Merge master into haskell-updates

2023-06-28 00:14:55 +00:00 · 2023-06-28 00:14:55 +00:00 · 0aaf2b2ebc
commit 0aaf2b2ebc
parent 6a2fef57ef da0a385a5e
244 changed files with 5427 additions and 2977 deletions
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@ -63,6 +63,16 @@ checkConfigOutput '^"one two"$' config.result ./shorthand-meta.nix

 checkConfigOutput '^true$' config.result ./test-mergeAttrDefinitionsWithPrio.nix

+# types.pathInStore
+checkConfigOutput '".*/store/5lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv"' config.pathInStore.ok1 ./types.nix
+checkConfigOutput '".*/store/xfb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15"' config.pathInStore.ok2 ./types.nix
+checkConfigOutput '".*/store/xfb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15/bin/bash"' config.pathInStore.ok3 ./types.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ""' config.pathInStore.bad1 ./types.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ".*/store"' config.pathInStore.bad2 ./types.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ".*/store/"' config.pathInStore.bad3 ./types.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: ".*/store/.links"' config.pathInStore.bad4 ./types.nix
+checkConfigError 'A definition for option .* is not of type .path in the Nix store.. Definition values:\n\s*- In .*: "/foo/bar"' config.pathInStore.bad5 ./types.nix
+
 # Check boolean option.
 checkConfigOutput '^false$' config.enable ./declare-enable.nix
 checkConfigError 'The option .* does not exist. Definition values:\n\s*- In .*: true' config.enable ./define-enable.nix
--- a/lib/tests/modules/types.nix
+++ b/lib/tests/modules/types.nix
@ -0,0 +1,24 @@
+{ lib, ... }:
+let
+  inherit (builtins)
+    storeDir;
+  inherit (lib)
+    types
+    mkOption
+    ;
+in
+{
+  options = {
+    pathInStore = mkOption { type = types.lazyAttrsOf types.pathInStore; };
+  };
+  config = {
+    pathInStore.ok1 = "${storeDir}/5lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv";
+    pathInStore.ok2 = "${storeDir}/xfb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15";
+    pathInStore.ok3 = "${storeDir}/xfb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15/bin/bash";
+    pathInStore.bad1 = "";
+    pathInStore.bad2 = "${storeDir}";
+    pathInStore.bad3 = "${storeDir}/";
+    pathInStore.bad4 = "${storeDir}/.links"; # technically true, but not reasonable
+    pathInStore.bad5 = "/foo/bar";
+  };
+}
--- a/lib/tests/release.nix
+++ b/lib/tests/release.nix
@ -38,9 +38,6 @@ let
      export PAGER=cat
      cacheDir=$TEST_ROOT/binary-cache

-      mkdir -p $NIX_CONF_DIR
-      echo "experimental-features = nix-command" >> $NIX_CONF_DIR/nix.conf
-
      nix-store --init

      cp -r ${../.} lib
--- a/lib/types.nix
+++ b/lib/types.nix
@ -461,6 +461,7 @@ rec {
    # - strings with context, e.g. "${pkgs.foo}" or (toString pkgs.foo)
    # - hardcoded store path literals (/nix/store/hash-foo) or strings without context
    #   ("/nix/store/hash-foo"). These get a context added to them using builtins.storePath.
+    # If you don't need a *top-level* store path, consider using pathInStore instead.
    package = mkOptionType {
      name = "package";
      descriptionClass = "noun";
@ -491,6 +492,14 @@ rec {
      merge = mergeEqualOption;
    };

+    pathInStore = mkOptionType {
+      name = "pathInStore";
+      description = "path in the Nix store";
+      descriptionClass = "noun";
+      check = x: isStringLike x && builtins.match "${builtins.storeDir}/[^.].*" (toString x) != null;
+      merge = mergeEqualOption;
+    };
+
    listOf = elemType: mkOptionType rec {
      name = "listOf";
      description = "list of ${optionDescriptionPhrase (class: class == "noun" || class == "composite") elemType}";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1439,6 +1439,12 @@
    githubId = 453170;
    name = "Alastair Pharo";
  };
+  astavie = {
+    email = "astavie@pm.me";
+    github = "astavie";
+    githubId = 7745457;
+    name = "Astavie";
+  };
  astro = {
    email = "astro@spaceboyz.net";
    github = "astro";
@ -4216,6 +4222,14 @@
    githubId = 39825;
    name = "Dominik Honnef";
  };
+  donovanglover = {
+    github = "donovanglover";
+    githubId = 2374245;
+    name = "Donovan Glover";
+    keys = [{
+      fingerprint = "EE7D 158E F9E7 660E 0C33  86B2 8FC5 F7D9 0A5D 8F4D";
+    }];
+  };
  doriath = {
    email = "tomasz.zurkowski@gmail.com";
    github = "doriath";
@ -10585,6 +10599,12 @@
    githubId = 1699466;
    name = "Michael Peyton Jones";
  };
+  michaelshmitty = {
+    name = "Michael Smith";
+    email = "shmitty@protonmail.com";
+    github = "michaelshmitty";
+    githubId = 114845;
+  };
  michalrus = {
    email = "m@michalrus.com";
    github = "michalrus";
@ -16689,6 +16709,12 @@
    githubId = 9413924;
    name = "Thorsten Weber";
  };
+  twesterhout = {
+    name = "Tom Westerhout";
+    matrix = "@twesterhout:matrix.org";
+    github = "twesterhout";
+    githubId = 14264576;
+  };
  twey = {
    email = "twey@twey.co.uk";
    github = "Twey";
--- a/maintainers/scripts/check-hydra-by-maintainer.nix
+++ b/maintainers/scripts/check-hydra-by-maintainer.nix
@ -1,15 +1,18 @@
 { maintainer }:
 let
-  pkgs = import ./../../default.nix { };
+  pkgs = import ./../../default.nix {
+    config.allowAliases = false;
+  };
+  inherit (pkgs) lib;
  maintainer_ = pkgs.lib.maintainers.${maintainer};
  packagesWith = cond: return: prefix: set:
-    (pkgs.lib.flatten
-      (pkgs.lib.mapAttrsToList
+    (lib.flatten
+      (lib.mapAttrsToList
        (name: pkg:
          let
            result = builtins.tryEval
              (
-                if pkgs.lib.isDerivation pkg && cond name pkg then
+                if lib.isDerivation pkg && cond name pkg then
                # Skip packages whose closure fails on evaluation.
                # This happens for pkgs like `python27Packages.djangoql`
                # that have disabled Python pkgs as dependencies.
@ -42,7 +45,7 @@ let
      )
    )
    (name: name)
-    ("")
+    ""
    pkgs;

 in
--- a/nixos/doc/manual/development/option-types.section.md
+++ b/nixos/doc/manual/development/option-types.section.md
@ -20,6 +20,11 @@ merging is handled.
    coerced to a string. Even if derivations can be considered as
    paths, the more specific `types.package` should be preferred.

+`types.pathInStore`
+
+:   A path that is contained in the Nix store. This can be a top-level store
+    path like `pkgs.hello` or a descendant like `"${pkgs.hello}/bin/hello"`.
+
 `types.package`

 :   A top-level store path. This can be an attribute set pointing
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -16,12 +16,16 @@

 - [GoToSocial](https://gotosocial.org/), an ActivityPub social network server, written in Golang. Available as [services.gotosocial](#opt-services.gotosocial.enable).

+- [Anuko Time Tracker](https://github.com/anuko/timetracker), a simple, easy to use, open source time tracking system. Available as [services.anuko-time-tracker](#opt-services.anuko-time-tracker.enable).
+
 - [sitespeed-io](https://sitespeed.io), a tool that can generate metrics (timings, diagnostics) for websites. Available as [services.sitespeed-io](#opt-services.sitespeed-io.enable).

 - [Apache Guacamole](https://guacamole.apache.org/), a cross-platform, clientless remote desktop gateway. Available as [services.guacamole-server](#opt-services.guacamole-server.enable) and [services.guacamole-client](#opt-services.guacamole-client.enable) services.

 ## Backward Incompatibilities {#sec-release-23.11-incompatibilities}

+- `python3.pkgs.sequoia` was removed in favor of `python3.pkgs.pysequoia`. The latter package is based on upstream's dedicated repository for sequoia's Python bindings, where the Python bindings from [gitlab:sequoia-pgp/sequoia](https://gitlab.com/sequoia-pgp/sequoia) were removed long ago.
+
 - `writeTextFile` now requires `executable` to be boolean, values like `null` or `""` will now fail to evaluate.

 - The latest version of `clonehero` now stores custom content in `~/.clonehero`. See the [migration instructions](https://clonehero.net/2022/11/29/v23-to-v1-migration-instructions.html). Typically, these content files would exist along side the binary, but the previous build used a wrapper script that would store them in `~/.config/unity3d/srylain Inc_/Clone Hero`.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1013,6 +1013,7 @@
  ./services/networking/shorewall.nix
  ./services/networking/shorewall6.nix
  ./services/networking/shout.nix
+  ./services/networking/sing-box.nix
  ./services/networking/sitespeed-io.nix
  ./services/networking/skydns.nix
  ./services/networking/smartdns.nix
@ -1168,6 +1169,7 @@
  ./services/wayland/cage.nix
  ./services/web-apps/akkoma.nix
  ./services/web-apps/alps.nix
+  ./services/web-apps/anuko-time-tracker.nix
  ./services/web-apps/atlassian/confluence.nix
  ./services/web-apps/atlassian/crowd.nix
  ./services/web-apps/atlassian/jira.nix
--- a/nixos/modules/programs/shadow.nix
+++ b/nixos/modules/programs/shadow.nix
@ -1,67 +1,131 @@
 # Configuration for the pwdutils suite of tools: passwd, useradd, etc.
-
 { config, lib, utils, pkgs, ... }:
-
 with lib;
-
 let
+  cfg = config.security.loginDefs;
+in
+{
+  options = with types; {
+    security.loginDefs = {
+      package = mkPackageOptionMD pkgs "shadow" { };

-  /*
-  There are three different sources for user/group id ranges, each of which gets
-  used by different programs:
-  - The login.defs file, used by the useradd, groupadd and newusers commands
-  - The update-users-groups.pl file, used by NixOS in the activation phase to
-    decide on which ids to use for declaratively defined users without a static
-    id
-  - Systemd compile time options -Dsystem-uid-max= and -Dsystem-gid-max=, used
-    by systemd for features like ConditionUser=@system and systemd-sysusers
-  */
-  loginDefs =
-    ''
-      DEFAULT_HOME yes
+      chfnRestrict = mkOption {
+        description = mdDoc ''
+          Use chfn SUID to allow non-root users to change their account GECOS information.
+        '';
+        type = nullOr str;
+        default = null;
+      };

-      SYS_UID_MIN  400
-      SYS_UID_MAX  999
-      UID_MIN      1000
-      UID_MAX      29999
+      settings = mkOption {
+        description = mdDoc ''
+          Config options for the /etc/login.defs file, that defines
+          the site-specific configuration for the shadow password suite.
+          See login.defs(5) man page for available options.
+        '';
+        type = submodule {
+          freeformType = (pkgs.formats.keyValue { }).type;
+          /* There are three different sources for user/group id ranges, each of which gets
+             used by different programs:
+             - The login.defs file, used by the useradd, groupadd and newusers commands
+             - The update-users-groups.pl file, used by NixOS in the activation phase to
+               decide on which ids to use for declaratively defined users without a static
+               id
+             - Systemd compile time options -Dsystem-uid-max= and -Dsystem-gid-max=, used
+               by systemd for features like ConditionUser=@system and systemd-sysusers
+              */
+          options = {
+            DEFAULT_HOME = mkOption {
+              description = mdDoc "Indicate if login is allowed if we can't cd to the home directory.";
+              default = "yes";
+              type = enum [ "yes" "no" ];
+            };

-      SYS_GID_MIN  400
-      SYS_GID_MAX  999
-      GID_MIN      1000
-      GID_MAX      29999
+            ENCRYPT_METHOD = mkOption {
+              description = mdDoc "This defines the system default encryption algorithm for encrypting passwords.";
+              # The default crypt() method, keep in sync with the PAM default
+              default = "YESCRYPT";
+              type = enum [ "YESCRYPT" "SHA512" "SHA256" "MD5" "DES"];
+            };

