Merge master into haskell-updates

2023-03-16 00:14:18 +00:00 · 2023-03-16 00:14:18 +00:00 · 01e9cabdad
commit 01e9cabdad
parent 6ff24bf612 1e00cab35a
2586 changed files with 11573 additions and 7113 deletions
--- a/.github/workflows/check-maintainers-sorted.yaml
+++ b/.github/workflows/check-maintainers-sorted.yaml
@ -0,0 +1,21 @@
+name: "Check that maintainer list is sorted"
+
+on:
+  pull_request:
+    paths:
+      - 'maintainers/maintainer-list.nix'
+permissions:
+  contents: read
+
+jobs:
+  nixos:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'NixOS'
+    steps:
+      - uses: actions/checkout@v3
+      - uses: cachix/install-nix-action@v19
+        with:
+          # explicitly enable sandbox
+          extra_nix_config: sandbox = true
+      - name: Check that maintainer-list.nix is sorted
+        run: nix-instantiate --eval maintainers/scripts/check-maintainers-sorted.nix
--- a/doc/languages-frameworks/gnome.section.md
+++ b/doc/languages-frameworks/gnome.section.md
@ -116,10 +116,6 @@ For convenience, it also adds `dconf.lib` for a GIO module implementing a GSetti

 - []{#ssec-gnome-hooks-gobject-introspection} `gobject-introspection` setup hook populates `GI_TYPELIB_PATH` variable with `lib/girepository-1.0` directories of dependencies, which is then added to wrapper by `wrapGAppsHook`. It also adds `share` directories of dependencies to `XDG_DATA_DIRS`, which is intended to promote GIR files but it also [pollutes the closures](https://github.com/NixOS/nixpkgs/issues/32790) of packages using `wrapGAppsHook`.

-  ::: {.warning}
-  The setup hook [currently](https://github.com/NixOS/nixpkgs/issues/56943) does not work in expressions with `strictDeps` enabled, like Python packages. In those cases, you will need to disable it with `strictDeps = false;`.
-  :::
-
 - []{#ssec-gnome-hooks-gst-grl-plugins} Setup hooks of `gst_all_1.gstreamer` and `grilo` will populate the `GST_PLUGIN_SYSTEM_PATH_1_0` and `GRL_PLUGIN_PATH` variables, respectively, which will then be added to the wrapper by `wrapGAppsHook`.

 You can also pass additional arguments to `makeWrapper` using `gappsWrapperArgs` in `preFixup` hook:
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
--- a/maintainers/scripts/check-maintainers-sorted.nix
+++ b/maintainers/scripts/check-maintainers-sorted.nix
@ -0,0 +1,57 @@
+let
+  lib = import ../../lib;
+  inherit (lib)
+    add attrNames elemAt foldl' genList length replaceStrings sort toLower trace;
+
+  maintainers = import ../maintainer-list.nix;
+  simplify = replaceStrings [ "-" "_" ] [ "" "" ];
+  compare = a: b: simplify (toLower a) < simplify (toLower b);
+  namesSorted =
+    sort
+      (a: b: a.key < b.key)
+      (map
+        (n: let pos = builtins.unsafeGetAttrPos n maintainers;
+            in assert pos == null -> throw "maintainers entry ${n} is malformed";
+              { name = n; line = pos.line; key = toLower (simplify n); })
+        (attrNames maintainers));
+  before = { name, line, key }:
+    foldl'
+      (acc: n: if n.key < key && (acc == null || n.key > acc.key) then n else acc)
+      null
+      namesSorted;
+  errors = foldl' add 0
+    (map
+      (i: let a = elemAt namesSorted i;
+              b = elemAt namesSorted (i + 1);
+              lim = let t = before a; in if t == null then "the initial {" else t.name;
+          in if a.line >= b.line
+             then trace
+               ("maintainer ${a.name} (line ${toString a.line}) should be listed "
+                + "after ${lim}, not after ${b.name} (line ${toString b.line})")
+               1
+             else 0)
+      (genList (i: i) (length namesSorted - 1)));
+in
+assert errors == 0; "all good!"
+
+# generate edit commands to sort the list.
+# may everything following the last current entry (closing } ff) in the wrong place
+# with lib;
+# concatStringsSep
+#   "\n"
+#   (let first = foldl' (acc: n: if n.line < acc then n.line else acc) 999999999 namesSorted;
+#        commands = map
+#          (i: let e = elemAt namesSorted i;
+#                  begin = foldl'
+#                    (acc: n: if n.line < e.line && n.line > acc then n.line else acc)
+#                    1
+#                    namesSorted;
+#                  end =
+#                    foldl' (acc: n: if n.line > e.line && n.line < acc then n.line else acc)
+#                      999999999
+#                      namesSorted;
+#              in "${toString e.line},${toString (end - 1)} p")
+#          (genList (i: i) (length namesSorted));
+#    in map
+#      (c: "sed -ne '${c}' maintainers/maintainer-list.nix")
+#      ([ "1,${toString (first - 1)} p" ] ++ commands))
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -93,6 +93,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `git-bug` has been updated to at least version 0.8.0, which includes backwards incompatible changes. The `git-bug-migration` package can be used to upgrade existing repositories.

+- `nushell` has been updated to at least version 0.77.0, which includes potential breaking changes in aliases. The old aliases are now available as `old-alias` but it is recommended you migrate to the new format. See [Reworked aliases](https://www.nushell.sh/blog/2023-03-14-nushell_0_77.html#reworked-aliases-breaking-changes-kubouch).
+
 - `keepassx` and `keepassx2` have been removed, due to upstream [stopping development](https://www.keepassx.org/index.html%3Fp=636.html). Consider [KeePassXC](https://keepassxc.org) as a maintained alternative.

 - The `services.kubo.settings` option is now no longer stateful. If you changed any of the options in `services.kubo.settings` in the past and then removed them from your NixOS configuration again, those changes are still in your Kubo configuration file but will now be reset to the default. If you're unsure, you may want to make a backup of your configuration file (probably /var/lib/ipfs/config) and compare after the update.
--- a/nixos/modules/services/cluster/hadoop/hbase.nix
+++ b/nixos/modules/services/cluster/hadoop/hbase.nix
@ -5,11 +5,95 @@ let
  cfg = config.services.hadoop;
  hadoopConf = "${import ./conf.nix { inherit cfg pkgs lib; }}/";
  mkIfNotNull = x: mkIf (x != null) x;
+  # generic hbase role options
+  hbaseRoleOption = name: extraOpts: {
+    enable = mkEnableOption (mdDoc "HBase ${name}");
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = mdDoc "Open firewall ports for HBase ${name}.";
+    };
+
+    restartIfChanged = mkOption {
+      type = types.bool;
+      default = false;
+      description = mdDoc "Restart ${name} con config change.";
+    };
+
+    extraFlags = mkOption {
+      type = with types; listOf str;
+      default = [];
+      example = literalExpression ''[ "--backup" ]'';
+      description = mdDoc "Extra flags for the ${name} service.";
+    };
+
+    environment = mkOption {
+      type = with types; attrsOf str;
+      default = {};
+      example = literalExpression ''
+        {
+          HBASE_MASTER_OPTS = "-Dcom.sun.management.jmxremote.ssl=true";
+        }
+      '';
+      description = mdDoc "Environment variables passed to ${name}.";
+    };
+  } // extraOpts;
+  # generic hbase role configs
+  hbaseRoleConfig = name: ports: (mkIf cfg.hbase."${name}".enable {
+    services.hadoop.gatewayRole = {
+      enable = true;
+      enableHbaseCli = mkDefault true;
+    };
+
+    systemd.services."hbase-${toLower name}" = {
+      description = "HBase ${name}";
+      wantedBy = [ "multi-user.target" ];
+      path = with cfg; [ hbase.package ] ++ optional
+        (with cfg.hbase.master; enable && initHDFS) package;
+      preStart = mkIf (with cfg.hbase.master; enable && initHDFS)
+        (concatStringsSep "\n" (
+          map (x: "HADOOP_USER_NAME=hdfs hdfs --config /etc/hadoop-conf ${x}")[
+            "dfsadmin -safemode wait"
+            "dfs -mkdir -p ${cfg.hbase.rootdir}"
+            "dfs -chown hbase ${cfg.hbase.rootdir}"
+          ]
+        ));
+
+      inherit (cfg.hbase."${name}") environment;
+      script = concatStringsSep " " (
+        [
+          "hbase --config /etc/hadoop-conf/"
+          "${toLower name} start"
+        ]
+        ++ cfg.hbase."${name}".extraFlags
+        ++ map (x: "--${toLower x} ${toString cfg.hbase.${name}.${x}}")
+          (filter (x: hasAttr x cfg.hbase.${name}) ["port" "infoPort"])
+      );
+
+      serviceConfig = {
+        User = "hbase";
+        SyslogIdentifier = "hbase-${toLower name}";
+        Restart = "always";
+      };
+    };
+
+    services.hadoop.hbaseSiteInternal."hbase.rootdir" = cfg.hbase.rootdir;
+
+    networking = {
+      firewall.allowedTCPPorts = mkIf cfg.hbase."${name}".openFirewall ports;
+      hosts = mkIf (with cfg.hbase.regionServer; enable && overrideHosts) {
+        "127.0.0.2" = mkForce [ ];
+        "::1" = mkForce [ ];
+      };
+    };
+
+  });
 in
 {
  options.services.hadoop = {

-    gatewayRole.enableHbaseCli = mkEnableOption (lib.mdDoc "HBase CLI tools");
+    gatewayRole.enableHbaseCli = mkEnableOption (mdDoc "HBase CLI tools");

    hbaseSiteDefault = mkOption {
      default = {
@ -21,7 +105,7 @@ in
        "hbase.cluster.distributed" = "true";
      };
      type = types.attrsOf types.anything;
-      description = lib.mdDoc ''
+      description = mdDoc ''
        Default options for hbase-site.xml
      '';
    };
@ -29,8 +113,12 @@ in
      default = {};
      type = with types; attrsOf anything;
      example = literalExpression ''
+        {
+          "hbase.hregion.max.filesize" = 20*1024*1024*1024;
+          "hbase.table.normalization.enabled" = "true";
+        }
      '';
-      description = lib.mdDoc ''
+      description = mdDoc ''
        Additional options and overrides for hbase-site.xml
        <https://github.com/apache/hbase/blob/rel/2.4.11/hbase-common/src/main/resources/hbase-default.xml>
      '';
@ -39,7 +127,7 @@ in
      default = {};
      type = with types; attrsOf anything;
      internal = true;
-      description = lib.mdDoc ''
+      description = mdDoc ''
        Internal option to add configs to hbase-site.xml based on module options
      '';
    };
@ -50,11 +138,11 @@ in
        type = types.package;
        default = pkgs.hbase;
        defaultText = literalExpression "pkgs.hbase";
-        description = lib.mdDoc "HBase package";
+        description = mdDoc "HBase package";
      };

      rootdir = mkOption {
-        description = lib.mdDoc ''
+        description = mdDoc ''
          This option will set "hbase.rootdir" in hbase-site.xml and determine
          the directory shared by region servers and into which HBase persists.
          The URL should be 'fully-qualified' to include the filesystem scheme.
@ -68,7 +156,7 @@ in
        default = "/hbase";
      };
      zookeeperQuorum = mkOption {
-        description = lib.mdDoc ''
+        description = mdDoc ''
          This option will set "hbase.zookeeper.quorum" in hbase-site.xml.
          Comma separated list of servers in the ZooKeeper ensemble.
        '';
@ -76,107 +164,36 @@ in
        example = "zk1.internal,zk2.internal,zk3.internal";
        default = null;
      };
-      master = {
-        enable = mkEnableOption (lib.mdDoc "HBase Master");
-        initHDFS = mkEnableOption (lib.mdDoc "initialization of the hbase directory on HDFS");
-
-        openFirewall = mkOption {
-          type = types.bool;
-          default = false;
-          description = lib.mdDoc ''
-            Open firewall ports for HBase master.
-          '';
+    } // (let
+      ports = port: infoPort: {
+        port = mkOption {
+          type = types.int;
+          default = port;
+          description = mdDoc "RPC port";
+        };
+        infoPort = mkOption {
+          type = types.int;
+          default = infoPort;
+          description = mdDoc "web UI port";
        };
      };
-      regionServer = {
-        enable = mkEnableOption (lib.mdDoc "HBase RegionServer");
-
-        overrideHosts = mkOption {
-          type = types.bool;
-          default = true;
-          description = lib.mdDoc ''
-            Remove /etc/hosts entries for "127.0.0.2" and "::1" defined in nixos/modules/config/networking.nix
-            Regionservers must be able to resolve their hostnames to their IP addresses, through PTR records
-            or /etc/hosts entries.
-
-          '';
-        };
-
-        openFirewall = mkOption {
-          type = types.bool;
-          default = false;
-          description = lib.mdDoc ''
-            Open firewall ports for HBase master.
-          '';
-        };
+    in mapAttrs hbaseRoleOption {
+      master.initHDFS = mkEnableOption (mdDoc "initialization of the hbase directory on HDFS");
+      regionServer.overrideHosts = mkOption {
+        type = types.bool;
+        default = true;
+        description = mdDoc ''
+          Remove /etc/hosts entries for "127.0.0.2" and "::1" defined in nixos/modules/config/networking.nix
+          Regionservers must be able to resolve their hostnames to their IP addresses, through PTR records
+          or /etc/hosts entries.
+        '';
      };
-    };
+      thrift = ports 9090 9095;
+      rest = ports 8080 8085;
+    });
  };

-  config = mkMerge [
-    (mkIf cfg.hbase.master.enable {
-      services.hadoop.gatewayRole = {
-        enable = true;
-        enableHbaseCli = mkDefault true;
-      };
-
-      systemd.services.hbase-master = {
-        description = "HBase master";
-        wantedBy = [ "multi-user.target" ];
-
-        preStart = mkIf cfg.hbase.master.initHDFS ''
-          HADOOP_USER_NAME=hdfs ${cfg.package}/bin/hdfs --config ${hadoopConf} dfsadmin -safemode wait
-          HADOOP_USER_NAME=hdfs ${cfg.package}/bin/hdfs --config ${hadoopConf} dfs -mkdir -p ${cfg.hbase.rootdir}
-          HADOOP_USER_NAME=hdfs ${cfg.package}/bin/hdfs --config ${hadoopConf} dfs -chown hbase ${cfg.hbase.rootdir}
-        '';
-
-        serviceConfig = {
-          User = "hbase";
-          SyslogIdentifier = "hbase-master";
-          ExecStart = "${cfg.hbase.package}/bin/hbase --config ${hadoopConf} " +
-                      "master start";
-          Restart = "always";
-        };
-      };
-
-      services.hadoop.hbaseSiteInternal."hbase.rootdir" = cfg.hbase.rootdir;
-
-      networking.firewall.allowedTCPPorts = mkIf cfg.hbase.master.openFirewall [
-        16000 16010
-      ];
-
-    })
-
-    (mkIf cfg.hbase.regionServer.enable {
-      services.hadoop.gatewayRole = {
-        enable = true;
-        enableHbaseCli = mkDefault true;
-      };
-
-      systemd.services.hbase-regionserver = {
-        description = "HBase RegionServer";
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = {
-          User = "hbase";
-          SyslogIdentifier = "hbase-regionserver";
-          ExecStart = "${cfg.hbase.package}/bin/hbase --config /etc/hadoop-conf/ " +
-                      "regionserver start";
-          Restart = "always";
-        };
-      };
-
-      services.hadoop.hbaseSiteInternal."hbase.rootdir" = cfg.hbase.rootdir;
-
-      networking = {
-        firewall.allowedTCPPorts = mkIf cfg.hbase.regionServer.openFirewall [
-          16020 16030
-        ];
-        hosts = mkIf cfg.hbase.regionServer.overrideHosts {
-          "127.0.0.2" = mkForce [ ];
-          "::1" = mkForce [ ];
-        };
-      };
-    })
+  config = mkMerge ([

    (mkIf cfg.gatewayRole.enable {

@ -192,5 +209,10 @@ in
        isSystemUser = true;
      };
    })
-  ];
+  ] ++ (mapAttrsToList hbaseRoleConfig {
+    master = [ 16000 16010 ];
+    regionServer = [ 16020 16030 ];
+    thrift = with cfg.hbase.thrift; [ port infoPort ];
+    rest = with cfg.hbase.rest; [ port infoPort ];
+  }));
 }
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -592,7 +592,8 @@ in
                    || dmConf.sddm.enable
                    || dmConf.xpra.enable
                    || dmConf.sx.enable
-                    || dmConf.startx.enable);
+                    || dmConf.startx.enable
+                    || config.services.greetd.enable);
      in mkIf (default) (mkDefault true);

    # so that the service won't be enabled when only startx is used
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@ -130,6 +130,13 @@ let
      pkgs.replaceDependency { inherit oldDependency newDependency drv; }
    ) baseSystemAssertWarn config.system.replaceRuntimeDependencies;

+  systemWithBuildDeps = system.overrideAttrs (o: {
+    systemBuildClosure = pkgs.closureInfo { rootPaths = [ system.drvPath ]; };
+    buildCommand = o.buildCommand + ''
+      ln -sn $systemBuildClosure $out/build-closure
+    '';
+  });
+
 in

 {
@ -306,6 +313,27 @@ in
      '';
    };

