Merge branch 'staging' into staging-next

2025-05-07 08:47:01 +02:00
parent 0589375505 7564f2f2dc
commit dc791e3dbb
306 changed files with 5171 additions and 2450 deletions
@@ -779,7 +779,7 @@ that depend on that library, you may want to use:

 ```nix
 haskellPackages.haskell-ci.overrideScope (self: super: {
-  Cabal = self.Cabal_3_14_1_1;
+  Cabal = self.Cabal_3_14_2_0;
 })
 ```

@@ -1141,12 +1141,15 @@ They cannot be overridden without rebuilding the package.

 If dependencies should be resolved at runtime, use `--suffix` to append fallback values to `PATH`.

-There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/build-support/setup-hooks/make-binary-wrapper/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.
+There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.

 `wrapProgram` is a convenience function you probably want to use most of the time, implemented by both `makeWrapper` and `makeBinaryWrapper`.

 Using the `makeBinaryWrapper` implementation is usually preferred, as it creates a tiny _compiled_ wrapper executable, that can be used as a shebang interpreter. This is needed mostly on Darwin, where shebangs cannot point to scripts, [due to a limitation with the `execve`-syscall](https://stackoverflow.com/questions/67100831/macos-shebang-with-absolute-path-not-working). Compiled wrappers generated by `makeBinaryWrapper` can be inspected with `less <path-to-wrapper>` - by scrolling past the binary data you should be able to see the shell command that generated the executable and there see the environment variables that were injected into the wrapper.

+However, `makeWrapper` is more flexible and implements more arguments.
+Use `makeWrapper` if you need the wrapper to use shell features (e.g. look up environment variables) at runtime.
+
 ### `remove-references-to -t` \<storepath\> [ `-t` \<storepath\> ... ] \<file\> ... {#fun-remove-references-to}

 Removes the references of the specified files to the specified store files. This is done without changing the size of the file by replacing the hash by `eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee`, and should work on compiled executables. This is meant to be used to remove the dependency of the output on inputs that are known to be unnecessary at runtime. Of course, reckless usage will break the patched programs.
@@ -106,7 +106,6 @@ luazip,,,,,,
 lusc_luv,,,,,,
 lush.nvim,,,https://luarocks.org/dev,,,teto
 luuid,,,,20120509-2,,
-luv,,,,1.48.0-2,,
 lyaml,,,,,,lblasc
 lz.n,,,,,,mrcjkb
 lze,,,,,,birdee
@@ -24,6 +24,15 @@

 - OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. Additionally, we now enable a configure option by default that attempts to lock sshd into RAM to prevent it from being swapped out, which may improve performance if the system is under memory pressure. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.

+- GNOME has been updated to version 48.
+
+  - `decibels` music player is now installed by default. You can disable it using [](#opt-environment.gnome.excludePackages).
+  - `gnome-shell-extensions` extension collection (which included GNOME Classic extensions, Apps Menu, and User Themes, among others) are no longer installed by default. You can install them again with [](#opt-services.xserver.desktopManager.gnome.sessionPath).
+  - Option [](#opt-services.gnome.core-developer-tools.enable) now also installs `sysprof` and `d-spy`.
+  - Option `services.gnome.core-utilities.enable` has been renamed to [](#opt-services.gnome.core-apps.enable).
+
+  Refer to the [GNOME release notes](https://release.gnome.org/48/) for more details.
+
 - The `intel` video driver for X.org (from the xf86-video-intel package) which was previously removed because it was non-functional has been fixed and the driver has been re-introduced.

 - The Mattermost module ({option}`services.mattermost`) and packages (`mattermost` and `mmctl`) have been substantially updated:
@@ -19,7 +19,7 @@ To enable the GNOME desktop use:
 While it is not strictly necessary to use GDM as the display manager with GNOME, it is recommended, as some features such as screen lock [might not work](#sec-gnome-faq-can-i-use-lightdm-with-gnome) without it.
 :::

-The default applications used in NixOS are very minimal, inspired by the defaults used in [gnome-build-meta](https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/40.0/elements/core/meta-gnome-core-utilities.bst).
+The default applications used in NixOS are very minimal, inspired by the defaults used in [gnome-build-meta](https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/48.0/elements/core/meta-gnome-core-apps.bst).

 ### GNOME without the apps {#sec-gnome-without-the-apps}

@@ -27,7 +27,7 @@ If you’d like to only use the GNOME desktop and not the apps, you can disable

 ```nix
 {
-  services.gnome.core-utilities.enable = false;
+  services.gnome.core-apps.enable = false;
 }
 ```

@@ -84,12 +84,19 @@ in
    maintainers = lib.teams.gnome.members;
  };

+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "gnome" "core-utilities" "enable" ]
+      [ "services" "gnome" "core-apps" "enable" ]
+    )
+  ];
+
  options = {

    services.gnome = {
      core-os-services.enable = mkEnableOption "essential services for GNOME3";
      core-shell.enable = mkEnableOption "GNOME Shell services";
-      core-utilities.enable = mkEnableOption "GNOME core utilities";
+      core-apps.enable = mkEnableOption "GNOME core apps";
      core-developer-tools.enable = mkEnableOption "GNOME core developer tools";
      games.enable = mkEnableOption "GNOME games";
    };
@@ -213,7 +220,7 @@ in

      services.gnome.core-os-services.enable = true;
      services.gnome.core-shell.enable = true;
-      services.gnome.core-utilities.enable = mkDefault true;
+      services.gnome.core-apps.enable = mkDefault true;

      services.displayManager.sessionPackages = [ pkgs.gnome-session.sessions ];

@@ -325,17 +332,9 @@ in
    })

    (lib.mkIf serviceCfg.core-shell.enable {
-      services.xserver.desktopManager.gnome.sessionPath =
-        let
-          mandatoryPackages = [
-            pkgs.gnome-shell
-          ];
-          optionalPackages = [
-            pkgs.gnome-shell-extensions
-          ];
-        in
-        mandatoryPackages
-        ++ utils.removePackagesByName optionalPackages config.environment.gnome.excludePackages;
+      services.xserver.desktopManager.gnome.sessionPath = [
+        pkgs.gnome-shell
+      ];

      services.colord.enable = mkDefault true;
      services.gnome.glib-networking.enable = true;
@@ -386,7 +385,7 @@ in
        source-sans
      ];

-      # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/gnome-3-38/elements/core/meta-gnome-core-shell.bst
+      # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/gnome-48/elements/core/meta-gnome-core-shell.bst
      environment.systemPackages =
        let
          mandatoryPackages = [
@@ -399,7 +398,6 @@ in
            pkgs.gnome-bluetooth
            pkgs.gnome-color-manager
            pkgs.gnome-control-center
-            pkgs.gnome-shell-extensions
            pkgs.gnome-tour # GNOME Shell detects the .desktop file on first log-in.
            pkgs.gnome-user-docs
            pkgs.glib # for gsettings program
@@ -413,11 +411,12 @@ in
        ++ utils.removePackagesByName optionalPackages config.environment.gnome.excludePackages;
    })

-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-45/elements/core/meta-gnome-core-utilities.bst
-    (lib.mkIf serviceCfg.core-utilities.enable {
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-apps.bst
+    (lib.mkIf serviceCfg.core-apps.enable {
      environment.systemPackages = utils.removePackagesByName (
        [
          pkgs.baobab
+          pkgs.decibels
          pkgs.epiphany
          pkgs.gnome-text-editor
          pkgs.gnome-calculator
@@ -499,17 +498,19 @@ in
      ] config.environment.gnome.excludePackages;
    })

-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/3.38.0/elements/core/meta-gnome-core-developer-tools.bst
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-developer-tools.bst
    (lib.mkIf serviceCfg.core-developer-tools.enable {
      environment.systemPackages = utils.removePackagesByName [
        pkgs.dconf-editor
        pkgs.devhelp
+        pkgs.d-spy
        pkgs.gnome-builder
        # boxes would make sense in this option, however
        # it doesn't function well enough to be included
        # in default configurations.
        # https://github.com/NixOS/nixpkgs/issues/60908
        # pkgs.gnome-boxes
+        pkgs.sysprof
      ] config.environment.gnome.excludePackages;

      services.sysprof.enable = notExcluded pkgs.sysprof;
@@ -211,7 +211,10 @@ in
      pkgs.gnome-session
      pkgs.gnome-shell
    ];
-    environment.systemPackages = [ pkgs.adwaita-icon-theme ];
+    environment.systemPackages = [
+      pkgs.adwaita-icon-theme
+      pkgs.gdm # For polkit rules
+    ];

    # We dont use the upstream gdm service
    # it has to be disabled since the gdm package has it
@@ -14,7 +14,7 @@
  libXtst,
  libsecret,
  gsettings-desktop-schemas,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
  makeWrapper,
  perl,
  ...
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
    libXtst
    libsecret
    zlib
-  ] ++ lib.optional (webkitgtk_4_0 != null) webkitgtk_4_0;
+  ] ++ lib.optional (webkitgtk_4_1 != null) webkitgtk_4_1;

  buildCommand = ''
    # Unpack tarball.
@@ -93,7 +93,7 @@ stdenv.mkDerivation rec {
            libXtst
            libsecret
          ]
-          ++ lib.optional (webkitgtk_4_0 != null) webkitgtk_4_0
+          ++ lib.optional (webkitgtk_4_1 != null) webkitgtk_4_1
        )
      } \
      --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules" \
@@ -16,7 +16,7 @@
  jdk,
  jdk8,
  gsettings-desktop-schemas,
-  webkitgtk_4_0 ? null, # for internal web browser
+  webkitgtk_4_1 ? null, # for internal web browser
  buildEnv,
  runCommand,
  callPackage,
@@ -64,7 +64,7 @@ let
      gtk
      libXtst
      gsettings-desktop-schemas
-      webkitgtk_4_0
+      webkitgtk_4_1
      makeWrapper
      ;
  };
@@ -10,7 +10,7 @@
  gtkspell3,
  librsvg,
  pygobject3,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
 }:

 buildPythonApplication rec {
@@ -37,7 +37,7 @@ buildPythonApplication rec {
    gtkspell3
    librsvg
    pygobject3
-    webkitgtk_4_0
+    webkitgtk_4_1
  ];

  # Needs a display
@@ -8,7 +8,7 @@
  gtk3,
  gtksourceview,
  pango,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
  pygobject3,
  pyyaml,
  setuptools,
@@ -39,7 +39,7 @@ buildPythonApplication rec {
    gtk3
    gtksourceview
    pango
-    webkitgtk_4_0
+    webkitgtk_4_1
    pygobject3
    pyyaml
  ];
@@ -14,7 +14,7 @@
  gtk3,
  libnotify,
  pango,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
  wrapGAppsHook3,

  # check inputs
@@ -96,7 +96,7 @@ buildPythonApplication rec {
      gtk3
      libnotify
      pango
-      webkitgtk_4_0
+      webkitgtk_4_1
    ]
    ++ (with gst_all_1; [
      gst-libav
@@ -21,7 +21,7 @@ let
      gtksourceview
      gnome-desktop
      libgnome-keyring
-      webkitgtk_4_0
+      webkitgtk_4_1
    ];
  xorgDeps =
    pkgs: with pkgs.xorg; [
@@ -34,27 +34,14 @@
  libbgcode,
  heatshrink,
  catch2,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
  systemd,
  wxGTK-override ? null,
  opencascade-override ? null,
 }:
 let
-  wxGTK-prusa = wxGTK32.overrideAttrs (old: {
-    pname = "wxwidgets-prusa3d-patched";
-    version = "3.2.0";
-    configureFlags = old.configureFlags ++ [ "--disable-glcanvasegl" ];
-    patches = [ ./wxWidgets-Makefile.in-fix.patch ];
-    src = fetchFromGitHub {
-      owner = "prusa3d";
-      repo = "wxWidgets";
-      rev = "78aa2dc0ea7ce99dc19adc1140f74c3e2e3f3a26";
-      hash = "sha256-rYvmNmvv48JSKVT4ph9AS+JdstnLSRmcpWz1IdgBzQo=";
-      fetchSubmodules = true;
-    };
-  });
-  nanosvg-fltk = nanosvg.overrideAttrs (old: rec {
+  nanosvg-fltk = nanosvg.overrideAttrs (old: {
    pname = "nanosvg-fltk";
    version = "unstable-2022-12-22";

@@ -66,7 +53,7 @@ let
    };
  });
  openvdb_tbb_2021_8 = openvdb.override { tbb = tbb_2021_11; };
-  wxGTK-override' = if wxGTK-override == null then wxGTK-prusa else wxGTK-override;
+  wxGTK-override' = if wxGTK-override == null then wxGTK32 else wxGTK-override;
  opencascade-override' =
    if opencascade-override == null then opencascade-occt_7_6_1 else opencascade-override;
 in
@@ -87,6 +74,8 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://github.com/prusa3d/PrusaSlicer/commit/cdc3db58f9002778a0ca74517865527f50ade4c3.patch";
      hash = "sha256-zgpGg1jtdnCBaWjR6oUcHo5sGuZx5oEzpux3dpRdMAM=";
    })
+    # https://github.com/prusa3d/PrusaSlicer/pull/11769
+    ./fix-ambiguous-constructors.patch
  ];

