfxlysfs9gyi1mv52idp5xk45g9h517g2jq4a8cqp2j7594v9c"
+  },
+  "50.10": {
+    "linux": "13s5p7205r9ha2j5n7carrwd0y7krq34bcdl08khp0kh2v4470a3"
+  },
+  "50.11": {
+    "linux": "0iz2d88gzvn0vjxlr99f13j4awhvh2lggjmipdwpbxhfsqih7dx0"
+  },
+  "50.12": {
+    "linux": "070014fzwszfgjyxjyij0k0hadah6s62lpi91ykp3vs220azya1m"
  }
 }
--- a/pkgs/games/dwarf-fortress/game.nix
+++ b/pkgs/games/dwarf-fortress/game.nix
@ -2,11 +2,15 @@
 , lib
 , fetchurl
 , SDL
+, SDL2
+, SDL2_image
+, SDL2_mixer
+, fmodex
 , dwarf-fortress-unfuck
+, autoPatchelfHook

  # Our own "unfuck" libs for macOS
 , ncurses
-, fmodex
 , gcc

 , dfVersion
@ -22,13 +26,13 @@ let
    hasAttr
    licenses
    maintainers
-    makeLibraryPath
+    optional
+    optionals
    optionalString
    splitVersion
+    toInt
    ;

-  libpath = makeLibraryPath [ stdenv.cc.cc stdenv.cc.libc dwarf-fortress-unfuck SDL ];
-
  # Map Dwarf Fortress platform names to Nixpkgs platform names.
  # Other srcs are avilable like 32-bit mac & win, but I have only
  # included the ones most likely to be needed by Nixpkgs users.
@ -41,9 +45,15 @@ let
    i686-cygwin = "win32";
  };

-  dfVersionTriple = splitVersion dfVersion;
-  baseVersion = elemAt dfVersionTriple 1;
-  patchVersion = elemAt dfVersionTriple 2;
+  dfVersionTuple = splitVersion dfVersion;
+  dfVersionBaseIndex = let
+    x = (builtins.length dfVersionTuple) - 2;
+  in if x >= 0 then x else 0;
+  baseVersion = toInt (elemAt dfVersionTuple dfVersionBaseIndex);
+  patchVersion = elemAt dfVersionTuple (dfVersionBaseIndex + 1);
+
+  isAtLeast50 = baseVersion >= 50;
+  enableUnfuck = !isAtLeast50 && dwarf-fortress-unfuck != null;

  game =
    if hasAttr dfVersion df-hashes
@ -57,7 +67,10 @@ let
    if hasAttr dfPlatform game
    then getAttr dfPlatform game
    else throw "Unsupported dfPlatform: ${dfPlatform}";
-
+  exe = if stdenv.isLinux then
+    if baseVersion >= 50 then "dwarfort" else "libs/Dwarf_Fortress"
+  else
+    "dwarfort.exe";
 in

 stdenv.mkDerivation {
@ -65,25 +78,49 @@ stdenv.mkDerivation {
  version = dfVersion;

  src = fetchurl {
-    url = "https://www.bay12games.com/dwarves/df_${baseVersion}_${patchVersion}_${dfPlatform}.tar.bz2";
+    url = "https://www.bay12games.com/dwarves/df_${toString baseVersion}_${toString patchVersion}_${dfPlatform}.tar.bz2";
    inherit sha256;
  };

+  sourceRoot = ".";
+
+  postUnpack = optionalString stdenv.isLinux ''
+    directory=${
+      if stdenv.isLinux then "df_linux"
+      else if stdenv.isDarwin then "df_osx"
+      else throw "Unsupported system"
+    }
+    if [ -d "$directory" ]; then
+      mv "$directory/"* .
+    fi
+  '';
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+  buildInputs = optionals isAtLeast50 [ SDL2 SDL2_image SDL2_mixer ]
+    ++ optional (!isAtLeast50) SDL
+    ++ optional enableUnfuck dwarf-fortress-unfuck
+    ++ [ stdenv.cc.cc.lib ];
+
  installPhase = ''
+    runHook preInstall
+
+    exe=$out/${exe}
    mkdir -p $out
    cp -r * $out
-    rm $out/libs/lib*

-    exe=$out/${if stdenv.isLinux then "libs/Dwarf_Fortress"
-                                 else "dwarfort.exe"}
+    # Lots of files are +x in the newer releases...
+    find $out -type d -exec chmod 0755 {} \;
+    find $out -type f -exec chmod 0644 {} \;
+    chmod +x $exe
+    [ -f $out/df ] && chmod +x $out/df
+    [ -f $out/run_df ] && chmod +x $out/run_df
+
+    # We don't need any of these since they will just break autoPatchelf on <version 50.
+    [ -d $out/libs ] && rm -f $out/libs/*.so $out/libs/*.so.*

    # Store the original hash
    md5sum $exe | awk '{ print $1 }' > $out/hash.md5.orig
-  '' + optionalString stdenv.isLinux ''
-    patchelf \
-      --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \
-      --set-rpath "${libpath}" \
-      $exe
+    echo "Original MD5: $(<$out/hash.md5.orig)" >&2
  '' + optionalString stdenv.isDarwin ''
    # My custom unfucked dwarfort.exe for macOS. Can't use
    # absolute paths because original doesn't have enough
@ -101,12 +138,24 @@ stdenv.mkDerivation {
              @executable_path/libs/libstdc++.6.dylib \
      $exe
  '' + ''
-    # Store the new hash
-    md5sum $exe | awk '{ print $1 }' > $out/hash.md5
+    ls -al $out
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    recompute_hash() {
+      # Store the new hash as the very last step.
+      exe=$out/${exe}
+      md5sum $exe | awk '{ print $1 }' > $out/hash.md5
+      echo "Patched MD5: $(<$out/hash.md5)" >&2
+    }
+
+    # Ensure that this runs after autoPatchelfHook.
+    trap recompute_hash EXIT
  '';

  passthru = {
-    inherit baseVersion patchVersion dfVersion;
+    inherit baseVersion patchVersion dfVersion exe;
    updateScript = ./update.sh;
  };

--- a/pkgs/games/dwarf-fortress/lazy-pack.nix
+++ b/pkgs/games/dwarf-fortress/lazy-pack.nix
@ -41,6 +41,8 @@ let
    then getAttr dfGame df-games
    else throw "Unknown Dwarf Fortress version: ${dfVersion}";
  dwarf-therapist = dwarf-fortress.dwarf-therapist;
+
+  mainProgram = if enableDFHack then "dfhack" else "dwarf-fortress";
 in
 buildEnv {
  name = "dwarf-fortress-full";
@ -54,6 +56,7 @@ buildEnv {
  ++ optional enableLegendsBrowser legends-browser;

  meta = {
+    inherit mainProgram;
    description = "An opinionated wrapper for Dwarf Fortress";
    maintainers = with maintainers; [ Baughn numinit ];
    license = licenses.mit;
--- a/pkgs/games/dwarf-fortress/twbt/default.nix
+++ b/pkgs/games/dwarf-fortress/twbt/default.nix
@ -81,8 +81,12 @@ stdenvNoCC.mkDerivation rec {
    cp -a *.png $art/data/art/
  '';