+    system.includeBuildDependencies = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Whether to include the build closure of the whole system in
+        its runtime closure.  This can be useful for making changes
+        fully offline, as it includes all sources, patches, and
+        intermediate outputs required to build all the derivations
+        that the system depends on.
+
+        Note that this includes _all_ the derivations, down from the
+        included applications to their sources, the compilers used to
+        build them, and even the bootstrap compiler used to compile
+        the compilers. This increases the size of the system and the
+        time needed to download its dependencies drastically: a
+        minimal configuration with no extra services enabled grows
+        from ~670MiB in size to 13.5GiB, and takes proportionally
+        longer to download.
+      '';
+    };
+
  };


@ -336,7 +364,7 @@ in
      ]; };
    };

-    system.build.toplevel = system;
+    system.build.toplevel = if config.system.includeBuildDependencies then systemWithBuildDeps else system;

  };

--- a/nixos/modules/system/boot/binfmt.nix
+++ b/nixos/modules/system/boot/binfmt.nix
@ -134,11 +134,11 @@ let
      mask = ''\xff\xff\xff\xff'';
    };
    x86_64-windows = {
-      magicOrExtension = ".exe";
+      magicOrExtension = "exe";
      recognitionType = "extension";
    };
    i686-windows = {
-      magicOrExtension = ".exe";
+      magicOrExtension = "exe";
      recognitionType = "extension";
    };
  };
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@ -158,6 +158,16 @@ in {
      '';
    };

+    managerEnvironment = mkOption {
+      type = with types; attrsOf (nullOr (oneOf [ str path package ]));
+      default = {};
+      example = { SYSTEMD_LOG_LEVEL = "debug"; };
+      description = lib.mdDoc ''
+        Environment variables of PID 1. These variables are
+        *not* passed to started units.
+      '';
+    };
+
    contents = mkOption {
      description = lib.mdDoc "Set of files that have to be linked into the initrd";
      example = literalExpression ''
@ -355,8 +365,11 @@ in {
        less = "${pkgs.less}/bin/less";
        mount = "${cfg.package.util-linux}/bin/mount";
        umount = "${cfg.package.util-linux}/bin/umount";
+        fsck = "${cfg.package.util-linux}/bin/fsck";
      };

+      managerEnvironment.PATH = "/bin:/sbin";
+
      contents = {
        "/init".source = "${cfg.package}/lib/systemd/systemd";
        "/etc/systemd/system".source = stage1Units;
@ -365,6 +378,7 @@ in {
          [Manager]
          DefaultEnvironment=PATH=/bin:/sbin ${optionalString (isBool cfg.emergencyAccess && cfg.emergencyAccess) "SYSTEMD_SULOGIN_FORCE=1"}
          ${cfg.extraConfig}
+          ManagerEnvironment=${lib.concatStringsSep " " (lib.mapAttrsToList (n: v: "${n}=${lib.escapeShellArg v}") cfg.managerEnvironment)}
        '';

        "/lib/modules".source = "${modulesClosure}/lib/modules";
@ -444,21 +458,6 @@ in {
                     (v: let n = escapeSystemdPath v.where;
                         in nameValuePair "${n}.automount" (automountToUnit n v)) cfg.automounts);

-      # The unit in /run/systemd/generator shadows the unit in
-      # /etc/systemd/system, but will still apply drop-ins from
-      # /etc/systemd/system/foo.service.d/
-      #
-      # We need IgnoreOnIsolate, otherwise the Requires dependency of
-      # a mount unit on its makefs unit causes it to be unmounted when
-      # we isolate for switch-root. Use a dummy package so that
-      # generateUnits will generate drop-ins instead of unit files.
-      packages = [(pkgs.runCommand "dummy" {} ''
-        mkdir -p $out/etc/systemd/system
-        touch $out/etc/systemd/system/systemd-{makefs,growfs}@.service
-      '')];
-      services."systemd-makefs@" = lib.mkIf needMakefs { unitConfig.IgnoreOnIsolate = true; };
-      services."systemd-growfs@" = lib.mkIf needGrowfs { unitConfig.IgnoreOnIsolate = true; };
-
      # make sure all the /dev nodes are set up
      services.systemd-tmpfiles-setup-dev.wantedBy = ["sysinit.target"];

--- a/nixos/modules/tasks/filesystems.nix
+++ b/nixos/modules/tasks/filesystems.nix
@ -140,7 +140,10 @@ let
        else if config.fsType == "reiserfs" then "-q"
        else null;
    in {
-      options = mkIf config.autoResize [ "x-nixos.autoresize" ];
+      options = mkMerge [
+        (mkIf config.autoResize [ "x-nixos.autoresize" ])
+        (mkIf (utils.fsNeededForBoot config) [ "x-initrd.mount" ])
+      ];
      formatOptions = mkIf (defaultFormatOptions != null) (mkDefault defaultFormatOptions);
    };

@ -155,27 +158,54 @@ let

  makeFstabEntries =
    let
-      fsToSkipCheck = [ "none" "bindfs" "btrfs" "zfs" "tmpfs" "nfs" "nfs4" "vboxsf" "glusterfs" "apfs" "9p" "cifs" "prl_fs" "vmhgfs" ];
+      fsToSkipCheck = [
+        "none"
+        "auto"
+        "overlay"
+        "iso9660"
+        "bindfs"
+        "udf"
+        "btrfs"
+        "zfs"
+        "tmpfs"
+        "bcachefs"
+        "nfs"
+        "nfs4"
+        "nilfs2"
+        "vboxsf"
+        "squashfs"
+        "glusterfs"
+        "apfs"
+        "9p"
+        "cifs"
+        "prl_fs"
+        "vmhgfs"
+      ] ++ lib.optionals (!config.boot.initrd.checkJournalingFS) [
+        "ext3"
+        "ext4"
+        "reiserfs"
+        "xfs"
+        "jfs"
+        "f2fs"
+      ];
      isBindMount = fs: builtins.elem "bind" fs.options;
      skipCheck = fs: fs.noCheck || fs.device == "none" || builtins.elem fs.fsType fsToSkipCheck || isBindMount fs;
      # https://wiki.archlinux.org/index.php/fstab#Filepath_spaces
      escape = string: builtins.replaceStrings [ " " "\t" ] [ "\\040" "\\011" ] string;
-    in fstabFileSystems: { rootPrefix ? "", excludeChecks ? false, extraOpts ? (fs: []) }: concatMapStrings (fs:
+    in fstabFileSystems: { rootPrefix ? "", extraOpts ? (fs: []) }: concatMapStrings (fs:
      (optionalString (isBindMount fs) (escape rootPrefix))
      + (if fs.device != null then escape fs.device
         else if fs.label != null then "/dev/disk/by-label/${escape fs.label}"
         else throw "No device specified for mount point ‘${fs.mountPoint}’.")
-      + " " + escape (rootPrefix + fs.mountPoint)
+      + " " + escape fs.mountPoint
      + " " + fs.fsType
      + " " + escape (builtins.concatStringsSep "," (fs.options ++ (extraOpts fs)))
-      + " " + (optionalString (!excludeChecks)
-        ("0 " + (if skipCheck fs then "0" else if fs.mountPoint == "/" then "1" else "2")))
+      + " 0 " + (if skipCheck fs then "0" else if fs.mountPoint == "/" then "1" else "2")
      + "\n"
    ) fstabFileSystems;

    initrdFstab = pkgs.writeText "initrd-fstab" (makeFstabEntries (filter utils.fsNeededForBoot fileSystems) {
      rootPrefix = "/sysroot";
-      excludeChecks = true;
      extraOpts = fs:
        (optional fs.autoResize "x-systemd.growfs")
        ++ (optional fs.autoFormat "x-systemd.makefs");
@ -328,7 +358,9 @@ in
        )}
      '';

-    boot.initrd.systemd.contents."/etc/fstab".source = initrdFstab;
+    boot.initrd.systemd.storePaths = [initrdFstab];
+    boot.initrd.systemd.managerEnvironment.SYSTEMD_SYSROOT_FSTAB = initrdFstab;
+    boot.initrd.systemd.services.initrd-parse-etc.environment.SYSTEMD_SYSROOT_FSTAB = initrdFstab;

    # Provide a target that pulls in all filesystems.
    systemd.targets.fs =
--- a/nixos/modules/virtualisation/ec2-metadata-fetcher.sh
+++ b/nixos/modules/virtualisation/ec2-metadata-fetcher.sh
@ -55,10 +55,9 @@ done
 echo "getting EC2 instance metadata..."

 get_imds() {
-  # Intentionally no --fail here, so that we proceed even if e.g. a
-  # 404 was returned (but we still fail if we can't reach the IMDS
-  # server).
-  curl --silent --show-error --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" "$@"
+  # --fail to avoid populating missing files with 404 HTML response body
+  # || true to allow the script to continue even when encountering a 404
+  curl --silent --show-error --fail --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" "$@" || true
 }

 get_imds -o "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -1101,15 +1101,17 @@ in
        what = "overlay";
        type = "overlay";
        options = "lowerdir=/sysroot/nix/.ro-store,upperdir=/sysroot/nix/.rw-store/store,workdir=/sysroot/nix/.rw-store/work";
-        wantedBy = ["local-fs.target"];
-        before = ["local-fs.target"];
-        requires = ["sysroot-nix-.ro\\x2dstore.mount" "sysroot-nix-.rw\\x2dstore.mount" "rw-store.service"];
-        after = ["sysroot-nix-.ro\\x2dstore.mount" "sysroot-nix-.rw\\x2dstore.mount" "rw-store.service"];
-        unitConfig.IgnoreOnIsolate = true;
+        wantedBy = ["initrd-fs.target"];
+        before = ["initrd-fs.target"];
+        requires = ["rw-store.service"];
+        after = ["rw-store.service"];
+        unitConfig.RequiresMountsFor = "/sysroot/nix/.ro-store";
      }];
      services.rw-store = {
-        after = ["sysroot-nix-.rw\\x2dstore.mount"];
-        unitConfig.DefaultDependencies = false;
+        unitConfig = {
+          DefaultDependencies = false;
+          RequiresMountsFor = "/sysroot/nix/.rw-store";
+        };
        serviceConfig = {
          Type = "oneshot";
          ExecStart = "/bin/mkdir -p -m 0755 /sysroot/nix/.rw-store/store /sysroot/nix/.rw-store/work /sysroot/nix/store";
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -238,6 +238,7 @@ in {
  freshrss-pgsql = handleTest ./freshrss-pgsql.nix {};
  frr = handleTest ./frr.nix {};
  fsck = handleTest ./fsck.nix {};
+  fsck-systemd-stage-1 = handleTest ./fsck.nix { systemdStage1 = true; };
  ft2-clone = handleTest ./ft2-clone.nix {};
  mimir = handleTest ./mimir.nix {};
  garage = handleTest ./garage {};
--- a/nixos/tests/fsck.nix
+++ b/nixos/tests/fsck.nix
@ -1,3 +1,9 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+, systemdStage1 ? false
+}:
+
 import ./make-test-python.nix {
  name = "fsck";

@ -11,13 +17,17 @@ import ./make-test-python.nix {
        autoFormat = true;
      };
    };
+
+    boot.initrd.systemd.enable = systemdStage1;
  };

  testScript = ''
    machine.wait_for_unit("default.target")

    with subtest("root fs is fsckd"):
-        machine.succeed("journalctl -b | grep 'fsck.ext4.*/dev/vda'")
+        machine.succeed("journalctl -b | grep '${if systemdStage1
+          then "fsck.*vda.*clean"
+          else "fsck.ext4.*/dev/vda"}'")

    with subtest("mnt fs is fsckd"):
        machine.succeed("journalctl -b | grep 'fsck.*/dev/vdb.*clean'")
--- a/nixos/tests/hadoop/hbase.nix
+++ b/nixos/tests/hadoop/hbase.nix
@ -53,6 +53,24 @@ with pkgs.lib;
        };
      };
    };
+    thrift = { ... }:{
+      services.hadoop = {
+        inherit coreSite;
+        hbase = {
+          inherit zookeeperQuorum;
+          thrift = defOpts;
+        };
+      };
+    };
+    rest = { ... }:{
+      services.hadoop = {
+        inherit coreSite;
+        hbase = {
+          inherit zookeeperQuorum;
+          rest = defOpts;
+        };
+      };
+    };
  };

  testScript = ''
@ -80,5 +98,12 @@ with pkgs.lib;
    assert "1 active master, 0 backup masters, 1 servers" in master.succeed("echo status | HADOOP_USER_NAME=hbase hbase shell -n")
    regionserver.wait_until_succeeds("echo \"create 't1','f1'\" | HADOOP_USER_NAME=hbase hbase shell -n")
    assert "NAME => 'f1'" in regionserver.succeed("echo \"describe 't1'\" | HADOOP_USER_NAME=hbase hbase shell -n")
+
+    rest.wait_for_open_port(8080)
+    assert "${hbase.version}" in regionserver.succeed("curl http://rest:8080/version/cluster")
+
+    thrift.wait_for_open_port(9090)
  '';
+
+  meta.maintainers = with maintainers; [ illustris ];
 })
--- a/nixos/tests/matrix/mjolnir.nix
+++ b/nixos/tests/matrix/mjolnir.nix
@ -107,7 +107,10 @@ import ../make-test-python.nix (
      client = { pkgs, ... }: {
        environment.systemPackages = [
          (pkgs.writers.writePython3Bin "create_management_room_and_invite_mjolnir"
-            { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
+            { libraries = with pkgs.python3Packages; [
+                matrix-nio
+              ] ++ matrix-nio.optional-dependencies.e2e;
+            } ''
            import asyncio

            from nio import (
--- a/nixos/tests/nixops/default.nix
+++ b/nixos/tests/nixops/default.nix
@ -30,12 +30,10 @@ let
        virtualisation.additionalPaths = [
          pkgs.hello
          pkgs.figlet
-
-          # This includes build dependencies all the way down. Not efficient,
-          # but we do need build deps to an *arbitrary* depth, which is hard to
-          # determine.
-          (allDrvOutputs nodes.server.config.system.build.toplevel)
        ];
+
+        # TODO: make this efficient, https://github.com/NixOS/nixpkgs/issues/180529
+        system.includeBuildDependencies = true;
      };
      server = { lib, ... }: {
        imports = [ ./legacy/base-configuration.nix ];
--- a/nixos/tests/openldap.nix
+++ b/nixos/tests/openldap.nix
@ -118,7 +118,7 @@ in {
    };
  };
  testScript = { nodes, ... }: let
-    specializations = "${nodes.machine.config.system.build.toplevel}/specialisation";
+    specializations = "${nodes.machine.system.build.toplevel}/specialisation";
    changeRootPw = ''
      dn: olcDatabase={1}mdb,cn=config
      changetype: modify
--- a/pkgs/applications/audio/blanket/default.nix
+++ b/pkgs/applications/audio/blanket/default.nix
@ -31,13 +31,13 @@ python3Packages.buildPythonApplication rec {
    pkg-config
    wrapGAppsHook4
    desktop-file-utils
+    gobject-introspection
  ];

  buildInputs = [
    glib
    gtk4
    libadwaita
-    gobject-introspection
    gst_all_1.gstreamer
    gst_all_1.gst-plugins-base
    gst_all_1.gst-plugins-good
@ -48,9 +48,6 @@ python3Packages.buildPythonApplication rec {
    pygobject3
  ];

-  # Broken with gobject-introspection setup hook
-  # https://github.com/NixOS/nixpkgs/issues/56943
-  strictDeps = false;
  format = "other";

  postPatch = ''
--- a/pkgs/applications/audio/cozy/default.nix
+++ b/pkgs/applications/audio/cozy/default.nix
@ -24,11 +24,6 @@ python3Packages.buildPythonApplication rec {
  pname = "cozy";
  version = "1.2.1";

-  # Temporary fix
-  # See https://github.com/NixOS/nixpkgs/issues/57029
-  # and https://github.com/NixOS/nixpkgs/issues/56943
-  strictDeps = false;
-
  src = fetchFromGitHub {
    owner = "geigi";
    repo = pname;
--- a/pkgs/applications/audio/easyeffects/default.nix
+++ b/pkgs/applications/audio/easyeffects/default.nix
@ -107,6 +107,5 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ jtojnar ];
    platforms = platforms.linux;
-    badPlatforms = [ "aarch64-linux" ];
  };
 }
--- a/pkgs/applications/audio/gpodder/default.nix
+++ b/pkgs/applications/audio/gpodder/default.nix
@ -27,17 +27,12 @@ python3Packages.buildPythonApplication rec {
    intltool
    wrapGAppsHook
    glibcLocales
+    gobject-introspection
  ];

-  # as of 2021-07, the gobject-introspection setup hook does not
-  # work with `strictDeps` enabled, thus for proper `wrapGAppsHook`
-  # it needs to be disabled explicitly. https://github.com/NixOS/nixpkgs/issues/56943
-  strictDeps = false;
-
  buildInputs = [
    python3
    gtk3
-    gobject-introspection
    gnome.adwaita-icon-theme
  ];