-      TTYGROUP     tty
-      TTYPERM      0620
+            SYS_UID_MIN = mkOption {
+              description = mdDoc "Range of user IDs used for the creation of system users by useradd or newusers.";
+              default = 400;
+              type = int;
+            };

-      # Ensure privacy for newly created home directories.
-      UMASK        077
+            SYS_UID_MAX = mkOption {
+              description = mdDoc "Range of user IDs used for the creation of system users by useradd or newusers.";
+              default = 999;
+              type = int;
+            };

-      # Uncomment this and install chfn SUID to allow non-root
-      # users to change their account GECOS information.
-      # This should be made configurable.
-      #CHFN_RESTRICT frwh
+            UID_MIN = mkOption {
+              description = mdDoc "Range of user IDs used for the creation of regular users by useradd or newusers.";
+              default = 1000;
+              type = int;
+            };

-      # The default crypt() method, keep in sync with the PAM default
-      ENCRYPT_METHOD YESCRYPT
-    '';
+            UID_MAX = mkOption {
+              description = mdDoc "Range of user IDs used for the creation of regular users by useradd or newusers.";
+              default = 29999;
+              type = int;
+            };

-  mkSetuidRoot = source:
-    { setuid = true;
-      owner = "root";
-      group = "root";
-      inherit source;
+            SYS_GID_MIN = mkOption {
+              description = mdDoc "Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers";
+              default = 400;
+              type = int;
+            };
+
+            SYS_GID_MAX = mkOption {
+              description = mdDoc "Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers";
+              default = 999;
+              type = int;
+            };
+
+            GID_MIN = mkOption {
+              description = mdDoc "Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.";
+              default = 1000;
+              type = int;
+            };
+
+            GID_MAX = mkOption {
+              description = mdDoc "Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.";
+              default = 29999;
+              type = int;
+            };
+
+            TTYGROUP = mkOption {
+              description = mdDoc ''
+                The terminal permissions: the login tty will be owned by the TTYGROUP group,
+                and the permissions will be set to TTYPERM'';
+              default = "tty";
+              type = str;
+            };
+
+            TTYPERM = mkOption {
+              description = mdDoc ''
+                The terminal permissions: the login tty will be owned by the TTYGROUP group,
+                and the permissions will be set to TTYPERM'';
+              default = "0620";
+              type = str;
+            };
+
+            # Ensure privacy for newly created home directories.
+            UMASK = mkOption {
+              description = mdDoc "The file mode creation mask is initialized to this value.";
+              default = "077";
+              type = str;
+            };
+          };
+        };
+        default = { };
+      };
    };

-in
-
-{
-
-  ###### interface
-
-  options = {
-
-    users.defaultUserShell = lib.mkOption {
-      description = lib.mdDoc ''
+    users.defaultUserShell = mkOption {
+      description = mdDoc ''
        This option defines the default shell assigned to user
        accounts. This can be either a full system path or a shell package.

@ -69,63 +133,107 @@ in
        used outside the store (in particular in /etc/passwd).
      '';
      example = literalExpression "pkgs.zsh";
-      type = types.either types.path types.shellPackage;
+      type = either path shellPackage;
    };
-
  };

-
  ###### implementation

  config = {
+    assertions = [
+      {
+        assertion = cfg.settings.SYS_UID_MIN <= cfg.settings.SYS_UID_MAX;
+        message = "SYS_UID_MIN must be less than or equal to SYS_UID_MAX";
+      }
+      {
+        assertion = cfg.settings.UID_MIN <= cfg.settings.UID_MAX;
+        message = "UID_MIN must be less than or equal to UID_MAX";
+      }
+      {
+        assertion = cfg.settings.SYS_GID_MIN <= cfg.settings.SYS_GID_MAX;
+        message = "SYS_GID_MIN must be less than or equal to SYS_GID_MAX";
+      }
+      {
+        assertion = cfg.settings.GID_MIN <= cfg.settings.GID_MAX;
+        message = "GID_MIN must be less than or equal to GID_MAX";
+      }
+    ];

-    environment.systemPackages =
-      lib.optional config.users.mutableUsers pkgs.shadow ++
-      lib.optional (types.shellPackage.check config.users.defaultUserShell)
-        config.users.defaultUserShell;
+    security.loginDefs.settings.CHFN_RESTRICT =
+      mkIf (cfg.chfnRestrict != null) cfg.chfnRestrict;
+
+    environment.systemPackages = optional config.users.mutableUsers cfg.package
+      ++ optional (types.shellPackage.check config.users.defaultUserShell) config.users.defaultUserShell
+      ++ optional (cfg.chfnRestrict != null) pkgs.util-linux;

    environment.etc =
-      { # /etc/login.defs: global configuration for pwdutils.  You
-        # cannot login without it!
-        "login.defs".source = pkgs.writeText "login.defs" loginDefs;
+      # Create custom toKeyValue generator
+      # see https://man7.org/linux/man-pages/man5/login.defs.5.html for config specification
+      let
+        toKeyValue = generators.toKeyValue {
+          mkKeyValue = generators.mkKeyValueDefault { } " ";
+        };
+      in
+      {
+        # /etc/login.defs: global configuration for pwdutils.
+        # You cannot login without it!
+        "login.defs".source = pkgs.writeText "login.defs" (toKeyValue cfg.settings);

        # /etc/default/useradd: configuration for useradd.
-        "default/useradd".source = pkgs.writeText "useradd"
-          ''
-            GROUP=100
-            HOME=/home
-            SHELL=${utils.toShellPath config.users.defaultUserShell}
-          '';
+        "default/useradd".source = pkgs.writeText "useradd" ''
+          GROUP=100
+          HOME=/home
+          SHELL=${utils.toShellPath config.users.defaultUserShell}
+        '';
      };

-    security.pam.services =
-      { chsh = { rootOK = true; };
-        chfn = { rootOK = true; };
-        su = { rootOK = true; forwardXAuth = true; logFailures = true; };
-        passwd = {};
-        # Note: useradd, groupadd etc. aren't setuid root, so it
-        # doesn't really matter what the PAM config says as long as it
-        # lets root in.
-        useradd = { rootOK = true; };
-        usermod = { rootOK = true; };
-        userdel = { rootOK = true; };
-        groupadd = { rootOK = true; };
-        groupmod = { rootOK = true; };
-        groupmems = { rootOK = true; };
-        groupdel = { rootOK = true; };
-        login = { startSession = true; allowNullPassword = true; showMotd = true; updateWtmp = true; };
-        chpasswd = { rootOK = true; };
+    security.pam.services = {
+      chsh = { rootOK = true; };
+      chfn = { rootOK = true; };
+      su = {
+        rootOK = true;
+        forwardXAuth = true;
+        logFailures = true;
      };
-
-    security.wrappers = {
-      su        = mkSetuidRoot "${pkgs.shadow.su}/bin/su";
-      sg        = mkSetuidRoot "${pkgs.shadow.out}/bin/sg";
-      newgrp    = mkSetuidRoot "${pkgs.shadow.out}/bin/newgrp";
-      newuidmap = mkSetuidRoot "${pkgs.shadow.out}/bin/newuidmap";
-      newgidmap = mkSetuidRoot "${pkgs.shadow.out}/bin/newgidmap";
-    } // lib.optionalAttrs config.users.mutableUsers {
-      chsh   = mkSetuidRoot "${pkgs.shadow.out}/bin/chsh";
-      passwd = mkSetuidRoot "${pkgs.shadow.out}/bin/passwd";
+      passwd = { };
+      # Note: useradd, groupadd etc. aren't setuid root, so it
+      # doesn't really matter what the PAM config says as long as it
+      # lets root in.
+      useradd.rootOK = true;
+      usermod.rootOK = true;
+      userdel.rootOK = true;
+      groupadd.rootOK = true;
+      groupmod.rootOK = true;
+      groupmems.rootOK = true;
+      groupdel.rootOK = true;
+      login = {
+        startSession = true;
+        allowNullPassword = true;
+        showMotd = true;
+        updateWtmp = true;
+      };
+      chpasswd = { rootOK = true; };
    };
+
+    security.wrappers =
+      let
+        mkSetuidRoot = source: {
+          setuid = true;
+          owner = "root";
+          group = "root";
+          inherit source;
+        };
+      in
+      {
+        su = mkSetuidRoot "${cfg.package.su}/bin/su";
+        sg = mkSetuidRoot "${cfg.package.out}/bin/sg";
+        newgrp = mkSetuidRoot "${cfg.package.out}/bin/newgrp";
+        newuidmap = mkSetuidRoot "${cfg.package.out}/bin/newuidmap";
+        newgidmap = mkSetuidRoot "${cfg.package.out}/bin/newgidmap";
+      }
+      // optionalAttrs config.users.mutableUsers {
+        chsh = mkSetuidRoot "${cfg.package.out}/bin/chsh";
+        passwd = mkSetuidRoot "${cfg.package.out}/bin/passwd";
+      };
  };
 }
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@ -72,7 +72,7 @@ let
          --replace \"/sbin/blkid \"${pkgs.util-linux}/sbin/blkid \
          --replace \"/bin/mount \"${pkgs.util-linux}/bin/mount \
          --replace /usr/bin/readlink ${pkgs.coreutils}/bin/readlink \
-          --replace /usr/bin/basename ${pkgs.coreutils}/bin/basename
+          --replace /usr/bin/basename ${pkgs.coreutils}/bin/basename 2>/dev/null
      ${optionalString (initrdBin != null) ''
        substituteInPlace $i --replace '/run/current-system/systemd' "${removeSuffix "/bin" initrdBin}"
      ''}
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -1281,6 +1281,7 @@ in {
      "d ${gitlabConfig.production.shared.path}/pages 0750 ${cfg.user} ${cfg.group} -"
      "d ${gitlabConfig.production.shared.path}/registry 0750 ${cfg.user} ${cfg.group} -"
      "d ${gitlabConfig.production.shared.path}/terraform_state 0750 ${cfg.user} ${cfg.group} -"
+      "d ${gitlabConfig.production.shared.path}/ci_secure_files 0750 ${cfg.user} ${cfg.group} -"
      "L+ /run/gitlab/config - - - - ${cfg.statePath}/config"
      "L+ /run/gitlab/log - - - - ${cfg.statePath}/log"
      "L+ /run/gitlab/tmp - - - - ${cfg.statePath}/tmp"
--- a/nixos/modules/services/misc/gollum.nix
+++ b/nixos/modules/services/misc/gollum.nix
@ -91,18 +91,30 @@ in
        The package used in the service
      '';
    };
+
+    user = mkOption {
+      type = types.str;
+      default = "gollum";
+      description = lib.mdDoc "Specifies the owner of the wiki directory";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "gollum";
+      description = lib.mdDoc "Specifies the owner group of the wiki directory";
+    };
  };

  config = mkIf cfg.enable {

-    users.users.gollum = {
-      group = config.users.users.gollum.name;
+    users.users.gollum = mkIf (cfg.user == "gollum") {
+      group = cfg.group;
      description = "Gollum user";
      createHome = false;
      isSystemUser = true;
    };

-    users.groups.gollum = { };
+    users.groups."${cfg.group}" = { };

    systemd.tmpfiles.rules = [
      "d '${cfg.stateDir}' - ${config.users.users.gollum.name} ${config.users.groups.gollum.name} - -"
@ -120,8 +132,8 @@ in
      '';

      serviceConfig = {
-        User = config.users.users.gollum.name;
-        Group = config.users.groups.gollum.name;
+        User = cfg.user;
+        Group = cfg.group;
        WorkingDirectory = cfg.stateDir;
        ExecStart = ''
          ${cfg.package}/bin/gollum \
--- a/nixos/modules/services/misc/nix-optimise.nix
+++ b/nixos/modules/services/misc/nix-optimise.nix
@ -1,28 +1,21 @@
 { config, lib, ... }:

-with lib;
-
 let
  cfg = config.nix.optimise;
 in

 {
-
-  ###### interface
-
  options = {
-
    nix.optimise = {
-
-      automatic = mkOption {
+      automatic = lib.mkOption {
        default = false;
-        type = types.bool;
+        type = lib.types.bool;
        description = lib.mdDoc "Automatically run the nix store optimiser at a specific time.";
      };