+  passthru = {
+    inherit dfVersion;
+  };
+
  meta = {
-    description = "A plugin for Dwarf Fortress / DFHack that improves various aspects the game interface";
+    description = "A plugin for Dwarf Fortress / DFHack that improves various aspects of the game interface";
    maintainers = with maintainers; [ Baughn numinit ];
    license = licenses.mit;
    platforms = platforms.linux;
--- a/pkgs/games/dwarf-fortress/unfuck.nix
+++ b/pkgs/games/dwarf-fortress/unfuck.nix
@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , libGL
 , libSM
@ -32,43 +33,43 @@ let
  unfuck-releases = {
    "0.43.05" = {
      unfuckRelease = "0.43.05";
-      sha256 = "173dyrbxlzqvjf1j3n7vpns4gfjkpyvk9z16430xnmd5m6nda8p2";
+      hash = "sha256-4iLVrKmlVdvBICb8NLe/U7pHtL372CGDkxt/2lf2bZw=";
    };
    "0.44.05" = {
      unfuckRelease = "0.44.05";
-      sha256 = "00yj4l4gazxg4i6fj9rwri6vm17i6bviy2mpkx0z5c0mvsr7s14b";
+      hash = "sha256-iwR9st4VsPJBn7cKH/cy8YS6Tcw8J+lMJK9/9Qgl0gM=";
    };
    "0.44.09" = {
      unfuckRelease = "0.44.09";
-      sha256 = "138p0v8z2x47f0fk9k6g75ikw5wb3vxldwv5ggbkf4hhvlw6lvzm";
+      hash = "sha256-9W9qON0QEjfXe2XzRvseixc+YznPzDQdcId08dEGF40=";
    };
    "0.44.10" = {
      unfuckRelease = "0.44.10";
-      sha256 = "0vb19qx2ibc79j4bgbk9lskb883qfb0815zw1dfz9k7rqwal8mzj";
+      hash = "sha256-8ldEFcf5zPRdC/yXgMByeCC0pqZprreITIetKDpOYW0=";
    };
    "0.44.11" = {
      unfuckRelease = "0.44.11.1";
-      sha256 = "1kszkb1d1vll8p04ja41nangsaxb5lv4p3xh2jhmsmipfixw7nvz";
+      hash = "sha256-f9vDe3Q3Vl2hFLCPSzYtqyv9rLKBKEnARZTu0MKaX88=";
    };
    "0.44.12" = {
      unfuckRelease = "0.44.12";
-      sha256 = "1kszkb1d1vll8p04ja41nangsaxb5lv4p3xh2jhmsmipfixw7nvz";
+      hash = "sha256-f9vDe3Q3Vl2hFLCPSzYtqyv9rLKBKEnARZTu0MKaX88=";
    };
    "0.47.01" = {
      unfuckRelease = "0.47.01";
-      sha256 = "11xvb3qh4crdf59pwfwpi73rzm3ysd1r1xp2k1jp7527jmqapk4k";
+      hash = "sha256-k8yrcJVHlHNlmOL2kEPTftSfx4mXO35TcS0zAvFYu4c=";
    };
    "0.47.02" = {
      unfuckRelease = "0.47.01";
-      sha256 = "11xvb3qh4crdf59pwfwpi73rzm3ysd1r1xp2k1jp7527jmqapk4k";
+      hash = "sha256-k8yrcJVHlHNlmOL2kEPTftSfx4mXO35TcS0zAvFYu4c=";
    };
    "0.47.04" = {
      unfuckRelease = "0.47.04";
-      sha256 = "1wa990xbsyiiz7abq153xmafvvk1dmgz33rp907d005kzl1z86i9";
+      hash = "sha256-KRr0A/2zANAOSDeP8V9tYe7tVO2jBLzU+TF6vTpISfE=";
    };
    "0.47.05" = {
-      unfuckRelease = "0.47.04";
-      sha256 = "1wa990xbsyiiz7abq153xmafvvk1dmgz33rp907d005kzl1z86i9";
+      unfuckRelease = "0.47.05-final";
+      hash = "sha256-kBdzU6KDpODOBP9XHM7lQRIEWUGOj838vXF1FbSr0Xw=";
    };
  };

@ -86,9 +87,17 @@ stdenv.mkDerivation {
    owner = "svenstaro";
    repo = "dwarf_fortress_unfuck";
    rev = release.unfuckRelease;
-    sha256 = release.sha256;
+    inherit (release) hash;
  };

+  patches = lib.optionals (versionOlder release.unfuckRelease "0.47.05") [(
+    fetchpatch {
+      name = "fix-noreturn-returning.patch";
+      url = "https://github.com/svenstaro/dwarf_fortress_unfuck/commit/6dcfe5ae869fddd51940c6c37a95f7bc639f4389.patch";
+      hash = "sha256-b9eI3iR7dmFqCrktPyn6QJ9U2A/7LvfYRS+vE3BOaqk=";
+    }
+  )];
+
  postPatch = ''
    # https://github.com/svenstaro/dwarf_fortress_unfuck/pull/27
    substituteInPlace CMakeLists.txt --replace \''${GLEW_LIBRARIES} GLEW::glew
--- a/pkgs/games/dwarf-fortress/update.sh
+++ b/pkgs/games/dwarf-fortress/update.sh
@ -2,9 +2,7 @@
 #! nix-shell -i bash -p jq nix coreutils curl

 # systems to generate hashes for
-systems='linux linux32 osx osx32
-     win win_s win32 win32_s
-         legacy legacy_s legacy32 legacy32_s'
+systems='linux osx'

 if [ $# -eq 0 ]; then
    versions="$(curl http://www.bay12games.com/dwarves/ \
--- a/pkgs/games/dwarf-fortress/wrapper/default.nix
+++ b/pkgs/games/dwarf-fortress/wrapper/default.nix
@ -2,6 +2,7 @@
 , lib
 , buildEnv
 , substituteAll
+, makeWrapper
 , runCommand
 , coreutils
 , gawk
@ -12,6 +13,9 @@
 , enableSoundSense ? false
 , soundSense
 , jdk
+, expect
+, xvfb-run
+, writeText
 , enableStoneSense ? false
 , enableTWBT ? false
 , twbt
@ -31,10 +35,15 @@
 }:

 let
-  dfhack_ = dfhack.override {
+  dfhack' = dfhack.override {
    inherit enableStoneSense;
  };

+  isAtLeast50 = dwarf-fortress.baseVersion >= 50;
+
+  # If TWBT is null or the dfVersion is wrong, it isn't supported (for example, on version 50).
+  enableTWBT' = enableTWBT && twbt != null && (twbt.dfVersion or null) == dwarf-fortress.version;
+
  ptheme =
    if builtins.isString theme
    then builtins.getAttr theme themes
@ -46,19 +55,19 @@ let
    # These are in inverse order for first packages to override the next ones.
    paths = extraPackages
         ++ lib.optional (theme != null) ptheme
-         ++ lib.optional enableDFHack dfhack_
+         ++ lib.optional enableDFHack dfhack'
         ++ lib.optional enableSoundSense soundSense
-         ++ lib.optionals enableTWBT [ twbt.lib twbt.art ]
+         ++ lib.optionals enableTWBT' [ twbt.lib twbt.art ]
         ++ [ dwarf-fortress ];

    ignoreCollisions = true;
  };