--- a/pkgs/applications/audio/pulseaudio-dlna/default.nix
+++ b/pkgs/applications/audio/pulseaudio-dlna/default.nix
@ -43,7 +43,7 @@ python3Packages.buildPythonApplication {
    notify2
    pyroute2
    pygobject3
-    PyChromecast
+    pychromecast
    lxml
    setuptools
    zeroconf
--- a/pkgs/applications/audio/pulseeffects-legacy/default.nix
+++ b/pkgs/applications/audio/pulseeffects-legacy/default.nix
@ -110,6 +110,5 @@ in stdenv.mkDerivation rec {
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
-    badPlatforms = [ "aarch64-linux" ];
  };
 }
--- a/pkgs/applications/audio/snd/default.nix
+++ b/pkgs/applications/audio/snd/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "snd";
-  version = "23.0";
+  version = "23.1";

  src = fetchurl {
    url = "mirror://sourceforge/snd/snd-${version}.tar.gz";
-    sha256 = "sha256-WnQtXr1IcOpNJBrSvLf2rNu2XPs8JU01LWsQSzvvivA=";
+    sha256 = "sha256-zNXA/HFUCTxKzeKde/XVK239dInnxkPBmxXrlicl1fI=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/audio/sonata/default.nix
+++ b/pkgs/applications/audio/sonata/default.nix
@ -39,10 +39,6 @@ in buildPythonApplication rec {
    setuptools
  ];

-  # Otherwise the setup hook for gobject-introspection is not run:
-  # https://github.com/NixOS/nixpkgs/issues/56943
-  strictDeps = false;
-
  postPatch = ''
    # Remove "Local MPD" tab which is not suitable for NixOS.
    sed -i '/localmpd/d' sonata/consts.py
--- a/pkgs/applications/audio/spotify-player/default.nix
+++ b/pkgs/applications/audio/spotify-player/default.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "spotify-player";
-  version = "0.12.0";
+  version = "0.12.1";

  src = fetchFromGitHub {
    owner = "aome510";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-nWXXaRHTzCXmu4eKw88pKuWXgdG9n7azPeBbXYz+Fio=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-KHbeCnsdHP7Zsj9KeVLuumcVOW6m7Tz1GgBBQ25Rbyo=";
  };

-  cargoHash = "sha256-y/qHiwZes4nVtjbFN/jL2LFugGpRKnYij7+XXZbqguQ=";
+  cargoHash = "sha256-51xKCiGdvJ8k9ArWBCazJGgRljqHxZiyTdes4i7JZH8=";

  nativeBuildInputs = [
    pkg-config
@ -46,6 +46,7 @@ rustPlatform.buildRustPackage rec {
  meta = with lib; {
    description = "A command driven spotify player";
    homepage = "https://github.com/aome510/spotify-player";
+    changelog = "https://github.com/aome510/spotify-player/releases/tag/v${version}";
    mainProgram = "spotify_player";
    license = licenses.mit;
    maintainers = with maintainers; [ dit7ya ];
--- a/pkgs/applications/audio/sublime-music/default.nix
+++ b/pkgs/applications/audio/sublime-music/default.nix
@ -70,15 +70,11 @@ python3Packages.buildPythonApplication rec {
    requests
    semver
  ]
-  ++ lib.optional chromecastSupport PyChromecast
+  ++ lib.optional chromecastSupport pychromecast
  ++ lib.optional keyringSupport keyring
  ++ lib.optional serverSupport bottle
  ;

-  # hook for gobject-introspection doesn't like strictDeps
-  # https://github.com/NixOS/nixpkgs/issues/56943
-  strictDeps = false;
-
  nativeCheckInputs = with python3Packages; [
    pytest
  ];
--- a/pkgs/applications/audio/tauon/default.nix
+++ b/pkgs/applications/audio/tauon/default.nix
@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
    plexapi
    pulsectl
    pycairo
-    PyChromecast
+    pychromecast
    pylast
    pygobject3
    pylyrics
--- a/pkgs/applications/audio/touchosc/default.nix
+++ b/pkgs/applications/audio/touchosc/default.nix
@ -45,7 +45,7 @@ in

 stdenv.mkDerivation rec {
  pname = "touchosc";
-  version = "1.1.6.150";
+  version = "1.1.9.163";

  suffix = {
    aarch64-linux = "linux-arm64";
@ -56,9 +56,9 @@ stdenv.mkDerivation rec {
  src = fetchurl {
    url = "https://hexler.net/pub/${pname}/${pname}-${version}-${suffix}.deb";
    hash = {
-      aarch64-linux = "sha256-sYkAFyXnmzgSzo68OF0oiv8tUvY+g1WCcY783OZO+RM=";
-      armv7l-linux  = "sha256-GWpYW1262plxIzPVzBEh4Z3fQIhSmy0N9xAgwnjXrQE=";
-      x86_64-linux  = "sha256-LUWlLEsTUqVoWAkjXC/zOziPqO85H8iIlwJU7eqLRcY=";
+      aarch64-linux = "sha256-LhF0pgMRbEXeLt5g56VBNuCssaTjsczx/+C76ckmGZo=";
+      armv7l-linux  = "sha256-T4AzXIbhO6fNN8xDFwz6M2lSH6hLgNjVyDsSt8m+Mr4=";
+      x86_64-linux  = "sha256-LJ36kHx8PPzfLpJMx1ANSmifS84saCQ8pF0quhgzdt0=";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

--- a/pkgs/applications/audio/touchosc/update.sh
+++ b/pkgs/applications/audio/touchosc/update.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p nix curl libxml2 jq common-updater-scripts
+#!nix-shell -i bash -p nix curl libxml2 jq

 set -euo pipefail

@ -8,6 +8,20 @@ nixpkgs="$(git rev-parse --show-toplevel || (printf 'Could not find root of nixp
 attr="${UPDATE_NIX_ATTR_PATH:-touchosc}"
 version="$(curl -sSL https://hexler.net/touchosc/appcast/linux | xmllint --xpath '/rss/channel/item/enclosure/@*[local-name()="version"]' - | cut -d= -f2- | tr -d '"' | head -n1)"

+narhash() {
+    nix --extra-experimental-features nix-command store prefetch-file --json "$url" | jq -r .hash
+}
+
+nixeval() {
+    if [ "$#" -ge 2 ]; then
+        systemargs=(--argstr system "$2")
+    else
+        systemargs=()
+    fi
+
+    nix --extra-experimental-features nix-command eval --json --impure "${systemargs[@]}" -f "$nixpkgs" "$1" | jq -r .
+}
+
 findpath() {
    path="$(nix --extra-experimental-features nix-command eval --json --impure -f "$nixpkgs" "$1.meta.position" | jq -r . | cut -d: -f1)"
    outpath="$(nix --extra-experimental-features nix-command eval --json --impure --expr "builtins.fetchGit \"$nixpkgs\"")"
@ -19,15 +33,22 @@ findpath() {
    echo "$path"
 }

+oldversion="${UPDATE_NIX_OLD_VERSION:-$(nixeval "$attr".version)}"
+
 pkgpath="$(findpath "$attr")"

-sed -i -e "/version\s*=/ s|\"$UPDATE_NIX_OLD_VERSION\"|\"$version\"|" "$pkgpath"
+if [ "$version" = "$oldversion" ]; then
+    echo 'update.sh: New version same as old version, nothing to do.'
+    exit 0
+fi
+
+sed -i -e "/version\s*=/ s|\"$oldversion\"|\"$version\"|" "$pkgpath"

 for system in aarch64-linux armv7l-linux x86_64-linux; do
-    url="$(nix --extra-experimental-features nix-command eval --json --impure --argstr system "$system" -f "$nixpkgs" "$attr".src.url | jq -r .)"
+    url="$(nixeval "$attr".src.url "$system")"

-    curhash="$(nix --extra-experimental-features nix-command eval --json --impure --argstr system "$system" -f "$nixpkgs" "$attr".src.outputHash | jq -r .)"
-    newhash="$(nix --extra-experimental-features nix-command store prefetch-file --json "$url" | jq -r .hash)"
+    curhash="$(nixeval "$attr".src.outputHash "$system")"
+    newhash="$(narhash "$url")"

    sed -i -e "s|\"$curhash\"|\"$newhash\"|" "$pkgpath"
 done
--- a/pkgs/applications/blockchains/clightning/default.nix
+++ b/pkgs/applications/blockchains/clightning/default.nix
@ -18,15 +18,15 @@
 , zlib
 }:
 let
-  py3 = python3.withPackages (p: [ p.Mako ]);
+  py3 = python3.withPackages (p: [ p.mako ]);
 in
 stdenv.mkDerivation rec {
  pname = "clightning";
-  version = "23.02";
+  version = "23.02.2";

  src = fetchurl {
    url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    sha256 = "sha256-uvk7sApIwlrkH8eERBetf/nsAkN2d35T/IEtICFflzY=";
+    sha256 = "sha256-fHGBwf79Q0DSLs/b+Lhg9kdIQzDn5rJYEB9yLkLbxlE=";
  };

  # when building on darwin we need dawin.cctools to provide the correct libtool
--- a/pkgs/applications/editors/bless/default.nix
+++ b/pkgs/applications/editors/bless/default.nix
@ -66,6 +66,5 @@ stdenv.mkDerivation rec {
    maintainers = [ maintainers.mkg20001 ];
    license = licenses.gpl2;
    platforms = platforms.linux;
-    badPlatforms = [ "aarch64-linux" ];
  };
 }
--- a/pkgs/applications/editors/codeblocks/default.nix
+++ b/pkgs/applications/editors/codeblocks/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, file, zip, wxGTK31, gtk3
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, file, zip, wxGTK32, gtk3
 , contribPlugins ? false, hunspell, gamin, boost, wrapGAppsHook
 }:

@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ pkg-config file zip wrapGAppsHook ];
-  buildInputs = [ wxGTK31 gtk3 ]
+  buildInputs = [ wxGTK32 gtk3 ]
    ++ lib.optionals contribPlugins [ hunspell gamin boost ];
  enableParallelBuilding = true;
  patches = [
@ -47,11 +47,74 @@ stdenv.mkDerivation rec {
      url = "https://github.com/arnholm/codeblocks_sfmirror/commit/2345b020b862ec855038dd32a51ebb072647f28d.patch";
      sha256 = "sha256-RRjwZA37RllnG8cJdBEnASpEd8z0+ru96fjntO42OvU=";
    })
+    (fetchpatch {
+      name = "fix-taskbar-icons.patch";
+      url = "https://github.com/arnholm/codeblocks_sfmirror/commit/40eb88e3f2b933f19f9933e06c8d0899c54f5e25.patch";
+      hash = "sha256-Gj5gtxX5QNYAeF+QrPS/bBHLLEmflSxUHSLUK3GSs0I=";
+    })
+    (fetchpatch {
+      name = "fix-warnings.patch";
+      url = "https://github.com/arnholm/codeblocks_sfmirror/commit/56ac0396fad7a5b4bbb40bb8c4b5fe1755078aef.patch";
+      excludes = [ "src/src/environmentsettingsdlg.h" ];
+      hash = "sha256-tl4rF9iAf1TzCIbKhVFqcxvr1IiPdwqLYZg0SY5BJ7I=";
+    })
    (fetchpatch {
      name = "fix-getstring.patch";
      url = "https://github.com/arnholm/codeblocks_sfmirror/commit/dbdf5c5ea9e3161233f0588a7616b7e4fedc7870.patch";
      sha256 = "sha256-DrEMFluN8vs0LERa7ULGshl7HdejpsuvXAMjIr/K1fQ=";
    })
+    # Fix build with wxGTK 3.1.6
+    (fetchpatch {
+      name = "remove-code-for-old-wx-1.patch";
+      url = "https://github.com/arnholm/codeblocks_sfmirror/commit/8035dfdff321754819f79e3165401aa59bd8c7f7.patch";
+      hash = "sha256-Z8Ap03W/XH5VwKFVudJr7rugb0BgI2dKJgQS4yIWbEM=";
+    })
+    (fetchpatch {
+      name = "remove-code-for-old-wx-2.patch";
+      url = "https://github.com/arnholm/codeblocks_sfmirror/commit/9a9c6a9d5e3e0f6eff5594ecd61a2222f073be9c.patch";
+      hash = "sha256-SwYixvbRuXQ+jA1ijmClWkzqzzr0viVuFOAsihGc5dM=";
+    })
+    (fetchpatch {
+      name = "remove-code-for-old-wx-3.patch";
+      url = "https://github.com/arnholm/codeblocks_sfmirror/commit/c28746f4887f10e6f9f10eeafae0fb22ecdbf9c7.patch";
+      hash = "sha256-1lcIiCnY2nBuUsffXC2rdglOE3ccIbogcgTx4M2Ee2I=";
+    })
+    (fetchpatch {
+      name = "fix-notebookstyles.patch";
+      url = "https://github.com/arnholm/codeblocks_sfmirror/commit/29315df024251850832583f73e67e515dae10830.patch";
+      hash = "sha256-Uc1V0eEbNljnN+1Dqb/35MLSSoLjyuRZMTofgcXRyb8=";
+    })
+    (fetchpatch {
+      name = "fix-regex.patch";
+      url = "https://github.com/arnholm/codeblocks_sfmirror/commit/46720043319758cb0e798eb23520063583c40eaa.patch";
+      hash = "sha256-Aix58T0JJcX/7VZukU/9i/nXh9GJywXC3yXEyUZK0js=";
+    })
+    (fetchpatch {
+      name = "fix-build-with-clang.patch";
+      url = "https://github.com/arnholm/codeblocks_sfmirror/commit/92cb2239662952e3b59b31e03edd653bb8066e64.patch";
+      hash = "sha256-XI7JW9Nuueb7muKpaC2icM/CxhrCJtO48cLHK+BVWXI=";
+    })
+    (fetchpatch {
+      name = "fix-normalize.patch";
+      url = "https://github.com/archlinux/svntogit-community/raw/458eacb60bc0e71e3d333943cebbc41e75ed0956/trunk/sc_wxtypes-normalize.patch";
+      hash = "sha256-7wEwDLwuNUWHUwHjFyq74sHiuEha1VexRLEX42rPZSs=";
+    })
+    # Fix HiDPI
+    (fetchpatch {
+      name = "update-about-dialog.patch";
+      url = "https://github.com/arnholm/codeblocks_sfmirror/commit/a4aacc92640b587ad049cd6aa68c637e536e9ab5.patch";
+      hash = "sha256-2S4sVn+Dq5y9xcxCkzQ+WeR+qWxAOLbQUZEnk060RI0=";
+    })
+    (fetchpatch {
+      name = "add-display-info.patch";
+      url = "https://github.com/arnholm/codeblocks_sfmirror/commit/f2f127cf5cd97c7da6a957a3f7764cb25cc9017e.patch";
+      hash = "sha256-C0dVfC0NIHMXfWNlOwjzoGz5tmG2dlnU/EE92Jjebbs=";
+    })
+    (fetchpatch {
+      name = "fix-hidpi.patch";
+      url = "https://github.com/arnholm/codeblocks_sfmirror/commit/b2e4f1279804e1d11b71bc75eeb37072c3589296.patch";
+      hash = "sha256-/Xp6ww9C3V6I67tTA4MrGpSGo3J0MXzFjzQU7RxY84U=";
+    })
  ];
  preConfigure = "substituteInPlace ./configure --replace /usr/bin/file ${file}/bin/file";
  postConfigure = lib.optionalString stdenv.isLinux "substituteInPlace libtool --replace ldconfig ${stdenv.cc.libc.bin}/bin/ldconfig";
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@ -45,6 +45,7 @@
  else if withAthena then "athena"
  else "lucid")
 , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, systemd
+, withTreeSitter ? lib.versionAtLeast version "29", tree-sitter ? null
 }:

 assert (libXft != null) -> libpng != null;      # probably a bug
@ -58,6 +59,7 @@ assert withGTK2 -> !withGTK3 && gtk2-x11 != null && !withPgtk;
 assert withGTK3 -> !withGTK2 && ((gtk3-x11 != null) || withPgtk);
 assert withPgtk -> withGTK3 && !withX && gtk3 != null;
 assert withXwidgets -> withGTK3 && webkitgtk != null;
+assert withTreeSitter -> tree-sitter != null;


 (if withMacport then llvmPackages_6.stdenv else stdenv).mkDerivation (finalAttrs: (lib.optionalAttrs nativeComp {
@ -164,7 +166,8 @@ assert withXwidgets -> withGTK3 && webkitgtk != null;
      ImageCaptureCore GSS ImageIO
    ]
    ++ lib.optionals stdenv.isDarwin [ sigtool ]
-    ++ lib.optionals nativeComp [ libgccjit ];
+    ++ lib.optionals nativeComp [ libgccjit ]
+    ++ lib.optionals withTreeSitter [ tree-sitter ];

  hardeningDisable = [ "format" ];

@ -193,6 +196,7 @@ assert withXwidgets -> withGTK3 && webkitgtk != null;
    ++ lib.optional withImageMagick "--with-imagemagick"
    ++ lib.optional withXinput2 "--with-xinput2"
    ++ lib.optional (!withToolkitScrollBars) "--without-toolkit-scroll-bars"
+    ++ lib.optional withTreeSitter "--with-tree-sitter"
  ;

  installTargets = [ "tags" "install" ];
@ -241,6 +245,7 @@ assert withXwidgets -> withGTK3 && webkitgtk != null;

  passthru = {
    inherit nativeComp;
+    treeSitter = withTreeSitter;
    pkgs = recurseIntoAttrs (emacsPackagesFor finalAttrs.finalPackage);
    tests = { inherit (nixosTests) emacs-daemon; };
  };
--- a/pkgs/applications/editors/leo-editor/default.nix
+++ b/pkgs/applications/editors/leo-editor/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "leo-editor";
-  version = "6.7.1";
+  version = "6.7.2";

  src = fetchFromGitHub {
    owner = "leo-editor";
    repo = "leo-editor";
    rev = version;
-    sha256 = "sha256-4sD/gN9cbgZ9Z5Xiyx2velX5q6J6vOQAeRor10Zamyw=";
+    sha256 = "sha256-n9Ze02Dvoci3QS5slJNpb3CI3zlTq6FsdVbxvZHCJ2A=";
  };

  dontBuild = true;
--- a/pkgs/applications/editors/neovim/tests/default.nix
+++ b/pkgs/applications/editors/neovim/tests/default.nix
@ -157,6 +157,28 @@ rec {
    '';
  });