-      dates = mkOption {
+      dates = lib.mkOption {
        default = ["03:45"];
-        type = types.listOf types.str;
+        type = with lib.types; listOf str;
        description = lib.mdDoc ''
          Specification (in the format described by
          {manpage}`systemd.time(7)`) of the time at
@ -32,9 +25,6 @@ in
    };
  };

-
-  ###### implementation
-
  config = {
    assertions = [
      {
@ -43,14 +33,19 @@ in
      }
    ];

-    systemd.services.nix-optimise = lib.mkIf config.nix.enable
-      { description = "Nix Store Optimiser";
+    systemd = lib.mkIf config.nix.enable {
+      services.nix-optimise = {
+        description = "Nix Store Optimiser";
        # No point this if the nix daemon (and thus the nix store) is outside
        unitConfig.ConditionPathIsReadWrite = "/nix/var/nix/daemon-socket";
        serviceConfig.ExecStart = "${config.nix.package}/bin/nix-store --optimise";
-        startAt = optionals cfg.automatic cfg.dates;
+        startAt = lib.optionals cfg.automatic cfg.dates;
      };

+      timers.nix-optimise.timerConfig = {
+        Persistent = true;
+        RandomizedDelaySec = 1800;
+      };
+    };
  };
-
 }
--- a/nixos/modules/services/networking/sing-box.nix
+++ b/nixos/modules/services/networking/sing-box.nix
@ -0,0 +1,67 @@
+{ config, lib, pkgs, utils, ... }:
+let
+  cfg = config.services.sing-box;
+  settingsFormat = pkgs.formats.json { };
+in
+{
+
+  meta = {
+    maintainers = with lib.maintainers; [ nickcao ];
+  };
+
+  options = {
+    services.sing-box = {
+      enable = lib.mkEnableOption (lib.mdDoc "sing-box universal proxy platform");
+
+      package = lib.mkPackageOptionMD pkgs "sing-box" { };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+          options = {
+            route = {
+              geoip.path = lib.mkOption {
+                type = lib.types.path;
+                default = "${pkgs.sing-geoip}/share/sing-box/geoip.db";
+                defaultText = lib.literalExpression "\${pkgs.sing-geoip}/share/sing-box/geoip.db";
+                description = lib.mdDoc ''
+                  The path to the sing-geoip database.
+                '';
+              };
+              geosite.path = lib.mkOption {
+                type = lib.types.path;
+                default = "${pkgs.sing-geosite}/share/sing-box/geosite.db";
+                defaultText = lib.literalExpression "\${pkgs.sing-geosite}/share/sing-box/geosite.db";
+                description = lib.mdDoc ''
+                  The path to the sing-geosite database.
+                '';
+              };
+            };
+          };
+        };
+        default = { };
+        description = lib.mdDoc ''
+          The sing-box configuration, see https://sing-box.sagernet.org/configuration/ for documentation.
+
+          Options containing secret data should be set to an attribute set
+          containing the attribute `_secret` - a string pointing to a file
+          containing the value the option should be set to.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.packages = [ cfg.package ];
+
+    systemd.services.sing-box = {
+      preStart = ''
+        umask 0077
+        mkdir -p /etc/sing-box
+        ${utils.genJqSecretsReplacementSnippet cfg.settings "/etc/sing-box/config.json"}
+      '';
+      wantedBy = [ "multi-user.target" ];
+    };
+  };
+
+}
--- a/nixos/modules/services/web-apps/anuko-time-tracker.nix
+++ b/nixos/modules/services/web-apps/anuko-time-tracker.nix
@ -0,0 +1,354 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.services.anuko-time-tracker;
+  configFile = let
+    smtpPassword = if cfg.settings.email.smtpPasswordFile == null
+                   then "''"
+                   else "trim(file_get_contents('${cfg.settings.email.smtpPasswordFile}'))";
+
+  in pkgs.writeText "config.php" ''
+    <?php
+    // Set include path for PEAR and its modules, which we include in the distribution.
+    // Updated for the correct location in the nix store.
+    set_include_path('${cfg.package}/WEB-INF/lib/pear' . PATH_SEPARATOR . get_include_path());
+    define('DSN', 'mysqli://${cfg.database.user}@${cfg.database.host}/${cfg.database.name}?charset=utf8mb4');
+    define('MULTIORG_MODE', ${lib.boolToString cfg.settings.multiorgMode});
+    define('EMAIL_REQUIRED', ${lib.boolToString cfg.settings.emailRequired});
+    define('WEEKEND_START_DAY', ${toString cfg.settings.weekendStartDay});
+    define('FORUM_LINK', '${cfg.settings.forumLink}');
+    define('HELP_LINK', '${cfg.settings.helpLink}');
+    define('SENDER', '${cfg.settings.email.sender}');
+    define('MAIL_MODE', '${cfg.settings.email.mode}');
+    define('MAIL_SMTP_HOST', '${toString cfg.settings.email.smtpHost}');
+    define('MAIL_SMTP_PORT', '${toString cfg.settings.email.smtpPort}');
+    define('MAIL_SMTP_USER', '${cfg.settings.email.smtpUser}');
+    define('MAIL_SMTP_PASSWORD', ${smtpPassword});
+    define('MAIL_SMTP_AUTH', ${lib.boolToString cfg.settings.email.smtpAuth});
+    define('MAIL_SMTP_DEBUG', ${lib.boolToString cfg.settings.email.smtpDebug});
+    define('DEFAULT_CSS', 'default.css');
+    define('RTL_CSS', 'rtl.css'); // For right to left languages.
+    define('LANG_DEFAULT', '${cfg.settings.defaultLanguage}');
+    define('CURRENCY_DEFAULT', '${cfg.settings.defaultCurrency}');
+    define('EXPORT_DECIMAL_DURATION', ${lib.boolToString cfg.settings.exportDecimalDuration});
+    define('REPORT_FOOTER', ${lib.boolToString cfg.settings.reportFooter});
+    define('AUTH_MODULE', 'db');
+  '';
+  package = pkgs.stdenv.mkDerivation rec {
+    pname = "anuko-time-tracker";
+    inherit (src) version;
+    src = cfg.package;
+    installPhase = ''
+      mkdir -p $out
+      cp -r * $out/
+
+      ln -s ${configFile} $out/WEB-INF/config.php
+
+      # Link writable templates_c directory
+      rm -rf $out/WEB-INF/templates_c
+      ln -s ${cfg.dataDir}/templates_c $out/WEB-INF/templates_c
+
+      # ln -fs ${cfg.dataDir}/templates_c $out/WEB-INF/templates_c
+    '';
+  };
+in
+{
+  options.services.anuko-time-tracker = {
+    enable = lib.mkEnableOption (lib.mdDoc "Anuko Time Tracker");
+
+    package = lib.mkPackageOptionMD pkgs "anuko-time-tracker" {};
+
+    database = {
+      createLocally = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = lib.mdDoc "Create the database and database user locally.";
+      };
+
+      host = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "Database host.";
+        default = "localhost";
+      };
+
+      name = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "Database name.";
+        default = "anuko_time_tracker";
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "Database username.";
+        default = "anuko_time_tracker";
+      };
+
+      passwordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        description = lib.mdDoc "Database user password file.";
+        default = null;
+      };
+    };
+
+    poolConfig = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.oneOf [ lib.types.str lib.types.int lib.types.bool ]);
+      default = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+      };
+      description = lib.mdDoc ''
+        Options for Anuko Time Tracker's PHP-FPM pool.
+      '';
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/anuko-time-tracker";
+      description = lib.mdDoc "Default data folder for Anuko Time Tracker.";
+      example = "/mnt/anuko-time-tracker";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "anuko_time_tracker";
+      description = lib.mdDoc "User under which Anuko Time Tracker runs.";
+    };
+
+    virtualHost = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = "localhost";
+      description = lib.mdDoc ''
+        Name of the nginx virtualhost to use and setup. If null, do not setup
+        any virtualhost.
+      '';
+    };
+
+    settings = {
+      multiorgMode = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = lib.mdDoc ''
+          Defines whether users see the Register option in the menu of Time Tracker that allows them
+          to self-register and create new organizations (top groups).
+        '';
+      };
+
+      emailRequired = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = lib.mdDoc "Defines whether an email is required for new registrations.";
+      };
+
+      weekendStartDay = lib.mkOption {
+        type = lib.types.int;
+        default = 6;
+        description = lib.mdDoc ''
+          This option defines which days are highlighted with weekend color.
+          6 means Saturday. For Saudi Arabia, etc. set it to 4 for Thursday and Friday to be
+          weekend days.
+        '';
+      };
+
+      forumLink = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "Forum link from the main menu.";
+        default = "https://www.anuko.com/forum/viewforum.php?f=4";
+      };
+
+      helpLink = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc "Help link from the main menu.";
+        default = "https://www.anuko.com/time-tracker/user-guide/index.htm";
+      };
+
+      email = {
+        sender = lib.mkOption {
+          type = lib.types.str;
+          description = lib.mdDoc "Default sender for mail.";
+          default = "Anuko Time Tracker <bounces@example.com>";
+        };
+
+        mode = lib.mkOption {
+          type = lib.types.str;
+          description = lib.mdDoc "Mail sending mode. Can be 'mail' or 'smtp'.";
+          default = "smtp";
+        };
+
+        smtpHost = lib.mkOption {
+          type = lib.types.str;
+          description = lib.mdDoc "MTA hostname.";
+          default = "localhost";
+        };
+
+        smtpPort = lib.mkOption {
+          type = lib.types.int;
+          description = lib.mdDoc "MTA port.";
+          default = 25;
+        };
+
+        smtpUser = lib.mkOption {
+          type = lib.types.str;
+          description = lib.mdDoc "MTA authentication username.";
+          default = "";
+        };
+
+        smtpAuth = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = lib.mdDoc "MTA requires authentication.";
+        };
+
+        smtpPasswordFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          example = "/var/lib/anuko-time-tracker/secrets/smtp-password";
+          description = lib.mdDoc ''
+            Path to file containing the MTA authentication password.
+          '';
+        };
+
+        smtpDebug = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = lib.mdDoc "Debug mail sending.";
+        };
+      };
+
+      defaultLanguage = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc ''
+          Defines Anuko Time Tracker default language. It is used on Time Tracker login page.
+          After login, a language set for user group is used.
+          Empty string means the language is defined by user browser.
+        '';
+        default = "";
+        example = "nl";
+      };
+
+      defaultCurrency = lib.mkOption {
+        type = lib.types.str;
+        description = lib.mdDoc ''
+          Defines a default currency symbol for new groups.
+          Use €, £, a more specific dollar like US$, CAD, etc.
+        '';
+        default = "$";
+        example = "€";
+      };
+
+      exportDecimalDuration = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = lib.mdDoc ''
+          Defines whether time duration values are decimal in CSV and XML data
+          exports (1.25 vs 1:15).
+        '';
+      };
+
+      reportFooter = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = lib.mdDoc "Defines whether to use a footer on reports.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
+        message = ''
+          <option>services.anuko-time-tracker.database.passwordFile</option> cannot be specified if
+          <option>services.anuko-time-tracker.database.createLocally</option> is set to true.
+        '';
+      }
+      {
+        assertion = cfg.settings.email.smtpAuth -> (cfg.settings.email.smtpPasswordFile != null);
+        message = ''
+          <option>services.anuko-time-tracker.settings.email.smtpPasswordFile</option> needs to be set if
+          <option>services.anuko-time-tracker.settings.email.smtpAuth</option> is enabled.
+        '';
+      }
+    ];
+
+    services.phpfpm = {
+      pools.anuko-time-tracker = {
+        inherit (cfg) user;
+        group = config.services.nginx.group;
+        settings = {
+          "listen.owner" = config.services.nginx.user;
+          "listen.group" = config.services.nginx.group;
+        } // cfg.poolConfig;
+      };
+    };
+
+    services.nginx = lib.mkIf (cfg.virtualHost != null) {
+      enable = true;
+      virtualHosts = {
+        "${cfg.virtualHost}" = {
+          root = lib.mkForce "${package}";
+          locations."/".index = "index.php";
+          locations."~ [^/]\\.php(/|$)" = {
+            extraConfig = ''
+              fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+              fastcgi_pass unix:${config.services.phpfpm.pools.anuko-time-tracker.socket};
+            '';
+          };
+        };
+      };
+    };
+
+    services.mysql = lib.mkIf cfg.database.createLocally {
+      enable = lib.mkDefault true;
+      package = lib.mkDefault pkgs.mariadb;
+      ensureDatabases = [ cfg.database.name ];
+      ensureUsers = [{
+        name = cfg.database.user;
+        ensurePermissions = {
+          "${cfg.database.name}.*" = "ALL PRIVILEGES";
+        };
+      }];
+    };
+
+    systemd = {
+      services = {
+        anuko-time-tracker-setup-database = lib.mkIf cfg.database.createLocally {
+          description = "Set up Anuko Time Tracker database";
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+          };
+          wantedBy = [ "phpfpm-anuko-time-tracker.service" ];
+          after = [ "mysql.service" ];
+          script =
+            let
+              mysql = "${config.services.mysql.package}/bin/mysql";
+            in
+            ''
+              if [ ! -f ${cfg.dataDir}/.dbexists ]; then
+                # Load database schema provided with package
+                ${mysql} ${cfg.database.name} < ${cfg.package}/mysql.sql
+
+                touch ${cfg.dataDir}/.dbexists
+              fi
+            '';
+        };
+      };
+      tmpfiles.rules = [
+        "d ${cfg.dataDir} 0750 ${cfg.user} ${config.services.nginx.group} -"
+        "d ${cfg.dataDir}/templates_c 0750 ${cfg.user} ${config.services.nginx.group} -"
+      ];
+    };
+
+    users.users."${cfg.user}" = {
+      isSystemUser = true;
+      group = config.services.nginx.group;
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ michaelshmitty ];
+}
--- a/nixos/modules/services/web-apps/lemmy.nix
+++ b/nixos/modules/services/web-apps/lemmy.nix
@ -202,7 +202,7 @@ in