-  settings_ = lib.recursiveUpdate {
+  settings' = lib.recursiveUpdate {
    init = {
      PRINT_MODE =
        if enableTextMode then "TEXT"
-        else if enableTWBT then "TWBT"
+        else if enableTWBT' then "TWBT"
        else if stdenv.hostPlatform.isDarwin then "STANDARD" # https://www.bay12games.com/dwarves/mantisbt/view.php?id=11680
        else null;
      INTRO = enableIntro;
@ -77,23 +86,31 @@ let
    else throw "dwarf-fortress: unsupported configuration value ${toString v}";

  config = runCommand "dwarf-fortress-config" {
-    nativeBuildInputs = [ gawk ];
+    nativeBuildInputs = [ gawk makeWrapper ];
  } (''
    mkdir -p $out/data/init

    edit_setting() {
      v=''${v//'&'/'\&'}
-      if ! gawk -i inplace -v RS='\r?\n' '
-        { n += sub("\\[" ENVIRON["k"] ":[^]]*\\]", "[" ENVIRON["k"] ":" ENVIRON["v"] "]"); print }
-        END { exit(!n) }
-      ' "$out/$file"; then
-        echo "error: no setting named '$k' in $file" >&2
-        exit 1
+      if [ -f "$out/$file" ]; then
+        if ! gawk -i inplace -v RS='\r?\n' '
+          { n += sub("\\[" ENVIRON["k"] ":[^]]*\\]", "[" ENVIRON["k"] ":" ENVIRON["v"] "]"); print }
+          END { exit(!n) }
+        ' "$out/$file"; then
+          echo "error: no setting named '$k' in $out/$file" >&2
+          exit 1
+        fi
+      else
+        echo "warning: no file $out/$file; cannot edit" >&2
      fi
    }
-  '' + forEach settings_ (file: kv: ''
+  '' + forEach settings' (file: kv: ''
    file=data/init/${lib.escapeShellArg file}.txt
-    cp ${baseEnv}/"$file" "$out/$file"
+    if [ -f "${baseEnv}/$file" ]; then
+      cp "${baseEnv}/$file" "$out/$file"
+    else
+      echo "warning: no file ${baseEnv}/$file; cannot copy" >&2
+    fi
  '' + forEach kv (k: v: lib.optionalString (v != null) ''
    export k=${lib.escapeShellArg k} v=${lib.escapeShellArg (toTxt v)}
    edit_setting
@ -103,7 +120,7 @@ let
    # Patch the MD5
    orig_md5=$(< "${dwarf-fortress}/hash.md5.orig")
    patched_md5=$(< "${dwarf-fortress}/hash.md5")
-    input_file="${dfhack_}/hack/symbols.xml"
+    input_file="${dfhack'}/hack/symbols.xml"
    output_file="$out/hack/symbols.xml"

    echo "[DFHack Wrapper] Fixing Dwarf Fortress MD5:"
@ -112,7 +129,7 @@ let
    echo "  Output:  $output_file"
    echo "  Replace: $patched_md5"

-    substitute "$input_file" "$output_file" --replace "$orig_md5" "$patched_md5"
+    substitute "$input_file" "$output_file" --replace-fail "$orig_md5" "$patched_md5"
  '');

  # This is a separate environment because the config files to modify may come
@ -124,11 +141,11 @@ let
  };
 in

-lib.throwIf (enableTWBT && !enableDFHack) "dwarf-fortress: TWBT requires DFHack to be enabled"
+lib.throwIf (enableTWBT' && !enableDFHack) "dwarf-fortress: TWBT requires DFHack to be enabled"
 lib.throwIf (enableStoneSense && !enableDFHack) "dwarf-fortress: StoneSense requires DFHack to be enabled"
-lib.throwIf (enableTextMode && enableTWBT) "dwarf-fortress: text mode and TWBT are mutually exclusive"
+lib.throwIf (enableTextMode && enableTWBT') "dwarf-fortress: text mode and TWBT are mutually exclusive"

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "dwarf-fortress";
  version = dwarf-fortress.dfVersion;

@ -136,36 +153,40 @@ stdenv.mkDerivation {
    name = "dwarf-fortress-init";
    src = ./dwarf-fortress-init.in;
    inherit env;
-    exe =
-      if stdenv.isLinux then "libs/Dwarf_Fortress"
-      else "dwarfort.exe";
+    inherit (dwarf-fortress) exe;
    stdenv_shell = "${stdenv.shell}";
    cp = "${coreutils}/bin/cp";
    rm = "${coreutils}/bin/rm";
    ln = "${coreutils}/bin/ln";
    cat = "${coreutils}/bin/cat";
    mkdir = "${coreutils}/bin/mkdir";
+    printf = "${coreutils}/bin/printf";
+    uname = "${coreutils}/bin/uname";
  };

  runDF = ./dwarf-fortress.in;
-  runDFHack = ./dfhack.in;
  runSoundSense = ./soundSense.in;

  passthru = {
    inherit dwarf-fortress dwarf-therapist twbt env;
-    dfhack = dfhack_;
+    dfhack = dfhack';
  };

-  buildCommand = ''
+  dontUnpack = true;
+  dontBuild = true;
+  preferLocalBuild = true;
+  installPhase = ''
    mkdir -p $out/bin

    substitute $runDF $out/bin/dwarf-fortress \
      --subst-var-by stdenv_shell ${stdenv.shell} \
+      --subst-var-by dfExe ${dwarf-fortress.exe} \
      --subst-var dfInit
    chmod 755 $out/bin/dwarf-fortress
  '' + lib.optionalString enableDFHack ''
-    substitute $runDFHack $out/bin/dfhack \
+    substitute $runDF $out/bin/dfhack \
      --subst-var-by stdenv_shell ${stdenv.shell} \
+      --subst-var-by dfExe dfhack \
      --subst-var dfInit
    chmod 755 $out/bin/dfhack
  '' + lib.optionalString enableSoundSense ''
@ -176,7 +197,55 @@ stdenv.mkDerivation {
    chmod 755 $out/bin/soundsense
  '';

-  preferLocalBuild = true;
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ expect xvfb-run ];
+
+  installCheckPhase = let
+    commonExpectStatements = fmod: lib.optionalString isAtLeast50 ''
+      expect "Loading audio..."
+    '' + lib.optionalString (!fmod && isAtLeast50) ''
+      expect "Failed to load fmod, trying SDL_mixer"
+    '' + lib.optionalString isAtLeast50 ''
+      expect "Audio loaded successfully!"
+    '' + ''
+      expect "Loading bindings from data/init/interface.txt"
+    '';
+    dfHackExpectScript = writeText "dfhack-test.exp" (''
+      spawn env NIXPKGS_DF_OPTS=debug xvfb-run $env(out)/bin/dfhack
+    '' + commonExpectStatements false + ''
+      expect "DFHack is ready. Have a nice day!"
+      expect "DFHack version ${version}"
+      expect "\[DFHack\]#"
+      send -- "lua print(os.getenv('out'))\r"
+      expect "$env(out)"
+      # Don't send 'die' here; just exit. Some versions of dfhack crash on exit.
+      exit 0
+    '');
+    vanillaExpectScript = fmod: writeText "vanilla-test.exp" (''
+      spawn env NIXPKGS_DF_OPTS=debug,${lib.optionalString fmod "fmod"} xvfb-run $env(out)/bin/dwarf-fortress
+    '' + commonExpectStatements fmod + ''
+      exit 0
+    '');
+  in
+  ''
+    export HOME="$(mktemp -dt dwarf-fortress.XXXXXX)"
+  '' + lib.optionalString enableDFHack ''
+    expect ${dfHackExpectScript}
+    df_home="$(find ~ -name "df_*" | head -n1)"
+    test -f "$df_home/dfhack"
+  '' + lib.optionalString isAtLeast50 ''
+    expect ${vanillaExpectScript true}
+    df_home="$(find ~ -name "df_*" | head -n1)"
+    test ! -f "$df_home/dfhack"
+    test -f "$df_home/libfmod_plugin.so"
+  '' + ''
+    expect ${vanillaExpectScript false}
+    df_home="$(find ~ -name "df_*" | head -n1)"
+    test ! -f "$df_home/dfhack"
+    test ! -f "$df_home/libfmod_plugin.so"
+  '' + ''
+    test -d "$df_home/data"
+  '';