+  # check that the vim-doc hook correctly generates the tag
+  # for neovim packages from luaPackages
+  # we know for a fact gitsigns-nvim has a doc folder and comes from luaPackages
+  checkForTagsLuaPackages = vimPlugins.gitsigns-nvim.overrideAttrs(oldAttrs: {
+    doInstallCheck = true;
+    installCheckPhase = ''
+      [ -f $out/doc/tags ]
+    '';
+  });
+
+  nvim_with_gitsigns_plugin = neovim.override {
+    extraName = "-with-gitsigns-plugin";
+    configure.packages.plugins = {
+      start = [
+        vimPlugins.gitsigns-nvim
+      ];
+    };
+  };
+  checkHelpLuaPackages = runTest nvim_with_gitsigns_plugin ''
+    export HOME=$TMPDIR
+    ${nvim_with_gitsigns_plugin}/bin/nvim -i NONE -c 'help gitsigns' +quitall! -e
+  '';

  # nixpkgs should detect that no wrapping is necessary
  nvimShouldntWrap = wrapNeovim2 "-should-not-wrap" nvimAutoDisableWrap;
--- a/pkgs/applications/editors/rednotebook/default.nix
+++ b/pkgs/applications/editors/rednotebook/default.nix
@ -30,10 +30,6 @@ buildPythonApplication rec {
    "--suffix XDG_DATA_DIRS : $XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
  ];

-  # Until gobject-introspection in nativeBuildInputs is supported.
-  # https://github.com/NixOS/nixpkgs/issues/56943#issuecomment-472568643
-  strictDeps = false;
-
  meta = with lib; {
    homepage = "https://rednotebook.sourceforge.io/";
    changelog = "https://github.com/jendrikseipp/rednotebook/blob/v${version}/CHANGELOG.md";
--- a/pkgs/applications/emulators/dolphin-emu/default.nix
+++ b/pkgs/applications/emulators/dolphin-emu/default.nix
@ -135,9 +135,6 @@ stdenv.mkDerivation rec {
    "--set QT_QPA_PLATFORM xcb"
  ];

-  # https://github.com/NixOS/nixpkgs/issues/201254
-  NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
-
  # Use nix-provided libraries instead of submodules
  postPatch = lib.optionalString stdenv.isDarwin ''
    substituteInPlace CMakeLists.txt \
--- a/pkgs/applications/emulators/retroarch/cores.nix
+++ b/pkgs/applications/emulators/retroarch/cores.nix
@ -49,7 +49,7 @@ let
  mkLibretroCore =
    { core
    , src ? (getCoreSrc core)
-    , version ? "unstable-2022-12-20"
+    , version ? "unstable-2023-03-13"
    , ...
    }@args:
    import ./mkLibretroCore.nix ({
@ -400,8 +400,6 @@ in
    core = "flycast";
    extraBuildInputs = [ libGL libGLU ];
    makefile = "Makefile";
-    makeFlags = lib.optionals stdenv.hostPlatform.isAarch64 [ "platform=arm64" ];
-    patches = [ ./fix-flycast-makefile.patch ];
    meta = {
      description = "Flycast libretro port";
      license = lib.licenses.gpl2Only;
@ -734,9 +732,7 @@ in

  picodrive = mkLibretroCore {
    core = "picodrive";
-    version = "unstable-2023-02-15";
    dontConfigure = true;
-    makeFlags = lib.optionals stdenv.hostPlatform.isAarch64 [ "platform=aarch64" ];
    meta = {
      description = "Fast MegaDrive/MegaCD/32X emulator";
      license = "MAME";
@ -822,8 +818,19 @@ in
    };
  };

-  scummvm = mkLibretroCore {
+  scummvm = mkLibretroCore rec {
    core = "scummvm";
+    version = "unstable-2022-04-06";
+    # Commit below introduces libretro platform, that uses libretro-{deps,common} as
+    # submodules. We will probably need to introduce this as separate derivations,
+    # but for now let's just use the last known version that does not use it.
+    # https://github.com/libretro/scummvm/commit/36446fa6eb33e67cc798f56ce1a31070260e2ada
+    src = fetchFromGitHub {
+      owner = "libretro";
+      repo = core;
+      rev = "2fb2e4c551c9c1510c56f6e890ee0300b7b3fca3";
+      hash = "sha256-wrlFqu+ONbYH4xMFDByOgySobGrkhVc7kYWI4JzA4ew=";
+    };
    extraBuildInputs = [ fluidsynth libjpeg libvorbis libGLU libGL ];
    makefile = "Makefile";
    preConfigure = "cd backends/platform/libretro/build";
--- a/pkgs/applications/emulators/retroarch/default.nix
+++ b/pkgs/applications/emulators/retroarch/default.nix
@ -52,26 +52,17 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "retroarch-bare";
-  version = "1.14.0";
+  version = "1.15.0";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "RetroArch";
-    hash = "sha256-oEENGehbzjJq1kTiz6gkXHMMe/rXjWPxxMoe4RqdqK4=";
+    hash = "sha256-kJOR3p3fKqGM8a5rgDPkz43uuf5AtS5fVnvr3tJgWbc=";
    rev = "v${version}";
  };

  patches = [
    ./use-default-values-for-libretro_info_path-assets_directory.patch
-    # TODO: remove those two patches in the next RetroArch release
-    (fetchpatch {
-      url = "https://github.com/libretro/RetroArch/commit/894c44c5ea7f1eada9207be3c29e8d5c0a7a9e1f.patch";
-      hash = "sha256-ThB6jd9pmsipT8zjehz7znK/s0ofHHCJeEYBKur6sO8=";
-    })
-    (fetchpatch {
-      url = "https://github.com/libretro/RetroArch/commit/c5bfd52159cf97312bb28fc42203c39418d1bbbd.patch";
-      hash = "sha256-rb1maAvCSUgq2VtJ67iqUY+Fz00Fchl8YGG0EPm0+F0=";
-    })
  ];