  # required for GCC 14
@@ -135,7 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
      libbgcode
      heatshrink
      catch2
-      webkitgtk_4_0
+      webkitgtk_4_1
    ]
    ++ lib.optionals withSystemd [
      systemd
@@ -0,0 +1,37 @@
+From 910328f3131e24e330808f5d4cb814454dbe201d Mon Sep 17 00:00:00 2001
+From: Gregor Riepl <onitake@gmail.com>
+Date: Mon, 27 Nov 2023 13:01:55 +0100
+Subject: [PATCH] Make initializers explicit to avoid ambiguous wxArrayString
+ overloads
+
+---
+ src/slic3r/GUI/PhysicalPrinterDialog.cpp | 2 +-
+ src/slic3r/GUI/Plater.cpp                | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/slic3r/GUI/PhysicalPrinterDialog.cpp b/src/slic3r/GUI/PhysicalPrinterDialog.cpp
+index 849e987c731..7d0c628c23f 100644
+--- a/src/slic3r/GUI/PhysicalPrinterDialog.cpp
+++ b/src/slic3r/GUI/PhysicalPrinterDialog.cpp
+@@ -607,7 +607,7 @@ void PhysicalPrinterDialog::build_printhost_settings(ConfigOptionsGroup* m_optgr
+     // Always fill in the "printhost_port" combo box from the config and select it.
+     {
+         Choice* choice = dynamic_cast<Choice*>(m_optgroup->get_field("printhost_port"));
+-        choice->set_values({ m_config->opt_string("printhost_port") });
+        choice->set_values(std::vector<std::string>({ m_config->opt_string("printhost_port") }));
+         choice->set_selection();
+     }
+ 
+diff --git a/src/slic3r/GUI/Plater.cpp b/src/slic3r/GUI/Plater.cpp
+index debfe625fd4..4d61e29a2dc 100644
+--- a/src/slic3r/GUI/Plater.cpp
+++ b/src/slic3r/GUI/Plater.cpp
+@@ -4420,7 +4420,7 @@ void Plater::load_project(const wxString& filename)
+     s_multiple_beds.set_loading_project_flag(true);
+     ScopeGuard guard([](){ s_multiple_beds.set_loading_project_flag(false);});
+ 
+-    if (! load_files({ into_path(filename) }).empty()) {
+    if (! load_files(std::vector<boost::filesystem::path>({ into_path(filename) })).empty()) {
+         // At least one file was loaded.
+         p->set_project_filename(filename);
+         // Save the names of active presets and project specific config into ProjectDirtyStateManager.
@@ -15,7 +15,7 @@
  gdk-pixbuf,
  cairo,
  pango,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
  openssl,
  gstreamer,
  gst-libav,
@@ -67,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
    cairo
    pango
    gtk3
-    webkitgtk_4_0
+    webkitgtk_4_1
    openssl
    libfixposix
  ];
@@ -2,9 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  buildPackages,
  vala,
-  cmake,
  ninja,
  wrapGAppsHook4,
  pkg-config,
@@ -15,17 +13,17 @@
  gtk4,
  glib-networking,
  libadwaita,
+  libcanberra,
  libnotify,
-  libsoup_2_4,
+  libsoup_3,
  libgee,
-  libsignal-protocol-c,
+  libomemo-c,
  libgcrypt,
+  meson,
  sqlite,
  gpgme,
-  pcre2,
  qrencode,
  icu,
-  gspell,
  srtp,
  libnice,
  gnutls,
@@ -34,30 +32,28 @@
  gst-plugins-good,
  gst-plugins-bad,
  gst-vaapi,
-  webrtc-audio-processing,
+  webrtc-audio-processing_1,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "dino";
-  version = "0.4.5";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "dino";
    repo = "dino";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-lF2cUalCrVD6274Ey8wggEXNvKXydlRjvX+815geL1c=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Y3MGKpfhjmqnIvmt4mXnkmpjF/riXPDXyUiSrsceY6o=";
  };

  postPatch = ''
-    # don't overwrite manually set version information
-    substituteInPlace CMakeLists.txt \
-      --replace "include(ComputeVersion)" ""
+    echo ${finalAttrs.version} > VERSION
  '';

  nativeBuildInputs = [
    vala
-    cmake
-    ninja # https://github.com/dino/dino/issues/230
+    meson
+    ninja
    pkg-config
    wrapGAppsHook4
    gettext
@@ -76,11 +72,10 @@ stdenv.mkDerivation (finalAttrs: {
    libnotify
    gpgme
    libgcrypt
-    libsoup_2_4
-    pcre2
+    libsoup_3
    icu
-    libsignal-protocol-c
-    gspell
+    libcanberra
+    libomemo-c
    srtp
    libnice
    gnutls
@@ -89,35 +84,22 @@ stdenv.mkDerivation (finalAttrs: {
    gst-plugins-good # contains rtpbin, required for VP9
    gst-plugins-bad # required for H264, MSDK
    gst-vaapi # required for VAAPI
-    webrtc-audio-processing
+    webrtc-audio-processing_1
  ];

-  cmakeFlags = [
-    "-DBUILD_TESTS=true"
-    "-DRTP_ENABLE_H264=true"
-    "-DRTP_ENABLE_MSDK=true"
-    "-DRTP_ENABLE_VAAPI=true"
-    "-DRTP_ENABLE_VP9=true"
-    "-DVERSION_FOUND=true"
-    "-DVERSION_IS_RELEASE=true"
-    "-DVERSION_FULL=${finalAttrs.version}"
-    "-DXGETTEXT_EXECUTABLE=${lib.getBin buildPackages.gettext}/bin/xgettext"
-    "-DMSGFMT_EXECUTABLE=${lib.getBin buildPackages.gettext}/bin/msgfmt"
-    "-DGLIB_COMPILE_RESOURCES_EXECUTABLE=${lib.getDev buildPackages.glib}/bin/glib-compile-resources"
-    "-DSOUP_VERSION=${lib.versions.major libsoup_2_4.version}"
+  doCheck = true;
+
+  mesonFlags = [
+    "-Dplugin-notification-sound=enabled"
+    "-Dplugin-rtp-h264=enabled"
+    "-Dplugin-rtp-msdk=enabled"
+    "-Dplugin-rtp-vaapi=enabled"
+    "-Dplugin-rtp-vp9=enabled"
  ];

  # Undefined symbols for architecture arm64: "_gpg_strerror"
  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-lgpg-error";

-  doCheck = true;
-  checkPhase = ''
-    runHook preCheck
-    ./xmpp-vala-test
-    ./signal-protocol-vala-test
-    runHook postCheck
-  '';
-
  # Dino looks for plugins with a .so filename extension, even on macOS where
  # .dylib is appropriate, and despite the fact that it builds said plugins with
  # that as their filename extension
@@ -46,11 +46,11 @@

 stdenv.mkDerivation rec {
  pname = "evolution";
-  version = "3.54.3";
+  version = "3.56.1";

  src = fetchurl {
    url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-dGz4HvXDJa8X9Tsvq0bWcmDzsT2gFNiZTUrZ6Ea4Ves=";
+    hash = "sha256-39/lmRCdI5vFbajpYlssGVcGegGujv81BmOj2q50vRY=";
  };

  nativeBuildInputs = [
@@ -37,7 +37,8 @@
  nlsSupport ? true,
  osxkeychainSupport ? stdenv.hostPlatform.isDarwin,
  guiSupport ? false,
-  withManual ? true,
+  # Disable the manual since libxslt doesn't seem to parse the files correctly.
+  withManual ? !stdenv.hostPlatform.useLLVM,
  pythonSupport ? true,
  withpcre2 ? true,
  sendEmailSupport ? perlSupport,
@@ -456,6 +457,12 @@ stdenv.mkDerivation (finalAttrs: {

  preInstallCheck =
    ''
+      # Some tests break with high concurrency
+      # https://github.com/NixOS/nixpkgs/pull/403237
+      if ((NIX_BUILD_CORES > 32)); then
+        NIX_BUILD_CORES=32
+      fi
+
      installCheckFlagsArray+=(
        GIT_PROVE_OPTS="--jobs $NIX_BUILD_CORES --failures --state=failed,save"
        GIT_TEST_INSTALLED=$out/bin
@@ -494,7 +501,11 @@ stdenv.mkDerivation (finalAttrs: {
    ''
    + ''
      # Flaky tests:
+      disable_test t0027-auto-crlf
+      disable_test t1451-fsck-buffer
+      disable_test t5319-multi-pack-index
      disable_test t6421-merge-partial-clone
+      disable_test t7504-commit-msg-hook

      # Fails reproducibly on ZFS on Linux with formD normalization
      disable_test t0021-conversion
@@ -1,8 +1,17 @@
-diff --git a/Documentation/git-send-email.txt b/Documentation/git-send-email.txt
-index 3db4eab4ba..39bc0e77c9 100644
+diff --git a/Documentation/git-send-email.adoc b/Documentation/git-send-email.adoc
+index 7f223db42d..7e46a07d31 100644
 --- a/Documentation/git-send-email.adoc
 +++ b/Documentation/git-send-email.adoc
-@@ -220,9 +220,9 @@ a password is obtained using 'git-credential'.
+@@ -177,7 +177,7 @@ Sending
+ 	The command will be executed in the shell if necessary.  Default
+ 	is the value of `sendemail.sendmailCmd`.  If unspecified, and if
+ 	--smtp-server is also unspecified, git-send-email will search
+-	for `sendmail` in `/usr/sbin`, `/usr/lib` and $PATH.
+	for `sendmail` in $PATH.
+ 
+ --smtp-encryption=<encryption>::
+ 	Specify in what way encrypting begins for the SMTP connection.
+@@ -233,9 +233,9 @@ a password is obtained using 'git-credential'.
 --smtp-server=<host>::
 	If set, specifies the outgoing SMTP server to use (e.g.
 	`smtp.example.com` or a raw IP address).  If unspecified, and if
@@ -16,10 +25,10 @@ index 3db4eab4ba..39bc0e77c9 100644
 For backward compatibility, this option can also specify a full pathname
 of a sendmail-like program instead; the program must support the `-i`
 diff --git a/git-send-email.perl b/git-send-email.perl
-index e65d969d0b..508d49483d 100755
+index 798d59b84f..69c9cc2a7d 100755
 --- a/git-send-email.perl
 +++ b/git-send-email.perl
-@@ -1066,8 +1066,7 @@ sub expand_one_alias {
+@@ -1091,8 +1091,7 @@ sub expand_one_alias {
 }
 
 if (!defined $sendmail_cmd && !defined $smtp_server) {
@@ -60,6 +60,7 @@ stdenv.mkDerivation {

  nativeBuildInputs = [
    cmake
+    extra-cmake-modules
    pkg-config
    wrapQtAppsHook
  ];
@@ -71,7 +72,6 @@ stdenv.mkDerivation {
    python3
    python3.pkgs.pyside2
    python3.pkgs.shiboken2
-    extra-cmake-modules
    wayland
    glog
    ceres-solver
@@ -3,7 +3,7 @@
  stdenv,
  fetchFromGitHub,
  obs-studio,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
  glib-networking,
  meson,
  cmake,
@@ -25,7 +25,7 @@ stdenv.mkDerivation {

  buildInputs = [
    obs-studio
-    webkitgtk_4_0
+    webkitgtk_4_1
    glib-networking
  ];

@@ -31,6 +31,7 @@
  libcap_ng,
  socat,
  libslirp,
+  libcbor,
  apple-sdk_13,
  darwinMinVersionHook,
  guestAgentSupport ?
@@ -195,6 +196,7 @@ stdenv.mkDerivation (finalAttrs: {
      snappy
      libtasn1
      libslirp
+      libcbor
    ]
    ++ lib.optionals (!userOnly) [ curl ]
    ++ lib.optionals ncursesSupport [ ncurses ]
@@ -22,10 +22,12 @@ assertExecutable() {
 # --unset        VAR     : remove VAR from the environment
 # --chdir        DIR     : change working directory (use instead of --run "cd DIR")
 # --run          COMMAND : run command before the executable
-# --add-flags    ARGS    : prepend ARGS to the invocation of the executable
+# --add-flag     ARG     : prepend the single argument ARG to the invocation of the executable
 #                          (that is, *before* any arguments passed on the command line)
-# --append-flags ARGS    : append ARGS to the invocation of the executable
+# --append-flag  ARG     : append the single argument ARG to the invocation of the executable
 #                          (that is, *after* any arguments passed on the command line)
+# --add-flags    ARGS    : prepend ARGS verbatim to the Bash-interpreted invocation of the executable
+# --append-flags ARGS    : append ARGS verbatim to the Bash-interpreted invocation of the executable