        environment = {
          LEMMY_CONFIG_LOCATION = "${settingsFormat.generate "config.hjson" cfg.settings}";
-          LEMMY_DATABASE_URL = mkIf (cfg.database.uri != null) cfg.database.uri;
+          LEMMY_DATABASE_URL = if cfg.database.uri != null then cfg.database.uri else (mkIf (cfg.database.createLocally) "postgres:///lemmy?host=/run/postgresql&user=lemmy");
        };

        documentation = [
--- a/nixos/modules/services/web-apps/pixelfed.nix
+++ b/nixos/modules/services/web-apps/pixelfed.nix
@ -380,6 +380,12 @@ in {
      };

      script = ''
+        # Before running any PHP program, cleanup the code cache.
+        # It's necessary if you upgrade the application otherwise you might
+        # try to import non-existent modules.
+        rm -f ${cfg.runtimeDir}/app.php
+        rm -rf ${cfg.runtimeDir}/cache/*
+
        # Concatenate non-secret .env and secret .env
        rm -f ${cfg.dataDir}/.env
        cp --no-preserve=all ${configFile} ${cfg.dataDir}/.env
@ -406,11 +412,6 @@ in {
        # Install Horizon
        # FIXME: require write access to public/ — should be done as part of install — pixelfed-manage horizon:publish

-        # Before running any PHP program, cleanup the bootstrap.
-        # It's necessary if you upgrade the application otherwise you might
-        # try to import non-existent modules.
-        rm -rf ${cfg.runtimeDir}/bootstrap/*
-
        # Perform the first migration.
        [[ ! -f ${cfg.dataDir}/.initial-migration ]] && pixelfed-manage migrate --force && touch ${cfg.dataDir}/.initial-migration

--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@ -260,10 +260,10 @@ in
    };

    system.extraDependencies = mkOption {
-      type = types.listOf types.package;
+      type = types.listOf types.pathInStore;
      default = [];
      description = lib.mdDoc ''
-        A list of packages that should be included in the system
+        A list of paths that should be included in the system
        closure but generally not visible to users.

        This option has also been used for build-time checks, but the
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -3165,7 +3165,7 @@ let

    (mkIf cfg.enable {

-      systemd.package = pkgs.systemdStage1Network;
+      systemd.package = mkDefault pkgs.systemdStage1Network;

      # For networkctl
      systemd.dbus.enable = mkDefault true;
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -107,6 +107,7 @@ in {
  allTerminfo = handleTest ./all-terminfo.nix {};
  alps = handleTest ./alps.nix {};
  amazon-init-shell = handleTest ./amazon-init-shell.nix {};
+  anuko-time-tracker = handleTest ./anuko-time-tracker.nix {};
  apcupsd = handleTest ./apcupsd.nix {};
  apfs = runTest ./apfs.nix;
  apparmor = handleTest ./apparmor.nix {};
@ -645,6 +646,7 @@ in {
  pulseaudio = discoverTests (import ./pulseaudio.nix);
  qboot = handleTestOn ["x86_64-linux" "i686-linux"] ./qboot.nix {};
  qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix {};
+  qemu-vm-volatile-root = runTest ./qemu-vm-volatile-root.nix;
  quorum = handleTest ./quorum.nix {};
  quake3 = handleTest ./quake3.nix {};
  qownnotes = handleTest ./qownnotes.nix {};
@ -686,6 +688,7 @@ in {
  shiori = handleTest ./shiori.nix {};
  signal-desktop = handleTest ./signal-desktop.nix {};
  simple = handleTest ./simple.nix {};
+  sing-box = handleTest ./sing-box.nix {};
  slurm = handleTest ./slurm.nix {};
  smokeping = handleTest ./smokeping.nix {};
  snapcast = handleTest ./snapcast.nix {};
--- a/nixos/tests/anuko-time-tracker.nix
+++ b/nixos/tests/anuko-time-tracker.nix
@ -0,0 +1,17 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "anuko-time-tracker";
+  meta = {
+    maintainers = with pkgs.lib.maintainers; [ michaelshmitty ];
+  };
+  nodes = {
+    machine = {
+      services.anuko-time-tracker.enable = true;
+    };
+  };
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("phpfpm-anuko-time-tracker")
+    machine.wait_for_open_port(80);
+    machine.wait_until_succeeds("curl -s --fail -L http://localhost/time.php | grep 'Anuko Time Tracker'")
+  '';
+})
--- a/nixos/tests/lemmy.nix
+++ b/nixos/tests/lemmy.nix
@ -26,6 +26,8 @@ in
            site_name = "Lemmy FTW";
            admin_email = "mightyiam@example.com";
          };
+          # https://github.com/LemmyNet/lemmy/blob/50efb1d519c63a7007a07f11cc8a11487703c70d/crates/utils/src/settings/mod.rs#L52
+          database.uri = "postgres:///lemmy?host=/run/postgresql&user=lemmy";
        };
        caddy.enable = true;
      };
--- a/nixos/tests/qemu-vm-volatile-root.nix
+++ b/nixos/tests/qemu-vm-volatile-root.nix
@ -0,0 +1,17 @@
+# Test that the root filesystem is a volatile tmpfs.
+
+{ lib, ... }:
+
+{
+  name = "qemu-vm-volatile-root";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine = _: {
+    virtualisation.diskImage = null;
+  };
+
+  testScript = ''
+    machine.succeed("findmnt --kernel --types tmpfs /")
+  '';
+}
--- a/nixos/tests/sing-box.nix
+++ b/nixos/tests/sing-box.nix
@ -0,0 +1,45 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+
+  name = "sing-box";
+
+  meta = {
+    maintainers = with lib.maintainers; [ nickcao ];
+  };
+
+  nodes.machine = { pkgs, ... }: {
+    environment.systemPackages = [ pkgs.curl ];
+    services.nginx.enable = true;
+    services.sing-box = {
+      enable = true;
+      settings = {
+        inbounds = [{
+          type = "mixed";
+          tag = "inbound";
+          listen = "127.0.0.1";
+          listen_port = 1080;
+          users = [{
+            username = "user";
+            password = { _secret = pkgs.writeText "password" "supersecret"; };
+          }];
+        }];
+        outbounds = [{
+          type = "direct";
+          tag = "outbound";
+        }];
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_unit("sing-box.service")
+
+    machine.wait_for_open_port(80)
+    machine.wait_for_open_port(1080)
+
+    machine.succeed("curl --fail --max-time 10 --proxy http://user:supersecret@localhost:1080 http://localhost")
+    machine.fail("curl --fail --max-time 10 --proxy http://user:supervillain@localhost:1080 http://localhost")
+    machine.succeed("curl --fail --max-time 10 --proxy socks5://user:supersecret@localhost:1080 http://localhost")
+  '';
+
+})
--- a/pkgs/applications/blockchains/dcrd/default.nix
+++ b/pkgs/applications/blockchains/dcrd/default.nix
@ -2,20 +2,18 @@

 buildGoModule rec {
  pname = "dcrd";
-  version = "1.5.2";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "decred";
    repo = "dcrd";
    rev = "refs/tags/release-v${version}";
-    sha256 = "14pxajc8si90hnddilfm09kmljwxq6i6p53fk0g09jp000cbklkl";
+    hash = "sha256-ZNBSIzx07zJrBxas7bHpZ8ZPDWJ4d7jumpKYj5Qmzlo=";
  };

-  vendorSha256 = "03aw6mcvp1vr01ppxy673jf5hdryd5032cxndlkaiwg005mxp1dy";
+  vendorHash = "sha256-++IPB2IadXd1LC5r6f1a0UqsTG/McAf7KQAw8WKKoaE=";

-  doCheck = false;
-
-  subPackages = [ "." "cmd/dcrctl" "cmd/promptsecret" ];
+  subPackages = [ "." "cmd/promptsecret" ];

  meta = {
    homepage = "https://decred.org";
--- a/pkgs/applications/blockchains/dcrwallet/default.nix
+++ b/pkgs/applications/blockchains/dcrwallet/default.nix
@ -2,18 +2,16 @@

 buildGoModule rec {
  pname = "dcrwallet";
-  version = "1.6.0";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "decred";
    repo = "dcrwallet";
-    rev = "refs/tags/v${version}";
-    sha256 = "sha256-WUfmv+laOwR/fc4osAFzPKqHQR+wOtSdLEsysICnuvg=";
+    rev = "release-v${version}";
+    hash = "sha256-ffY5IvSGu4Q7EdJpfdsIKxxjkm6FD0DR9ItnaO90SBc=";
  };

-  vendorSha256 = "sha256-9IRNlULvARIZu6dWaKrvx6fiDJ80SBLINhK/9tW9k/0=";
-
-  doCheck = false;
+  vendorHash = "sha256-dduHuMa5UPf73lfirTHSrYnOUbc2IyULpstZPGUJzuc=";

  subPackages = [ "." ];

--- a/pkgs/applications/editors/cpeditor/default.nix
+++ b/pkgs/applications/editors/cpeditor/default.nix
@ -30,6 +30,8 @@ stdenv.mkDerivation rec {
    substituteInPlace src/Core/Runner.cpp --replace "/bin/bash" "${runtimeShell}"
  '';