  nativeBuildInputs = [ pkg-config wrapQtAppsHook ] ++
--- a/pkgs/applications/emulators/retroarch/fix-flycast-makefile.patch
+++ b/pkgs/applications/emulators/retroarch/fix-flycast-makefile.patch
@ -1,12 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 01d99c30..8c2dd248 100644
--- a/Makefile
-+++ b/Makefile
-@@ -440,7 +440,6 @@ else ifeq ($(platform), arm64)
- 	CPUFLAGS += -DTARGET_LINUX_ARMv8 -frename-registers
- 	CFLAGS += $(CPUFLAGS)
- 	CXXFLAGS += $(CPUFLAGS)
-	ASFLAGS += $(CFLAGS) -c -frename-registers -fno-strict-aliasing -ffast-math -ftree-vectorize
- 	PLATFORM_EXT := unix
- 	WITH_DYNAREC=arm64
- 	HAVE_GENERIC_JIT = 0
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@ -14,38 +14,38 @@
    "beetle-lynx": {
        "owner": "libretro",
        "repo": "beetle-lynx-libretro",
-        "rev": "9c48124dc15604b3eb6892e3616dfb77992a6fd6",
-        "sha256": "ZXFU4QmjVQVU5bE5TVmGm4gepZpuoS8+p60l+Ha4I9s="
+        "rev": "3ca44fda26f27418c92ada1b0f38b948af2151ae",
+        "sha256": "f0A8gA3UT40UDaAkWQcPoDd6vAcM37tNtZ2hCOIyBJA="
    },
    "beetle-ngp": {
        "owner": "libretro",
        "repo": "beetle-ngp-libretro",
-        "rev": "00c7cb8ea97ad9a372307405d8abf34e401fec8a",
-        "sha256": "MtZMPjgT4dQy+E+4jSDE08PRi0pwa+q48kmTHhfIQMY="
+        "rev": "65460e3a9ad529f6901caf669abbda11f437ab55",
+        "sha256": "+xfD1ZMKtbv5Lp12+5RM7Vl3eEF38kykKW8wj/2EN5w="
    },
    "beetle-pce-fast": {
        "owner": "libretro",
        "repo": "beetle-pce-fast-libretro",
-        "rev": "d4fa4480f17f067c3aba25380717a5aee059f026",
-        "sha256": "t7OJuqEWec3GvNq9dsmrRhgz+GybBzt1ZO6FwZ9L5yE="
+        "rev": "e480f6388375f59fd3e7aeef8ef8531c20e5c73e",
+        "sha256": "uURt6rB0IngWzEpl0DjbckdaTIjNwVCm3auvy7AwUdA="
    },
    "beetle-pcfx": {
        "owner": "libretro",
        "repo": "beetle-pcfx-libretro",
-        "rev": "af16dfd8353ed6cf76ef381b98a6a9abf59051ec",
-        "sha256": "snAA5PCU2NRsCiQtBRYEzczPSGG9OT2jDTrGaPZqhic="
+        "rev": "724bd21b4524f8cf376dbc29c3e5a12cb674c758",
+        "sha256": "xeIVZ8FWGbETWYRIBNs3Yum7FDit5fb77hhH+RU45BY="
    },
    "beetle-psx": {
        "owner": "libretro",
        "repo": "beetle-psx-libretro",
-        "rev": "3827fb4bd0d36f0db7b59e0c220524c7daaf0430",
-        "sha256": "CGNzb6XDPsp+EitkgyvDha9DoZSy+e9JWye0nmCiOns="
+        "rev": "fd812d4cf8f65644faef1ea8597f826ddc37c0a0",
+        "sha256": "yvMgnY2dGUk8TvvfDklN3f6b1ol7vDu6AJcYzdwy9pI="
    },
    "beetle-saturn": {
        "owner": "libretro",
        "repo": "beetle-saturn-libretro",
-        "rev": "19ce186783174b93b90845c3f0e1fa1694904912",
-        "sha256": "mEuv9lrDi/q2ASV9hxYptievupcv4PfUWPYlDcNzXQg="
+        "rev": "9bd31a4a42d06ca0f6d30ee38a569e57c150c414",
+        "sha256": "RHvH9Jp6c4cgEMTo+p+dU7qgJqjPbRqJLURadjAysrM="
    },
    "beetle-snes": {
        "owner": "libretro",
@ -62,20 +62,20 @@
    "beetle-supergrafx": {
        "owner": "libretro",
        "repo": "beetle-supergrafx-libretro",
-        "rev": "787772dff157c8fe54b2e16bb770f2c344c8932b",
-        "sha256": "i4SnjIqA0U88FnaT7fz5fqMyp8FyfNvxxhflOaAv1mA="
+        "rev": "1ff2daa9377114d5394142f75f1c388b706567ed",
+        "sha256": "0FCm9kURtUQpyPb8cSmRAxttnUJnhE3EWV8DPvlj8HE="
    },
    "beetle-vb": {
        "owner": "libretro",
        "repo": "beetle-vb-libretro",
-        "rev": "3e845666d7ce235a071eb306e94074f1a72633bf",
-        "sha256": "ukKzG+O2o6EAF0l7cmMQOkemJ1oweIpRH5rle1gqaFk="
+        "rev": "dd6393f76ff781df0f4e8c953f5b053b1e61b313",
+        "sha256": "C8OtTNdC7GNFsY2EH56in35IX8d6ou/1R04kMvM9674="
    },
    "beetle-wswan": {
        "owner": "libretro",
        "repo": "beetle-wswan-libretro",
-        "rev": "cccee4217e53e164fd70196e56dfb24b967e5fd8",
-        "sha256": "RpGYQwDWkfYY0qnrTuAMzVuOSfTX5AZph7FD8ijUggc="
+        "rev": "81e8b2afd31b7f0f939a3df6d70c8723bcc8a701",
+        "sha256": "xmDtMC5pId5X4vf9kHO55HmRpp/4ZruOM8QJSl//9R8="
    },
    "blastem": {
        "owner": "libretro",
@ -92,8 +92,8 @@
    "bsnes": {
        "owner": "libretro",
        "repo": "bsnes-libretro",
-        "rev": "dabf6679024124b2f819c79f279dbb85a5263255",
-        "sha256": "iv8gxC48i8JMzby3vR4eYDViqCwSf8JGlPekQE6AF4c="
+        "rev": "4da970a334ba4644cef72e560985ea3f31fa40f7",
+        "sha256": "Bu5j1wrMNVMmxQULZwTdXyWi2i6F5C6m8wFDxvtjYdI="
    },
    "bsnes-hd": {
        "owner": "DerKoun",
@ -110,8 +110,8 @@
    "citra": {
        "owner": "libretro",
        "repo": "citra",
-        "rev": "f0b09a5c0cb3767d43f5f8ca12a783012298fd44",
-        "sha256": "v86R5TLmNNMhuTMCwU3mAAtLK5H0sP//soh4x+cFgTQ=",
+        "rev": "d7e1612c17b1acb5d5eb68bb046820db49aeea5e",
+        "sha256": "u2XwAudFgI7j/k6Bq5fk874aI6KpZawlBoIs2+M+eZY=",
        "fetchSubmodules": true
    },
    "desmume": {
@ -153,14 +153,14 @@
    "fbneo": {
        "owner": "libretro",
        "repo": "fbneo",
-        "rev": "ef17049274a21239e5f21198b026dacbb38d7b90",
-        "sha256": "2N7c5L9grp+Rkhj25SoB9K9rVHq4H9IzU2KSeb1O7/E="
+        "rev": "ffcd114b8ea3f3387b66997263ea5df358675aa5",
+        "sha256": "a4hXRluHQY5hC5jFU2mlqUAI5GmQk6Rbl1HNRA929CI="
    },
    "fceumm": {
        "owner": "libretro",
        "repo": "libretro-fceumm",
-        "rev": "8c3f690e61a1d65dfb25510426ae88eeae93e1ae",
-        "sha256": "vzPrAEII8SWj3Ki2OaZb0/9gbQDz04rp2dXf2LE1sXg="
+        "rev": "1fa798b220a6df8417dcf7da0ab117533385d9c2",
+        "sha256": "B1iHZ7BVaM/GBgdD2jNZIEmXcRqKC6YaO9z1ByocMtE="
    },
    "flycast": {
        "owner": "libretro",
@ -183,20 +183,20 @@
    "gambatte": {
        "owner": "libretro",
        "repo": "gambatte-libretro",
-        "rev": "7e02df60048db0898131ea365f387a026e4e648d",
-        "sha256": "RnFuD8PL+/uPhWe+sSXMPm5+XH8FzCwY+MSquR/AB+o="
+        "rev": "ea563fac40e281b29d37f6b56657abef8f1aaf0d",
+        "sha256": "2jVbEsGkvdH1lA2//mb2Rm3xeh4EyFUcOUXdydSisvk="
    },
    "genesis-plus-gx": {
        "owner": "libretro",
        "repo": "Genesis-Plus-GX",
-        "rev": "74a2f6521aea975a51f99497b57c5db500d61ed9",
-        "sha256": "qTNbFXg5QFKSzMOWhDdDfc0FinF/D7n2OruG5zv+ANY="
+        "rev": "f6a9bd72a56a11c2068be2d15fa52dda3e1e8027",
+        "sha256": "4siJGPRMpXHfP6mBPoDJArNaISTNjPKT69cvtGldadI="
    },
    "gpsp": {
        "owner": "libretro",
        "repo": "gpsp",
-        "rev": "81649a2c8075201bb823cce8fdf16a31c92a3b6c",
-        "sha256": "De9Tke+fp6CtXzm0w6Qzts3jj1j/1uB0kYZfaWyNqA0="
+        "rev": "541adc9e1c6c9328c07058659594d6300ae0fa19",
+        "sha256": "2iv/gMOgTZReDgVzEc3WyOdAlYgfANK08CtpZIyPxgA="
    },
    "gw": {
        "owner": "libretro",
@ -207,8 +207,8 @@
    "handy": {
        "owner": "libretro",
        "repo": "libretro-handy",
-        "rev": "517bb2d02909271836604c01c8f09a79ad605297",
-        "sha256": "Igf/OvmnCzoWjCZBoep7T0pXsoBKq3NJpXlYhE7nr3s="
+        "rev": "63db085af671bad2929078c55434623b7d4632a1",
+        "sha256": "N6M3KSU4NPJCqoG/UMrna9/6H5PsBBMUQLrvqiIdxpE="
    },
    "hatari": {
        "owner": "libretro",
@ -219,8 +219,8 @@
    "mame": {
        "owner": "libretro",
        "repo": "mame",
-        "rev": "85581d60bb24fea14542b154aef2c7b624f5b60f",
-        "sha256": "AUqJAXJCvddv9vPqXt5EZncKNdeLaXoc6xhYWqOMebY="
+        "rev": "f7761a9902d59030882c58d4482446196e748c50",
+        "sha256": "g37WAMt9iBbAYq4DfeTlHWmdW5/Vl7g90v6vCLmMQ3g="
    },
    "mame2000": {
        "owner": "libretro",
@ -237,8 +237,8 @@
    "mame2003-plus": {
        "owner": "libretro",
        "repo": "mame2003-plus-libretro",
-        "rev": "3249de7ceaaa92ee18e93cbd8c2ace9f1ee34c08",
-        "sha256": "mBF1j4em4e/fKEmPA8MmAZrXXYQiqFfAloOHdMbVq+k="
+        "rev": "0b9309d9d86aea2457df74709e997bea37899475",
+        "sha256": "US0nkEH4EeKRejuN8UoDeLt5dhafuo7PEVx0FnpeUG0="
    },
    "mame2010": {
        "owner": "libretro",
@ -267,7 +267,7 @@
    "mesen": {
        "owner": "libretro",
        "repo": "mesen",
-        "rev": "c89474c9d87df967d21b7b7d5971dc9475fec028",
+        "rev": "caa4e6f14373c40bd2805c600d1b476e7616444a",
        "sha256": "cnPNBWXbnCpjgW/wJIboiRBzv3zrHWxpNM1kg09ShLU="
    },
    "mesen-s": {
@ -285,45 +285,45 @@
    "mgba": {
        "owner": "libretro",
        "repo": "mgba",
-        "rev": "ec5ecb26deba8d7ac830fc66ade9fac0eeaeb4ae",
-        "sha256": "kDDs+M7TPu6UhFnj9+XGI9whQFQ5/+7fSb0YUN7oMsg="
+        "rev": "a69c3434afe8b26cb8f9463077794edfa7d5efad",
+        "sha256": "rmitsZzRWJ0VYzcNz/UtIK8OscQ4lkyuAwgfXOvSTzg="
    },
    "mupen64plus": {
        "owner": "libretro",
        "repo": "mupen64plus-libretro-nx",
-        "rev": "bc241538b9ef85d8b22c392d7699dc73f460e283",
-        "sha256": "eCosI2yL1HJpHWvZLYZQe6+1rmmyHLFYCY7bX+3hPec="
+        "rev": "5a63aadedc29655254d8fc7b4da3a325472e198b",
+        "sha256": "QNa8WGJFShO4vc4idUntCUaLik4xQXBA+X7z5sjZ2NE="
    },
    "neocd": {
        "owner": "libretro",
        "repo": "neocd_libretro",
-        "rev": "53f5453311a1ac43700fedb2317c810586f9ccf5",
-        "sha256": "BZBpojShHk+j5wz/d7FnykpX562TgH6PAqTUigE+zUU="
+        "rev": "2070f5258c9d3feee15962f9db8c8ef20072ece8",
+        "sha256": "X+lS1zW5oTzp7wwurM5xjVqIBwEOCIdj/NX/+33K2qg="
    },
    "nestopia": {
        "owner": "libretro",
        "repo": "nestopia",
-        "rev": "d30c55052292826836f6dbaa2adc46fdf1a2d93c",
-        "sha256": "R2Kbtr2EqNUyx5eGBYyyw/ugSxVRM70TP/IsIsU0EZM="
+        "rev": "16b14865caf1effca030630e2fc73d2d4271fc53",
+        "sha256": "dU9X8sK/qDA/Qj0x1GicmSAzQyRqVmLiTcfCPe8+BjM="
    },
    "np2kai": {
        "owner": "AZO234",
        "repo": "NP2kai",
-        "rev": "606fafa7081b62df5f4727c34560da23927c21cd",
-        "sha256": "qS7OrY8bFkAmRgbzLCw9PqgxtKuVNKI+tsDVU7PqWIw=",
+        "rev": "6089943a80a45b6c18d765765f7f31d7a5c0d9c6",
+        "sha256": "tdF0Qb+smWAVoPmI0dd5s51cnYxMmqM36rQNMiEjU9A=",
        "fetchSubmodules": true
    },
    "nxengine": {
        "owner": "libretro",
        "repo": "nxengine-libretro",
-        "rev": "e271c6262d73f07e5d92d285503f1c049801c51a",
-        "sha256": "PfzHV6/nGUdbnfZ8+aHuoIQhvKcxdbuKnjIMWIIFt7Q="
+        "rev": "1f371e51c7a19049e00f4364cbe9c68ca08b303a",
+        "sha256": "4XBNTzgN8pLyrK9KsVxTRR1I8CQaZCnVR4gMryYpWW0="
    },
    "o2em": {
        "owner": "libretro",
        "repo": "libretro-o2em",
-        "rev": "3303cc15e4323280084471f694f6d34c78199725",
-        "sha256": "xH8Dlsg84q8awxjObMPXKZcJSwmix1YdRXIpee7rw6o="
+        "rev": "a2a12472fde910b6089ac3ca6de805bd58a9c999",
+        "sha256": "0cZYw3rrnaR+PfwReRXadLV8RVLblYqlZxJue6OZncg="
    },
    "opera": {
        "owner": "libretro",
@ -340,59 +340,59 @@
    "pcsx2": {
        "owner": "libretro",
        "repo": "pcsx2",
-        "rev": "d2e37b80cfe6f6eecfe0356c7537d8e98bee7a8d",
-        "sha256": "rHXJG2wGoyNGvxxeZVF/I1CpaSBPUwZNERJtkG/z7MU="
+        "rev": "f3c8743d6a42fe429f703b476fecfdb5655a98a9",
+        "sha256": "0piCNWX7QbZ58KyTlWp4h1qLxXpi1z6ML8sBHMTvCY4="
    },
    "pcsx_rearmed": {
        "owner": "libretro",
        "repo": "pcsx_rearmed",
-        "rev": "aced3eb3fcaa0fe13c44c4dd196cdab42555fd98",
-        "sha256": "RzcrSADagi3AIPINQxc36BfMjWjatP/JL6HY744XnZk="
+        "rev": "4373e29de72c917dbcd04ec2a5fb685e69d9def3",
+        "sha256": "727//NqBNEo6RHNQr1RY5cxMrEvfuJczCo+cUJZVv7U="
    },
    "picodrive": {
        "owner": "libretro",
        "repo": "picodrive",
-        "rev": "b2d43acfbc288038749d8a8fdfbcb0474568e043",
-        "sha256": "kDSQgF8G/IpZ9NkSwuOjFSkirkum7foRT01qIbNJmJI=",
+        "rev": "7ab066aab84f15388a53433ea273420bcf917e00",
+        "sha256": "NK9ASiiIkGZmi2YfCqEzZallVfS7nprLRrBk4dlGyAI=",
        "fetchSubmodules": true
    },
    "play": {
        "owner": "jpd002",
        "repo": "Play-",
-        "rev": "0483fc43da01b5b29883acb2cf1d02d33bba1e30",
-        "sha256": "OxBQFTQP0L8k0lH88Ey6KWybW912Ehsv7XjWrvFivxo=",
+        "rev": "b33834af08a4954f06be215eee80a72e7a378e91",
+        "sha256": "IxZk+kSdrkDAabbzdFM8QUrjaJUc1DHjSfAtDuwDJkw=",
        "fetchSubmodules": true
    },
    "ppsspp": {
        "owner": "hrydgard",
        "repo": "ppsspp",
-        "rev": "1fa2f7a97191d2a73f243bfc464edef69b26f652",
-        "sha256": "BDX2eHtFbsloC9XYORHwpix8tbRSQUbcoP7DKFIohW4=",
+        "rev": "7df51c3d060a780b7383c5c1380e346ad9304bb4",
+        "sha256": "GK3W0/yWaID3s0W0v6TcgJ0ZU984YspWMS6+XLyThjM=",
        "fetchSubmodules": true
    },
    "prboom": {
        "owner": "libretro",
        "repo": "libretro-prboom",
-        "rev": "4e671fa0a4b7b892e17ac4e1803c9d627653a4c1",
-        "sha256": "d2/cpfhNczZkHzMGQIxO9jw65AMs9Jmh4ItiLLdDYsk="
+        "rev": "d9c3975669b4aab5a1397e0174838bcbbc3c1582",
+        "sha256": "klSJ7QIpNjlfyjhfeEQZ3j8Gnp4agd0qKVp0vr+KHVA="
    },
    "prosystem": {
        "owner": "libretro",
        "repo": "prosystem-libretro",
-        "rev": "cf544d3c8e40ff197ea5bb177a1269db31077803",
-        "sha256": "A7yQwzM8ewI+UCPQVyO7DNyiQCTw2yG1soi6l7T3pDE="
+        "rev": "763ad22c7de51c8f06d6be0d49c554ce6a94a29b",
+        "sha256": "rE/hxP8hl9lLTNx/WympFDByjZs46ekyxLKRV4V8D9E="
    },
    "puae": {
        "owner": "libretro",
        "repo": "libretro-uae",
-        "rev": "af9e35383c00980aabb38c929e679704b624dee0",
-        "sha256": "hp4XOQUKktmUfLtRfVv1Oe1vqHUYu+vagxSSef55APs="
+        "rev": "ae58c0f226b654d643b9f2dce58f64657f57cb76",
+        "sha256": "6oMTwCYGdVhh+R853gOQRzZfa7slDwe6aGVCvdm6NDU="
    },
    "quicknes": {
        "owner": "libretro",
        "repo": "QuickNES_Core",
-        "rev": "1b88a09f1c386ff9ee46bb371583ae04c5cb5dd0",
-        "sha256": "Q7DDufGTdP+R05ND56PxMNR96ZacJFxPi0ETieV2B58="
+        "rev": "75d501a87ec2074e8d2f7256fb0359513c263c29",
+        "sha256": "yAHVTgOt8SGyPXihp4YNKKAvxl9VBBAvHyzLW86zSCw="
    },
    "sameboy": {
        "owner": "libretro",
@ -403,8 +403,8 @@
    "scummvm": {
        "owner": "libretro",
        "repo": "scummvm",
-        "rev": "2fb2e4c551c9c1510c56f6e890ee0300b7b3fca3",
-        "sha256": "wrlFqu+ONbYH4xMFDByOgySobGrkhVc7kYWI4JzA4ew="
+        "rev": "ab2e5d59cd25dfa5943d45c2567e8330d67fad8b",
+        "sha256": "9IaQR0prbCT70iWA99NMgGAKPobifdWBX17p4zL0fEM="
    },
    "smsplus-gx": {
        "owner": "libretro",
@ -415,8 +415,8 @@
    "snes9x": {
        "owner": "snes9xgit",
        "repo": "snes9x",
-        "rev": "3c4982edddfdba482204ed48cf0b1d41ccae5493",
-        "sha256": "d4luyBSU/4PdsDd2jLwWSyckBPAqXMJ3C1sNmLO+E6U="
+        "rev": "cc0a87711a7a208cabefc9fd1dbb90e31fe51684",
+        "sha256": "1m6QvYl5Z0WM1XeXCYLvQaXH8A15P3x8ZzwdFeVPeWo="
    },
    "snes9x2002": {
        "owner": "libretro",
@ -433,26 +433,26 @@
    "snes9x2010": {
        "owner": "libretro",
        "repo": "snes9x2010",
-        "rev": "e86e54624a7910a64a9a744e3734d4067c48d240",
-        "sha256": "U1eeXuhYssAOgiNOZ7fr/8rkPScts3GmWgK6ki39PVA="
+        "rev": "d8b10c4cd7606ed58f9c562864c986bc960faaaf",
+        "sha256": "7FmteYrAYr+pGNXGg9CBC4NFlijGRf7GdtJfiNjmonU="
    },
    "stella": {
        "owner": "stella-emu",
        "repo": "stella",
-        "rev": "82da36dd685c68b09047d7c835175879edb68653",
-        "sha256": "y7AOSY2VUe4Jv+wteplvA1ul5iXHoeYQhgycD+nfIuc="
+        "rev": "93ea39d6155f08c21707a85a0b04b33008a7ab15",
+        "sha256": "9dCBaLxb1CBbngBd3tJ0x5lT+dnzzhK2DO4Gk/S6WW4="
    },
    "stella2014": {
        "owner": "libretro",
        "repo": "stella2014-libretro",
-        "rev": "1351a4fe2ca6b1f3a66c7db0df2ec268ab002d41",
-        "sha256": "/sVDOfP5CE8k808lhmH3tT47oZ1ka3pgDG5LglfPmHc="
+        "rev": "8ab051edd4816f33a5631d230d54059eeed52c5f",
+        "sha256": "wqssB8WXXF2Lu9heII8nWLLOvI38cIfHSMA7OOd6jx0="
    },
    "swanstation": {
        "owner": "libretro",
        "repo": "swanstation",
-        "rev": "f2e335bfd4751410dfb24d933f762b9a4fd7fdeb",
-        "sha256": "l3A1Xb6YD+OOTZEF6whst1Kr8fSRnXuIVIUN1BCa2Bw="
+        "rev": "e24f21196cdcd50321475c4366b51af245a6bbe6",
+        "sha256": "DjAB0Z0yY9IGESeNNkkbdoAO5ItJ/8cZ5ycRofHG978="
    },
    "tgbdual": {
        "owner": "libretro",
@ -463,8 +463,8 @@
    "thepowdertoy": {
        "owner": "libretro",
        "repo": "ThePowderToy",
-        "rev": "ac620c0a89a18774c3ad176a8a1bc596df23ff57",
-        "sha256": "C/X1DbmnucRddemEYml2zN3qr5yoXY3b+nvqfpboS0M="
+        "rev": "f644498193c4c8be689d8a1d2a70e37e4eff4243",
+        "sha256": "aPUqrrrH2Ia56A3Kx6ClMcZO9nbHGJIcEQ6nFyIMamo="
    },
    "tic80": {
        "owner": "libretro",
@ -476,20 +476,20 @@
    "vba-m": {
        "owner": "libretro",
        "repo": "vbam-libretro",
-        "rev": "7e30b038893de63e674944f75581d57c7685ea3a",
-        "sha256": "CmmiKiy0mFqAiagUHFV5wRSZ0MkzADrHRAG+h82dWAQ="
+        "rev": "640ce45325694d1dc574e90c95c55bc464368d7e",
+        "sha256": "aiIeleZHt95Y/kigLEbRaCb3KM0ezMB7yzO16FbuBNM="
    },
    "vba-next": {
        "owner": "libretro",
        "repo": "vba-next",
-        "rev": "4191e09e2b0fcf175a15348c1fa8a12bbc6320dd",
-        "sha256": "IG2oH4F17tlSv1cXYZobggb37tFNE53JOHzan/X0+ws="
+        "rev": "0c310082a6345790124e9348861b300bcccbeced",
+        "sha256": "RQx/WR83EtPcQkx0ft4Y0/5LaKIOST3L/fh4qoPxz78="
    },
    "vecx": {
        "owner": "libretro",
        "repo": "libretro-vecx",
-        "rev": "b5c17bb7fd4a704f58160bc699322a16d0643396",
-        "sha256": "nICXrVyoMWs2yDcewHd7z6rBt+haY/Dqf5lvF6RLnyg="
+        "rev": "8e932c1d585ae9e467186dea9e73ce38fe1490f7",
+        "sha256": "2Vo30yiP6SfUt3XHCfQTKTKEtCywdRIoUe6d0Or21WM="
    },
    "virtualjaguar": {
        "owner": "libretro",
@ -500,7 +500,7 @@
    "yabause": {
        "owner": "libretro",
        "repo": "yabause",
-        "rev": "c7e02721eddb3de0ec7ae0d61e9e3afa5f586a62",
-        "sha256": "Y2YsPpgBA021pRDOFqH29zsRSbFIpRo5fq+tkknJbSA="
+        "rev": "4c96b96f7fbe07223627c469ff33376b2a634748",
+        "sha256": "7hEpGh2EcrlUoRiUNntaMZEQtStglYAY1MeCub5p8f8="
    }
 }
--- a/pkgs/applications/emulators/retroarch/libretro-core-info.nix
+++ b/pkgs/applications/emulators/retroarch/libretro-core-info.nix
@ -5,12 +5,12 @@

 stdenvNoCC.mkDerivation rec {
  pname = "libretro-core-info";
-  version = "1.14.0";
+  version = "1.15.0";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-core-info";
-    hash = "sha256-3nw8jUxBQJxiKlWS6OjTjwUYWKx3r2E7eHmbj4naWrk=";
+    hash = "sha256-WIgcHuZgAOrlg+WyOS4TyzWziNzjyQB2sPDM9fR6kwA=";
    rev = "v${version}";
  };