 # --prefix          ENV SEP VAL   : suffix/prefix ENV with VAL, separated by SEP
 # --suffix
@@ -164,6 +166,14 @@ makeShellWrapper() {
                contents="$(cat "$fileName")"
                addValue "$p" "$varName" "$separator" "$contents"
            done
+        elif [[ "$p" == "--add-flag" ]]; then
+            flags=${params[n + 1]@Q}
+            n=$((n + 1))
+            flagsBefore="${flagsBefore-} $flags"
+        elif [[ "$p" == "--append-flag" ]]; then
+            flags=${params[n + 1]@Q}
+            n=$((n + 1))
+            flagsAfter="${flagsAfter-} $flags"
        elif [[ "$p" == "--add-flags" ]]; then
            flags="${params[$((n + 1))]}"
            n=$((n + 1))
@@ -14,11 +14,11 @@

 stdenv.mkDerivation rec {
  pname = "adwaita-icon-theme";
-  version = "47.0";
+  version = "48.0";

  src = fetchurl {
    url = "mirror://gnome/sources/adwaita-icon-theme/${lib.versions.major version}/adwaita-icon-theme-${version}.tar.xz";
-    hash = "sha256-rQiKIpWMuEaeQdnxu6Dvsn5YaiECITzYnMJtsuACvf4=";
+    hash = "sha256-hHBoiIZQ2WcxFb5tvyv9wxpGrrxSimqdtEIOYOZWuNQ=";
  };

  nativeBuildInputs = [
@@ -8,7 +8,7 @@
  makeDesktopItem,
  glib,
  libsecret,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
 }:

 stdenv.mkDerivation rec {
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
        --prefix LD_LIBRARY_PATH : ${
          lib.makeLibraryPath [
            glib
-            webkitgtk_4_0
+            webkitgtk_4_1
          ]
        } \
        --run "mkdir -p /tmp/SWT-GDBusServer"
@@ -20,7 +20,7 @@
  poppler,
  stdenv,
  testers,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
  wrapGAppsHook3,
 }:

@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
    libxshmfence # otherwise warnings in compilation
    pcre
    poppler
-    webkitgtk_4_0
+    webkitgtk_4_1
  ];

  installPhase = ''
@@ -7,7 +7,7 @@
  jdk,
  libsecret,
  glib,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
  wrapGAppsHook3,
  _7zz,
  nixosTests,
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
          --prefix LD_LIBRARY_PATH : ${
            lib.makeLibraryPath ([
              glib
-              webkitgtk_4_0
+              webkitgtk_4_1
            ])
          } \
          --set WEBKIT_DISABLE_DMABUF_RENDERER 1 \
@@ -17,22 +17,25 @@
  wayland,
  wrapGAppsHook4,
  desktop-file-utils,
+  gitUpdater,
+  common-updater-scripts,
+  _experimental-update-script-combinators,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "ashpd-demo";
-  version = "0.4.1";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "bilelmoussaoui";
    repo = "ashpd";
    rev = "${finalAttrs.version}-demo";
-    hash = "sha256-fIyJEUcyTcjTbBycjuJb99wALQelMT7Zq6PHKcL2F80=";
+    hash = "sha256-0IGqA8PM6I2p4/MrptkdSWIZThMoeaMsdMc6tVTI2MU=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    src = "${finalAttrs.src}/ashpd-demo";
-    hash = "sha256-iluV24uSEHDcYi6pO2HNrKs4ShwFvZ/ryv8ioopaNMI=";
+    hash = "sha256-kUEzVBk8dKXCQdHFJJS633CBG1F57TIxJg1xApMwzbI=";
  };

  nativeBuildInputs = [
@@ -63,6 +66,37 @@ stdenv.mkDerivation (finalAttrs: {
    cd ashpd-demo
  '';

+  passthru = {
+    updateScript =
+      let
+        updateSource = gitUpdater {
+          url = finalAttrs.src.gitRepoUrl;
+          rev-suffix = "-demo";
+        };
+
+        updateLockfile = {
+          command = [
+            "sh"
+            "-c"
+            ''
+              PATH=${
+                lib.makeBinPath [
+                  common-updater-scripts
+                ]
+              }
+              update-source-version ashpd-demo --ignore-same-version --source-key=cargoDeps.vendorStaging > /dev/null
+            ''
+          ];
+          # Experimental feature: do not copy!
+          supportedFeatures = [ "silent" ];
+        };
+      in
+      _experimental-update-script-combinators.sequence [
+        updateSource
+        updateLockfile
+      ];
+  };
+
  meta = with lib; {
    description = "Tool for playing with XDG desktop portals";
    mainProgram = "ashpd-demo";
@@ -27,7 +27,7 @@

 stdenv.mkDerivation rec {
  pname = "at-spi2-core";
-  version = "2.54.1";
+  version = "2.56.2";

  outputs = [
    "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor version}/at-spi2-core-${version}.tar.xz";
-    hash = "sha256-8HKeXIdl/rGWm7bB+6GK+iWCEmsDWap1oXP9oaz5PEw=";
+    hash = "sha256-4bHJg2qJR4UvdEDDLiMXkjTHa9mM2cxAAfN2QF+LeDs=";
  };

  nativeBuildInputs =
@@ -10,26 +10,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "atf";
-  version = "0.22";
+  version = "0.23";

  src = fetchFromGitHub {
    owner = "freebsd";
    repo = "atf";
    tag = "atf-${finalAttrs.version}";
-    hash = "sha256-vZfBk/lH+04d3NbTUYjAaxwGFHtnagl/kY04hgkE4Iw=";
+    hash = "sha256-g9cXeiCaiyGQXtg6eyrbRQpqk4VLGSFuhfPB+ynbDIo=";
  };

-  patches = [
-    # https://github.com/freebsd/atf/issues/88
-    # https://github.com/freebsd/atf/pull/85
-    # Maintainer say it fix some tests in issue 88.
-    ./pr-85.patch
-    (fetchpatch {
-      url = "https://github.com/freebsd/atf/commit/b42c98612cb99fa3f52766a46203263dc1de7187.patch?full_index=1";
-      hash = "sha256-goDPIdIF8vHXDengVIYbxw5W/JT5kfsG5japgtranas=";
-    })
-  ];
-
  postPatch =
    lib.optionalString finalAttrs.doInstallCheck ''
      # Can’t find `c_helpers` in the work folder.
@@ -19,11 +19,11 @@

 stdenv.mkDerivation rec {
  pname = "baobab";
-  version = "47.0";
+  version = "48.0";

  src = fetchurl {
    url = "mirror://gnome/sources/baobab/${lib.versions.major version}/baobab-${version}.tar.xz";
-    hash = "sha256-uI90+cBS08I4j3Bi0ijPXpJ1Raz3QIxWhB34DM0fnDc=";
+    hash = "sha256-VFklBNSdgH8jWRvn5+7xDGyd/LesUnuBw6zVh4eyb9o=";
  };

  nativeBuildInputs = [
@@ -28,7 +28,7 @@
  xcbutilkeysyms,
  xcb-util-cursor,
  gtk3,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
  python3,
  curl,
  pcre,
@@ -107,7 +107,7 @@ stdenv.mkDerivation (finalAttrs: {
      libXScrnSaver
      curl
      gtk3
-      webkitgtk_4_0
+      webkitgtk_4_1
      freetype
      libGL
      libusb1
@@ -23,7 +23,7 @@ let
    lib.concatStringsSep "\n\n" extraCertificateStrings
  );

-  srcVersion = "3.108";
+  srcVersion = "3.111";
  version = if nssOverride != null then nssOverride.version else srcVersion;
  meta = with lib; {
    homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -47,7 +47,7 @@ let
          owner = "nss-dev";
          repo = "nss";
          rev = "NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM";
-          hash = "sha256-L2XRj3D8SsS2QYQFDLwGtaPoZ7tN4kz8hGdVKefFSu8=";
+          hash = "sha256-GFtoSvLF5nAwBIiMa9CeEl5geAOK60gG2tjuQFubgYs=";
        };

    dontBuild = true;
@@ -55,7 +55,7 @@
  enablePluginClamd ? true,
  enablePluginDillo ? true,
  enablePluginFancy ? true,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
  enablePluginFetchInfo ? true,
  enablePluginKeywordWarner ? true,
  enablePluginLibravatar ? enablePluginRavatar,
@@ -147,7 +147,7 @@ let
    {
      flags = [ "fancy-plugin" ];
      enabled = enablePluginFancy;
-      deps = [ webkitgtk_4_0 ];
+      deps = [ webkitgtk_4_1 ];
    }
    {
      flags = [ "fetchinfo-plugin" ];
@@ -0,0 +1,13 @@
+diff --git a/Source/cmCurl.cxx b/Source/cmCurl.cxx
+index b9133ed7d47b9023de66a94ed5ff15a0f1ba440c..0cf8a71a72daaa07cb42b3f5eef81d2d04300cd6 100644
+--- a/Source/cmCurl.cxx
+++ b/Source/cmCurl.cxx
+@@ -170,7 +170,7 @@ std::string cmCurlSetNETRCOption(::CURL* curl, const std::string& netrc_level,
+                                  const std::string& netrc_file)
+ {
+   std::string e;
+-  CURL_NETRC_OPTION curl_netrc_level = CURL_NETRC_LAST;
+  long curl_netrc_level = CURL_NETRC_LAST;
+   ::CURLcode res;
+ 
+   if (!netrc_level.empty()) {
@@ -76,6 +76,8 @@ stdenv.mkDerivation (finalAttrs: {
      # Backport of https://gitlab.kitware.com/cmake/cmake/-/merge_requests/9900
      # Needed to correctly link curl in pkgsStatic.
      ./008-FindCURL-Add-more-target-properties-from-pkg-config.diff
+      # Backport of https://gitlab.kitware.com/cmake/cmake/-/commit/1b0c92a3a1b782ff3e1c4499b6ab8db614d45bcd
+      ./009-cmCurl-Avoid-using-undocumented-type-for-CURLOPT_NETRC-values.diff
    ];