  inherit (dwarf-fortress) meta;
 }
--- a/pkgs/games/dwarf-fortress/wrapper/dfhack.in
+++ b/pkgs/games/dwarf-fortress/wrapper/dfhack.in
@ -1,11 +0,0 @@
-#!@stdenv_shell@ -e
-
-source @dfInit@
-
-for i in *.init *.init-example dfhack-config/default dfhack-config/init hack/* stonesense/*; do
-  if [ -e "$i" ]; then update_path "$i"; fi
-done
-
-cd "$DF_DIR"
-LD_LIBRARY_PATH="$env_dir/hack/libs:$env_dir/hack${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH" \
-  LD_PRELOAD="$env_dir/hack/libdfhack.so:$LD_PRELOAD" exec $env_dir/libs/Dwarf_Fortress "$@"
--- a/pkgs/games/dwarf-fortress/wrapper/dwarf-fortress-init.in
+++ b/pkgs/games/dwarf-fortress/wrapper/dwarf-fortress-init.in
@ -1,45 +1,181 @@
 #!@stdenv_shell@ -e
+set -euo pipefail
 shopt -s extglob

-[ -z "$DF_DIR" ] && export DF_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/df_linux"
-env_dir="@env@"
-exe="$env_dir/@exe@"
+export NIXPKGS_DF_ENV="@env@"

-update_path() {
-  local path="$1"
+if [[ -v DF_DIR ]] && [ -n "$DF_DIR" ] && { [[ ! -v NIXPKGS_DF_HOME ]] || [ -z "$NIXPKGS_DF_HOME" ]; }; then
+  # Compatibility for users that were using DF_DIR, since the dfhack script clobbers this variable.
+  export NIXPKGS_DF_HOME="$DF_DIR"
+fi

-  @mkdir@ -p "$DF_DIR/$(dirname "$path")"
-  # If user has replaced these data directories, let them stay.
-  if [ ! -e "$DF_DIR/$path" ] || [ -L "$DF_DIR/$path" ]; then
-    @rm@ -f "$DF_DIR/$path"
-    @ln@ -s "$env_dir/$path" "$DF_DIR/$path"
+if [[ ! -v NIXPKGS_DF_HOME ]] || [ -z "$NIXPKGS_DF_HOME" ]; then
+  export NIXPKGS_DF_HOME="${XDG_DATA_HOME:-$HOME/.local/share}/df_linux"
+fi
+
+# Compatibility.
+export DF_DIR="$NIXPKGS_DF_HOME"
+
+### BEGIN: Default DF options
+declare -A _NIXPKGS_DF_OPTS
+_NIXPKGS_DF_OPTS[fmod]=0    # Don't use fmod by default.
+_NIXPKGS_DF_OPTS[debug]=0   # No debugging output by default.
+### END: Default DF options
+
+# Read NIXPKGS_DF_OPTS.
+if [[ ! -v NIXPKGS_DF_OPTS ]]; then
+  NIXPKGS_DF_OPTS=''
+fi
+IFS=',' read -ra options <<< "$NIXPKGS_DF_OPTS"
+for option in ${options[@]+"${options[@]}"}; do
+  key="${option%=*}"
+  value="${option##*=}"
+  if [ -n "$key" ]; then
+    if [ -z "$value" ] || [ "$key" == "$value" ]; then
+      value=1
+    fi
+    _NIXPKGS_DF_OPTS["$key"]="$value"
+  fi
+done
+
+# Rebuild the canonical option string from the read options.
+NIXPKGS_DF_OPTS=''
+for key in "${!_NIXPKGS_DF_OPTS[@]}"; do
+  value="${_NIXPKGS_DF_OPTS["${key}"]}"
+  NIXPKGS_DF_OPTS="$NIXPKGS_DF_OPTS$key=$value,"
+done
+NIXPKGS_DF_OPTS="${NIXPKGS_DF_OPTS%,}"
+
+# Echoes a log.
+# $@: log messages
+log() {
+  for msg in "$@"; do
+    echo "[nixpkgs] $msg" >&2
+  done
+}
+
+# Echoes a log if NIXPKGS_DF_OPTS includes debug.
+# $@: log messages
+debug() {
+  if [ "${_NIXPKGS_DF_OPTS[debug]}" -ne 0 ]; then
+    log "$@"
  fi
 }

+# Updates a path in $NIXPKGS_DF_HOME from $NIXPKGS_DF_ENV.
+# $1: The environment path.
+update_path() {
+  local path="$1"
+  local orig="$NIXPKGS_DF_ENV/$path"
+  local final="$NIXPKGS_DF_HOME/$path"
+
+  # If user has replaced these data directories, let them stay.
+  @mkdir@ -p "$(dirname -- "$final")"
+  if [ ! -e "$final" ] || [ -L "$final" ]; then
+    debug "Linking: $final -> $orig"
+    @rm@ -f "$final"
+    @ln@ -s "$orig" "$final"
+  else
+    debug "Not updating: $final"
+  fi
+}
+
+# Cleans up a path in $NIXPKGS_DF_HOME that may or may not be in $NIXPKGS_DF_ENV.
+# $1: The environment path.
+cleanup_path() {
+  local path="$1"
+  local final="$NIXPKGS_DF_HOME/$path"
+
+  # Let them stay if not a link.
+  if [ ! -e "$final" ] || [ -L "$final" ]; then
+    debug "Cleaning up: $final"
+    @rm@ -f "$final"
+  else
+    debug "Not cleaning: $final"
+  fi
+}
+
+# Force copies a path in $NIXPKGS_DF_HOME that may or may not be in $NIXPKGS_DF_ENV.
+# $1: The environment path.
 forcecopy_path() {
  local path="$1"

-  @mkdir@ -p "$DF_DIR/$(dirname "$path")"
-  @rm@ -rf "$DF_DIR/$path"
-  @cp@ -rL --no-preserve=all "$env_dir/$path" "$DF_DIR/$path"
+  if [ -z "$NIXPKGS_DF_ENV" ] || [ -z "$path" ]; then
+    # Avoid producing "/" for any `rm -rf`
+    return
+  fi
+
+  local orig="$NIXPKGS_DF_ENV/$path"
+  local final="$NIXPKGS_DF_HOME/$path"
+
+  if [ -e "$orig" ]; then
+    debug "Force copying: $orig -> $final"
+    @mkdir@ -p "$(dirname -- "$final")"
+    @rm@ -rf "$final"
+    @cp@ -rL --no-preserve=all "$orig" "$final"
+  else
+    debug "Removing: $final"
+    @rm@ -rf "$final"
+  fi
 }