--- a/pkgs/applications/emulators/retroarch/mkLibretroCore.nix
+++ b/pkgs/applications/emulators/retroarch/mkLibretroCore.nix
@ -53,6 +53,7 @@ stdenv.mkDerivation ({
    "ARCH=${{
      armv7l = "arm";
      armv6l = "arm";
+      aarch64 = "arm64";
      i686 = "x86";
    }.${stdenv.hostPlatform.parsed.cpu.name} or stdenv.hostPlatform.parsed.cpu.name}"
  ] ++ (args.makeFlags or [ ]);
--- a/pkgs/applications/emulators/rpcs3/default.nix
+++ b/pkgs/applications/emulators/rpcs3/default.nix
@ -9,10 +9,10 @@

 let
  # Keep these separate so the update script can regex them
-  rpcs3GitVersion = "14757-3388c8ed0";
-  rpcs3Version = "0.0.26-14757-3388c8ed0";
-  rpcs3Revision = "3388c8ed090afb216f40c1d00361c6f6f1e7a9ba";
-  rpcs3Sha256 = "0w2qsk91dxp0lxy6bdz4yyf79wqfnzyxswrg1kxwm0s7iwwch2pj";
+  rpcs3GitVersion = "14812-cf5346c26";
+  rpcs3Version = "0.0.27-14812-cf5346c26";
+  rpcs3Revision = "cf5346c263111760752cabb94767c07c501207c4";
+  rpcs3Sha256 = "1dkik6r6khmpcbh27n1bzg7y1ws7ljrkn81a7qn21wmh709sscc8";

  ittapi = fetchFromGitHub {
    owner = "intel";
--- a/pkgs/applications/emulators/vbam/default.nix
+++ b/pkgs/applications/emulators/vbam/default.nix
@ -57,6 +57,5 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ lassulus netali ];
    homepage = "https://vba-m.com/";
    platforms = lib.platforms.linux;
-    badPlatforms = [ "aarch64-linux" ];
  };
 }
--- a/pkgs/applications/finance/odoo/default.nix
+++ b/pkgs/applications/finance/odoo/default.nix
@ -130,7 +130,7 @@ in python.pkgs.buildPythonApplication rec {
    vobject
    werkzeug
    xlrd
-    XlsxWriter
+    xlsxwriter
    xlwt
    zeep
  ];
--- a/pkgs/applications/graphics/cq-editor/default.nix
+++ b/pkgs/applications/graphics/cq-editor/default.nix
@ -22,7 +22,7 @@ mkDerivationWith python3Packages.buildPythonApplication rec {

  propagatedBuildInputs = with python3Packages; [
    cadquery
-    Logbook
+    logbook
    pyqt5
    pyparsing
    pyqtgraph
--- a/pkgs/applications/graphics/curtail/default.nix
+++ b/pkgs/applications/graphics/curtail/default.nix
@ -37,24 +37,30 @@ python3.pkgs.buildPythonApplication rec {
    meson
    ninja
    pkg-config
+    gobject-introspection
+  ];
+
+  buildInputs = [
+    appstream-glib
+    gettext
+    gtk3
  ];

  propagatedBuildInputs = [
-    appstream-glib
    python3.pkgs.pygobject3
-    gobject-introspection
-    gettext
  ];

-  # Currently still required for the gobject-introspection setup hook
-  strictDeps = false;
-
  preInstall = ''
    patchShebangs ../build-aux/meson/postinstall.py
  '';

-  postInstall = ''
-    wrapProgram $out/bin/curtail --prefix PATH : ${lib.makeBinPath [ jpegoptim libwebp optipng pngquant ]}
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=(
+      "''${gappsWrapperArgs[@]}"
+      "--prefix" "PATH" ":" "${lib.makeBinPath [ jpegoptim libwebp optipng pngquant ]}"
+    )
  '';

  meta = with lib; {
--- a/pkgs/applications/graphics/displaycal/default.nix
+++ b/pkgs/applications/graphics/displaycal/default.nix
@ -29,7 +29,7 @@ python3.pkgs.buildPythonApplication rec {
    wxPython_4_2
    dbus-python
    distro
-    PyChromecast
+    pychromecast
    send2trash
  ];

--- a/pkgs/applications/graphics/eddy/default.nix
+++ b/pkgs/applications/graphics/eddy/default.nix
@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {
    wrapQtAppsHook
    python3Packages.setuptools
    python3Packages.rfc3987
-    python3Packages.JPype1
+    python3Packages.jpype1
    python3Packages.pyqt5
  ];

--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@ -6,18 +6,20 @@
 , enableSwftools ? false
 , swftools
 , python3Packages
+, qtbase
+, qtcharts
 }:

 python3Packages.buildPythonPackage rec {
  pname = "hydrus";
-  version = "503";
+  version = "519";
  format = "other";

  src = fetchFromGitHub {
    owner = "hydrusnetwork";
    repo = "hydrus";
    rev = "refs/tags/v${version}";
-    hash = "sha256-nJn5EphbmVYAAOisV3fym/nHlJl/aPZ2Iyp+Z2/N3Jc=";
+    hash = "sha256-q5pPRMBuB6hqDGuOl0kMyXjMKze5dw+3kdmA2FPJTPU=";
  };

  nativeBuildInputs = [
@ -25,6 +27,11 @@ python3Packages.buildPythonPackage rec {
    python3Packages.mkdocs-material
  ];

+  buildInputs = [
+    qtbase
+    qtcharts
+  ];
+
  propagatedBuildInputs = with python3Packages; [
    beautifulsoup4
    cbor2
@ -37,8 +44,10 @@ python3Packages.buildPythonPackage rec {
    opencv4
    pillow
    psutil
+    pympler
    pyopenssl
-    pyside2
+    pyqt6
+    pyqt6-charts
    pysocks
    python-dateutil
    python3Packages.mpv
@ -82,6 +91,7 @@ python3Packages.buildPythonPackage rec {
    -e TestHydrusServer \
    -e TestHydrusSessions \
    -e TestServer \
+    -e TestClientMetadataMigration \
  '';

  outputs = [ "out" "doc" ];
--- a/pkgs/applications/graphics/kodelife/default.nix
+++ b/pkgs/applications/graphics/kodelife/default.nix
@ -45,7 +45,7 @@ in

 stdenv.mkDerivation rec {
  pname = "kodelife";
-  version = "1.0.6.163";
+  version = "1.0.8.170";

  suffix = {
    aarch64-linux = "linux-arm64";
@ -56,9 +56,9 @@ stdenv.mkDerivation rec {
  src = fetchurl {
    url = "https://hexler.net/pub/${pname}/${pname}-${version}-${suffix}.deb";
    hash = {
-      aarch64-linux = "sha256-BbNk/YfTx/J8ApgdiY/thnD2MFUUCSQt/CMjkewLcL0=";
-      armv7l-linux  = "sha256-fp4YM2BgyTr4vvxw5FaqKyGm608q8fOpB3gAgPA9UQ4=";
-      x86_64-linux  = "sha256-sLRdU/UW2JORAUOPzmr+VUkcLoesrshjdLvDCizX0iM=";
+      aarch64-linux = "sha256-FHE87B34QSc7rcKHE3wkZq1VzcZeKWh68rlIIMDRmm8=";
+      armv7l-linux  = "sha256-OqomlL7IFHyQQULbdbf5I0dRXdy3lDHY4ej2P1OZgzo=";
+      x86_64-linux  = "sha256-QNcWMVZ4bTXPLFEtD35hP2LbuNntvF2e9Wk2knt4TBY=";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

--- a/pkgs/applications/graphics/mcomix/default.nix
+++ b/pkgs/applications/graphics/mcomix/default.nix
@ -25,17 +25,13 @@ python3.pkgs.buildPythonApplication rec {
    hash = "sha256-Nok4oqTezO84q9IDZvgi33ZeKfRL+tpg7QEDmp2ZZpU=";
  };

-  buildInputs = [ gobject-introspection gtk3 gdk-pixbuf ];
-  nativeBuildInputs = [ wrapGAppsHook ];
+  buildInputs = [ gtk3 gdk-pixbuf ];
+  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
  propagatedBuildInputs = (with python3.pkgs; [ pillow pygobject3 pycairo ]);

  # Tests are broken
  doCheck = false;

-  # Correct wrapper behavior, see https://github.com/NixOS/nixpkgs/issues/56943
-  # until https://github.com/NixOS/nixpkgs/pull/102613
-  strictDeps = false;
-
  # prevent double wrapping
  dontWrapGApps = true;

--- a/pkgs/applications/graphics/pick-colour-picker/default.nix
+++ b/pkgs/applications/graphics/pick-colour-picker/default.nix
@ -37,10 +37,6 @@ buildPythonPackage rec {
    gtk3
  ];

-  # https://github.com/NixOS/nixpkgs/issues/56943
-  # this must be false, otherwise the gobject-introspection hook doesn't run
-  strictDeps = false;
-
  preDistPhases = [ "fixupIconPath" ];

  fixupIconPath = ''
--- a/pkgs/applications/graphics/tev/default.nix
+++ b/pkgs/applications/graphics/tev/default.nix
@ -48,7 +48,6 @@ stdenv.mkDerivation rec {
    changelog = "https://github.com/Tom94/tev/releases/tag/v${version}";
    license = licenses.bsd3;
    platforms = platforms.unix;
-    badPlatforms = [ "aarch64-linux" ]; # fails on Hydra since forever
    broken = stdenv.isDarwin; # needs apple frameworks + SDK fix? see #205247
    maintainers = with maintainers; [ ];
  };
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@ -12,12 +12,12 @@ let
    if extension == "zip" then fetchzip args else fetchurl args;

  pname = "1password-cli";
-  version = "2.14.0";
+  version = "2.15.0";
  sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-Pmfdz6jGWuRS76/35/+Al5gAbJ7rFyQQLB9tQr1Ecv8=" "zip";
-    i686-linux = fetch "linux_386" "sha256-UQfoof5yuSiMjIWcbSuE45dhJ41MionPcMn8uAwP6I8=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-sx3wgAvazgWjSQMQxVE0irDXCNnDAPBivKQTUC3bZ08=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-pFoOoE329jSzshaHo/XFTIirKsxfdz1yOA0Ljb9VNkY=" "pkg";
+    aarch64-linux = fetch "linux_arm64" "sha256-D+i+RrPBwFHDL7ExiZUL/xc7vBcfHI7C6z0gNIs/Brs=" "zip";
+    i686-linux = fetch "linux_386" "sha256-Y19dbv9eQJF3V+94bByfWLUeDuJ78fUM9vJf1/Nd3rI=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-Mxp6wCwBUNNucN0W0awghUzg2OQTkrwXsZgS/nVP41M=" "zip";
+    aarch64-darwin = fetch "apple_universal" "sha256-KJVXW2Ze1AmDWNeTEfr7SsZMBmLyMfBv/FgC+XAds0A=" "pkg";
    x86_64-darwin = aarch64-darwin;
  };
  platforms = builtins.attrNames sources;
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@ -99,11 +99,11 @@ stdenv.mkDerivation rec {
        setupPyBuildFlags = [ "--enable=load_extension" ];
      }))
      beautifulsoup4
-      cchardet
      css-parser
      cssselect
      python-dateutil
      dnspython
+      faust-cchardet
      feedparser
      html2text
      html5-parser
--- a/pkgs/applications/misc/cobang/default.nix
+++ b/pkgs/applications/misc/cobang/default.nix
@ -13,7 +13,7 @@
 , pango
 , gst-python
 , kiss-headers
-, Logbook
+, logbook
 , pillow
 , poetry-core
 , pygobject3
@ -47,7 +47,7 @@ buildPythonApplication rec {
  propagatedBuildInputs = [
    gst-python
    kiss-headers
-    Logbook
+    logbook
    pillow
    poetry-core
    pygobject3
--- a/pkgs/applications/misc/corectrl/default.nix
+++ b/pkgs/applications/misc/corectrl/default.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec{
  pname = "corectrl";
-  version = "1.3.1";
+  version = "1.3.3";

  src = fetchFromGitLab {
    owner = "corectrl";
    repo = "corectrl";
    rev = "v${version}";
-    sha256 = "sha256-mVMyXpNhwljxsAvrKeHPxUSfdF/mfxG157T13Kb8PnE=";
+    sha256 = "sha256-WgtLDAjywHd9++7DvPfpfEXGbBQWx8kQxseIadho1YE=";
  };
  patches = [
    ./polkit-dir.patch
--- a/pkgs/applications/misc/cotp/default.nix
+++ b/pkgs/applications/misc/cotp/default.nix
@ -7,7 +7,7 @@
 }:

 rustPlatform.buildRustPackage rec {
-  name = "cotp";
+  pname = "cotp";
  version = "1.2.3";

  src = fetchFromGitHub {
@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-Pg07iq2jj8cUA4iQsY52cujmUZLYrbTG5Zj+lITxpls=";
  };

-  cargoHash = "sha256-gH9axiM0Qgl2TdJUpnDONHtU2I5l03SrKEe+2l5V21Y=";
+  cargoHash = "sha256-9jOrDFLnzjxqN2h6e1/qKRn5RQKlfyeKKmjZthQX3jM=";

  buildInputs = lib.optionals stdenv.isLinux [ libxcb ]
    ++ lib.optionals stdenv.isDarwin [ AppKit ];
--- a/pkgs/applications/misc/electron-cash/default.nix
+++ b/pkgs/applications/misc/electron-cash/default.nix
@ -38,7 +38,7 @@ python3Packages.buildPythonApplication rec {
    cython
    trezor
    keepkey
-    btchip
+    btchip-python
    hidapi
    pyopenssl
    pyscard
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@ -71,7 +71,7 @@ python3.pkgs.buildPythonApplication {
    requests
    tlslite-ng
    # plugins
-    btchip
+    btchip-python
    ckcc-protocol
    keepkey
    trezor
--- a/pkgs/applications/misc/electrum/grs.nix
+++ b/pkgs/applications/misc/electrum/grs.nix
@ -54,7 +54,7 @@ python3.pkgs.buildPythonApplication {
    requests
    tlslite-ng
    # plugins
-    btchip
+    btchip-python
    ckcc-protocol
    keepkey
    trezor
--- a/pkgs/applications/misc/electrum/ltc.nix
+++ b/pkgs/applications/misc/electrum/ltc.nix
@ -71,7 +71,7 @@ python3.pkgs.buildPythonApplication {
    requests
    tlslite-ng
    # plugins
-    btchip
+    btchip-python
    ckcc-protocol
    keepkey
    trezor
--- a/pkgs/applications/misc/etesync-dav/default.nix
+++ b/pkgs/applications/misc/etesync-dav/default.nix
@ -11,14 +11,14 @@ let
        version = "2.0.3";
        src = old.src.override {
          inherit version;
-          sha256 = "sha256-4RIMIoyi9VO0cN9KX6knq2YlhGdSYGmYGz6wqRkCaH0=";
+          hash = "sha256-4RIMIoyi9VO0cN9KX6knq2YlhGdSYGmYGz6wqRkCaH0=";
        };
      });
      flask-wtf = super.flask-wtf.overridePythonAttrs (old: rec {
        version = "0.15.1";
        src = old.src.override {
          inherit version;
-          sha256 = "ff177185f891302dc253437fe63081e7a46a4e99aca61dfe086fb23e54fff2dc";
+          hash = "sha256-/xdxhfiRMC3CU0N/5jCB56RqTpmsph3+CG+yPlT/8tw=";
        };
        disabledTests = [
          "test_outside_request"
@ -33,7 +33,7 @@ let
        version = "2.0.3";
        src = old.src.override {
          inherit version;
-          sha256 = "b863f8ff057c522164b6067c9e28b041161b4be5ba4d0daceeaa50a163822d3c";
+          hash = "sha256-uGP4/wV8UiFktgZ8niiwQRYbS+W6TQ2s7qpQoWOCLTw=";
        };
      });
    };
@ -44,7 +44,7 @@ in python.pkgs.buildPythonApplication rec {

  src = python.pkgs.fetchPypi {
    inherit pname version;
-    sha256 = "a4e2ee83932755d29ac39c1e74005ec289880fd2d4d2164f09fe2464a294d720";
+    hash = "sha256-pOLug5MnVdKaw5wedABewomID9LU0hZPCf4kZKKU1yA=";
  };

  propagatedBuildInputs = with python.pkgs; [
--- a/pkgs/applications/misc/fluidd/default.nix
+++ b/pkgs/applications/misc/fluidd/default.nix
@ -2,12 +2,12 @@

 stdenvNoCC.mkDerivation rec {
  pname = "fluidd";
-  version = "1.23.2";
+  version = "1.23.3";

  src = fetchurl {
    name = "fluidd-v${version}.zip";
    url = "https://github.com/cadriel/fluidd/releases/download/v${version}/fluidd.zip";
-    sha256 = "sha256-dSlpCmVtF4H9d2DcOBkybrQz39QRlBCTTuGPA9yH8is=";
+    sha256 = "sha256-CCIu6DNU71oL0JIW3mQ5ThRSjbXeBmJ4FbF6i2dERbc=";
  };

  nativeBuildInputs = [ unzip ];
--- a/pkgs/applications/misc/gnome-secrets/default.nix
+++ b/pkgs/applications/misc/gnome-secrets/default.nix
@ -18,7 +18,6 @@ python3Packages.buildPythonApplication rec {
  pname = "gnome-secrets";
  version = "7.2";
  format = "other";
-  strictDeps = false; # https://github.com/NixOS/nixpkgs/issues/56943

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
--- a/pkgs/applications/misc/hamster/default.nix
+++ b/pkgs/applications/misc/hamster/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, python3Packages, intltool, glib, itstool
+{ lib, fetchFromGitHub, python3Packages, intltool, glib, itstool, gtk3
 , wrapGAppsHook, gobject-introspection, pango, gdk-pixbuf, atk, wafHook }:

 python3Packages.buildPythonApplication rec {
@ -28,6 +28,7 @@ python3Packages.buildPythonApplication rec {
    pango
    gdk-pixbuf
    atk
+    gtk3
  ];

  propagatedBuildInputs = with python3Packages; [
@ -37,10 +38,6 @@ python3Packages.buildPythonApplication rec {
    dbus-python
  ];