  outputs =
@@ -0,0 +1,155 @@
+From 5fbd78eb2dc4afbd8884e8eed27147fc3d4318f6 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Fri, 4 Apr 2025 10:43:13 +0200
+Subject: [PATCH] http2: fix stream window size after unpausing
+
+When pausing a HTTP/2 transfer, the stream's local window size
+is reduced to 0 to prevent the server from sending further data
+which curl cannot write out to the application.
+
+When unpausing again, the stream's window size was not correctly
+increased again. The attempt to trigger a window update was
+ignored by nghttp2, the server never received it and the transfer
+stalled.
+
+Add a debug feature to allow use of small window sizes which
+reproduces this bug in test_02_21.
+
+Fixes #16955
+Closes #16960
+---
+ docs/libcurl/libcurl-env-dbg.md |  5 +++++
+ lib/http2.c                     | 31 +++++++++++++++++++++++++++++++
+ tests/http/test_02_download.py  | 27 +++++++++++++++++++++++++--
+ 3 files changed, 61 insertions(+), 2 deletions(-)
+
+diff --git a/docs/libcurl/libcurl-env-dbg.md b/docs/libcurl/libcurl-env-dbg.md
+index 471533625f6b..60c887bfd5a9 100644
+--- a/docs/libcurl/libcurl-env-dbg.md
+++ b/docs/libcurl/libcurl-env-dbg.md
+@@ -147,3 +147,8 @@ Make a blocking, graceful shutdown of all remaining connections when
+ a multi handle is destroyed. This implicitly triggers for easy handles
+ that are run via easy_perform. The value of the environment variable
+ gives the shutdown timeout in milliseconds.
+
+## `CURL_H2_STREAM_WIN_MAX`
+
+Set to a positive 32-bit number to override the HTTP/2 stream window's
+default of 10MB. Used in testing to verify correct window update handling.
+diff --git a/lib/http2.c b/lib/http2.c
+index 88fbcceb7135..a1221dcc51de 100644
+--- a/lib/http2.c
+++ b/lib/http2.c
+@@ -44,6 +44,7 @@
+ #include "connect.h"
+ #include "rand.h"
+ #include "strdup.h"
+#include "strparse.h"
+ #include "transfer.h"
+ #include "dynbuf.h"
+ #include "headers.h"
+@@ -141,6 +142,9 @@ struct cf_h2_ctx {
+   uint32_t goaway_error;        /* goaway error code from server */
+   int32_t remote_max_sid;       /* max id processed by server */
+   int32_t local_max_sid;        /* max id processed by us */
+#ifdef DEBUGBUILD
+  int32_t stream_win_max;       /* max h2 stream window size */
+#endif
+   BIT(initialized);
+   BIT(via_h1_upgrade);
+   BIT(conn_closed);
+@@ -166,6 +170,18 @@ static void cf_h2_ctx_init(struct cf_h2_ctx *ctx, bool via_h1_upgrade)
+   Curl_hash_offt_init(&ctx->streams, 63, h2_stream_hash_free);
+   ctx->remote_max_sid = 2147483647;
+   ctx->via_h1_upgrade = via_h1_upgrade;
+#ifdef DEBUGBUILD
+  {
+    const char *p = getenv("CURL_H2_STREAM_WIN_MAX");
+
+    ctx->stream_win_max = H2_STREAM_WINDOW_SIZE_MAX;
+    if(p) {
+      curl_off_t l;
+      if(!Curl_str_number(&p, &l, INT_MAX))
+        ctx->stream_win_max = (int32_t)l;
+    }
+  }
+#endif
+   ctx->initialized = TRUE;
+ }
+ 
+@@ -285,7 +301,15 @@ static int32_t cf_h2_get_desired_local_win(struct Curl_cfilter *cf,
+      * This gets less precise the higher the latency. */
+     return (int32_t)data->set.max_recv_speed;
+   }
+#ifdef DEBUGBUILD
+  else {
+    struct cf_h2_ctx *ctx = cf->ctx;
+    CURL_TRC_CF(data, cf, "stream_win_max=%d", ctx->stream_win_max);
+    return ctx->stream_win_max;
+  }
+#else
+   return H2_STREAM_WINDOW_SIZE_MAX;
+#endif
+ }
+ 
+ static CURLcode cf_h2_update_local_win(struct Curl_cfilter *cf,
+@@ -302,6 +326,13 @@ static CURLcode cf_h2_update_local_win(struct Curl_cfilter *cf,
+     int32_t wsize = nghttp2_session_get_stream_effective_local_window_size(
+                       ctx->h2, stream->id);
+     if(dwsize > wsize) {
+      rv = nghttp2_session_set_local_window_size(ctx->h2, NGHTTP2_FLAG_NONE,
+                                                 stream->id, dwsize);
+      if(rv) {
+        failf(data, "[%d] nghttp2 set_local_window_size(%d) failed: "
+              "%s(%d)", stream->id, dwsize, nghttp2_strerror(rv), rv);
+        return CURLE_HTTP2;
+      }
+       rv = nghttp2_submit_window_update(ctx->h2, NGHTTP2_FLAG_NONE,
+                                         stream->id, dwsize - wsize);
+       if(rv) {
+diff --git a/tests/http/test_02_download.py b/tests/http/test_02_download.py
+index 4b9ae3caefab..b55f022338ad 100644
+--- a/tests/http/test_02_download.py
+++ b/tests/http/test_02_download.py
+@@ -313,9 +313,9 @@ def test_02_20_h2_small_frames(self, env: Env, httpd):
+         assert httpd.stop()
+         assert httpd.start()
+ 
+-    # download via lib client, 1 at a time, pause/resume at different offsets
+    # download serial via lib client, pause/resume at different offsets
+     @pytest.mark.parametrize("pause_offset", [0, 10*1024, 100*1023, 640000])
+-    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
+    @pytest.mark.parametrize("proto", ['http/1.1', 'h3'])
+     def test_02_21_lib_serial(self, env: Env, httpd, nghttpx, proto, pause_offset):
+         if proto == 'h3' and not env.have_h3():
+             pytest.skip("h3 not supported")
+@@ -332,6 +332,29 @@ def test_02_21_lib_serial(self, env: Env, httpd, nghttpx, proto, pause_offset):
+         srcfile = os.path.join(httpd.docs_dir, docname)
+         self.check_downloads(client, srcfile, count)
+ 
+    # h2 download parallel via lib client, pause/resume at different offsets
+    # debug-override stream window size to reproduce #16955
+    @pytest.mark.parametrize("pause_offset", [0, 10*1024, 100*1023, 640000])
+    @pytest.mark.parametrize("swin_max", [0, 10*1024])
+    def test_02_21_h2_lib_serial(self, env: Env, httpd, pause_offset, swin_max):
+        proto = 'h2'
+        count = 2
+        docname = 'data-10m'
+        url = f'https://localhost:{env.https_port}/{docname}'
+        run_env = os.environ.copy()
+        run_env['CURL_DEBUG'] = 'multi,http/2'
+        if swin_max > 0:
+            run_env['CURL_H2_STREAM_WIN_MAX'] = f'{swin_max}'
+        client = LocalClient(name='hx-download', env=env, run_env=run_env)
+        if not client.exists():
+            pytest.skip(f'example client not built: {client.name}')
+        r = client.run(args=[
+             '-n', f'{count}', '-P', f'{pause_offset}', '-V', proto, url
+        ])
+        r.check_exit_code(0)
+        srcfile = os.path.join(httpd.docs_dir, docname)
+        self.check_downloads(client, srcfile, count)
+
+     # download via lib client, several at a time, pause/resume
+     @pytest.mark.parametrize("pause_offset", [100*1023])
+     @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
@@ -91,7 +91,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "curl";
-  version = "8.12.1";
+  version = "8.13.0";

  src = fetchurl {
    urls = [
@@ -100,9 +100,14 @@ stdenv.mkDerivation (finalAttrs: {
        builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
      }/curl-${finalAttrs.version}.tar.xz"
    ];
-    hash = "sha256-A0Hx7ZeibIEauuvTfWK4M5VnkrdgfqPxXQAWE8dt4gI=";
+    hash = "sha256-Sgk5eaPC0C3i+8AFSaMncQB/LngDLG+qXs0vep4VICU=";
  };

+  patches = [
+    # Backport of https://github.com/curl/curl/commit/5fbd78eb2dc4afbd8884e8eed27147fc3d4318f6
+    ./0001-http2-fix-stream-window-size-after-unpausing.patch
+  ];
+
  # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
  # necessary for FreeBSD code path in configure
  postPatch = ''
@@ -14,19 +14,18 @@
  gnome,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "d-spy";
-  version = "47.0";
+  version = "48.0";

  outputs = [
    "out"
-    "lib"
    "dev"
  ];

  src = fetchurl {
-    url = "mirror://gnome/sources/d-spy/${lib.versions.major version}/d-spy-${version}.tar.xz";
-    hash = "sha256-7/sw1DKtXkPmxEm9+OMX2il+VuAnQW5z4ulsTPGPaeg=";
+    url = "mirror://gnome/sources/d-spy/${lib.versions.major finalAttrs.version}/d-spy-${finalAttrs.version}.tar.xz";
+    hash = "sha256-D3oJAZBGGU2X/Dw0KzhOocOA4Qqc/IAlv83lfVlcODA=";
  };

  nativeBuildInputs = [
@@ -55,11 +54,8 @@ stdenv.mkDerivation rec {
    description = "D-Bus exploration tool";
    mainProgram = "d-spy";
    homepage = "https://gitlab.gnome.org/GNOME/d-spy";
-    license = with licenses; [
-      lgpl3Plus # library
-      gpl3Plus # app
-    ];
+    license = licenses.gpl3Plus;
    teams = [ teams.gnome ];
    platforms = platforms.linux;
  };
-}
+})
@@ -10,7 +10,7 @@
  wrapGAppsHook3,
  gtk3,
  glib,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
  glib-networking,
  override_xmx ? "1024m",
 }:
@@ -83,7 +83,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
            lib.makeLibraryPath [
              gtk3
              glib
-              webkitgtk_4_0
+              webkitgtk_4_1
              glib-networking
            ]
          }"
@@ -1,7 +1,7 @@
 {
  lib,
  stdenv,
-  fetchFromGitLab,
+  fetchurl,
  appstream,
  blueprint-compiler,
  desktop-file-utils,
@@ -13,20 +13,15 @@
  pkg-config,
  typescript,
  wrapGAppsHook4,
-  nix-update-script,
+  gnome,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "decibels";
  version = "48.0";

-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    group = "GNOME";
-    owner = "Incubator";
-    repo = "decibels";
-    tag = version;
-    hash = "sha256-qtKiKfcxGLuV1bE3lb7l4s+reZRJXcjlV35M8eZmvHc=";
-    fetchSubmodules = true;
+  src = fetchurl {
+    url = "mirror://gnome/sources/decibels/${lib.versions.major finalAttrs.version}/decibels-${finalAttrs.version}.tar.xz";
+    hash = "sha256-IpsRqSYxR7y4w+If8NSvZZ+yYmL4rs5Uetz4xl4DH3Q=";
  };

  nativeBuildInputs = [
@@ -60,16 +55,21 @@ stdenv.mkDerivation rec {
  '';

  passthru = {
-    updateScript = nix-update-script { };
+    updateScript = gnome.updateScript {
+      packageName = "decibels";
+    };
  };

  meta = {
    description = "Play audio files";
-    homepage = "https://gitlab.gnome.org/GNOME/Incubator/decibels";
-    changelog = "https://gitlab.gnome.org/GNOME/decibels/-/blob/${version}/NEWS?ref_type=tags";
+    homepage = "https://gitlab.gnome.org/GNOME/decibels";
+    changelog = "https://gitlab.gnome.org/GNOME/decibels/-/blob/${finalAttrs.version}/NEWS?ref_type=tags";
    license = lib.licenses.gpl3Only;
-    teams = [ lib.teams.gnome-circle ];
+    teams = [
+      lib.teams.gnome
+      lib.teams.gnome-circle
+    ];
    mainProgram = "org.gnome.Decibels";
    platforms = lib.platforms.linux;
  };
-}
+})
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
  # writes its output to stdout instead of creating a file.
  patches = [ ./db2x_texixml-to-stdout.patch ];

-  strictDpes = true;
+  strictDeps = true;
  nativeBuildInputs = [
    makeWrapper
    perlPackages.perl
@@ -46,6 +46,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    cmake
+    extra-cmake-modules
    ninja
    pkg-config
    qttools
@@ -57,7 +58,6 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
    SDL2
    cpuinfo
    curl
-    extra-cmake-modules
    libXrandr
    libbacktrace
    libwebp
@@ -1,10 +0,0 @@
-prefix=@out@
-exec_prefix=${prefix}
-libdir=${exec_prefix}/lib
-includedir=${prefix}/include
-
-Name: duktape
-Description: An embeddable Javascript engine, with a focus on portability and compact footprint
-Version: @version@
-Libs: -L${libdir} -lduktape
-Cflags: -I${includedir}
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
      make -f Makefile.cmdline
    ''
    + lib.optionalString (!stdenv.hostPlatform.isStatic) ''
-      make -f Makefile.sharedlibrary
+      make INSTALL_PREFIX="$out" -f Makefile.sharedlibrary
    '';

  installPhase =
@@ -37,8 +37,8 @@ stdenv.mkDerivation (finalAttrs: {
    + lib.optionalString (!stdenv.hostPlatform.isStatic) ''
      install -d $out/lib/pkgconfig
      install -d $out/include
-      make -f Makefile.sharedlibrary install INSTALL_PREFIX=$out
-      substituteAll ${./duktape.pc.in} $out/lib/pkgconfig/duktape.pc
+
+      make INSTALL_PREFIX="$out" -f Makefile.sharedlibrary install
    '';

  enableParallelBuilding = true;
@@ -15,7 +15,7 @@
  shared-mime-info,
  stdenv,
  unzip,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
  zlib,
 }:

@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
          glib
          gtk3
          libXtst
-          webkitgtk_4_0
+          webkitgtk_4_1
        ])
      } \
      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
@@ -108,7 +108,7 @@ stdenv.mkDerivation rec {
    libXtst
    zlib
    shared-mime-info
-    webkitgtk_4_0
+    webkitgtk_4_1
  ];

  dontBuild = true;
@@ -11,7 +11,7 @@

 stdenv.mkDerivation rec {
  pname = "ell";
-  version = "0.73";
+  version = "0.76";

  outputs = [
    "out"
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
  src = fetchgit {
    url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
    rev = version;
-    hash = "sha256-pwAlRh+rkfPA6dXOGZcIidyCD2ioxVPSJjnyvrWuwow=";
+    hash = "sha256-LSTmcVBKI+EpDiTpiKFEeIIXIXc6C5gOYn5zf7sHe/I=";
  };

  nativeBuildInputs = [
@@ -2,7 +2,7 @@
  lib,
  flutter324,
  fetchFromGitHub,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
  sqlite,
  libayatana-appindicator,
  makeDesktopItem,
@@ -49,7 +49,7 @@ flutter324.buildFlutterApplication rec {
  ];

  buildInputs = [
-    webkitgtk_4_0
+    webkitgtk_4_1
    sqlite
    libayatana-appindicator
    # The networking client used by ente-auth (native_dio_adapter)
@@ -37,11 +37,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "epiphany";
-  version = "47.3.1";
+  version = "48.3";

  src = fetchurl {
    url = "mirror://gnome/sources/epiphany/${lib.versions.major finalAttrs.version}/epiphany-${finalAttrs.version}.tar.xz";
-    hash = "sha256-eV17gfGLdIfZ6b/Ayy1oqJPSIA9F+Tl81CyzOSsggak=";
+    hash = "sha256-2ilT5+K3O/dHPAozl5EE15NieVKV6qCio46hiFN9rxM=";
  };

  nativeBuildInputs = [
@@ -42,7 +42,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "evince";
-  version = "46.3.1";
+  version = "48.0";

  outputs = [
    "out"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/evince/${lib.versions.major finalAttrs.version}/evince-${finalAttrs.version}.tar.xz";
-    hash = "sha256-lFwgpvI4ObDVMycpFxRY6QaA2oJk6Zxvn0HCGcfu7nw=";
+    hash = "sha256-zS9lg1X6kHX9+eW0SqCvOn4JKMVWFOsQQrNhds9FESY=";
  };

  depsBuildBuild = [
@@ -66,10 +66,10 @@ index 5e65ec8..2cae29d 100644
 	g_mutex_unlock (&mutex);
 
 diff --git a/src/addressbook/libebook/e-book.c b/src/addressbook/libebook/e-book.c
-index e85a56b..59d3fe2 100644
+index a9b68e3..6a13b1b 100644
 --- a/src/addressbook/libebook/e-book.c
 +++ b/src/addressbook/libebook/e-book.c
-@@ -2587,7 +2587,18 @@ e_book_get_self (ESourceRegistry *registry,
+@@ -2586,7 +2586,18 @@ e_book_get_self (ESourceRegistry *registry,
 		return FALSE;
 	}
 
@@ -89,7 +89,7 @@ index e85a56b..59d3fe2 100644
 	uid = g_settings_get_string (settings, SELF_UID_KEY);
 	g_object_unref (settings);
 
-@@ -2642,7 +2653,18 @@ e_book_set_self (EBook *book,
+@@ -2641,7 +2652,18 @@ e_book_set_self (EBook *book,
 	g_return_val_if_fail (E_IS_BOOK (book), FALSE);
 	g_return_val_if_fail (E_IS_CONTACT (contact), FALSE);
 
@@ -109,7 +109,7 @@ index e85a56b..59d3fe2 100644
 	g_settings_set_string (
 		settings, SELF_UID_KEY,
 		e_contact_get_const (contact, E_CONTACT_UID));
-@@ -2670,7 +2692,18 @@ e_book_is_self (EContact *contact)
+@@ -2669,7 +2691,18 @@ e_book_is_self (EContact *contact)
 
 	g_return_val_if_fail (E_IS_CONTACT (contact), FALSE);
 
@@ -130,10 +130,10 @@ index e85a56b..59d3fe2 100644
 	g_object_unref (settings);
 
 diff --git a/src/addressbook/libedata-book/e-book-meta-backend.c b/src/addressbook/libedata-book/e-book-meta-backend.c
-index 3ab8908..6c4b210 100644
+index 752f83f..eaa3dad 100644
 --- a/src/addressbook/libedata-book/e-book-meta-backend.c
 +++ b/src/addressbook/libedata-book/e-book-meta-backend.c
-@@ -146,7 +146,18 @@ ebmb_is_power_saver_enabled (void)
+@@ -145,7 +145,18 @@ ebmb_is_power_saver_enabled (void)
 	GSettings *settings;
 	gboolean enabled = FALSE;
 
@@ -154,10 +154,10 @@ index 3ab8908..6c4b210 100644
 	if (g_settings_get_boolean (settings, "limit-operations-in-power-saver-mode")) {
 		GPowerProfileMonitor *power_monitor;
 diff --git a/src/calendar/backends/contacts/e-cal-backend-contacts.c b/src/calendar/backends/contacts/e-cal-backend-contacts.c
-index 047fb97..960f44c 100644
+index 9f8646a..079aba9 100644
 --- a/src/calendar/backends/contacts/e-cal-backend-contacts.c
 +++ b/src/calendar/backends/contacts/e-cal-backend-contacts.c
-@@ -1333,7 +1333,18 @@ e_cal_backend_contacts_init (ECalBackendContacts *cbc)
+@@ -1338,7 +1338,18 @@ e_cal_backend_contacts_init (ECalBackendContacts *cbc)
 		(GDestroyNotify) g_free,
 		(GDestroyNotify) contact_record_free);
 
@@ -204,10 +204,10 @@ index 2525856..7ecc1a8 100644
 				g_clear_object (&settings);
 			}
 diff --git a/src/calendar/libecal/e-reminder-watcher.c b/src/calendar/libecal/e-reminder-watcher.c
-index a83d3d3..dc7acac 100644
+index 026ae80..e3003c2 100644
 --- a/src/calendar/libecal/e-reminder-watcher.c
 +++ b/src/calendar/libecal/e-reminder-watcher.c
-@@ -2826,8 +2826,33 @@ e_reminder_watcher_init (EReminderWatcher *watcher)
+@@ -2844,8 +2844,33 @@ e_reminder_watcher_init (EReminderWatcher *watcher)
 
 	watcher->priv = e_reminder_watcher_get_instance_private (watcher);
 	watcher->priv->cancellable = g_cancellable_new ();
@@ -244,10 +244,10 @@ index a83d3d3..dc7acac 100644
 		g_signal_connect_object (
 			watcher->priv->desktop_settings,
 diff --git a/src/calendar/libedata-cal/e-cal-meta-backend.c b/src/calendar/libedata-cal/e-cal-meta-backend.c
-index f19ab22..abd3263 100644
+index 84ccbb0..9010429 100644
 --- a/src/calendar/libedata-cal/e-cal-meta-backend.c
 +++ b/src/calendar/libedata-cal/e-cal-meta-backend.c
-@@ -158,7 +158,18 @@ ecmb_is_power_saver_enabled (void)
+@@ -157,7 +157,18 @@ ecmb_is_power_saver_enabled (void)
 	GSettings *settings;
 	gboolean enabled = FALSE;
 
@@ -267,7 +267,7 @@ index f19ab22..abd3263 100644
 
 	if (g_settings_get_boolean (settings, "limit-operations-in-power-saver-mode")) {
 		GPowerProfileMonitor *power_monitor;
-@@ -2629,7 +2640,20 @@ ecmb_receive_object_sync (ECalMetaBackend *meta_backend,
+@@ -2628,7 +2639,20 @@ ecmb_receive_object_sync (ECalMetaBackend *meta_backend,
 			if (is_declined) {
 				GSettings *settings;
 
@@ -290,10 +290,10 @@ index f19ab22..abd3263 100644
 				g_clear_object (&settings);
 			}
 diff --git a/src/camel/camel-cipher-context.c b/src/camel/camel-cipher-context.c
-index d5a0823..2ae03f8 100644
+index d00fbd5..0f67653 100644
 --- a/src/camel/camel-cipher-context.c
 +++ b/src/camel/camel-cipher-context.c
-@@ -1631,7 +1631,18 @@ camel_cipher_can_load_photos (void)
+@@ -1630,7 +1630,18 @@ camel_cipher_can_load_photos (void)
 	GSettings *settings;
 	gboolean load_photos;
 
@@ -314,10 +314,10 @@ index d5a0823..2ae03f8 100644
 	g_clear_object (&settings);
 
 diff --git a/src/camel/camel-gpg-context.c b/src/camel/camel-gpg-context.c
-index 4c10de7..6c0ab5e 100644
+index 4594ab1..e71ce05 100644
 --- a/src/camel/camel-gpg-context.c
 +++ b/src/camel/camel-gpg-context.c
-@@ -744,7 +744,18 @@ gpg_ctx_get_executable_name (void)
+@@ -745,7 +745,18 @@ gpg_ctx_get_executable_name (void)
 		GSettings *settings;
 		gchar *path;
 
@@ -338,10 +338,10 @@ index 4c10de7..6c0ab5e 100644
 		g_clear_object (&settings);
 
 diff --git a/src/camel/camel-utils.c b/src/camel/camel-utils.c
-index e61160c..b6553a4 100644
+index 0c1c7dd..4188934 100644
 --- a/src/camel/camel-utils.c
 +++ b/src/camel/camel-utils.c
-@@ -362,7 +362,19 @@ void
+@@ -361,7 +361,19 @@ void
 _camel_utils_initialize (void)
 {
 	G_LOCK (mi_user_headers);
@@ -363,10 +363,10 @@ index e61160c..b6553a4 100644
 		G_CALLBACK (mi_user_headers_settings_changed_cb), NULL);
 	G_UNLOCK (mi_user_headers);
 diff --git a/src/camel/providers/imapx/camel-imapx-server.c b/src/camel/providers/imapx/camel-imapx-server.c
-index 396cf39..e31dc1a 100644
+index 8cf56f0..f4355d5 100644
 --- a/src/camel/providers/imapx/camel-imapx-server.c
 +++ b/src/camel/providers/imapx/camel-imapx-server.c
-@@ -5682,7 +5682,18 @@ camel_imapx_server_do_old_flags_update (CamelFolder *folder)
+@@ -5681,7 +5681,18 @@ camel_imapx_server_do_old_flags_update (CamelFolder *folder)
 	if (do_old_flags_update) {
 		GSettings *eds_settings;
 
@@ -387,10 +387,10 @@ index 396cf39..e31dc1a 100644
 		if (g_settings_get_boolean (eds_settings, "limit-operations-in-power-saver-mode")) {
 			GPowerProfileMonitor *power_monitor;
 diff --git a/src/camel/providers/smtp/camel-smtp-transport.c b/src/camel/providers/smtp/camel-smtp-transport.c
-index 38bedb6..f799c29 100644
+index f7c5d3c..67732c3 100644
 --- a/src/camel/providers/smtp/camel-smtp-transport.c
 +++ b/src/camel/providers/smtp/camel-smtp-transport.c
-@@ -1472,7 +1472,18 @@ smtp_helo (CamelSmtpTransport *transport,
+@@ -1471,7 +1471,18 @@ smtp_helo (CamelSmtpTransport *transport,
 		transport->authtypes = NULL;
 	}
 
@@ -507,10 +507,10 @@ index 3738359..f9ce2d9 100644
 		g_object_unref (settings);
 
 diff --git a/src/libedataserver/e-oauth2-service.c b/src/libedataserver/e-oauth2-service.c
-index 29c1dd2..84d42b7 100644
+index db775f9..fb524db 100644
 --- a/src/libedataserver/e-oauth2-service.c
 +++ b/src/libedataserver/e-oauth2-service.c
-@@ -94,7 +94,18 @@ eos_default_guess_can_process (EOAuth2Service *service,
+@@ -93,7 +93,18 @@ eos_default_guess_can_process (EOAuth2Service *service,
 	name_len = strlen (name);
 	hostname_len = strlen (hostname);
 
@@ -556,10 +556,10 @@ index 1539f8b..77cf123 100644
 	g_signal_connect (
 		registry->priv->settings, "changed",
 diff --git a/src/libedataserverui/e-reminders-widget.c b/src/libedataserverui/e-reminders-widget.c
-index 14b6481..7149b74 100644
+index b47a374..e812fbe 100644
 --- a/src/libedataserverui/e-reminders-widget.c
 +++ b/src/libedataserverui/e-reminders-widget.c
-@@ -1986,7 +1986,19 @@ static void
+@@ -1985,7 +1985,19 @@ static void
 e_reminders_widget_init (ERemindersWidget *reminders)
 {
 	reminders->priv = e_reminders_widget_get_instance_private (reminders);
@@ -51,7 +51,7 @@

 stdenv.mkDerivation rec {
  pname = "evolution-data-server";
-  version = "3.54.3";
+  version = "3.56.1";

  outputs = [
    "out"
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/evolution-data-server/${lib.versions.majorMinor version}/evolution-data-server-${version}.tar.xz";
-    hash = "sha256-UQjcOO5cwfjvkVXof2xBKflkRVCglixa4j/4B7V8uNA=";
+    hash = "sha256-ZGzAA32j+fKVeUxjfZU5StdvjJvuImi+LEGD4ncgwTc=";
  };

  patches = [
@@ -16,7 +16,7 @@
  librsvg,
  streamripper,
  udisks,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
  iconTheme ? adwaita-icon-theme,
  deviceDetectionSupport ? true,
  documentationSupport ? true,
@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
    ++ lib.optional multimediaKeySupport keybinder3
    ++ lib.optional (musicBrainzSupport || cdMetadataSupport) python3.pkgs.musicbrainzngs
    ++ lib.optional podcastSupport python3.pkgs.feedparser
-    ++ lib.optional wikipediaSupport webkitgtk_4_0;
+    ++ lib.optional wikipediaSupport webkitgtk_4_1;

  nativeCheckInputs = with python3.pkgs; [
    pytest
@@ -31,7 +31,6 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    extra-cmake-modules
    fcitx5
    fmt
    gtest
@@ -17,13 +17,13 @@
  vala,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "five-or-more";
-  version = "3.32.3";
+  version = "48.1";

  src = fetchurl {
-    url = "mirror://gnome/sources/five-or-more/${lib.versions.majorMinor version}/five-or-more-${version}.tar.xz";
-    hash = "sha256-LRDXLu/esyS0R9YyrwwySW4l/BWjwB230vAMm1HQnvQ=";
+    url = "mirror://gnome/sources/five-or-more/${lib.versions.major finalAttrs.version}/five-or-more-${finalAttrs.version}.tar.xz";
+    hash = "sha256-2UHOLjfqZsDYDx6BeX+8u+To72WnkLPMXla58QtepaM=";
  };

  nativeBuildInputs = [
@@ -50,7 +50,9 @@ stdenv.mkDerivation rec {
  '';

  passthru = {
-    updateScript = gnome.updateScript { packageName = "five-or-more"; };
+    updateScript = gnome.updateScript {
+      packageName = "five-or-more";
+    };
  };

  meta = with lib; {
@@ -61,4 +63,4 @@ stdenv.mkDerivation rec {
    license = licenses.gpl2;
    platforms = platforms.unix;
  };
-}
+})
@@ -10,8 +10,8 @@
  pkg-config,
  stdenv,
  versionCheckHook,
+  enableManpages ? !stdenv.buildPlatform.isRiscV64 && !stdenv.buildPlatform.isLoongArch64,
 }:
-
 stdenv.mkDerivation (finalAttrs: {
  pname = "flac";
  version = "1.5.0";
@@ -29,13 +29,18 @@ stdenv.mkDerivation (finalAttrs: {
    cmake
    doxygen
    graphviz
-    pandoc
    pkg-config
-  ];
+  ] ++ lib.optional enableManpages pandoc;

  buildInputs = [ libogg ];