+  env.NIX_CFLAGS_COMPILE = "-std=c++14";
+
  meta = with lib; {
    description = "An IDE specially designed for competitive programming";
    homepage = "https://cpeditor.org";
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -403,12 +403,12 @@
  };
  elm = buildGrammar {
    language = "elm";
-    version = "0.0.0+rev=692c50c";
+    version = "0.0.0+rev=73edfcd";
    src = fetchFromGitHub {
      owner = "elm-tooling";
      repo = "tree-sitter-elm";
-      rev = "692c50c0b961364c40299e73c1306aecb5d20f40";
-      hash = "sha256-0LpuyebOB5ew9fULBcaw8aUbF7HM5sXQpv+Jroz4tXg=";
+      rev = "73edfcdc3bb2ddfc731cd5d63e6cb287a18da90d";
+      hash = "sha256-0fC3NYHtZQbi9Ca5UAAD9FEXQUJ9z8caf0XQsPpU5Rs=";
    };
    meta.homepage = "https://github.com/elm-tooling/tree-sitter-elm";
  };
@ -711,12 +711,12 @@
  };
  hack = buildGrammar {
    language = "hack";
-    version = "0.0.0+rev=b7bd692";
+    version = "0.0.0+rev=b1c41e4";
    src = fetchFromGitHub {
      owner = "slackhq";
      repo = "tree-sitter-hack";
-      rev = "b7bd6928532ada34dddb1dece4a158ab62c6e783";
-      hash = "sha256-TSbi4Ik/AjswuIdTaFfJ53S0c/qfq0JYPzVv07JASmc=";
+      rev = "b1c41e4b82c625cc33ddb8701f6aa5a09c72fcf5";
+      hash = "sha256-eEvT8pZeGwtnEanYG2qdkCWR6ifh2qm/yxGOTbuZhdE=";
    };
    meta.homepage = "https://github.com/slackhq/tree-sitter-hack";
  };
@ -733,15 +733,26 @@
  };
  haskell = buildGrammar {
    language = "haskell";
-    version = "0.0.0+rev=a75238f";
+    version = "0.0.0+rev=ba0bfb0";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-haskell";
-      rev = "a75238fdefc2281cdba7dc4dca13f1d68a91f177";
-      hash = "sha256-KCP6nP2AI6ZwuADSlWTP21I+U4aUr40/sYTn1FVqVMA=";
+      rev = "ba0bfb0e5d8e9e31c160d287878c6f26add3ec08";
+      hash = "sha256-ZSOF0CLOn82GwU3xgvFefmh/AD2j5zz8I0t5YPwfan0=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-haskell";
  };
+  haskell_persistent = buildGrammar {
+    language = "haskell_persistent";
+    version = "0.0.0+rev=58a6ccf";
+    src = fetchFromGitHub {
+      owner = "MercuryTechnologies";
+      repo = "tree-sitter-haskell-persistent";
+      rev = "58a6ccfd56d9f1de8fb9f77e6c42151f8f0d0f3d";
+      hash = "sha256-p4Anm/xeG/d7nYBPDABcdDih/a+0rMjwtVUJru7m9QY=";
+    };
+    meta.homepage = "https://github.com/MercuryTechnologies/tree-sitter-haskell-persistent";
+  };
  hcl = buildGrammar {
    language = "hcl";
    version = "0.0.0+rev=becebeb";
@ -799,12 +810,12 @@
  };
  html = buildGrammar {
    language = "html";
-    version = "0.0.0+rev=86c253e";
+    version = "0.0.0+rev=ff48883";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-html";
-      rev = "86c253e675e7fdd1c0482efe0706f24bafbc3a7d";
-      hash = "sha256-mOJ1JUlsnFPH5jQcWdhWJkoZ0qOK1CTvmi/gEPzzeYk=";
+      rev = "ff48883eb679bbb71b7ac08c8023c8defbf9e234";
+      hash = "sha256-o4yQsFosxGHj60nezRXDGVBVEPsgITHqE7Ub4rOEAAU=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-html";
  };
@ -1120,12 +1131,12 @@
  };
  matlab = buildGrammar {
    language = "matlab";
-    version = "0.0.0+rev=26c5255";
+    version = "0.0.0+rev=b09c27e";
    src = fetchFromGitHub {
      owner = "acristoffers";
      repo = "tree-sitter-matlab";
-      rev = "26c525577c7349b8d9805d244cacd8ef98807b78";
-      hash = "sha256-nvjqmyVcVfTkuMFyDWWJLZNN/SeiNwLrQU6qfvQqpmw=";
+      rev = "b09c27e42732c59321604a15163480ebb4f82f1c";
+      hash = "sha256-gIaHyExmgFSEe6Nm7G5NPNafWWhl50Fn1UQm35MrAuE=";
    };
    meta.homepage = "https://github.com/acristoffers/tree-sitter-matlab";
  };
@ -1443,12 +1454,12 @@
  };
  python = buildGrammar {
    language = "python";
-    version = "0.0.0+rev=6282715";
+    version = "0.0.0+rev=6ecc2b5";
    src = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-python";
-      rev = "62827156d01c74dc1538266344e788da74536b8a";
-      hash = "sha256-hVtX4Dyqrq+cSvKTmKMxLbAplcCdR8dfFDoIZNtPFA0=";
+      rev = "6ecc2b54b39ac390848d81dfcf5ee961f33a2f03";
+      hash = "sha256-gfFD1E6hXaNU0z81VHvo0oMU9iLcyRWP6sIRj6uagYU=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-python";
  };
@ -1509,12 +1520,12 @@
  };
  racket = buildGrammar {
    language = "racket";
-    version = "0.0.0+rev=2804e03";
+    version = "0.0.0+rev=bbdb0bf";
    src = fetchFromGitHub {
      owner = "6cdh";
      repo = "tree-sitter-racket";
-      rev = "2804e03223953dc4709f4c041b57b722095a0397";
-      hash = "sha256-mPG0faYCxML1Ehu6bZS86rEV9Ys+tgwsGlNKgA4U3zQ=";
+      rev = "bbdb0bfbaf0dd5f6650b97a393a06a19cef50562";
+      hash = "sha256-in/VhL0PkhOXaeiMje8oqTxYJ9/VirLTfzF9QZg/Fuk=";
    };
    meta.homepage = "https://github.com/6cdh/tree-sitter-racket";
  };
@ -1696,12 +1707,12 @@
  };
  sql = buildGrammar {
    language = "sql";
-    version = "0.0.0+rev=d38db87";
+    version = "0.0.0+rev=7bd15d1";
    src = fetchFromGitHub {
      owner = "derekstride";
      repo = "tree-sitter-sql";
-      rev = "d38db87c3e979a692cd542be44524f7f5e46f965";
-      hash = "sha256-PT7joV3kA8LqB6t/bhahxNsp8zfOKNWQIT8gQ4UnqY4=";
+      rev = "7bd15d1ca789c5aaef5d2dbfdb14565ec8223d1b";
+      hash = "sha256-yX1Ttwl+GgmguThHpIsnM/x3O57WY+u4NcChSdokHo0=";
    };
    meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
  };
@ -2022,12 +2033,12 @@
  };
  vimdoc = buildGrammar {
    language = "vimdoc";
-    version = "0.0.0+rev=e9b4d2b";
+    version = "0.0.0+rev=8c0469d";
    src = fetchFromGitHub {
      owner = "neovim";
      repo = "tree-sitter-vimdoc";
-      rev = "e9b4d2b3e732ed841980e7369e945e46ce715b8c";
-      hash = "sha256-4j8iEo1BIh4RdYjGPokXNIHhlS7G3JE4ABQ/i3yuObA=";
+      rev = "8c0469d1f84f1e2733d4490dfb3cf8f8b100e2da";
+      hash = "sha256-8Y2Ow9Hppo8qB8SoaxF/vnOTC8pXZg/d5HjlBxy0wwg=";
    };
    meta.homepage = "https://github.com/neovim/tree-sitter-vimdoc";
  };
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -466,6 +466,10 @@ self: super: {
    '';
  });

+  executor-nvim = super.executor-nvim.overrideAttrs (old: {
+    dependencies = with self; [ nui-nvim ];
+  });
+
  fcitx-vim = super.fcitx-vim.overrideAttrs (old: {
    passthru.python3Dependencies = ps: with ps; [ dbus-python ];
    meta = {
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -257,6 +257,7 @@ https://github.com/dmix/elvish.vim/,,
 https://github.com/mattn/emmet-vim/,,
 https://github.com/vim-scripts/emodeline/,,
 https://github.com/sainnhe/everforest/,,
+https://github.com/google/executor.nvim/,HEAD,
 https://github.com/nvchad/extensions/,HEAD,nvchad-extensions
 https://github.com/jinh0/eyeliner.nvim/,HEAD,
 https://github.com/fenetikm/falcon/,,
@ -574,6 +575,7 @@ https://github.com/ethanholz/nvim-lastplace/,HEAD,
 https://github.com/kosayoda/nvim-lightbulb/,,
 https://github.com/josa42/nvim-lightline-lsp/,,
 https://github.com/mfussenegger/nvim-lint/,,
+https://github.com/mrded/nvim-lsp-notify/,HEAD,
 https://github.com/jose-elias-alvarez/nvim-lsp-ts-utils/,,
 https://github.com/neovim/nvim-lspconfig/,,
 https://github.com/RishabhRD/nvim-lsputils/,,
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -587,6 +587,22 @@ let
        };
      };

+      brandonkirbyson.solarized-palenight = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "solarized-palenight";
+          publisher = "BrandonKirbyson";
+          version = "1.0.1";
+          sha256 = "sha256-vVbaHSaBX6QzpnYMQlpPsJU1TQYJEBe8jq95muzwN0o=";
+        };
+        meta = {
+          description = " A solarized-palenight theme for vscode";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=BrandonKirbyson.solarized-palenight";
+          homepage = "https://github.com/BrandonKirbyson/Solarized-Palenight";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.sebtm ];
+        };
+      };
+
      brettm12345.nixfmt-vscode = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "nixfmt-vscode";
--- a/pkgs/applications/editors/xed-editor/default.nix
+++ b/pkgs/applications/editors/xed-editor/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "xed-editor";
-  version = "3.4.1";
+  version = "3.4.2";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "xed";
    rev = version;
-    sha256 = "sha256-fBwxc6n4sNNRiKcax96Tl3cFD+Ryvmj+XizB3z2s4+Q=";
+    sha256 = "sha256-fTrvHf7iA3qexxdebSgzLXlngAOkdraW3KiVTVYodrY=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/emulators/craftos-pc/default.nix
+++ b/pkgs/applications/emulators/craftos-pc/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, callPackage
 , patchelf
 , unzip
 , poco
@ -59,6 +60,11 @@ stdenv.mkDerivation rec {
    cp -R ${craftos2-rom}/* $out/share/craftos
  '';

+  passthru.tests = {
+    eval-hello-world = callPackage ./test-eval-hello-world { };
+    eval-periphemu = callPackage ./test-eval-periphemu { };
+  };
+
  meta = with lib; {
    description = "An implementation of the CraftOS-PC API written in C++ using SDL";
    homepage = "https://www.craftos-pc.cc";
--- a/pkgs/applications/emulators/craftos-pc/test-eval-hello-world/default.nix
+++ b/pkgs/applications/emulators/craftos-pc/test-eval-hello-world/default.nix
@ -0,0 +1,18 @@
+{ stdenv
+, craftos-pc
+, grep
+}:
+
+stdenv.mkDerivation {
+  name = "craftos-pc-test-eval-hello-world";
+  meta.timeout = 60;
+  nativeBuildInputs = [ craftos-pc grep ];
+  buildCommand = ''
+    export HOME=$(pwd)
+    mkdir $HOME/.local $HOME/.config
+    export XDG_CONFIG_DIR=$HOME/.config
+    export XDG_DATA_DIR=$HOME/.local
+    craftos --headless --script ${./init.lua} | grep "Hello Nixpkgs!" > /dev/null
+    touch $out
+  '';
+}
--- a/pkgs/applications/emulators/craftos-pc/test-eval-hello-world/init.lua
+++ b/pkgs/applications/emulators/craftos-pc/test-eval-hello-world/init.lua
@ -0,0 +1,3 @@
+print("Hello Nixpkgs!")
+
+shell.run("shutdown")
--- a/pkgs/applications/emulators/craftos-pc/test-eval-periphemu/default.nix
+++ b/pkgs/applications/emulators/craftos-pc/test-eval-periphemu/default.nix
@ -0,0 +1,19 @@
+{ stdenv
+, craftos-pc
+, grep
+}:
+stdenv.mkDerivation {
+  name = "craftos-pc-test-eval-periphemu";
+  meta.timeout = 60;
+  nativeBuildInputs = [ craftos-pc grep ];
+  buildCommand = ''
+    export HOME=$(pwd)
+    mkdir $HOME/.local $HOME/.config
+    export XDG_CONFIG_DIR=$HOME/.config
+    export XDG_DATA_DIR=$HOME/.local
+    if craftos --headless --script ${./init.lua} | grep -q "FAIL"; then
+        exit 1
+    fi
+    touch $out
+  '';
+}
--- a/pkgs/applications/emulators/craftos-pc/test-eval-periphemu/init.lua
+++ b/pkgs/applications/emulators/craftos-pc/test-eval-periphemu/init.lua
@ -0,0 +1,18 @@
+local function assert(cond1, cond2)
+    if not cond1 == cond2 then print("FAIL") end
+end
+
+local function driveTests()
+    periphemu.create("left", "drive")
+    local p = peripheral.wrap("left")
+
+    assert(p.isDiskPresent(), false)
+    p.insertDisk(649)
+    assert(p.isDiskPresent(), true)
+    assert(p.getDiskID(), 649)
+    assert(p.getDiskLabel(), nil)
+end
+
+driveTests()
+
+shell.run("shutdown")
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@ -6,7 +6,7 @@
 }:

 let
-  version = "5.11.0";
+  version = "5.11.1";

  docFiles = [
    (fetchurl {
@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
    owner = "paraview";
    repo = "paraview";
    rev = "v${version}";
-    sha256 = "sha256-WvkKGl5lG+apX6m4ULVZZVtDsSUjEVXe/seh95b+LmI=";
+    hash = "sha256-LatNHfiAqB2kqzERRnYae0WIXBb4nXQ79Be4kuh8NFQ=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@ -9,7 +9,7 @@
 let

  pname = "1password";
-  version = if channel == "stable" then "8.10.7" else "8.10.8-13.BETA";
+  version = if channel == "stable" then "8.10.7" else "8.10.8-42.BETA";

  sources = {
    stable = {
@ -33,19 +33,19 @@ let
    beta = {
      x86_64-linux = {
        url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        sha256 = "sha256-+Gg4OJXjdufEBNa3+qBXz0/NfPDXDfuiCYjMEDHnOKo=";
+        sha256 = "sha256-nPstDndWuPMSGJlbyniEfljdEy+TOB9zWMJ+db7xCx4=";
      };
      aarch64-linux = {
        url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        sha256 = "sha256-xDwwxo4UsoPzcxFblYeZ9QIDIJ6f6vGBxYySqP9o/A0=";
+        sha256 = "sha256-waJjvqF6OXGrf90srvvZ+hyxapcQApGTsxTzNMX9V3s=";
      };
      x86_64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        sha256 = "sha256-NphHgeMrjBqApU5crNj1JOTTXD4kXoO067feVs/YxuA=";
+        sha256 = "sha256-i9hbnjXx2/RWJ9YvrFDOGbi7dpiHtxWsN0HAZPOhK8o=";
      };
      aarch64-darwin = {
        url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        sha256 = "sha256-M1MnSbZ6qsT7Ke5e8/4ppCxlXekulJnm9Zb5+4tt8Vg=";
+        sha256 = "sha256-tat2x2J4/yKhWp4sWCEqU+SSZaNRx8WTcCJAAbo1Kpk=";
      };
    };
  };
--- a/pkgs/applications/misc/comodoro/default.nix
+++ b/pkgs/applications/misc/comodoro/default.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "comodoro";
-  version = "0.0.8";
+  version = "0.0.9";

  src = fetchFromGitHub {
    owner = "soywod";
    repo = "comodoro";
    rev = "v${version}";
-    sha256 = "rGnVXyfWJkPHfpf1gRGbDJ6Y1ycKOOcCZ+Jx35fUo6M=";
+    hash = "sha256-pxe3Nv1N85uWsiv4s0wtD++zlZZgMADH51f5RMK9huA=";
  };

-  cargoSha256 = "jpshuavywCLN03xD/gFgQeGbKtmHq5pULbxd+RUbaDk=";
+  cargoSha256 = "E5oHeMow9MrVrlDX+v0tX9Nv3gHUxDNUpRAT5jPa+DI=";

  nativeBuildInputs = lib.optional (installManPages || installShellCompletions) installShellFiles;

--- a/pkgs/applications/misc/electrum/grs.nix
+++ b/pkgs/applications/misc/electrum/grs.nix
@ -9,11 +9,11 @@
 }:

 let
-  version = "4.3.1";
+  version = "4.4.4";

  libsecp256k1_name =
-    if stdenv.isLinux then "libsecp256k1.so.0"
-    else if stdenv.isDarwin then "libsecp256k1.0.dylib"
+    if stdenv.isLinux then "libsecp256k1.so.{v}"
+    else if stdenv.isDarwin then "libsecp256k1.{v}.dylib"
    else "libsecp256k1${stdenv.hostPlatform.extensions.sharedLibrary}";

  libzbar_name =
@ -31,7 +31,7 @@ python3.pkgs.buildPythonApplication {
    owner = "Groestlcoin";
    repo = "electrum-grs";
    rev = "refs/tags/v${version}";
-    sha256 = "1h9r32wdn0p7br36r719x96c8gay83dijw80y2ks951mam16mkkb";
+    sha256 = "0fl01qdvb1z6l6kwipj1lj0qmjk3mzw25wv7yh5j1hh1f5lng0s8";
  };

  nativeBuildInputs = lib.optionals enableQt [ wrapQtAppsHook ];
@ -55,6 +55,7 @@ python3.pkgs.buildPythonApplication {
    tlslite-ng
    # plugins
    btchip-python
+    ledger-bitcoin
    ckcc-protocol
    keepkey
    trezor
@ -66,7 +67,7 @@ python3.pkgs.buildPythonApplication {
  postPatch = ''
    # make compatible with protobuf4 by easing dependencies ...
    substituteInPlace ./contrib/requirements/requirements.txt \
-      --replace "protobuf>=3.12,<4" "protobuf>=3.12"
+      --replace "protobuf>=3.20,<4" "protobuf>=3.20"
    # ... and regenerating the paymentrequest_pb2.py file
    protoc --python_out=. electrum_grs/paymentrequest.proto

--- a/pkgs/applications/misc/eos-installer/default.nix
+++ b/pkgs/applications/misc/eos-installer/default.nix
@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
    description = "Installer UI which writes images to disk";
    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ qyliss ];
+    mainProgram = "gnome-image-installer";
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/mob/default.nix
+++ b/pkgs/applications/misc/mob/default.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "mob";
-  version = "4.4.3";
+  version = "4.4.5";

  src = fetchFromGitHub {
    owner = "remotemobprogramming";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-XWXoY/e/xceO3sOGvA2hrdvbdb8nomMg7AGUW090I74=";
+    sha256 = "sha256-/Kr5K0QkjARWKR8YhDsOQ2CoUzUu5LWUq6smhB0yDCM=";
  };

  vendorHash = null;
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/mobile-config.nix
+++ b/pkgs/applications/networking/browsers/firefox/mobile-config.nix
@ -0,0 +1,113 @@
+{ stdenv, lib, runCommand, fetchFromGitLab, wrapFirefox, firefox-unwrapped }:
+
+let
+  pkg = fetchFromGitLab {
+    owner = "postmarketOS";
+    repo = "mobile-config-firefox";
+    rev = "ff2f07873f4ebc6e220da0e9b9f04c69f451edda";
+    sha256 = "sha256-8wRz8corz00+0qROMiOmZAddM4tjfmE91bx0+P8JNx4=";
+  };
+  userChrome = runCommand "userChrome.css" {} ''
+    cat ${pkg}/src/userChrome/*.css > $out
+  '';
+  userContent = runCommand "userContent.css" {} ''
+    cat ${pkg}/src/userContent/*.css > $out
+  '';
+in wrapFirefox firefox-unwrapped {
+  # extraPolicies = (lib.importJSON "${pkg}/src/policies.json").policies;
+  extraPoliciesFiles = [ "${pkg}/src/policies.json" ];
+  extraPrefs = ''
+    // Copyright 2022 Arnaud Ferraris, Oliver Smith
+    // SPDX-License-Identifier: MPL-2.0
+
+    // This is a Firefox autoconfig file:
+    // https://support.mozilla.org/en-US/kb/customizing-firefox-using-autoconfig
+
+    // Import custom userChrome.css on startup or new profile creation
+    const {classes: Cc, interfaces: Ci, utils: Cu} = Components;
+    Cu.import("resource://gre/modules/Services.jsm");
+    Cu.import("resource://gre/modules/FileUtils.jsm");
+
+    var updated = false;
+
+    // Create <profile>/chrome/ directory if not already present
+    var chromeDir = Services.dirsvc.get("ProfD", Ci.nsIFile);
+    chromeDir.append("chrome");
+    if (!chromeDir.exists()) {
+        chromeDir.create(Ci.nsIFile.DIRECTORY_TYPE, FileUtils.PERMS_DIRECTORY);
+    }
+
+    // Create nsIFile objects for userChrome.css in <profile>/chrome/ and in /etc/
+    var chromeFile = chromeDir.clone();
+    chromeFile.append("userChrome.css");
+    var defaultChrome = new FileUtils.File("${userChrome}");
+
+    // No auto-upgrade. Should this be replaced with symlinking?
+    // // Remove the existing userChrome.css if older than the installed one
+    // if (chromeFile.exists() && defaultChrome.exists() &&
+    //   chromeFile.lastModifiedTime < defaultChrome.lastModifiedTime) {
+    //   chromeFile.remove(false);
+    // }
+
+    // Copy userChrome.css to <profile>/chrome/
+    if (!chromeFile.exists()) {
+      defaultChrome.copyTo(chromeDir, "userChrome.css");
+      updated = true;
+    }
+
+    // Create nsIFile objects for userContent.css in <profile>/chrome/ and in /etc/
+    var contentFile = chromeDir.clone();
+    contentFile.append("userContent.css");
+    var defaultContent = new FileUtils.File("${userContent}");
+
+    // No auto-upgrade. Should this be replaced with symlinking?
+    // // Remove the existing userContent.css if older than the installed one
+    // if (contentFile.exists() && defaultContent.exists() &&
+    //   contentFile.lastModifiedTime < defaultContent.lastModifiedTime) {
+    //   contentFile.remove(false);
+    // }
+
+    // Copy userContent.css to <profile>/chrome/
+    if (!contentFile.exists()) {
+      defaultContent.copyTo(chromeDir, "userContent.css");
+      updated = true;
+    }
+
+    // Restart Firefox immediately if one of the files got updated
+    if (updated === true) {
+        var appStartup = Cc["@mozilla.org/toolkit/app-startup;1"].getService(Ci.nsIAppStartup);
+        appStartup.quit(Ci.nsIAppStartup.eForceQuit | Ci.nsIAppStartup.eRestart);
+    }
+
+    defaultPref('general.useragent.override', 'Mozilla/5.0 (Android 11; Mobile; rv:96.0) Gecko/96.0 Firefox/96.0');
+    defaultPref('browser.urlbar.suggest.topsites', false);
+    defaultPref('browser.urlbar.suggest.engines', false);
+    defaultPref('browser.newtabpage.enabled', true);
+
+    // Enable android-style pinch-to-zoom
+    pref('dom.w3c.touch_events.enabled', true);
+    pref('apz.allow_zooming', true);
+    pref('apz.allow_double_tap_zooming', true);
+
+    // Save vertical space by hiding the titlebar
+    pref('browser.tabs.inTitlebar', 1);
+
+    // Disable search suggestions
+    pref('browser.search.suggest.enabled', false);
+
+    // Empty new tab page: faster, less distractions
+    pref('browser.newtabpage.enabled', false);
+
+    // Allow UI customizations with userChrome.css and userContent.css
+    pref('toolkit.legacyUserProfileCustomizations.stylesheets', true);
+
+    // Select the entire URL with one click
+    pref('browser.urlbar.clickSelectsAll', true);
+
+    // Disable cosmetic animations, save CPU
+    pref('toolkit.cosmeticAnimations.enabled', false);
+
+    // Disable download animations, save CPU
+    pref('browser.download.animateNotifications', false);
+  '';
+}
--- a/pkgs/applications/networking/browsers/mullvad-browser/default.nix
+++ b/pkgs/applications/networking/browsers/mullvad-browser/default.nix
@ -78,12 +78,12 @@ let
      ++ lib.optionals mediaSupport [ ffmpeg ]
  );

-  version = "12.0.7";
+  version = "12.5";

  sources = {
    x86_64-linux = fetchurl {
      url = "https://cdn.mullvad.net/browser/${version}/mullvad-browser-linux64-${version}_ALL.tar.xz";
-      hash = "sha256-8TcC39A9VFyhFb+pfefzvwJqXq1yF7C2YDcbCyEa0yo=";
+      hash = "sha256-RTDFi+vMkzRtDFgv9sP1bfIeWzzXR307aoMhNiT6vRs=";
    };
  };