-@mkdir@ -p "$DF_DIR"
+# Runs the final executable. Expects NIXPKGS_DF_HOME and NIXPKGS_DF_EXE to be set.
+go() {
+  cd "$NIXPKGS_DF_HOME"
+  debug "Executing: $NIXPKGS_DF_HOME/$NIXPKGS_DF_EXE"
+
+  # If we make it past here, we want to log.
+  # shellcheck disable=SC2093
+  exec -a "$NIXPKGS_DF_EXE" "$NIXPKGS_DF_HOME/$NIXPKGS_DF_EXE"
+  log "Execution of $NIXPKGS_DF_HOME/$NIXPKGS_DF_EXE failed!"
+  exit 1
+}
+
+@mkdir@ -p "$NIXPKGS_DF_HOME"

@cat@ <<EOF >&2
-Using $DF_DIR as Dwarf Fortress overlay directory.
-If you do any changes in it, don't forget to clean it when updating the game version!
-We try to detect changes based on data directories being symbolic links -- keep this in mind.
-
+/------------------------------------------------------------------------------\\
+| Hello from the nixpkgs Dwarf Fortress wrapper!                               |
+|                                                                              |
+| Using the following Dwarf Fortress overlay directory as NIXPKGS_DF_HOME:     |
+| $(@printf@ '% -76s' "$NIXPKGS_DF_HOME") |
+|                                                                              |
+| If you make any changes in it, don't forget to clean it when updating the    |
+| game version! We detect changes if data directories are symbolic links.      |
+|                                                                              |
+| Even though we do our best on our own, this script may miss some. Submit a   |
+| pull request if there are any that become a problem.                         |
+|                                                                              |
+| We started with the following nixpkgs launch options as NIXPKGS_DF_OPTS:     |
+| $(@printf@ '% -76s' "$NIXPKGS_DF_OPTS") |
+|                                                                              |
+| If you want to try fmod over SDL_mixer, set NIXPKGS_DF_OPTS=fmod.            |
+\\------------------------------------------------------------------------------/
 EOF

-cd "$env_dir"
-for i in data/init/* data/!(init|index|announcement) raw; do
-  update_path "$i"
+cd "$NIXPKGS_DF_ENV"
+
+# All potential important files in DF 50 and below.
+for path in dwarfort *.so libs raw data/init/* data/!(init|index|announcement); do
+  force_delete=0
+  if [[ "$path" == libfmod*.so* ]] && [ "${_NIXPKGS_DF_OPTS[fmod]}" -eq 0 ]; then
+    force_delete=1
+  fi
+
+  if [ -e "$path" ] && [ "$force_delete" -eq 0 ]; then
+    update_path "$path"
+  else
+    cleanup_path "$path"
+  fi
 done

-forcecopy_path data/index
-# For some reason, it's needed to be writable...
-forcecopy_path data/announcement
-forcecopy_path data/help
-forcecopy_path data/dipscript
+# These need to be copied due to read only flags on older versions of DF.
+for path in index announcement help dipscript; do
+  forcecopy_path "data/$path"
+done
+
+# Handle library paths on Darwin.
+if [ "$(@uname@)" == Darwin ]; then
+  export DYLD_LIBRARY_PATH="$NIXPKGS_DF_ENV/libs"
+  export DYLD_FRAMEWORK_PATH="$NIXPKGS_DF_ENV/libs"
+fi
--- a/pkgs/games/dwarf-fortress/wrapper/dwarf-fortress.in
+++ b/pkgs/games/dwarf-fortress/wrapper/dwarf-fortress.in
@ -1,9 +1,35 @@
 #!@stdenv_shell@ -e

+export NIXPKGS_DF_EXE="@dfExe@"
 source @dfInit@

-export DYLD_LIBRARY_PATH="$env_dir/libs"
-export DYLD_FRAMEWORK_PATH="$env_dir/libs"
+# If we're switching back from dfhack to vanilla, cleanup all dfhack
+# links so Dwarf Fortress doesn't autoload its leftover libdfhooks.so.
+# Otherwise, populate them.
+dfhack_files=(
+  dfhack
+  dfhack-run
+  .dfhackrc
+  libdfhooks.so
+  dfhack-config/default
+  dfhack-config/init
+  hack/*
+  stonesense/*
+  *.init *.init-example
+)

-cd "$DF_DIR"
-exec "$exe" "$@"
+if [ "${NIXPKGS_DF_EXE##*/}" == dfhack ]; then
+  for i in "${dfhack_files[@]}"; do
+    if [ -e "$i" ]; then
+      update_path "$i"
+    else
+      cleanup_path "$i"
+    fi
+  done
+else
+  for i in "${dfhack_files[@]}"; do
+    cleanup_path "$i"
+  done
+fi
+
+go
--- a/pkgs/games/dwarf-fortress/wrapper/soundSense.in
+++ b/pkgs/games/dwarf-fortress/wrapper/soundSense.in
@ -1,10 +1,10 @@
 #!@stdenv_shell@ -e

+export NIXPKGS_DF_EXE="soundsense/soundSense.sh"
 source @dfInit@

-for p in soundsense/*; do
-  update_path "$p"
+for path in soundsense/*; do
+  update_path "$path"
 done

-cd "$DF_DIR"
-PATH=@jre@/bin exec $DF_DIR/soundsense/soundSense.sh
+PATH="@jre@/bin:$PATH" go
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@ -385,13 +385,7 @@ let self = {

    inputs = [ luajit_openresty ];

-    preConfigure = let
-      # fix compilation against nginx 1.23.0
-      nginx-1-23-patch = fetchpatch {
-        url = "https://github.com/openresty/lua-nginx-module/commit/b6d167cf1a93c0c885c28db5a439f2404874cb26.patch";
-        sha256 = "sha256-l7GHFNZXg+RG2SIBjYJO1JHdGUtthWnzLIqEORJUNr4=";
-      };
-    in ''
+    preConfigure = ''
      export LUAJIT_LIB="${luajit_openresty}/lib"
      export LUAJIT_INC="$(realpath ${luajit_openresty}/include/luajit-*)"

@ -399,7 +393,6 @@ let self = {
      lua_src=$TMPDIR/lua-src
      cp -r "${src}/" "$lua_src"
      chmod -R +w "$lua_src"
-      patch -p1 -d $lua_src -i ${nginx-1-23-patch}
      export configureFlags="''${configureFlags//"${src}"/"$lua_src"}"
      unset lua_src
    '';
@ -786,8 +779,8 @@ let self = {
      name = "spnego-http-auth";
      owner = "stnoonan";
      repo = "spnego-http-auth-nginx-module";
-      rev = "72c8ee04c81f929ec84d5a6d126f789b77781a8c";
-      sha256 = "05rw3a7cv651951li995r5l1yzz6kwkm2xpbd59jsfzd74bw941i";
+      rev = "3575542b3147bd03a6c68a750c3662b0d72ed94e";
+      hash = "sha256-s0m5h7m7dsPD5o2SvBb9L2kB57jwXZK5SkdkGuOmlgs=";
    };

    inputs = [ libkrb5 ];
@ -796,7 +789,7 @@ let self = {
      description = "SPNEGO HTTP Authentication Module";
      homepage = "https://github.com/stnoonan/spnego-http-auth-nginx-module";
      license = with licenses; [ bsd2 ];
-      maintainers = with maintainers; [ ];
+      maintainers = teams.deshaw.members;
    };
  };

--- a/pkgs/servers/mediamtx/default.nix
+++ b/pkgs/servers/mediamtx/default.nix
@ -1,21 +1,33 @@
 { lib
 , fetchFromGitHub
+, fetchurl
 , buildGoModule
 , nixosTests
 }:

+let
+  hlsJs = fetchurl {
+    url = "https://cdn.jsdelivr.net/npm/hls.js@v1.5.8/dist/hls.min.js";
+    hash = "sha256-KG8Cm0dAsFbrBHuMi9c+bMocpSvWWK4c9aWH9LGfDY4=";
+  };
+in
 buildGoModule rec {
  pname = "mediamtx";
-  version = "1.5.1";
+  # check for hls.js version updates in internal/servers/hls/hlsjsdownloader/VERSION
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "bluenviron";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-FtMjcPeXLkITuGFwjHQ2Tu5pK3Hb/3L9SmcJaJFkP9k=";
+    hash = "sha256-i4tuGlRW5/HZobeSsgzWjHxIxZKB0cZIJcJyD0O/eIY=";
  };

-  vendorHash = "sha256-nchBsmk5hAqBPXk5aUSf/H46PdCg8JfGbeV4VBXBs+E=";
+  vendorHash = "sha256-RWHu6VuL9RmmAS1CyInXVbn3dxU6yTAze92C19Fm6gM=";
+
+  postPatch = ''
+    cp ${hlsJs} internal/servers/hls/hls.min.js
+  '';

  # Tests need docker
  doCheck = false;
--- a/pkgs/servers/search/meilisearch/Cargo.lock
+++ b/pkgs/servers/search/meilisearch/Cargo.lock
@ -494,7 +494,7 @@ checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"

 [[package]]
 name = "benchmarks"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "anyhow",
 "bytes",
@ -628,7 +628,7 @@ dependencies = [

 [[package]]
 name = "build-info"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "anyhow",
 "time",
@ -1529,7 +1529,7 @@ dependencies = [

 [[package]]
 name = "dump"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "anyhow",
 "big_s",
@ -1767,7 +1767,7 @@ dependencies = [

 [[package]]
 name = "file-store"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "faux",
 "tempfile",
@ -1790,7 +1790,7 @@ dependencies = [

 [[package]]
 name = "filter-parser"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "insta",
 "nom",
@ -1810,7 +1810,7 @@ dependencies = [

 [[package]]
 name = "flatten-serde-json"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "criterion",
 "serde_json",
@ -1928,7 +1928,7 @@ dependencies = [

 [[package]]
 name = "fuzzers"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "arbitrary",
 "clap",
@ -2145,9 +2145,9 @@ checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"

 [[package]]
 name = "grenad"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a007932af5475ebb5c63bef8812bb1c36f317983bb4ca663e9d6dd58d6a0f8c"
+checksum = "c297f45167e6d543eb728e12ff284283e4ba2182a25c6cdcec883fda3316c7e7"
 dependencies = [
 "bytemuck",
 "byteorder",
@ -2157,9 +2157,9 @@ dependencies = [

 [[package]]
 name = "h2"
-version = "0.3.24"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9"
+checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
 dependencies = [
 "bytes",
 "fnv",
@ -2420,7 +2420,7 @@ checksum = "206ca75c9c03ba3d4ace2460e57b189f39f43de612c2f85836e65c929701bb2d"

 [[package]]
 name = "index-scheduler"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "anyhow",
 "big_s",
@ -2607,7 +2607,7 @@ dependencies = [

 [[package]]
 name = "json-depth-checker"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "criterion",
 "serde_json",
@ -3115,7 +3115,7 @@ checksum = "490cc448043f947bae3cbee9c203358d62dbee0db12107a74be5c30ccfd09771"

 [[package]]
 name = "meili-snap"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "insta",
 "md5",
@ -3124,7 +3124,7 @@ dependencies = [

 [[package]]
 name = "meilisearch"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "actix-cors",
 "actix-http",
@ -3217,7 +3217,7 @@ dependencies = [

 [[package]]
 name = "meilisearch-auth"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "base64 0.21.7",
 "enum-iterator",
@ -3236,7 +3236,7 @@ dependencies = [

 [[package]]
 name = "meilisearch-types"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "actix-web",
 "anyhow",
@ -3266,7 +3266,7 @@ dependencies = [

 [[package]]
 name = "meilitool"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "anyhow",
 "clap",
@ -3305,7 +3305,7 @@ dependencies = [

 [[package]]
 name = "milli"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "arroy",
 "big_s",
@ -3746,7 +3746,7 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"

 [[package]]
 name = "permissive-json-pointer"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "big_s",
 "serde_json",
@ -5941,7 +5941,7 @@ dependencies = [

 [[package]]
 name = "xtask"
-version = "1.7.3"
+version = "1.7.6"
 dependencies = [
 "anyhow",
 "build-info",
--- a/pkgs/servers/search/meilisearch/default.nix
+++ b/pkgs/servers/search/meilisearch/default.nix
@ -6,9 +6,10 @@
 , SystemConfiguration
 , nixosTests
 , nix-update-script
+, libclang
 }:

-let version = "1.7.3";
+let version = "1.7.6";
 in
 rustPlatform.buildRustPackage {
  pname = "meilisearch";
@ -18,7 +19,7 @@ rustPlatform.buildRustPackage {
    owner = "meilisearch";
    repo = "MeiliSearch";
    rev = "refs/tags/v${version}";
-    hash = "sha256-2kwogur6hS7/xjUhH9aRJevWbtgg5xQkvB/aIj7wyJ8=";
+    hash = "sha256-LsJM7zkoiu5LZb/rhnZaAS/wVNH8b6YZ+vNEE1wVIIk=";
  };

  cargoBuildFlags = [
@ -43,6 +44,8 @@ rustPlatform.buildRustPackage {
    Security SystemConfiguration
  ];