-  cmakeFlags = lib.optionals (!stdenv.hostPlatform.isStatic) [ "-DBUILD_SHARED_LIBS=ON" ];
+  cmakeFlags =
+    lib.optionals (!stdenv.hostPlatform.isStatic) [
+      "-DBUILD_SHARED_LIBS=ON"
+    ]
+    ++ lib.optionals (!enableManpages) [
+      "-DINSTALL_MANPAGES=OFF"
+    ];

  CFLAGS = [
    "-O3"
@@ -46,13 +51,16 @@ stdenv.mkDerivation (finalAttrs: {
  patches = [ ./package.patch ];
  doCheck = true;

-  outputs = [
-    "bin"
-    "dev"
-    "doc"
-    "man"
-    "out"
-  ];
+  outputs =
+    [
+      "bin"
+      "dev"
+      "doc"
+      "out"
+    ]
+    ++ lib.optionals enableManpages [
+      "man"
+    ];

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
@@ -43,7 +43,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "gdm";
-  version = "47.0";
+  version = "48.0";

  outputs = [
    "out"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/gdm/${lib.versions.major finalAttrs.version}/gdm-${finalAttrs.version}.tar.xz";
-    hash = "sha256-xYWDJr+8yKzlgTUuK+RGItwOnlwoAchpD9Lu1QJgf4Q=";
+    hash = "sha256-G8Btr/CT7HteN+y0+S5do0dKGxugdu25FR7pZ9HDCt8=";
  };

  mesonFlags = [
@@ -22,7 +22,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ghex";
-  version = "46.2";
+  version = "48.alpha";

  outputs = [
    "out"
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/ghex/${lib.versions.major finalAttrs.version}/ghex-${finalAttrs.version}.tar.xz";
-    hash = "sha256-qPJ2o2OXpw0guGL/fGZCQ9nPKJHeub4G10Wk8axmHzE=";
+    hash = "sha256-QP7kmZfZGhkmYmEXDEi7hy+zBupB+2WnIVBghow73+I=";
  };

  nativeBuildInputs = [
@@ -64,13 +64,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "ghostscript${lib.optionalString x11Support "-with-X"}";
-  version = "10.05.0";
+  version = "10.05.1";

  src = fetchurl {
    url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs${
      lib.replaceStrings [ "." ] [ "" ] version
    }/ghostscript-${version}.tar.xz";
-    hash = "sha256-qsnE/fYYBadvYiABJzXBroMoE3iDFL/AQFXMDIlZuaM=";
+    hash = "sha256-IvK9yhXCiDDJcVzdxcKW6maJi/2rC2BKTgvP6wOvbK0=";
  };

  patches = [
@@ -9,7 +9,7 @@
  wrapGAppsHook4,
  gtk4,
  gdk-pixbuf,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
  gtksourceview5,
  glib-networking,
  libadwaita,
@@ -43,7 +43,7 @@ python3.pkgs.buildPythonApplication rec {
  buildInputs = [
    gtk4
    gdk-pixbuf
-    webkitgtk_4_0
+    webkitgtk_4_1
    gtksourceview5
    glib-networking
    libadwaita
@@ -8,6 +8,7 @@
  pkg-config,
  gnome,
  gtk3,
+  gtk4,
  atk,
  gobject-introspection,
  spidermonkey_128,
@@ -30,6 +31,7 @@
 let
  testDeps = [
    gtk3
+    gtk4
    atk
    pango.out
    gdk-pixbuf
@@ -39,7 +41,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gjs";
-  version = "1.82.1";
+  version = "1.84.2";

  outputs = [
    "out"
@@ -49,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/gjs/${lib.versions.majorMinor finalAttrs.version}/gjs-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+zmqVjZXbeDloRcfVqGlgl4r0aaZcvsSC6eL0Qm1aTw=";
+    hash = "sha256-NRQu3zRXBWNjACkew6fVg/FJaf8/rg/zD0qVseZ0AWY=";
  };

  patches = [
@@ -123,6 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
    ln -s $PWD/libgjs.so.0 $out/lib/libgjs.so.0
    ln -s $PWD/subprojects/gobject-introspection-tests/libgimarshallingtests.so $installedTests/libexec/installed-tests/gjs/libgimarshallingtests.so
    ln -s $PWD/subprojects/gobject-introspection-tests/libregress.so $installedTests/libexec/installed-tests/gjs/libregress.so
+    ln -s $PWD/subprojects/gobject-introspection-tests/libutility.so $installedTests/libexec/installed-tests/gjs/libutility.so
    ln -s $PWD/subprojects/gobject-introspection-tests/libwarnlib.so $installedTests/libexec/installed-tests/gjs/libwarnlib.so
    ln -s $PWD/installed-tests/js/libgjstesttools/libgjstesttools.so $installedTests/libexec/installed-tests/gjs/libgjstesttools.so
  '';
@@ -142,6 +145,8 @@ stdenv.mkDerivation (finalAttrs: {

  checkPhase = ''
    runHook preCheck
+    GTK_A11Y=none \
+    HOME=$(mktemp -d) \
    xvfb-run -s '-screen 0 800x600x24' \
      meson test --print-errorlogs
    runHook postCheck
@@ -75,7 +75,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "glib";
-  version = "2.82.5";
+  version = "2.84.1";

  outputs = [
    "bin"
@@ -88,7 +88,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    hash = "sha256-BcIDH5vfa1q6egbKhPC0rO0osZvxtQxqslzGdSd8vD8=";
+    hash = "sha256-K0vC7ElhGl/DX4asqFXy7QGW5p5TCSura7czlr8weJo=";
  };

  patches =
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "glslang";
-  version = "15.1.0";
+  version = "15.3.0";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "glslang";
    rev = version;
-    hash = "sha256-E1Zenf7XSGoozx4hxdOlMu+XZ6mJROSu7jIVYPWe3go=";
+    hash = "sha256-HwFP4KJuA+BMQVvBWV0BCRj9U5I3CLEU+5bBtde2f6w=";
  };

  outputs = [
@@ -1,17 +1,17 @@
 diff --git a/vendor/glycin/src/sandbox.rs b/vendor/glycin/src/sandbox.rs
-index 7d00b36..aa70dc7 100644
+index 08db832..4f44b21 100644
 --- a/vendor/glycin/src/sandbox.rs
 +++ b/vendor/glycin/src/sandbox.rs
-@@ -165,7 +165,7 @@ impl Sandbox {
+@@ -202,7 +202,7 @@ impl Sandbox {
 
-                 args.push(self.command);
+                 args.push(self.exec());
 
 -                ("bwrap".into(), args, Some(seccomp_memfd))
 +                ("@bwrap@".into(), args, Some(seccomp_memfd))
             }
             SandboxMechanism::FlatpakSpawn => {
                 let memory_limit = Self::memory_limit();
-@@ -233,8 +233,8 @@ impl Sandbox {
+@@ -299,8 +299,8 @@ impl Sandbox {
                 "/",
                 // Make /usr available as read only
                 "--ro-bind",
@@ -24,11 +24,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "glycin-loaders";
-  version = "1.1.6";
+  version = "1.2.1";

  src = fetchurl {
    url = "mirror://gnome/sources/glycin/${lib.versions.majorMinor finalAttrs.version}/glycin-${finalAttrs.version}.tar.xz";
-    hash = "sha256-2EzFaBTyKEEArTQ5pDCDe7IfD5jUbg0rWGifLBlwjwQ=";
+    hash = "sha256-zMV46aPoPQ3BU1c30f2gm6qVxxZ/Xl7LFfeGZUCU7tU=";
  };

  patches = [
@@ -81,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = with lib; {
    description = "Glycin loaders for several formats";
-    homepage = "https://gitlab.gnome.org/sophie-h/glycin";
+    homepage = "https://gitlab.gnome.org/GNOME/glycin";
    teams = [ teams.gnome ];
    license = with licenses; [
      mpl20 # or
@@ -25,11 +25,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-applets";
-  version = "3.54.0";
+  version = "3.56.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-applets/${lib.versions.majorMinor finalAttrs.version}/gnome-applets-${finalAttrs.version}.tar.xz";
-    hash = "sha256-FASM8amK2U4U715E/f6IVvo/KDZAHHkr/83mi4db2vk=";
+    hash = "sha256-+heu3JVa3ZgaouQ7TAcTU/aGu9HuwdcXqJCnNTIK0XE=";
  };

  nativeBuildInputs = [
@@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-backgrounds";
-  version = "47.0";
+  version = "48.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-backgrounds/${lib.versions.major version}/gnome-backgrounds-${version}.tar.xz";
-    hash = "sha256-h0pKOcQmFzb2qFRyKDNAC2EkQcRoGqWYLZCxWryckf0=";
+    hash = "sha256-LWuqAR7peATHVh9+HL2NR2PjC1W4gY3aePn3WvuNjQU=";
  };

  patches = [
@@ -50,11 +50,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-boxes";
-  version = "47.0";
+  version = "48.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-boxes/${lib.versions.major version}/gnome-boxes-${version}.tar.xz";
-    hash = "sha256-Zb9sLeG/TVFpXJGSxbHmKFyzLJihiqlIo3bqMgOLx48=";
+    hash = "sha256-0F9fQlaPr79tiHcRYbBu1fc51DEhJ41BjK6VxW5RPq0=";
  };

  patches = [
@@ -42,7 +42,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-builder";
-  version = "47.2";
+  version = "48.0";

  outputs = [
    "out"
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-builder/${lib.versions.major finalAttrs.version}/gnome-builder-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Roe5PEfNHjNmWi3FA3kLYhPugnhy/ABNl40UvL+ptJU=";
+    hash = "sha256-ev6aejs8ZiF2i8RqYdaY3XiLNlP7RqcII4vcz03me6Q=";
  };

  patches = [
@@ -26,11 +26,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-calculator";
-  version = "47.1";
+  version = "48.1";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-calculator/${lib.versions.major version}/gnome-calculator-${version}.tar.xz";
-    hash = "sha256-vp+SJ5m35+ZclzSLm35kf/4zyDG7OlHTniwWjSrcQOA=";
+    hash = "sha256-vEvUGpuhkPRcvuDYxnUs3F0osM7xxr0MAeLa4fPBkWI=";
  };

  nativeBuildInputs = [
@@ -22,11 +22,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-calendar";
-  version = "47.0";
+  version = "48.1";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-calendar/${lib.versions.major version}/gnome-calendar-${version}.tar.xz";
-    hash = "sha256-OwMxPxxNEtyCHgfiCdFZbVPq+iVdSS0s5av5LtG1HnY=";
+    hash = "sha256-Bs6t1cAL6ONYGB1CHs8mgs4K6i/LEtkDsw0pyjMonwI=";
  };

  nativeBuildInputs = [
@@ -22,11 +22,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-characters";
-  version = "47.0";
+  version = "48.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-characters/${lib.versions.major version}/gnome-characters-${version}.tar.xz";
-    hash = "sha256-a88Foi8w8THYqANbD2PYapVnAHpfbfXOhVa6Bnd7dXQ=";
+    hash = "sha256-osMspU2RHbJARCA1DTRC5pGi3Oiw9dAImfZs/4w8jXE=";
  };