--- a/pkgs/applications/networking/cluster/karmor/default.nix
+++ b/pkgs/applications/networking/cluster/karmor/default.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "karmor";
-  version = "0.13.3";
+  version = "0.13.7";

  src = fetchFromGitHub {
    owner = "kubearmor";
    repo = "kubearmor-client";
    rev = "v${version}";
-    hash = "sha256-BhGe4CMd0YgWc4EAyig5wmLgHJxNc8ppsUMBeRaIJEE=";
+    hash = "sha256-IZUDVw41AfugqVG2hsxoKO7zl1FraVzME/GUxZwaAG4=";
  };

  vendorHash = "sha256-VT0CiaG5AODAL6nhoPmpulPApgTUiH0mXI6mS1eK14k=";
--- a/pkgs/applications/networking/cluster/kluctl/default.nix
+++ b/pkgs/applications/networking/cluster/kluctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kluctl";
-  version = "2.20.4";
+  version = "2.20.6";

  src = fetchFromGitHub {
    owner = "kluctl";
    repo = "kluctl";
    rev = "v${version}";
-    hash = "sha256-Z3tXfzbVs0FWTsi6vbM6BNQBLeCseWn4yBR5PNeRz2s=";
+    hash = "sha256-B8+HKqIuJaH+6ViBxWfiAAmXieQKcwAW565SwUpIJKI=";
  };

-  vendorHash = "sha256-z0eiWU5CFMfK6fz+LUtxtSP/MAuVn7iOHB+A7Uv2OQY=";
+  vendorHash = "sha256-x5Zy8H7DzxU+uBCUL6edv8x2LwiIjXl5UrRUMDtUEk8=";

  ldflags = [ "-s" "-w" "-X main.version=v${version}" ];

--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@ -12,16 +12,16 @@

 buildGoModule rec {
  pname = "kubebuilder";
-  version = "3.10.0";
+  version = "3.11.0";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "kubebuilder";
    rev = "v${version}";
-    hash = "sha256-W1FjmhZWBt/ThkSHHGAR4p1Vxal4WOCutlsHIDZeRZM=";
+    hash = "sha256-R4piek1mhMy5QPB6weR3F7PiIq0LvwkRAnIndbar9tg=";
  };

-  vendorHash = "sha256-/Kvn3KwSB/mxgBKM+383QHCnVTOt06ZP3gt7FGqA5aM=";
+  vendorHash = "sha256-5XUYmAfFH6UlLF09PqcSLUxkgZ5iHZGj0Vurab+Jl1g=";

  subPackages = ["cmd"];

--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -164,13 +164,13 @@
    "vendorHash": null
  },
  "bitbucket": {
-    "hash": "sha256-T9e3IQHe6uCdllRTctJg/aG1QmPFR6V4ryw79yX2k/o=",
+    "hash": "sha256-Sby7Dvu4UWzdbQWa/GLMkDzlK7foaFApy4yLNBOJgck=",
    "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
    "owner": "DrFaust92",
    "repo": "terraform-provider-bitbucket",
-    "rev": "v2.33.0",
+    "rev": "v2.34.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ebkUF+Xv9diwUYXYt/WK+0tWheqL1cgA665VbGLmvvo="
+    "vendorHash": "sha256-AcUw5i3st7VfAnpy/6nTYfTv3rOAN2jm4rUmEKcSrXM="
  },
  "brightbox": {
    "hash": "sha256-yKoYjrZs6EOX1pdDuF+LOu/jZ3fidZJBU7yhSp6qSFU=",
@ -363,11 +363,11 @@
    "vendorHash": "sha256-2iVEcpESaEdgTcmlQ6Wynuxv8RmPFlhF+BVDSjHmclM="
  },
  "exoscale": {
-    "hash": "sha256-DD6CkdZ9KCCkPCgPyWXaAvHfHyn9rYXRsXg9BVJkELM=",
+    "hash": "sha256-dLA9BWW4ghD1OSZaZtFfv8ipS+2lTeNRr1YD3E8ewpI=",
    "homepage": "https://registry.terraform.io/providers/exoscale/exoscale",
    "owner": "exoscale",
    "repo": "terraform-provider-exoscale",
-    "rev": "v0.49.0",
+    "rev": "v0.50.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -474,13 +474,13 @@
    "vendorHash": "sha256-fqVBnAivVekV+4tpkl+E6eNA3wi8mhLevJRCs3W7L2g="
  },
  "grafana": {
-    "hash": "sha256-5V0TW80GQKa2JHrSf9SlsCrT9jTTQK+SMRa/OCIrthE=",
+    "hash": "sha256-J5Fn3JGp7jXAA04RJ3FFKqLpB4hekd0yFA8zkfPPQ+4=",
    "homepage": "https://registry.terraform.io/providers/grafana/grafana",
    "owner": "grafana",
    "repo": "terraform-provider-grafana",
-    "rev": "v1.41.0",
+    "rev": "v1.42.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-CRqUSPXap8lXRa/yIDnG11F/D+IdylY3JzkV6bXmzwY="
+    "vendorHash": "sha256-8FgjFIgEx3pA6vKo7m9e6gASrpp5cPtN7A2US2GASy8="
  },
  "gridscale": {
    "hash": "sha256-OzOI//WXMHzHSbsqLSAfVpt756SbF3Uv0r/7MsVMjzY=",
@ -1234,11 +1234,11 @@
    "vendorHash": null
  },
  "vsphere": {
-    "hash": "sha256-XVMTKYb9RuK5sErVHsP0j5otUEioxp6C7GV7/J6OYVA=",
+    "hash": "sha256-lWMtsBRAirNI7dNXI7APzS1AbPmkz5fsbpCdd/0XBRc=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/vsphere",
    "owner": "hashicorp",
    "repo": "terraform-provider-vsphere",
-    "rev": "v2.4.0",
+    "rev": "v2.4.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-wKKrBSJkbdqqnDLoS+jhvI26rOzvMWjjsN8wh67Le5U="
  },
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -2,9 +2,9 @@
 let
  versions = if stdenv.isLinux then {
    stable = "0.0.27";
-    ptb = "0.0.42";
+    ptb = "0.0.43";
    canary = "0.0.161";
-    development = "0.0.216";
+    development = "0.0.217";
  } else {
    stable = "0.0.273";
    ptb = "0.0.59";
@ -20,7 +20,7 @@ let
      };
      ptb = fetchurl {
        url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        sha256 = "ZAMyAqyFEBJeTUqQzr5wK+BOFGURqhoHL8w2hJvL0vI=";
+        sha256 = "tG+QR62JcBYrvJS6KU6oAWSfQFdl68AMcU8E9Zahy2A=";
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
@ -28,7 +28,7 @@ let
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        sha256 = "sha256-lQnIQC7Wek7OYDzZvLIJfb8I4oATD8pSB+mjQMPyqYQ=";
+        sha256 = "sha256-fzNFKrYo5qckrWZAkkiK337czCt6nOM1O8FeG18Q8Y0=";
      };
    };
    x86_64-darwin = {
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@ -15,18 +15,17 @@
 , enableRST ? true, docutils
 , enableSpelling ? true, gspell
 , enableUPnP ? true, gupnp-igd
-, enableOmemoPluginDependencies ? true
 , enableAppIndicator ? true, libappindicator-gtk3
 , extraPythonPackages ? ps: []
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "gajim";
-  version = "1.7.3";
+  version = "1.8.0";

  src = fetchurl {
    url = "https://gajim.org/downloads/${lib.versions.majorMinor version}/gajim-${version}.tar.gz";
-    hash = "sha256-t8yzWfdsY8pXye7Dn5hME0bOHgf+MzuyVY3hweXc0xg=";
+    hash = "sha256-EgH8mt0am2l9z4csGHH6rpLqTzFiBRzOPB4NCEP8TUM=";
  };

  format = "pyproject";
@ -53,9 +52,9 @@ python3.pkgs.buildPythonApplication rec {

  propagatedBuildInputs = with python3.pkgs; [
    nbxmpp pygobject3 dbus-python pillow css-parser precis-i18n keyring setuptools packaging gssapi
+    omemo-dr qrcode
  ] ++ lib.optionals enableE2E [ pycrypto python-gnupg ]
    ++ lib.optional enableRST docutils
-    ++ lib.optionals enableOmemoPluginDependencies [ python-axolotl qrcode ]
    ++ extraPythonPackages python3.pkgs;

  nativeCheckInputs = [ xvfb-run dbus ];
@ -75,7 +74,7 @@ python3.pkgs.buildPythonApplication rec {
    ${python3.interpreter} -m unittest discover -s test/common -v
  '';

-  # test are broken in 1.7.3
+  # test are broken in 1.7.3, 1.8.0
  doCheck = false;

  # necessary for wrapGAppsHook
--- a/pkgs/applications/networking/instant-messengers/teams/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams/default.nix
@ -102,6 +102,10 @@ let
      mv share/teams $out/opt/
      mv share $out/share

+      mkdir -p $out/share/icons/hicolor/512x512/apps
+      mv $out/share/pixmaps/teams.png $out/share/icons/hicolor/512x512/apps
+      rmdir $out/share/pixmaps
+
      substituteInPlace $out/share/applications/teams.desktop \
        --replace /usr/bin/ ""

--- a/pkgs/applications/networking/mailreaders/ayatana-webmail/default.nix
+++ b/pkgs/applications/networking/mailreaders/ayatana-webmail/default.nix
@ -0,0 +1,90 @@
+{ lib
+, fetchFromGitHub
+, gettext
+, gtk3
+, python3Packages
+, gdk-pixbuf
+, libnotify
+, glib
+, gobject-introspection
+, wrapGAppsHook
+# BTW libappindicator is also supported, but upstream recommends their
+# implementation, see:
+# https://github.com/AyatanaIndicators/ayatana-webmail/issues/24#issuecomment-1050352862
+, libayatana-appindicator
+, gsettings-desktop-schemas
+, libcanberra-gtk3
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "ayatana-webmail";
+  version = "22.12.15";
+
+  src = fetchFromGitHub {
+    owner = "AyatanaIndicators";
+    repo = "ayatana-webmail";
+    rev = version;
+    hash = "sha256-K2jqCWrY1i1wYdZVpjN/3TcVyWariOQQ4slZf6sEPRU=";
+  };
+  postConfigure = ''
+    # Fix fhs paths
+    substituteInPlace \
+      ayatanawebmail/accounts.py \
+      ayatanawebmail/actions.py \
+      ayatanawebmail/dialog.py \
+      --replace /usr/share $out/share
+  '';
+
+  buildInputs = [
+    gtk3
+    gdk-pixbuf
+    glib
+    libnotify
+    gettext
+    libayatana-appindicator
+    gsettings-desktop-schemas
+  ];
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook
+    glib # For compiling gsettings-schemas
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    urllib3
+    babel
+    psutil
+    secretstorage
+    polib
+    pygobject3
+    dbus-python
+  ];
+
+  # No tests, and they cause a failure
+  doCheck = false;
+
+  postInstall = ''
+    # Fix fhs paths
+    mv $out/${python3Packages.python.sitePackages}/etc $out
+    mv $out/${python3Packages.python.sitePackages}/usr/{bin,share} $out/
+    rmdir $out/${python3Packages.python.sitePackages}/usr
+    # Compile gsettings desktop schemas
+    glib-compile-schemas $out/share/glib-2.0/schemas
+  '';
+
+  # See https://nixos.org/nixpkgs/manual/#ssec-gnome-common-issues-double-wrapped
+  dontWrapGApps = true;
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+    makeWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ libcanberra-gtk3 ]})
+  '';
+
+  meta = with lib; {
+    description = "Webmail notifications and actions for any desktop";
+    homepage = "https://github.com/AyatanaIndicators/ayatana-webmail";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ doronbehar ];
+  };
+}
--- a/pkgs/applications/networking/mailreaders/electron-mail/default.nix
+++ b/pkgs/applications/networking/mailreaders/electron-mail/default.nix
@ -2,12 +2,12 @@

 let
  pname = "electron-mail";
-  version = "5.1.6";
+  version = "5.1.8";
  name = "ElectronMail-${version}";

  src = fetchurl {
    url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-linux-x86_64.AppImage";
-    sha256 = "sha256-lsXVsx7U43czWFWxAgwTUYTnUXSL4KPFnXLzUklieAo=";
+    sha256 = "sha256-btqlxFrQUyb728i99IE65A9jwEFNvJ5b6zji0kwwATU=";
  };

  appimageContents = appimageTools.extract { inherit name src; };
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@ -26,12 +26,12 @@

 stdenv.mkDerivation rec {
  pname = "gnucash";
-  version = "5.2";
+  version = "5.3";