+  env.LIBCLANG_PATH = "${libclang.lib}/lib";
+
  passthru = {
    updateScript = nix-update-script { };
    tests = {
--- a/pkgs/servers/teleport/12/Cargo.lock
+++ b/pkgs/servers/teleport/12/Cargo.lock
--- a/pkgs/servers/teleport/12/default.nix
+++ b/pkgs/servers/teleport/12/default.nix
@ -1,17 +0,0 @@
-{ callPackage, ... }@args:
-callPackage ../generic.nix ({
-  version = "12.4.32";
-  hash = "sha256-dYriqQwrc3tfLv+/G/W8n+4cLbPUq7lq1/kGH/GIsHs=";
-  vendorHash = "sha256-R7gWdUIrc7VLe+9/En47FI3G9x2V1VGUVTrT/kmA9c4=";
-  yarnHash = "sha256-Sr9T2TmrysMQs6A00rHU1IZjslu8jyYkVnYE6AmBmLA=";
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "rdp-rs-0.1.0" = "sha256-4NbAsEmyUdmBcHuzx+SLQCGKICC4V4FX4GTK2SzyHC0=";
-    };
-  };
-  extPatches = [
-    # https://github.com/NixOS/nixpkgs/issues/120738
-    ../tsh.patch
-  ];
-} // builtins.removeAttrs args [ "callPackage" ])
--- a/pkgs/servers/teleport/13/default.nix
+++ b/pkgs/servers/teleport/13/default.nix
@ -1,5 +1,5 @@
-{ callPackage, ... }@args:
-callPackage ../generic.nix ({
+args:
+import ../generic.nix (args // {
  version = "13.4.14";
  hash = "sha256-g11D5lekI3pUpKf5CLUuNjejs0gN/bEemHkCj3akha0=";
  vendorHash = "sha256-kiDhlR/P81u/yNq72JuskES/UzMrTFzJT0H3xldGk8I=";
@ -14,4 +14,4 @@ callPackage ../generic.nix ({
    # https://github.com/NixOS/nixpkgs/issues/120738
    ../tsh.patch
  ];
-} // builtins.removeAttrs args [ "callPackage" ])
+})
--- a/pkgs/servers/teleport/14/default.nix
+++ b/pkgs/servers/teleport/14/default.nix
@ -1,5 +1,5 @@
-{ callPackage, ... }@args:
-callPackage ../generic.nix ({
+args:
+import ../generic.nix (args // {
  version = "14.3.0";
  hash = "sha256-yTbJeHCmPlelq7BrZQRY3XyNQiovV7NQ1tNh2NfYGbk=";
  vendorHash = "sha256-lHsgSbY1nqQminU67QgV6FbHXNlv5tCMv2oVq48S33M=";
@ -14,4 +14,4 @@ callPackage ../generic.nix ({
    # https://github.com/NixOS/nixpkgs/issues/120738
    ../tsh_14.patch
  ];
-} // builtins.removeAttrs args [ "callPackage" ])
+})
--- a/pkgs/servers/teleport/15/Cargo.lock
+++ b/pkgs/servers/teleport/15/Cargo.lock
--- a/pkgs/servers/teleport/15/default.nix
+++ b/pkgs/servers/teleport/15/default.nix
@ -0,0 +1,26 @@
+{ wasm-bindgen-cli, ... }@args:
+import ../generic.nix (args // {
+  version = "15.2.2";
+  hash = "sha256-LzJaskFaBtWkodeuT4mDNTs4+6FZj2OI+ZtjogU3KzQ=";
+  vendorHash = "sha256-D62Jk6LKdbprvkzAKoQVnEKdGQp5ITJYFf53q6154pU=";
+  yarnHash = "sha256-jpcjO1wT6m8J7LNQVeWo1j2G5P+sexrnNF1ipCZ8lCU=";
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "boring-4.4.0" = "sha256-4wdl2kIA5oHQ0H6IddKQ+B5kRwrTeMbKe1+tAYZt2uw=";
+      "ironrdp-async-0.1.0" = "sha256-BKaVPr3O4D7DdwNJUjrU1zB7OwmJZnpJeyuMx+FqKjI=";
+      "sspi-0.10.1" = "sha256-fkclC/plTh2d8zcmqthYmr5yXqbPTeFxI1VuaPX5vxk=";
+    };
+  };
+  extPatches = [
+    # https://github.com/NixOS/nixpkgs/issues/120738
+    ../tsh_14.patch
+  ];
+
+  # wasm-bindgen-cli version must match the version of wasm-bindgen in Cargo.lock
+  wasm-bindgen-cli = wasm-bindgen-cli.override {
+    version = "0.2.91";
+    hash = "sha256-f/RK6s12ItqKJWJlA2WtOXtwX4Y0qa8bq/JHlLTAS3c=";
+    cargoHash = "sha256-3vxVI0BhNz/9m59b+P2YEIrwGwlp7K3pyPKt4VqQuHE=";
+  };
+})
--- a/pkgs/servers/teleport/default.nix
+++ b/pkgs/servers/teleport/default.nix
@ -0,0 +1,12 @@
+{ callPackages, lib, ... }@args:
+let
+  f = args: rec {
+    teleport_13 = import ./13 args;
+    teleport_14 = import ./14 args;
+    teleport_15 = import ./15 args;
+    teleport = teleport_15;
+  };
+  # Ensure the following callPackages invocation includes everything 'generic' needs.
+  f' = lib.setFunctionArgs f (builtins.functionArgs (import ./generic.nix));
+in
+callPackages f' (builtins.removeAttrs args [ "callPackages" ])
--- a/pkgs/servers/teleport/generic.nix
+++ b/pkgs/servers/teleport/generic.nix
@ -6,14 +6,19 @@
 , makeWrapper
 , CoreFoundation
 , AppKit
+, binaryen
+, cargo
 , libfido2
 , nodejs
 , openssl
 , pkg-config
+, rustc
 , Security
 , stdenv
 , xdg-utils
 , yarn
+, wasm-bindgen-cli
+, wasm-pack
 , prefetch-yarn-deps
 , nixosTests

@ -69,12 +74,23 @@ let
    pname = "teleport-webassets";
    inherit src version;

-    nativeBuildInputs = [
-      nodejs
-      yarn
-      prefetch-yarn-deps
+    cargoDeps = rustPlatform.importCargoLock cargoLock;
+
+    RUSTFLAGS = builtins.concatStringsSep " " [
+      "-C linker=lld"
    ];

+    nativeBuildInputs = [ nodejs yarn prefetch-yarn-deps ] ++
+      lib.optional (lib.versionAtLeast version "15") [
+        binaryen
+        cargo
+        rustc
+        rustc.llvmPackages.lld
+        rustPlatform.cargoSetupHook
+        wasm-bindgen-cli
+        wasm-pack
+      ];
+
    configurePhase = ''
      export HOME=$(mktemp -d)
    '';
@ -88,7 +104,16 @@ let
        --ignore-engines --ignore-scripts
      patchShebangs .

-      yarn build-ui-oss
+      ${if lib.versionAtLeast version "15"
+      then ''
+        PATH=$PATH:$PWD/node_modules/.bin
+        pushd web/packages/teleport
+        # https://github.com/gravitational/teleport/blob/6b91fe5bbb9e87db4c63d19f94ed4f7d0f9eba43/web/packages/teleport/README.md?plain=1#L18-L20
+        RUST_MIN_STACK=16777216 wasm-pack build ./src/ironrdp --target web --mode no-install
+        vite build
+        popd
+      ''
+      else "yarn build-ui-oss"}
    '';

    installPhase = ''
@ -154,7 +179,7 @@ buildGoModule rec {
  meta = with lib; {
    description = "Certificate authority and access plane for SSH, Kubernetes, web applications, and databases";
    homepage = "https://goteleport.com/";
-    license = licenses.asl20;
+    license = if lib.versionAtLeast version "15" then licenses.agpl3Plus else licenses.asl20;
    maintainers = with maintainers; [ arianvp justinas sigma tomberek freezeboy techknowlogick ];
    platforms = platforms.unix;
    # go-libfido2 is broken on platforms with less than 64-bit because it defines an array
--- a/pkgs/shells/hilbish/default.nix
+++ b/pkgs/shells/hilbish/default.nix
@ -2,19 +2,19 @@

 buildGoModule rec {
  pname = "hilbish";
-  version = "2.2.1";
+  version = "2.2.2";

  src = fetchFromGitHub {
    owner = "Rosettea";
    repo = "Hilbish";
    rev = "v${version}";
-    hash = "sha256-pXl0emLY+W0DkW4HONv3qVZzCEZnx/SX3MjyBajsosg=";
+    hash = "sha256-tkEEvxIBPpPbdIFxbo0pOHHORXEFZ8wn9emIeyz6glc=";
    fetchSubmodules = true;
  };

  subPackages = [ "." ];