-  # Setup hooks have trouble with strict deps.
-  # https://github.com/NixOS/nixpkgs/issues/56943
-  strictDeps = false;
-
  dontWrapGApps = true;

  # Arguments to be passed to `makeWrapper`, only used by buildPython*
--- a/pkgs/applications/misc/haxor-news/default.nix
+++ b/pkgs/applications/misc/haxor-news/default.nix
@ -12,7 +12,7 @@ let
        version = "1.0.18";
        src = oldAttrs.src.override {
          inherit version;
-          sha256 = "09h1153wgr5x2ny7ds0w2m81n3bb9j8hjb8sjfnrg506r01clkyx";
+          hash = "sha256-3U/KAsgGlJetkxotCZFMaw0bUBUc6Ha8Fb3kx0cJASY=";
        };
      });
      # Use click 7
@ -20,7 +20,7 @@ let
        version = "7.1.2";
        src = old.src.override {
          inherit version;
-          sha256 = "d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a";
+          hash = "sha256-0rUlXHxjSbwb0eWeCM0SrLvWPOZJ8liHVXg6qU37axo=";
        };
      });
    };
@ -37,7 +37,7 @@ buildPythonApplication rec {
    owner = "donnemartin";
    repo = pname;
    rev = "811a5804c09406465b2b02eab638c08bf5c4fa7f";
-    sha256 = "1g3dfsyk4727d9jh9w6j5r51ag07851cls7v7a7hmdvdixpvbzp6";
+    hash = "sha256-5v61b49ttwqPOvtoykJBBzwVSi7S8ARlakccMr12bbw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/misc/holochain-launcher/default.nix
+++ b/pkgs/applications/misc/holochain-launcher/default.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation rec {
  name = "holochain-launcher";
-  version = "0.9.1";
+  version = "0.9.2";

  src = fetchurl {
    url = "https://github.com/holochain/launcher/releases/download/v${version}/holochain-launcher_${version}_amd64.deb";
-    sha256 = "sha256-vYsJBMtdkbe87Xn8Ah0eT+azFWfm3ZUooejs7oB2KVQ=";
+    sha256 = "sha256-ipcv1rP4DDjBEybmntsfw2ubjCgm1cGDlYM7sN0jeVo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/kondo/default.nix
+++ b/pkgs/applications/misc/kondo/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "kondo";
-  version = "0.5";
+  version = "0.6";

  src = fetchFromGitHub {
    owner = "tbillington";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-TTgsfoJ3TEK7wyRJfBIxvPA53wZbq7KJ4LxjUbrHE4Y=";
+    sha256 = "sha256-f0eRM4U2FwMGjmQKb3tjX2TRv1hN//FkoA2h6WmFOQk=";
  };

-  cargoSha256 = "sha256-s5e997I7YiDKF6rOB0XwcxbnHR8AifYPX9ctvdz8VTw=";
+  cargoHash = "sha256-DouQN9Lo/CoqZZD3HuO1+Xzvc2yL5l157TeAi+bmfrE=";

  meta = with lib; {
    description = "Save disk space by cleaning unneeded files from software projects";
--- a/pkgs/applications/misc/kupfer/default.nix
+++ b/pkgs/applications/misc/kupfer/default.nix
@ -11,6 +11,8 @@
 , shared-mime-info
 , wrapGAppsHook
 , wafHook
+, bash
+, dbus
 }:

 with python3Packages;
@ -33,14 +35,12 @@ buildPythonApplication rec {
    itstool            # for help pages
    desktop-file-utils # for update-desktop-database
    shared-mime-info   # for update-mime-info
+    docutils # for rst2man
+    dbus # for detection of dbus-send during build
  ];
-  buildInputs = [ docutils libwnck keybinder3 ];
+  buildInputs = [ libwnck keybinder3 bash ];
  propagatedBuildInputs = [ pygobject3 gtk3 pyxdg dbus-python pycairo ];

-  # without strictDeps kupfer fails to build: Could not find the python module 'gi.repository.Gtk'
-  # see https://github.com/NixOS/nixpkgs/issues/56943 for details
-  strictDeps = false;
-
  postInstall = ''
    gappsWrapperArgs+=(
      "--prefix" "PYTHONPATH" : "${makePythonPath propagatedBuildInputs}"
--- a/pkgs/applications/misc/lutris/default.nix
+++ b/pkgs/applications/misc/lutris/default.nix
@ -84,13 +84,12 @@ buildPythonApplication rec {
    sha256 = "sha256-rsiXm7L/M85ot6NrTyy//lMRFlLPJYve9y6Erg9Ugxg=";
  };

-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
  buildInputs = [
    atk
    gdk-pixbuf
    glib-networking
    gnome-desktop
-    gobject-introspection
    gtk3
    libnotify
    pango
@ -139,9 +138,6 @@ buildPythonApplication rec {
    "--prefix PATH : ${lib.makeBinPath requiredTools}"
    "\${gappsWrapperArgs[@]}"
  ];
-  # needed for glib-schemas to work correctly (will crash on dialogues otherwise)
-  # see https://github.com/NixOS/nixpkgs/issues/56943
-  strictDeps = false;

  meta = with lib; {
    homepage = "https://lutris.net";
--- a/pkgs/applications/misc/minigalaxy/default.nix
+++ b/pkgs/applications/misc/minigalaxy/default.nix
@ -31,18 +31,14 @@ python3Packages.buildPythonApplication rec {
    runHook postCheck
  '';

-  # Cannot find GSettings schemas when opening settings,
-  # probably https://github.com/NixOS/nixpkgs/issues/56943
-  strictDeps = false;
-
  nativeBuildInputs = [
    gettext
    wrapGAppsHook
+    gobject-introspection
  ];

  buildInputs = [
    glib-networking
-    gobject-introspection
    gtk3
  ];

@ -64,6 +60,7 @@ python3Packages.buildPythonApplication rec {
  ];

  # Run Linux games using the Steam Runtime by using steam-run in the wrapper
+  # FIXME: not working with makeBinaryWrapper
  postFixup = ''
    sed -e 's#exec -a "$0"#exec -a "$0" ${steam-run}/bin/steam-run#' -i $out/bin/minigalaxy
  '';
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@ -38,6 +38,17 @@ let
              nativeBuildInputs = [ ];
              format = "setuptools";
              outputs = [ "out" ];
+              patches = [ ];
+            });
+            # downgrade needed for flask-babel 2.0.0
+            babel = super.babel.overridePythonAttrs (oldAttrs: rec {
+              version = "2.11.0";
+              src = super.fetchPypi {
+                pname = "Babel";
+                inherit version;
+                hash = "sha256-XvSzImsBgN7d7UIpZRyLDho6aig31FoHMnLzE+TPl/Y=";
+              };
+              propagatedBuildInputs = [ self.pytz ];
            });
          }
        )
--- a/pkgs/applications/misc/onboard/default.nix
+++ b/pkgs/applications/misc/onboard/default.nix
@ -108,9 +108,6 @@ python3.pkgs.buildPythonApplication rec {
    python3.pkgs.nose
  ];

-  # Temporary fix, see https://github.com/NixOS/nixpkgs/issues/56943
-  strictDeps = false;
-
  doCheck = false;

  preBuild = ''
--- a/pkgs/applications/misc/openlp/lib.nix
+++ b/pkgs/applications/misc/openlp/lib.nix
@ -4,7 +4,7 @@

 # python deps
 , python, buildPythonPackage
-, alembic, beautifulsoup4, chardet, lxml, Mako, pyenchant
+, alembic, beautifulsoup4, chardet, lxml, mako, pyenchant
 , pyqt5_with_qtwebkit, pyxdg, sip_4, sqlalchemy, sqlalchemy-migrate
 }:

@ -37,7 +37,7 @@ buildPythonPackage rec {
    beautifulsoup4
    chardet
    lxml
-    Mako
+    mako
    pyenchant
    pyqt5_with_qtwebkit
    pyxdg
--- a/pkgs/applications/misc/printrun/default.nix
+++ b/pkgs/applications/misc/printrun/default.nix
@ -32,8 +32,6 @@ python3Packages.buildPythonApplication rec {
  '';

  dontWrapGApps = true;
-  # https://github.com/NixOS/nixpkgs/issues/56943
-  strictDeps = false;

  preFixup = ''
    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
--- a/pkgs/applications/misc/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@ -26,7 +26,7 @@ let
        src = self.fetchPypi {
          pname = "Flask-Migrate";
          inherit version;
-          sha256 = "ae2f05671588762dd83a21d8b18c51fe355e86783e24594995ff8d7380dffe38";
+          hash = "sha256-ri8FZxWIdi3YOiHYsYxR/jVehng+JFlJlf+Nc4Df/jg=";
        };
      });
      flask-sqlalchemy = super.flask-sqlalchemy.overridePythonAttrs (old: rec {
@ -43,7 +43,7 @@ let
        version = "1.0.1";
        src = old.src.override {
          inherit version;
-          sha256 = "6c80b1e5ad3665290ea39320b91e1be1e0d5f60652b964a3070216de83d2e47c";
+          hash = "sha256-bICx5a02ZSkOo5MguR4b4eDV9gZSuWSjBwIW3oPS5Hw=";
        };
        nativeCheckInputs = old.nativeCheckInputs ++ (with self; [
          requests
@ -55,18 +55,18 @@ let
        version = "2.11.3";
        src = old.src.override {
          inherit version;
-          sha256 = "sha256-ptWEM94K6AA0fKsfowQ867q+i6qdKeZo8cdoy4ejM8Y=";
+          hash = "sha256-ptWEM94K6AA0fKsfowQ867q+i6qdKeZo8cdoy4ejM8Y=";
        };
        patches = [
          # python 3.10 compat fixes. In later upstream releases, but these
          # are not compatible with flask 1 which we need here :(
          (fetchpatch {
            url = "https://github.com/thmo/jinja/commit/1efb4cc918b4f3d097c376596da101de9f76585a.patch";
-            sha256 = "sha256-GFaSvYxgzOEFmnnDIfcf0ImScNTh1lR4lxt2Uz1DYdU=";
+            hash = "sha256-GFaSvYxgzOEFmnnDIfcf0ImScNTh1lR4lxt2Uz1DYdU=";
          })
          (fetchpatch {
            url = "https://github.com/mkrizek/jinja/commit/bd8bad37d1c0e2d8995a44fd88e234f5340afec5.patch";
-            sha256 = "sha256-Uow+gaO+/dH6zavC0X/SsuMAfhTLRWpamVlL87DXDRA=";
+            hash = "sha256-Uow+gaO+/dH6zavC0X/SsuMAfhTLRWpamVlL87DXDRA=";
            excludes = [ "CHANGES.rst" ];
          })
        ];
@ -76,21 +76,21 @@ let
        version = "2.0.1";
        src = old.src.override {
          inherit version;
-          sha256 = "sha256-WUxngH+xYjizDES99082wCzfItHIzake+KDtjav1Ygo=";
+          hash = "sha256-WUxngH+xYjizDES99082wCzfItHIzake+KDtjav1Ygo=";
        };
      });
      itsdangerous = super.itsdangerous.overridePythonAttrs (old: rec {
        version = "1.1.0";
        src = old.src.override {
          inherit version;
-          sha256 = "321b033d07f2a4136d3ec762eac9f16a10ccd60f53c0c91af90217ace7ba1f19";
+          hash = "sha256-MhsDPQfypBNtPsdi6snxahDM1g9TwMka+QIXrOe6Hxk=";
        };
      });
      flask = super.flask.overridePythonAttrs (old: rec {
        version = "1.1.4";
        src = old.src.override {
          inherit version;
-          sha256 = "0fbeb6180d383a9186d0d6ed954e0042ad9f18e0e8de088b2b419d526927d196";
+          hash = "sha256-D762GA04OpGG0NbtlU4AQq2fGODo3giLK0GdUmkn0ZY=";
        };
      });
      sqlsoup = super.sqlsoup.overrideAttrs ({ meta ? {}, ... }: {
@ -100,13 +100,13 @@ let
        version = "7.1.2";
        src = old.src.override {
          inherit version;
-          sha256 = "d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a";
+          hash = "sha256-0rUlXHxjSbwb0eWeCM0SrLvWPOZJ8liHVXg6qU37axo=";
        };
      });
      # Now requires `lingua` as check input that requires a newer `click`,
      # however `click-7` is needed by the older flask we need here. Since it's just
      # for the test-suite apparently, let's skip it for now.
-      Mako = super.Mako.overridePythonAttrs (lib.const {
+      mako = super.mako.overridePythonAttrs (lib.const {
        nativeCheckInputs = [];
        doCheck = false;
      });
@ -165,7 +165,7 @@ python3'.pkgs.buildPythonPackage rec {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-SYXw8PBCb514v3rcy15W/vZS5JyMsu81D2sJmviLRtw=";
+    hash = "sha256-SYXw8PBCb514v3rcy15W/vZS5JyMsu81D2sJmviLRtw=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/pytrainer/default.nix
+++ b/pkgs/applications/misc/pytrainer/default.nix
@ -1,5 +1,5 @@
 { lib
-, python3
+, python310
 , fetchFromGitHub
 , gdk-pixbuf
 , gnome
@ -17,11 +17,19 @@
 }:

 let
-  python = python3.override {
+  python = python310.override {
    packageOverrides = (self: super: {
      matplotlib = super.matplotlib.override {
        enableGtk3 = true;
      };
+      sqlalchemy = super.sqlalchemy.overridePythonAttrs (old: rec {
+        version = "1.4.46";
+        src = self.fetchPypi {
+          pname = "SQLAlchemy";
+          inherit version;
+          hash = "sha256-aRO4JH2KKS74MVFipRkx4rQM6RaB8bbxj2lwRSAMSjA=";
+        };
+      });
    });
  };
 in python.pkgs.buildPythonApplication rec {
@ -77,7 +85,7 @@ in python.pkgs.buildPythonApplication rec {
      TZ=Europe/Kaliningrad \
      LC_ALL=en_US.UTF-8 \
      xvfb-run -s '-screen 0 800x600x24' \
-      ${python3.interpreter} setup.py test
+      ${python.interpreter} setup.py test
  '';

  meta = with lib; {
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.16.1";
+  version = "2.16.2";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Pq8HjmWSfBgieSJejrlw+FiRdq9NxryYPcw++Pdjsuk=";
+    sha256 = "sha256-13JWceuiNz1FxgVVQ2KV88zYLIBkEVeTfPF5eEK1oe8=";
  };

-  vendorSha256 = "sha256-E2Q+mXojMb8E0zSnaCOl9xp5QLeYcuTXjhcp3Hc8gH4=";
+  vendorHash = "sha256-rmQpS4k/G3s/H7sPxVZ70KtJEvYjsDV2htV97viWttM=";

  ldflags = [
    "-s -w"
--- a/pkgs/applications/misc/wike/default.nix
+++ b/pkgs/applications/misc/wike/default.nix
@ -12,7 +12,6 @@ python3.pkgs.buildPythonApplication rec {
  pname = "wike";
  version = "1.7.1";
  format = "other";
-  strictDeps = false; # https://github.com/NixOS/nixpkgs/issues/56943

  src = fetchFromGitHub {
    owner = "hugolabe";
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -472,9 +472,6 @@ buildStdenv.mkDerivation ({
  separateDebugInfo = enableDebugSymbols;
  enableParallelBuilding = true;

-  # https://github.com/NixOS/nixpkgs/issues/201254
-  NIX_LDFLAGS = if (with stdenv; isAarch64 && isLinux) then [ "-lgcc" ] else null;
-
  # tests were disabled in configureFlags
  doCheck = false;

@ -501,41 +498,6 @@ buildStdenv.mkDerivation ({
    gappsWrapperArgs+=(--argv0 "$out/bin/.${binaryName}-wrapped")
  '';

-  # Workaround: The separateDebugInfo hook skips artifacts whose build ID's length is not 40.
-  # But we got 16-length build ID here. The function body is mainly copied from pkgs/build-support/setup-hooks/separate-debug-info.sh
-  # Remove it when https://github.com/NixOS/nixpkgs/pull/146275 is merged.
-  preFixup = lib.optionalString enableDebugSymbols ''
-    _separateDebugInfo() {
-        [ -e "$prefix" ] || return 0
-
-        local dst="''${debug:-$out}"
-        if [ "$prefix" = "$dst" ]; then return 0; fi
-
-        dst="$dst/lib/debug/.build-id"
-
-        # Find executables and dynamic libraries.
-        local i
-        while IFS= read -r -d $'\0' i; do
-            if ! isELF "$i"; then continue; fi
-
-            # Extract the Build ID. FIXME: there's probably a cleaner way.
-            local id="$($READELF -n "$i" | sed 's/.*Build ID: \([0-9a-f]*\).*/\1/; t; d')"
-            if [[ -z "$id" ]]; then
-                echo "could not find build ID of $i, skipping" >&2
-                continue
-            fi
-
-            # Extract the debug info.
-            echo "separating debug info from $i (build ID $id)"
-            mkdir -p "$dst/''${id:0:2}"
-            $OBJCOPY --only-keep-debug "$i" "$dst/''${id:0:2}/''${id:2}.debug"
-
-            # Also a create a symlink <original-name>.debug.
-            ln -sfn ".build-id/''${id:0:2}/''${id:2}.debug" "$dst/../$(basename "$i")"
-        done < <(find "$prefix" -type f -print0)
-    }
-  '';
-
  postFixup = lib.optionalString crashreporterSupport ''
    patchelf --add-rpath "${lib.makeLibraryPath [ curl ]}" $out/lib/${binaryName}/crashreporter
  '';
--- a/pkgs/applications/networking/browsers/ladybird/default.nix
+++ b/pkgs/applications/networking/browsers/ladybird/default.nix
@ -57,9 +57,6 @@ stdenv.mkDerivation {
    "-Daligned_alloc=_mm_malloc"
  ]);