  nativeBuildInputs = [
@@ -22,11 +22,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-chess";
-  version = "47.0";
+  version = "48.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-chess/${lib.versions.major version}/gnome-chess-${version}.tar.xz";
-    hash = "sha256-OkQ6LHiA5q0TG3Wt2AdO2+WYK3aruEKQT+PfnCxQ6H4=";
+    hash = "sha256-eDTEdvCLvyd5BrApNjLtMugDdMuUQyayGeqQVqapXz8=";
  };

  nativeBuildInputs = [
@@ -26,11 +26,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-clocks";
-  version = "47.0";
+  version = "48.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-clocks/${lib.versions.major finalAttrs.version}/gnome-clocks-${finalAttrs.version}.tar.xz";
-    hash = "sha256-QovfS9F+Jt5s7wFM16fuvYkUPD8nMrJLfaaYErqlITE=";
+    hash = "sha256-YW7h+3UwCx8muXZiGelUdRNgyg+g9JExG8+DvzgIfGI=";
  };

  nativeBuildInputs = [
@@ -22,11 +22,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-connections";
-  version = "47.2.1";
+  version = "48.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-connections/${lib.versions.major finalAttrs.version}/gnome-connections-${finalAttrs.version}.tar.xz";
-    hash = "sha256-BSPjy4edSsC5Xn7l8y22YSi1q4QE/xGSMHHNVs/k2Lg=";
+    hash = "sha256-Nw75QFBrVybG8rfLl5ayI9HW1Chfg8/DOFvWdMMon9A=";
  };

  nativeBuildInputs = [
@@ -20,11 +20,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-console";
-  version = "47.1";
+  version = "48.0.1";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-console/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-0/YAtFtRcWaRrukocDMunJqMqJ1VNWXzEx2eKAdHJdA=";
+    hash = "sha256-AY6Qjk2uvPyxUNTxuyjZgnKqnRTWgV6vjaRfiJ2wXEk=";
  };

  nativeBuildInputs = [
@@ -29,11 +29,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-contacts";
-  version = "47.1.1";
+  version = "48.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-contacts/${lib.versions.major version}/gnome-contacts-${version}.tar.xz";
-    hash = "sha256-R+GuRbcEGgXV4nZJ2RLiwwAlYYisRg7cukaJnGYIpHg=";
+    hash = "sha256-onYplbWUJ+w/GF8otVlONwd7cqcM18GSF+1jRjfswbU=";
  };

  nativeBuildInputs = [
@@ -65,6 +65,7 @@
  tzdata,
  udisks2,
  upower,
+  wayland-scanner,
  libepoxy,
  gnome-user-share,
  gnome-remote-desktop,
@@ -74,11 +75,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-control-center";
-  version = "47.4";
+  version = "48.1";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-control-center/${lib.versions.major finalAttrs.version}/gnome-control-center-${finalAttrs.version}.tar.xz";
-    hash = "sha256-KMfbdNcg/MnyE8EtNy5+rMF2ekm8TKZrK9ILD9ECJmg=";
+    hash = "sha256-AYPbNlqqj4W0SyPMnK5nXRyDNgSf7BGoym6pvb6MSP4=";
  };

  patches = [
@@ -98,6 +99,7 @@ stdenv.mkDerivation (finalAttrs: {
    pkg-config
    python3
    shared-mime-info
+    wayland-scanner
    wrapGAppsHook4
  ];

@@ -0,0 +1,13 @@
+diff --git a/system-indicators/si-input-sources.c b/system-indicators/si-input-sources.c
+index f13b262..2186b76 100644
+--- a/system-indicators/si-input-sources.c
+++ b/system-indicators/si-input-sources.c
+@@ -807,7 +807,7 @@ spawn_keyboard_display (const char *description)
+   flags = G_SPAWN_SEARCH_PATH | G_SPAWN_DO_NOT_REAP_CHILD;
+   error = NULL;
+ 
+-  argv[0] = g_strdup ("tecla");
+  argv[0] = g_strdup ("@tecla@");
+   argv[1] = g_strdup (description);
+   argv[2] = NULL;
+ 
@@ -20,7 +20,9 @@
  pkg-config,
  polkit,
  gdm,
+  replaceVars,
  systemd,
+  tecla,
  upower,
  pam,
  wrapGAppsHook3,
@@ -64,13 +66,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-flashback";
-  version = "3.54.0";
+  version = "3.56.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-flashback/${lib.versions.majorMinor finalAttrs.version}/gnome-flashback-${finalAttrs.version}.tar.xz";
-    hash = "sha256-gkNa4wLNZK6xG25M0YTaj/+qzSSFFf+gIidZXDzPne4=";
+    hash = "sha256-LQ+iLzc9sIDq7w5Wk7lijN6ETyVjPVqQMTsEndlSkmA=";
  };

+  patches = [
+    (replaceVars ./fix-paths.patch {
+      tecla = lib.getExe tecla;
+    })
+  ];
+
  # make .desktop Execs absolute
  postPatch = ''
    patch -p0 <<END_PATCH
@@ -18,11 +18,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-font-viewer";
-  version = "47.0";
+  version = "48.0";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-font-viewer/${lib.versions.major version}/gnome-font-viewer-${version}.tar.xz";
-    hash = "sha256-uOWgQuCyQbDHyuQ/dNoNX4jmQjAXqR/rhudhfttAgO0=";
+    hash = "sha256-cyYkIxtiT/XHrAOoznG+Ejk9qlNVHRFVCyDXsKOocqc=";
  };

  doCheck = true;
@@ -37,11 +37,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-initial-setup";
-  version = "47.4";
+  version = "48.1";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-initial-setup/${lib.versions.major finalAttrs.version}/gnome-initial-setup-${finalAttrs.version}.tar.xz";
-    hash = "sha256-LAKZ3CtxaBGCNZUNWJijUclMuduP2AjarV1uS6lbh7g=";
+    hash = "sha256-s9q/fnm2Zf8SJB+9umFUiVE9iGIkdZmGr49IZXWSMV4=";
  };

  patches = [
@@ -3,6 +3,8 @@
  stdenv,
  fetchurl,
  pkg-config,
+  meson,
+  ninja,
  dbus,
  libgcrypt,
  pam,
@@ -15,16 +17,17 @@
  libselinux,
  p11-kit,
  openssh,
-  wrapGAppsHook3,
+  wrapGAppsNoGuiHook,
  docbook-xsl-nons,
  docbook_xml_dtd_43,
  gnome,
+  writeText,
  useWrappedDaemon ? true,
 }:

 stdenv.mkDerivation rec {
  pname = "gnome-keyring";
-  version = "46.2";
+  version = "48.0";

  outputs = [
    "out"
@@ -33,16 +36,18 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-keyring/${lib.versions.major version}/gnome-keyring-${version}.tar.xz";
-    hash = "sha256-vybJZriot/MoXsyLs+RnucIPlTW5TcRRycVZ3c/2GSU=";
+    hash = "sha256-8gUYySDp6j+cm4tEvoxQ2Nf+7NDdViSWD3e9LKT7650=";
  };

  nativeBuildInputs = [
    pkg-config
+    meson
+    ninja
    gettext
    libxslt
    docbook-xsl-nons
    docbook_xml_dtd_43
-    wrapGAppsHook3
+    wrapGAppsNoGuiHook
  ];

  buildInputs = [
@@ -61,32 +66,37 @@ stdenv.mkDerivation rec {
    python3
  ];

-  configureFlags = [
-    "--with-pkcs11-config=${placeholder "out"}/etc/pkcs11/" # installation directories
-    "--with-pkcs11-modules=${placeholder "out"}/lib/pkcs11/"
+  mesonFlags = [
+    # installation directories
+    "-Dpkcs11-config=${placeholder "out"}/etc/pkcs11" # todo: this should probably be /share/p11-kit/modules
+    "-Dpkcs11-modules=${placeholder "out"}/lib/pkcs11"
    # gnome-keyring doesn't build with ssh-agent by default anymore, we need to
    # switch to using gcr https://github.com/NixOS/nixpkgs/issues/140824
-    "--enable-ssh-agent"
-    # cross compilation requires these paths to be explicitly declared:
-    "LIBGCRYPT_CONFIG=${lib.getExe' (lib.getDev libgcrypt) "libgcrypt-config"}"
-    "SSH_ADD=${lib.getExe' openssh "ssh-add"}"
-    "SSH_AGENT=${lib.getExe' openssh "ssh-agent"}"
+    "-Dssh-agent=true"
+    # TODO: enable socket activation
+    "-Dsystemd=disabled"
+    "--cross-file=${writeText "crossfile.ini" ''
+      [binaries]
+      ssh-add = '${lib.getExe' openssh "ssh-add"}'
+      ssh-agent = '${lib.getExe' openssh "ssh-agent"}'
+    ''}"
  ];

  # Tends to fail non-deterministically.
  # - https://github.com/NixOS/nixpkgs/issues/55293
  # - https://github.com/NixOS/nixpkgs/issues/51121
+  # - At least “gnome-keyring:gkm::xdg-store / xdg-trust” is still flaky on 48.beta.
  doCheck = false;

-  postPatch = ''
-    patchShebangs build
-  '';
-
  checkPhase = ''
+    runHook postCheck
+
    export HOME=$(mktemp -d)
    dbus-run-session \
      --config-file=${dbus}/share/dbus-1/session.conf \
-      make check
+      meson test --print-errorlogs
+
+    runHook preCheck
  '';

  # Use wrapped gnome-keyring-daemon with cap_ipc_lock=ep
@@ -109,7 +119,12 @@ stdenv.mkDerivation rec {
    description = "Collection of components in GNOME that store secrets, passwords, keys, certificates and make them available to applications";
    homepage = "https://gitlab.gnome.org/GNOME/gnome-keyring";
    changelog = "https://gitlab.gnome.org/GNOME/gnome-keyring/-/blob/${version}/NEWS?ref_type=tags";
-    license = licenses.gpl2;
+    license = [
+      # Most of the code (some is 2Plus)
+      licenses.lgpl21Plus
+      # Some stragglers
+      licenses.gpl2Plus
+    ];
    teams = [ teams.gnome ];
    platforms = platforms.linux;
  };
@@ -20,11 +20,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-mahjongg";
-  version = "47.2";
+  version = "48.1";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-mahjongg/${lib.versions.major finalAttrs.version}/gnome-mahjongg-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Nd+SZBnzeCY4CjNGIHVjzYfH6ZoT3r4Ok6FAnYXMYVc=";
+    hash = "sha256-3Ujg+BrKNL6tpGxdIhsyWRuO2B6dNhw6JY359rIiLIQ=";
  };

  nativeBuildInputs = [
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Disassemble a pile of tiles by removing matching pairs";
    mainProgram = "gnome-mahjongg";
    teams = [ teams.gnome ];
-    license = licenses.gpl3Plus;
+    license = licenses.gpl2Plus;
    platforms = platforms.unix;
  };
 })
@@ -30,11 +30,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-maps";
-  version = "47.4";
+  version = "48.2";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-maps/${lib.versions.major finalAttrs.version}/gnome-maps-${finalAttrs.version}.tar.xz";
-    hash = "sha256-GMXicPtSLP08AD7AEJPgZesvK40bJ4Dfwnngv3dzXgs=";
+    hash = "sha256-rW3WEmiF+xaG7kv0mnh6clfHzF93nlQTQVWmgKMKjLk=";
  };

  doCheck = !stdenv.hostPlatform.isDarwin;
@@ -7,26 +7,25 @@
  vala,
  pkg-config,
  gnome,
-  adwaita-icon-theme,
-  gtk3,
-  wrapGAppsHook3,
+  gtk4,
+  libadwaita,
+  wrapGAppsHook4,
  librsvg,
  gettext,
  itstool,
-  python3,
  libxml2,
-  libgnome-games-support,
+  libgnome-games-support_2_0,
  libgee,
  desktop-file-utils,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-mines";
-  version = "40.1";
+  version = "48.1";

  src = fetchurl {
-    url = "mirror://gnome/sources/gnome-mines/${lib.versions.major version}/gnome-mines-${version}.tar.xz";
-    hash = "sha256-NQLps/ccs7LnEcDmAZGH/rzCvKh349RW3KtwD3vjEnI=";
+    url = "mirror://gnome/sources/gnome-mines/${lib.versions.major finalAttrs.version}/gnome-mines-${finalAttrs.version}.tar.xz";
+    hash = "sha256-70stLd477GFBV+3eTZGJzGr+aSlSot1VsocOLmLtgQQ=";
  };

  nativeBuildInputs = [
@@ -36,27 +35,23 @@ stdenv.mkDerivation rec {
    pkg-config
    gettext
    itstool
-    python3
    libxml2
-    wrapGAppsHook3
+    wrapGAppsHook4
    desktop-file-utils
  ];

  buildInputs = [
-    gtk3
+    gtk4
+    libadwaita
+    libgnome-games-support_2_0
    librsvg
-    adwaita-icon-theme
-    libgnome-games-support
    libgee
  ];