-  vendorHash = "sha256-nE+THN+Q7Ze36c0nd3oROoFPLIzH/kw9qBwMxv+j9uE=";
+  vendorHash = "sha256-jf+S1On3Cib20Uepsm8WeRwEyuRKzSPFfsT2YVkx4fs=";

  ldflags = [
    "-s"
--- a/pkgs/tools/audio/wyoming/faster-whisper.nix
+++ b/pkgs/tools/audio/wyoming/faster-whisper.nix
@ -5,14 +5,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "wyoming-faster-whisper";
-  version = "2.0.0";
+  version = "2.1.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "rhasspy";
    repo = "wyoming-faster-whisper";
    rev = "refs/tags/v${version}";
-    hash = "sha256-CeFSxL2Mn9lgboKghbteCl6VMTqruJgrI0io+TdaV5k=";
+    hash = "sha256-zWa872YkPh8B7dE//leth+ixIa1wHSRcjkvH2lXzolc=";
  };

  nativeBuildInputs = with python3Packages; [
--- a/pkgs/tools/misc/esphome/default.nix
+++ b/pkgs/tools/misc/esphome/default.nix
@ -19,14 +19,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
  pname = "esphome";
-  version = "2024.3.1";
+  version = "2024.3.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-lWDQp3I8AJT5iTT8wMj/ZL6ykw2NNeLXdq1obnMP7Ao=";
+    hash = "sha256-WeTajznndw01jXIEnOiSEy9psLuMeAC6j7UmHg0+Fys=";
  };

  nativeBuildInputs = with python.pkgs; [
--- a/pkgs/tools/misc/ollama/default.nix
+++ b/pkgs/tools/misc/ollama/default.nix
@ -100,10 +100,6 @@ let
      cudaPackages.cuda_cudart
      cudaPackages.cuda_cudart.static
    ];
-    postBuild = ''
-      rm "$out/lib64"
-      ln -s "lib" "$out/lib64"
-    '';
  };

  runtimeLibs = lib.optionals enableRocm [
@ -140,6 +136,8 @@ goBuild ((lib.optionalAttrs enableRocm {

  nativeBuildInputs = [
    cmake
+  ] ++ lib.optionals enableRocm [
+    rocmPackages.llvm.bintools
  ] ++ lib.optionals (enableRocm || enableCuda) [
    makeWrapper
  ] ++ lib.optionals stdenv.isDarwin
--- a/pkgs/tools/networking/edgedb/Cargo.lock
+++ b/pkgs/tools/networking/edgedb/Cargo.lock
@ -998,7 +998,7 @@ checksum = "9ea835d29036a4087793836fa931b08837ad5e957da9e23886b29586fb9b6650"

 [[package]]
 name = "edgedb-cli"
-version = "4.0.2"
+version = "4.1.1"
 dependencies = [
 "ansi-escapes",
 "anyhow",
@ -2642,9 +2642,9 @@ checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"

 [[package]]
 name = "proc-macro2"
-version = "1.0.59"
+version = "1.0.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6aeca18b86b413c660b781aa319e4e2648a3e6f9eadc9b47e9038e6fe9f3451b"
+checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
 dependencies = [
 "unicode-ident",
 ]
--- a/pkgs/tools/networking/edgedb/default.nix
+++ b/pkgs/tools/networking/edgedb/default.nix
@ -19,13 +19,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "edgedb";
-  version = "4.0.2";
+  version = "4.1.1";

  src = fetchFromGitHub {
    owner = "edgedb";
    repo = "edgedb-cli";
    rev = "v${version}";
-    hash = "sha256-uilotat61U6jW1NLh7fVHOujkzUSFRdpeOx+ECGsByY=";
+    hash = "sha256-PHtjm3xlGwkDskH3A9/QQrmzt2Xi+sqnQAQV6WG7a6M=";
    fetchSubmodules = true;
  };

--- a/pkgs/tools/security/cloudfox/default.nix
+++ b/pkgs/tools/security/cloudfox/default.nix
@ -1,20 +1,21 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
 }:

 buildGoModule rec {
  pname = "cloudfox";
-  version = "1.13.4";
+  version = "1.14.0";

  src = fetchFromGitHub {
    owner = "BishopFox";
    repo = "cloudfox";
    rev = "refs/tags/v${version}";
-    hash = "sha256-nN/gSvAwKjfZulqH4caGoJmzlY0ik8JrFReuvYWwZTE=";
+    hash = "sha256-vh7U66od+i1kmTtpHZ1tuMPTl0AnXoYUKMU16ZgxFBQ=";
  };

-  vendorHash = "sha256-aRbGBEci3QT1mH+yaOUVynPysJ1za6CaoLGppJaa94c=";
+  vendorHash = "sha256-2+UiaU4S64afH8Y8uz5ZclO5NxTi4YlUZ87ZN1MnLj0=";

  ldflags = [
    "-w"
@ -26,10 +27,10 @@ buildGoModule rec {

  meta = with lib; {
    description = "Tool for situational awareness of cloud penetration tests";
-    mainProgram = "cloudfox";
    homepage = "https://github.com/BishopFox/cloudfox";
    changelog = "https://github.com/BishopFox/cloudfox/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
+    mainProgram = "cloudfox";
  };
 }
--- a/pkgs/tools/security/govulncheck/default.nix
+++ b/pkgs/tools/security/govulncheck/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "govulncheck";
-  version = "1.0.4";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "golang";
    repo = "vuln";
    rev = "refs/tags/v${version}";
-    hash = "sha256-GLZaJ/hVA1A2Mek1G7QkDGowqa5Bm4sRh0Y7QMhud/w=";
+    hash = "sha256-sS58HyrwyRv3zYi8OgiDYnKSbyu2i3KVoSX/0wQbqGw=";
  };

  patches = [
@ -23,7 +23,7 @@ buildGoModule rec {
    })
  ];

-  vendorHash = "sha256-Jg2Nx63Xak149111jbBP6SgK3hze21Dx5qcDKXCqa48=";
+  vendorHash = "sha256-ZHf//khvBGG+gRBKoKZo4NKoIJCQsbQfe2uT7cAHDcM=";

  subPackages = [
    "cmd/govulncheck"
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -1219,6 +1219,7 @@ mapAliases ({
  tdesktop = telegram-desktop; # Added 2023-04-07
  telegram-cli = throw "telegram-cli was removed because it was broken and abandoned upstream"; # Added 2023-07-28
  teleport_11 = throw "teleport 11 has been removed as it is EOL. Please upgrade to Teleport 12 or later"; # Added 2023-11-27
+  teleport_12 = throw "teleport 12 has been removed as it is EOL. Please upgrade to Teleport 13 or later"; # Added 2024-02-04
  teleprompter = throw "teleprompter has been removed. reason: upstream dead and does not work with recent electron versions"; # Added 2024-03-14
  tensile = throw "'tensile' has been replaced with 'rocmPackages.tensile'"; # Added 2023-10-08
  testVersion = testers.testVersion; # Added 2022-04-20
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -2530,10 +2530,6 @@ with pkgs;

  gittyup = libsForQt5.callPackage ../applications/version-management/gittyup { };

-  gitui = callPackage ../applications/version-management/gitui {
-    inherit (darwin.apple_sdk.frameworks) Security AppKit;
-  };
-
  gitweb = callPackage ../applications/version-management/gitweb { };

  glab = callPackage ../applications/version-management/glab { };
@ -13631,16 +13627,9 @@ with pkgs;

  telegraf = callPackage ../servers/monitoring/telegraf { };

-  teleport_12 = callPackage ../servers/teleport/12 {
+  inherit (callPackages ../servers/teleport {
    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security AppKit;
-  };
-  teleport_13 = callPackage ../servers/teleport/13 {
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security AppKit;
-  };
-  teleport_14 = callPackage ../servers/teleport/14 {
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security AppKit;
-  };
-  teleport = teleport_14;
+  }) teleport_13 teleport_14 teleport_15 teleport;

  telepresence = callPackage ../tools/networking/telepresence {
    pythonPackages = python3Packages;