-  # https://github.com/NixOS/nixpkgs/issues/201254
-  NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
-
  # https://github.com/SerenityOS/serenity/issues/10055
  postInstall = lib.optionalString stdenv.isDarwin ''
    install_name_tool -add_rpath $out/lib $out/bin/ladybird
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@ -1,11 +1,11 @@
 {
-  "packageVersion": "110.0.1-1",
+  "packageVersion": "111.0-2",
  "source": {
-    "rev": "110.0.1-1",
-    "sha256": "06k33gf2q77w3airgbqmki555pp2yv33cbkivbi4hgz80zl1m4i3"
+    "rev": "111.0-2",
+    "sha256": "0kz365pldyancbq029b3v0wpc1jchzywqjriy6276f1kwssyp8pr"
  },
  "firefox": {
-    "version": "110.0.1",
-    "sha512": "42c6a99a3874a0f60121188c43788fb35577734d9366c3f89ad41b8328cc542ce172ec81ca35b9ea551eaa698197ccdb43922ec3215d311e0770aaaa59625d21"
+    "version": "111.0",
+    "sha512": "cdb300fdbb2b60068b0fc10a18df587b417e484901d36f52dd174d320d3440a42b02ea000f325c5781fd8853a5171b1a5184562fb535ece90619e4c64d46bb82"
  }
 }
--- a/pkgs/applications/networking/browsers/offpunk/default.nix
+++ b/pkgs/applications/networking/browsers/offpunk/default.nix
@ -3,10 +3,8 @@
  installShellFiles,
  less,
  lib,
-  makeWrapper,
  offpunk,
-  python3,
-  stdenv,
+  python3Packages,
  testers,
  timg,
  xdg-utils,
@ -14,7 +12,7 @@
 }:

 let
-  pythonDependencies = with python3.pkgs; [
+  pythonDependencies = with python3Packages; [
    beautifulsoup4
    cryptography
    feedparser
@ -30,40 +28,34 @@ let
    xsel
  ];
 in
-stdenv.mkDerivation (finalAttrs: {
+python3Packages.buildPythonPackage rec {
  pname = "offpunk";
-  version = "1.9";
+  version = "1.9.2";
+  format = "flit";
+
+  disabled = python3Packages.pythonOlder "3.7";

  src = fetchFromSourcehut {
    owner = "~lioploum";
    repo = "offpunk";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-sxX4/7jbNbLwHVfE1lDtjr/luby5zAf6Hy1RcwXZLBA=";
+    rev = "v${version}";
+    sha256 = "sha256-CYsuoj5/BaaboDRtcOrGzJoZDCfOLs7ROVWLVjOAnRU=";
  };

-  nativeBuildInputs = [ makeWrapper installShellFiles ];
-  buildInputs = otherDependencies ++ pythonDependencies;
+  nativeBuildInputs = [ installShellFiles ];
+  propagatedBuildInputs = otherDependencies ++ pythonDependencies;

-  installPhase = ''
-    runHook preInstall
-
-    install -D ./offpunk.py $out/bin/offpunk
-
-    wrapProgram $out/bin/offpunk \
-        --set PYTHONPATH "$PYTHONPATH" \
-        --set PATH ${lib.makeBinPath otherDependencies}
-
-   installManPage man/*.1
-   runHook postInstall
+  postInstall = ''
+    installManPage man/*.1
  '';

  passthru.tests.version = testers.testVersion { package = offpunk; };

  meta = with lib; {
    description = "An Offline-First browser for the smolnet ";
-    homepage = finalAttrs.src.meta.homepage;
+    homepage = src.meta.homepage;
    maintainers = with maintainers; [ DamienCassou ];
    platforms = platforms.linux;
    license = licenses.bsd2;
  };
-})
+}
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@ -51,11 +51,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "opera";
-  version = "95.0.4635.37";
+  version = "96.0.4693.31";

  src = fetchurl {
    url = "${mirror}/${version}/linux/${pname}-stable_${version}_amd64.deb";
-    hash = "sha256-NQv9EVaBPfHygr76neYGACuk8A6Oc1GXAgizMa+jngw=";
+    hash = "sha256-ygJmwwwYg5lc7rDMkc8YH7oThET+4reFqPTrojtFowQ=";
  };

  unpackPhase = "dpkg-deb -x $src .";
--- a/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
+++ b/pkgs/applications/networking/cluster/argocd-autopilot/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "argocd-autopilot";
-  version = "0.4.12";
+  version = "0.4.13";

  src = fetchFromGitHub {
    owner = "argoproj-labs";
    repo = "argocd-autopilot";
    rev = "v${version}";
-    sha256 = "sha256-YYUOW3QWJx+XdrZTaPEGs5TJH2lVUJGPcPYYehR3V0M=";
+    sha256 = "sha256-zmb4T6D7kkAUY+Ky/mpNM6srC0LfzpZ9b1cjFhhKS5A=";
  };

  vendorHash = "sha256-p8Q+oQFbkulcDFdHUoQ1qdO1zsi7XmU/IjnScZogz2g=";
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "argocd";
-  version = "2.6.3";
+  version = "2.6.5";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo-cd";
    rev = "v${version}";
-    sha256 = "sha256-l2cuCS5CtAbmv7wHvccNA+DJ8+hN5/xHWTqZFGyBKGQ=";
+    sha256 = "sha256-+3d20bD2sxck8fCrMv6Z9O70g7iWdHA5FdFVoLDtY2k=";
  };

  proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-c4KvsHN+2QXk/+MJgRIm5L6LtRe5juUF8rw84aVot38=";
+  vendorHash = "sha256-BqES6nhV17iqK1dsa+2IdNCd1Wl1O6hOBczqxRHewPk=";

  # Set target as ./cmd per cli-local
  # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "glooctl";
-  version = "1.13.9";
+  version = "1.13.10";

  src = fetchFromGitHub {
    owner = "solo-io";
    repo = "gloo";
    rev = "v${version}";
-    hash = "sha256-rlZtZC5D5wSYVjP/IHSY9eSfaGRGhtfndkC6PYDMXqg=";
+    hash = "sha256-PsdaGVBEslcBMNCj1NQozwbrRx1Nx7Z5+jtZLCrJwDU=";
  };

  subPackages = [ "projects/gloo/cli/cmd" ];
--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@ -2,7 +2,7 @@

 (callPackage ./generic.nix { }) {
  channel = "edge";
-  version = "23.3.1";
-  sha256 = "10vl3lay9f823qp0cqh4a7fzfkh8qcl0k6jwdjvrd93d4rasvnsm";
-  vendorSha256 = "sha256-DPYGh2lUgyYqquaNVRWb2CCAAFi0bm3ZKHNOoVq6dJ4=";
+  version = "23.3.2";
+  sha256 = "1vbi24nd8mh7vpzxy6qbjd3b7ifg16yc6abb8yvnqvxws8klpj8f";
+  vendorSha256 = "sha256-sWNaCmh1fbtJOIHMwA4XAyGUNWpqME+PfmbxSFfH4ws=";
 }
--- a/pkgs/applications/networking/cluster/stern/default.nix
+++ b/pkgs/applications/networking/cluster/stern/default.nix
@ -4,16 +4,16 @@ let isCrossBuild = stdenv.hostPlatform != stdenv.buildPlatform;
 in
 buildGoModule rec {
  pname = "stern";
-  version = "1.23.0";
+  version = "1.24.0";

  src = fetchFromGitHub {
    owner = "stern";
    repo = "stern";
    rev = "v${version}";
-    sha256 = "sha256-tqp2H8aWPBgje1zIK673cbr+DShhTQL9VQ0dEL/he7s=";
+    sha256 = "sha256-jJxrBBs8PkYg9oH9MY1RLJb262REmbKciHXiwWTqoRc=";
  };

-  vendorHash = "sha256-ud07lWHwQfAHgVenUApwrfxmTjJKVm+pOExdR9pZFxA=";
+  vendorHash = "sha256-1MhscgCGSJXkcj5Rt29+xbBX1uGfOS0kmab+DNY/Bt4=";

  subPackages = [ "." ];

--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -210,11 +210,11 @@
    "vendorHash": null
  },
  "cloudamqp": {
-    "hash": "sha256-gUOWUvdlmn+u6IL6UrzA8MKErl43VmtIqnilzUTKuis=",
+    "hash": "sha256-W+TuJhLP1bFTjSzLrkq9cqtt4uQB0yA/evFi8p4P0vs=",
    "homepage": "https://registry.terraform.io/providers/cloudamqp/cloudamqp",
    "owner": "cloudamqp",
    "repo": "terraform-provider-cloudamqp",
-    "rev": "v1.24.0",
+    "rev": "v1.24.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-V5nI7B45VJb7j7AoPrKQknJbVW5C9oyDs9q2u8LXD+M="
  },
@ -420,11 +420,11 @@
    "vendorHash": "sha256-uWTY8cFztXFrQQ7GW6/R+x9M6vHmsb934ldq+oeW5vk="
  },
  "github": {
-    "hash": "sha256-GieysqBcXSgHuT13FqDtPPklFPRBREwMrTZZ7QH14pY=",
+    "hash": "sha256-5HOGOISVozkwJU1/CRpzBOqChWEG3TTNrE5tssgWtH8=",
    "homepage": "https://registry.terraform.io/providers/integrations/github",
    "owner": "integrations",
    "repo": "terraform-provider-github",
-    "rev": "v5.18.0",
+    "rev": "v5.18.3",
    "spdx": "MIT",
    "vendorHash": null
  },
@ -621,11 +621,11 @@
    "vendorHash": "sha256-UnWHUD9T4nTT6Y2UrvBIdIk9eA8l0vWJ/IpEY3PIzDU="
  },
  "ksyun": {
-    "hash": "sha256-mq0wE9jkn67HFyg0MgtD9lY7lk0+4/rnPLJ4mXX0xwY=",
+    "hash": "sha256-1P4iv9UbSUepsKP+xKvy+YTHAIemMkwQruTrHyAsxsI=",
    "homepage": "https://registry.terraform.io/providers/kingsoftcloud/ksyun",
    "owner": "kingsoftcloud",
    "repo": "terraform-provider-ksyun",
-    "rev": "v1.3.66",
+    "rev": "v1.3.67",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-miHKAz+ONXtuC1DNukcyZbbaYReY69dz9Zk6cJdORdQ="
  },
@ -783,13 +783,13 @@
    "vendorHash": "sha256-3t8pUAwuVeZN5cYGs72YsdRvJunudSmKSldFWEFVA/4="
  },
  "ns1": {
-    "hash": "sha256-fPeWs1VMsCY+OywHdwP9EUyjpoTYquBqP8W08Z/0DAA=",
+    "hash": "sha256-F7nKtDlVnW7jDPTeszYv9aYMAnHo2/k+MxsXdjghS88=",
    "homepage": "https://registry.terraform.io/providers/ns1-terraform/ns1",
    "owner": "ns1-terraform",
    "repo": "terraform-provider-ns1",
-    "rev": "v2.0.0",
+    "rev": "v2.0.2",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-R4q9ASqTdKv4BG4zNktKsLxa6UU42UzWTLYHuRnJ4Zg="
+    "vendorHash": "sha256-dGHT3mq5a+3KhNZQkYZ+HYrqxR9YT7Yn64UkmE0vz6M="
  },
  "null": {
    "hash": "sha256-ExXDbAXMVCTZBlYmi4kD/7JFB1fCFAoPL637+1N6rEI=",
@ -1045,13 +1045,13 @@
    "vendorHash": "sha256-NO1r/EWLgH1Gogru+qPeZ4sW7FuDENxzNnpLSKstnE8="
  },
  "spotinst": {
-    "hash": "sha256-a/WXuEIvFsbYGoIDT0vHNM1LoFs7VlqmGXHDszON/rU=",
+    "hash": "sha256-mbqnFKxHSh4IF+zPpT2wIz1/dJKpuM7TUHS0Cvt/srg=",
    "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
    "owner": "spotinst",
    "repo": "terraform-provider-spotinst",
-    "rev": "v1.105.0",
+    "rev": "v1.106.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-juso8uzTjqf/vxUmpiv/07WkqMJRS1CqHQhu6pHf7QY="
+    "vendorHash": "sha256-TxTw+13HJDHDdLhGjM3SXOL87RJdRFs0Y+t/oK81DfI="
  },
  "stackpath": {
    "hash": "sha256-7KQUddq+M35WYyAIAL8sxBjAaXFcsczBRO1R5HURUZg=",
@ -1090,20 +1090,20 @@
    "vendorHash": "sha256-2wPmLpjhG6QgG+BUCO0oIzHjBOWIOYuptgdtSIm9TZw="
  },
  "talos": {
-    "hash": "sha256-Uj4UlxPvI80og/wJPtQgyrejXLcfc6R4IJfsXiVNm+Y=",
+    "hash": "sha256-/Ml+Vsh50U5CoVdnls69iTPoSPpgAtOpO2hWlcmbyKw=",
    "homepage": "https://registry.terraform.io/providers/siderolabs/talos",
    "owner": "siderolabs",
    "repo": "terraform-provider-talos",
-    "rev": "v0.1.1",
+    "rev": "v0.1.2",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-tltQNtTsPoT5CTrKM7vLDVkmmW2FTd6MBubfXZveGxI="
+    "vendorHash": "sha256-GkmUKSnqkabwGCl22/90529BWb0oJaIJHYHlS/h3KNY="
  },
  "tencentcloud": {
-    "hash": "sha256-+VzUyIDQcDyoMVH113cMd6jCUIsAIw/Ir1wM+/YIefM=",
+    "hash": "sha256-iQHueKyp1bYj5/hRDmUFENSc5V7Q3+eq3mmYGIvPOG8=",
    "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
    "owner": "tencentcloudstack",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.79.14",
+    "rev": "v1.79.15",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -1254,12 +1254,12 @@
    "vendorHash": "sha256-ib1Esx2AO7b9S+v+zzuATgSVHI3HVwbzEeyqhpBz1BQ="
  },
  "yandex": {
-    "hash": "sha256-0P8R0L5PGrDKWGd92OkKi9WCfMK5IrdYJyoINaZWZjc=",
+    "hash": "sha256-XT31rLurZAvjE08cAGIkd7pcS1LMdOIU6e60qLrLsXI=",
    "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
    "owner": "yandex-cloud",
    "proxyVendor": true,
    "repo": "terraform-provider-yandex",
-    "rev": "v0.86.0",
+    "rev": "v0.87.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-r2+ARKvTghscGBhmZpz84vdBudiy2OsmQR03oDz5gbs="
  }
--- a/pkgs/applications/networking/cluster/tubekit/default.nix
+++ b/pkgs/applications/networking/cluster/tubekit/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "tubekit";
-  version = "4";
+  version = "5";

  src = fetchFromGitHub {
    owner = "reconquest";
    repo = "tubekit";
    rev = "refs/tags/v${version}";
-    hash = "sha256-sq91uR8ITMOv8hivwKQR02mMlJpjDHw6RxiwVUrpwnY=";
+    hash = "sha256-fUe5bMFF569A9Xdx3bfQH2DzbQDRfZ+ewlDL+gK2gWw=";
  };

-  vendorHash = "sha256-qrGzmr1dZPn5r2WBJA7FT7RTqP2sxnrXgbrnKlnpF0Y=";
+  vendorHash = "sha256-qAmkUV5l5g8/w8ZTYFGYvd9I8NUk8rMYjutenHvTRnw=";

  meta = with lib; {
    description = "Kubectl alternative with quick context switching";
--- a/pkgs/applications/networking/feedreaders/gnome-feeds/default.nix
+++ b/pkgs/applications/networking/feedreaders/gnome-feeds/default.nix
@ -66,9 +66,6 @@ python3.pkgs.buildPythonApplication rec {
    requests
  ];

-  # https://github.com/NixOS/nixpkgs/issues/56943
-  strictDeps = false;
-
  dontWrapGApps = true;

  preFixup = ''
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -30,7 +30,7 @@ python3Packages.buildPythonApplication rec {

  propagatedBuildInputs = with python3Packages; [
    # See https://github.com/Flexget/Flexget/blob/master/requirements.txt
-    APScheduler
+    apscheduler
    beautifulsoup4
    click
    colorama
@ -44,7 +44,7 @@ python3Packages.buildPythonApplication rec {
    packaging
    psutil
    pynzb
-    PyRSS2Gen
+    pyrss2gen
    python-dateutil
    pyyaml
    rebulk
--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@ -12,7 +12,7 @@
 , sqlite
 , tinyxml
 , wrapGAppsHook
-, wxGTK30
+, wxGTK32
 , gtk3
 , xdg-utils
 }:
@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
    pugixml
    sqlite
    tinyxml
-    wxGTK30
+    wxGTK32
    gtk3
    xdg-utils
  ];
--- a/Show More
+++ b/Show More