-  postPatch = ''
-    chmod +x build-aux/meson_post_install.py
-    patchShebangs build-aux/meson_post_install.py
-  '';
-
  passthru = {
-    updateScript = gnome.updateScript { packageName = "gnome-mines"; };
+    updateScript = gnome.updateScript {
+      packageName = "gnome-mines";
+    };
  };

  meta = with lib; {
@@ -67,4 +62,4 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3;
    platforms = platforms.unix;
  };
-}
+})
@@ -31,13 +31,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "gnome-music";
-  version = "47.1";
+  version = "48.0";

  format = "other";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-music/${lib.versions.major version}/gnome-music-${version}.tar.xz";
-    hash = "sha256-Zm8XX1YKGtnLq2HqDzA5PKL+0pRrpG5cAOrqEX28cNA=";
+    hash = "sha256-jNqs0FJitjuxYIolrK1RboksMyIyNXy5t/aPLPuG1m4=";
  };

  nativeBuildInputs = [
@@ -4,10 +4,10 @@
  fetchurl,
  pkg-config,
  gnome,
+  gsound,
  gtk4,
  wrapGAppsHook4,
  librsvg,
-  gsound,
  gettext,
  itstool,
  vala,
@@ -22,11 +22,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-nibbles";
-  version = "4.1.0";
+  version = "4.2.2";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-nibbles/${lib.versions.majorMinor finalAttrs.version}/gnome-nibbles-${finalAttrs.version}.tar.xz";
-    hash = "sha256-YyQb2KFfWRgKYYEgQeLo85hiJn3J5lLz0XNULFUNkpI=";
+    hash = "sha256-Pkofm68cV7joNd7fCGnjJy5lNKHdacTib64QxCAKrwA=";
  };

  nativeBuildInputs = [
@@ -42,14 +42,21 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  buildInputs = [
+    gsound
    gtk4
    librsvg
-    gsound
    libadwaita
    libgee
    libgnome-games-support_2_0
  ];

+  # The "we can link with libadwaita?" valac.links() check fails otherwise.
+  # Command line: `valac testfile.vala --pkg=libadwaita-1 --Xcc=-w --Xcc=-DVALA_STRICT_C` -> 1
+  # testfile.vala.c:50:46: error: passing argument 2 of 'adw_about_dialog_set_developers'
+  # from incompatible pointer type [-Wincompatible-pointer-types]
+  # 50 |         adw_about_dialog_set_developers (ad, s);
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+
  passthru = {
    updateScript = gnome.updateScript { packageName = "gnome-nibbles"; };
  };
@@ -32,7 +32,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-online-accounts";
-  version = "3.52.3.1";
+  version = "3.54.2";

  outputs =
    [
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-online-accounts/${lib.versions.majorMinor finalAttrs.version}/gnome-online-accounts-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Se1yfW/ElHSZb6ft8JGbIeT8hW6jfm4w8XtQsQOvlwE=";
+    hash = "sha256-D389KcBmb/vMUD8+DzOWNi7/25MX1BZkzmXfFH7zU3I=";
  };

  mesonFlags = [
@@ -25,7 +25,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-panel";
-  version = "3.54.0";
+  version = "3.56.0";

  outputs = [
    "out"
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-panel/${lib.versions.majorMinor finalAttrs.version}/gnome-panel-${finalAttrs.version}.tar.xz";
-    hash = "sha256-lLnNUcpQ/zKiic1QWRNuexYMHxJrXWZp4QbcqIUEXCg=";
+    hash = "sha256-UoptZ92E7a5sgKXuZW+E+9lC87Nx1g+XottgZc9P0XA=";
  };

  patches = [
@@ -13,6 +13,9 @@
  libei,
  libepoxy,
  libdrm,
+  libva,
+  vulkan-loader,
+  shaderc,
  nv-codec-headers-11,
  pipewire,
  systemd,
@@ -31,11 +34,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-remote-desktop";
-  version = "47.3";
+  version = "48.1";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-remote-desktop/${lib.versions.major version}/gnome-remote-desktop-${version}.tar.xz";
-    hash = "sha256-QE2wiHLmkDlD4nUam2Myf2NZcKnKodL2dTCcpEV8+cI=";
+    hash = "sha256-vPN3D8oPrtovrjsaP/by6QoCd492pC6P0QPK4YYo9PI=";
  };

  nativeBuildInputs = [
@@ -44,6 +47,7 @@ stdenv.mkDerivation rec {
    pkg-config
    python3
    asciidoc
+    shaderc # for glslc
    wrapGAppsHook3
  ];

@@ -58,6 +62,8 @@ stdenv.mkDerivation rec {
    libei
    libepoxy
    libdrm
+    libva
+    vulkan-loader
    nv-codec-headers-11
    libnotify
    libopus
@@ -24,17 +24,17 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-robots";
-  version = "41.1";
+  version = "41.2";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-robots/${lib.versions.major finalAttrs.version}/gnome-robots-${finalAttrs.version}.tar.xz";
-    hash = "sha256-K4BQcFrIPpOL56iREyYB62XHk/IJzX6RDGzWQphzBHg=";
+    hash = "sha256-kSHC+DaBIEP+7yumYc1dD9SOPWMZxDlBuf3RWLmw65E=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src;
    name = "gnome-robots-${finalAttrs.version}";
-    hash = "sha256-7kwjpZJqAqqKlt6mOFyjaaxZ1Tr2WuhE72jwjCZpX9E=";
+    hash = "sha256-1h9+XPmkapzdYsI6qtPPHtlwEEmyIzaAogLiYvIHJak=";
  };

  nativeBuildInputs = [
@@ -62,12 +62,6 @@ stdenv.mkDerivation (finalAttrs: {
    gst_all_1.gst-plugins-good
  ];

-  postPatch = ''
-    # https://gitlab.gnome.org/GNOME/gnome-robots/-/merge_requests/38
-    substituteInPlace data/icons/meson.build \
-      --replace-fail 'gtk-update-icon-cache' 'gtk4-update-icon-cache'
-  '';
-
  preFixup = ''
    # Seal GStreamer plug-ins so that we can notice when they are missing.
    gappsWrapperArgs+=(--set "GST_PLUGIN_SYSTEM_PATH_1_0" "$GST_PLUGIN_SYSTEM_PATH_1_0")
@@ -91,7 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
                  common-updater-scripts
                ]
              }
-              update-source-version gnome-robots --ignore-same-version --source-key=cargoDeps > /dev/null
+              update-source-version gnome-robots --ignore-same-version --source-key=cargoDeps.vendorStaging > /dev/null
            ''
          ];
          # Experimental feature: do not copy!
@@ -6,10 +6,10 @@ index b4b1f8fa..99d52cba 100755
    [ "x$XDG_SESSION_CLASS" != "xgreeter" ] &&
    [  -n "$SHELL" ]; then
   if [ "$1" != '-l' ]; then
-    exec bash -c "exec -l '$SHELL' -c '$0 -l $*'"
+-    exec bash -c "exec -l '$SHELL' -c 'exec $0 -l $*'"
 +    # Make sure the shell actually sets up the environment.
 +    unset __NIXOS_SET_ENVIRONMENT_DONE
-+    exec @bash@ -c "exec -l '$SHELL' -c '$0 -l $*'"
+    exec @bash@ -c "exec -l '$SHELL' -c 'exec $0 -l $*'"
   else
     shift
   fi
@@ -34,7 +34,7 @@
 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-session";
  # Also bump ./ctl.nix when bumping major version.
-  version = "47.0.1";
+  version = "48.0";

  outputs = [
    "out"
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-session/${lib.versions.major finalAttrs.version}/gnome-session-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Vq6caOSZlXk+sglrzcRTOxEWaeHlTItuCx2VL2peinA=";
+    hash = "sha256-3ZCfvFsizb2y/E3xpH140bWUPMxeYeaiChhGJGNHxBc=";
  };

  patches = [
@@ -43,11 +43,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-settings-daemon";
-  version = "47.2";
+  version = "48.1";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-settings-daemon/${lib.versions.major finalAttrs.version}/gnome-settings-daemon-${finalAttrs.version}.tar.xz";
-    hash = "sha256-HrdYhi6Ij1WghpGTCH8c+8x6EWNlTmMAmf9DQt0/alo=";
+    hash = "sha256-OGCi6iFNy8tmAK56HjNYpTiSFQh7w+SkfO4/h7ruBi4=";
  };

  patches = [
@@ -15,11 +15,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-shell-extensions";
-  version = "47.4";
+  version = "48.1";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-shell-extensions/${lib.versions.major finalAttrs.version}/gnome-shell-extensions-${finalAttrs.version}.tar.xz";
-    hash = "sha256-VDN57FsNBCAO5iofa6JAcWoJ11rQrd3bIFvjjOgpP1g=";
+    hash = "sha256-m2f8LFgC2hcTp3sZ/6BCMY3XHnva6EN3lsX1GXlTOTw=";
  };

  patches = [
@@ -10,10 +10,10 @@ index de91167c5..1c9965678 100644
 +ExecStart=@gsettings@ set org.gnome.shell disable-user-extensions true
 Restart=no
 diff --git a/js/ui/extensionDownloader.js b/js/ui/extensionDownloader.js
-index 197cc1c1c..dd74aa167 100644
+index 53fd92846..89533cedc 100644
 --- a/js/ui/extensionDownloader.js
 +++ b/js/ui/extensionDownloader.js
-@@ -110,7 +110,7 @@ async function extractExtensionArchive(bytes, dir) {
+@@ -124,7 +124,7 @@ async function extractExtensionArchive(bytes, dir) {
     stream.close_async(GLib.PRIORITY_DEFAULT, null);
 
     const unzip = Gio.Subprocess.new(
@@ -22,7 +22,7 @@ index 197cc1c1c..dd74aa167 100644
         Gio.SubprocessFlags.NONE);
     await unzip.wait_check_async(null);
 
-@@ -132,7 +132,7 @@ async function extractExtensionArchive(bytes, dir) {
+@@ -146,7 +146,7 @@ async function extractExtensionArchive(bytes, dir) {
     }
 
     const compileSchema = Gio.Subprocess.new(
@@ -32,15 +32,15 @@ index 197cc1c1c..dd74aa167 100644
 
     try {
 diff --git a/js/ui/status/keyboard.js b/js/ui/status/keyboard.js
-index fff4e73c2..92859b099 100644
+index 1b43e1051..a31b0a304 100644
 --- a/js/ui/status/keyboard.js
 +++ b/js/ui/status/keyboard.js
-@@ -1092,6 +1092,6 @@ class InputSourceIndicator extends PanelMenu.Button {
-         if (xkbVariant.length > 0)
-             description = `${description}\t${xkbVariant}`;
+@@ -1104,6 +1104,6 @@ class InputSourceIndicator extends PanelMenu.Button {
+     _showLayout() {
+         Main.overview.hide();
 
-        Util.spawn(['tecla', description]);
-+        Util.spawn(['@tecla@', description]);
+-        Util.spawn(['tecla']);
+        Util.spawn(['@tecla@']);
     }
 });
 diff --git a/subprojects/extensions-tool/src/command-install.c b/subprojects/extensions-tool/src/command-install.c
@@ -69,7 +69,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-shell";
-  version = "47.4";
+  version = "48.1";

  outputs = [
    "out"
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-shell/${lib.versions.major finalAttrs.version}/gnome-shell-${finalAttrs.version}.tar.xz";
-    hash = "sha256-aAuvaU9F+PyDLSRa2mxjtfxLAwzPvrv8Dg47wo2i5G0=";
+    hash = "sha256-uk9FWv1iE/OHVFlG482dqjnJBPerFt2DCsd6c/8QAso=";
  };

  patches = [
@@ -183,7 +183,9 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  postPatch = ''
-    patchShebangs src/data-to-c.py
+    patchShebangs \
+      src/data-to-c.py \
+      meson/generate-app-list.py

    # We can generate it ourselves.
    rm -f man/gnome-shell.1
@@ -48,11 +48,11 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "gnome-software";
-  version = "47.4";
+  version = "48.1";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-software/${lib.versions.major finalAttrs.version}/gnome-software-${finalAttrs.version}.tar.xz";
-    hash = "sha256-coHFS5t0jWai55LrjgMxyJec44+vrfct482ZnYDpe08=";
+    hash = "sha256-CEqYUEApTDZFS0ZKIUT5gcAnSQa0xJ1xYT5hztapbo8=";
  };

  patches = [
--- a/Show More
+++ b/Show More