  # raw source code doesn't work out of box; fetchFromGitHub not usable
  src = fetchurl {
    url = "https://github.com/Gnucash/gnucash/releases/download/${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-SCYXa35wu4ifmcIG+v+t2JJijXhSVxXp9xKOz0ixRoA=";
+    hash = "sha256-FFjLCMWF6unXJL7G8oErzAO76D7SlKRqeJeqqwGm8Vo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "PortfolioPerformance";
-  version = "0.64.0";
+  version = "0.64.1";

  src = fetchurl {
    url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-8LebPYIML3YV8DsoLPQiH4Q6ETBTgZ7IpeGJDN2R7ro=";
+    hash = "sha256-R3Cj24dZ2wD1c29zRLGnuJm3wfc9+n/sNNW316HT9N4=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@ -77,14 +77,13 @@ stdenv.mkDerivation rec {
  postPatch = lib.optionalString (!stable) ''
    substituteInPlace cmake/KiCadVersion.cmake \
      --replace "unknown" "${builtins.substring 0 10 src.rev}"
+
+    substituteInPlace cmake/CreateGitVersionHeader.cmake \
+      --replace "0000000000000000000000000000000000000000" "${src.rev}"
  '';

  makeFlags = optionals (debug) [ "CFLAGS+=-Og" "CFLAGS+=-ggdb" ];

-  # some ngspice tests attempt to write to $HOME/.cache/
-  XDG_CACHE_HOME = "$TMP";
-  # failing tests still attempt to create $HOME though
-
  cmakeFlags = [
    "-DKICAD_USE_EGL=ON"
    "-DOCC_INCLUDE_DIR=${opencascade-occt}/include/opencascade"
@ -165,10 +164,24 @@ stdenv.mkDerivation rec {
  ++ optional (withNgspice) libngspice
  ++ optional (debug) valgrind;

+  # some ngspice tests attempt to write to $HOME/.cache/
+  # this could be and was resolved with XDG_CACHE_HOME = "$TMP";
+  # but failing tests still attempt to create $HOME
+  # and the newer CLI tests seem to also use $HOME...
+  HOME = "$TMP";
+
  # debug builds fail all but the python test
  doInstallCheck = !(debug);
  installCheckTarget = "test";

+  pythonForTests = python.withPackages(ps: with ps; [
+    numpy
+    pytest
+    cairosvg
+    pytest-image-diff
+  ]);
+  nativeInstallCheckInputs = optional (!stable) pythonForTests;
+
  dontStrip = debug;

  meta = {
--- a/pkgs/applications/science/electronics/kicad/versions.nix
+++ b/pkgs/applications/science/electronics/kicad/versions.nix
@ -25,23 +25,23 @@
  };
  "kicad-unstable" = {
    kicadVersion = {
-      version =			"2023-04-14";
+      version =			"2023-06-24";
      src = {
-        rev =			"4a3f77cd9dac9dc5921eb9beaa63d0d3c9c051e5";
-        sha256 =		"06dsiyvr7zn3cp13w0y63d1qmjlhzsqlvajkximg3pw5mmiljxrr";
+        rev =			"1c1849ec1a6614247abe4c623c086def2b3192e0";
+        sha256 =		"0faf4fw7nrfwdrl4pjqdyfzqbvb9jd4nk4aq83v1w358yqyk7zg9";
      };
    };
    libVersion = {
-      version =			"2023-04-14";
+      version =			"2023-06-24";
      libSources = {
-        symbols.rev =		"38d4e7e1ab6a9b5d9eee85f687e60467753b2135";
-        symbols.sha256 =	"0df6fx9b19v6sxrfyggbisw72y66kiwqi05k8mldsgiw6q55gbkc";
+        symbols.rev =		"43456780d309682f6da4a6f14710355b06fc4c5d";
+        symbols.sha256 =	"1ql2w3q3dv13ascw8s0hzwda486763qma7i2m877jw3p78gjhldr";
        templates.rev =		"867eef383a0f61015cb69677d5c632d78a2ea01a";
        templates.sha256 =	"1qi20mrsfn4fxmr1fyphmil2i9p2nzmwk5rlfchc5aq2194nj3lq";
-        footprints.rev =	"4da055a2d572ff87e7ecea97cf358ed8c1d46dfc";
-        footprints.sha256 =	"1xb84284dmcb7mbvzlrxb4v4km3ih7gq856h8cglf9jn8wzlnvrk";
-        packages3d.rev =	"0f43a0962437feb53bd2083e9f39efffb5a5dd90";
-        packages3d.sha256 =	"1nkk4325jh89vh52ykfnf9pz1k3jk5017gz6r2cia2v4b3jadi31";
+        footprints.rev =	"6a59a2d3940dbab7b3e8254a5b9bf06cc5330301";
+        footprints.sha256 =	"0jlz0ln9vzj1av1fmw8ma8kfqlb8w0r9vrfng19bkc3cgh9lvh9x";
+        packages3d.rev =	"8a2c5c4c85457832f3320902456d066d29561806";
+        packages3d.sha256 =	"0dmssyhqd94d9wj8w7g7xjan560b2rwcs540sgl0rc77cw2jify8";
      };
    };
  };
--- a/pkgs/applications/science/logic/klee/default.nix
+++ b/pkgs/applications/science/logic/klee/default.nix
@ -45,30 +45,24 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "klee";
-  version = "2.3";
+  version = "3.0";

  src = fetchFromGitHub {
    owner = "klee";
    repo = "klee";
    rev = "v${version}";
-    sha256 = "sha256-E1c6K6Q+LAWm342W8I00JI6+LMvqmULHZLkv9Kj5RmY=";
+    hash = "sha256-y5lWmtIcLAthQ0oHYQNd+ir75YaxHZR9Jgiz+ZUFQjY=";
  };

+  nativeBuildInputs = [ cmake ];
  buildInputs = [
    cryptominisat
    gperftools
-    lit # Configure phase checking for lit
    llvm
    sqlite
    stp
    z3
  ];
-
-  nativeBuildInputs = [
-    clang
-    cmake
-  ];
-
  nativeCheckInputs = [
    gtest

@ -83,8 +77,9 @@ in stdenv.mkDerivation rec {
  in [
    "-DCMAKE_BUILD_TYPE=${if debug then "Debug" else if !debug && includeDebugInfo then "RelWithDebInfo" else "MinSizeRel"}"
    "-DKLEE_RUNTIME_BUILD_TYPE=${if debugRuntime then "Debug" else "Release"}"
+    "-DLLVMCC=${clang}/bin/clang"
+    "-DLLVMCXX=${clang}/bin/clang++"
    "-DKLEE_ENABLE_TIMESTAMP=${onOff false}"
-    "-DENABLE_KLEE_UCLIBC=${onOff true}"
    "-DKLEE_UCLIBC_PATH=${kleeuClibc}"
    "-DENABLE_KLEE_ASSERTS=${onOff asserts}"
    "-DENABLE_POSIX_RUNTIME=${onOff true}"
--- a/pkgs/applications/version-management/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-machete/default.nix
@ -12,13 +12,13 @@

 buildPythonApplication rec {
  pname = "git-machete";
-  version = "3.17.4";
+  version = "3.17.6";

  src = fetchFromGitHub {
    owner = "virtuslab";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-g3SEUVcyr6+nt0zMHB1F4drCwmQvPYQErOwSl9I+1Tg=";
+    hash = "sha256-o3Z1xPu5RcspU4m3Bb6ydZkXOMgOMJPN/+TLekwe/wI=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,14 +1,14 @@
 {
-  "version": "16.0.5",
-  "repo_hash": "sha256-hUEPJMdmR+p7nHWjdS+9SXcgm0LciPC9at+GP9UcUvI=",
-  "yarn_hash": "0yy04jnfvn5dgciqd105xiwg7chjwp3w6iqbjpylak9h82ci6wlh",
+  "version": "16.1.0",
+  "repo_hash": "sha256-sRel6okv2NYV4As3+AudqVvJ1/eLQGJGFvs+BA14wis=",
+  "yarn_hash": "1cqyf06810ls94nkys0l4p86ni902q32aqjp66m7j1x6ldh248al",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v16.0.5-ee",
+  "rev": "v16.1.0-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "16.0.5",
-    "GITLAB_PAGES_VERSION": "16.0.5",
-    "GITLAB_SHELL_VERSION": "14.20.0",
-    "GITLAB_WORKHORSE_VERSION": "16.0.5"
+    "GITALY_SERVER_VERSION": "16.1.0",
+    "GITLAB_PAGES_VERSION": "16.1.0",
+    "GITLAB_SHELL_VERSION": "14.23.0",
+    "GITLAB_WORKHORSE_VERSION": "16.1.0"
  }
 }
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -13,7 +13,7 @@
 }:

 let
-  version = "16.0.5";
+  version = "16.1.0";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@ -24,10 +24,10 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      sha256 = "sha256-YhqKMFDjjL2I82m51GdKNVO8vdJPppDKZDBQGskpyA4=";
+      sha256 = "sha256-+Fnj9fgQQtyGMWOL5NkNON/N9p6POjAtpF2O06iKh90=";
    };

-    vendorSha256 = "sha256-KBhTI70eReZGSd7RxwGXcUGa0wDo7q5tU9fUhrLeFO0=";
+    vendorSha256 = "sha256-6oOFQGPwiMRQrESXsQsGzvWz9bCb0VTYIyyG/C2b3nA=";

    ldflags = [ "-X ${gitaly_package}/internal/version.version=${version}" "-X ${gitaly_package}/internal/version.moduleVersion=${version}" ];

--- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "gitlab-pages";
-  version = "16.0.5";
+  version = "16.1.0";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${version}";
-    sha256 = "sha256-bZwq8nG3QmPCgfuBUQW6LQdi7F1+n2JfzfU3oP+QCJw=";
+    sha256 = "sha256-vAprB+pDwpr2Wq4aM0wnHlNzUvc1ajasdORwT0LDTTY=";
  };

-  vendorHash = "sha256-s3HHoz9URACuVVhePQQFviTqlQU7vCLOjTJPBlus1Vo=";
+  vendorHash = "sha256-SN4r9hcTTQUr3miv2Cm7iBryyh7yG1xx9lCvq3vQwc0=";
  subPackages = [ "." ];

  meta = with lib; {
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@ -2,19 +2,19 @@

 buildGoModule rec {
  pname = "gitlab-shell";
-  version = "14.20.0";
+  version = "14.23.0";
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-shell";
    rev = "v${version}";
-    sha256 = "sha256-5rjrBt0AihSHMYOD6JbXGvvFaUbtYnMHX2Z4K+Svno0=";
+    sha256 = "sha256-nQJq9aPC5YtTbyiwtzKwDG95PnBr6XdNpSIJkfgvnzU=";
  };

  buildInputs = [ ruby libkrb5 ];

  patches = [ ./remove-hardcoded-locations.patch ];

-  vendorSha256 = "sha256-kKbTbOCuAGIbnFXTOZyoVRM5PIackbmND6PrryVvLTM=";
+  vendorSha256 = "sha256-JEWgOuWvtuaipF8fFTsFbB+sYfaHEYUl9Z8Q1XAuJuE=";

  postInstall = ''
    cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "16.0.5";
+  version = "16.1.0";

  src = fetchFromGitLab {
    owner = data.owner;
@ -16,7 +16,7 @@ buildGoModule rec {

  sourceRoot = "source/workhorse";

-  vendorSha256 = "sha256-B9YZkqAMYvTnnWx2tYEF0VZ/+9LZaWS5euQ9ZX2m49E=";
+  vendorSha256 = "sha256-lKl/V2fti0eqrEoeJNNwvJbZO7z7v+5HlES+dyxxcP4=";
  buildInputs = [ git ];
  ldflags = [ "-X main.Version=${version}" ];
  doCheck = false;
--- a/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
+++ b/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
@ -53,7 +53,7 @@ index d096174fca3a..02d0f689c523 100644
 # Important: keep the satellites.path setting until GitLab 9.0 at
 # least. This setting is fed to 'rm -rf' in
 diff --git a/config/puma.rb.example b/config/puma.rb.example
-index 9fc354a8fe8..2352ca9b58c 100644
+index 07a6f6a25015..14a718a43202 100644
 --- a/config/puma.rb.example
 +++ b/config/puma.rb.example
@@ -5,12 +5,8 @@
@ -71,7 +71,7 @@ index 9fc354a8fe8..2352ca9b58c 100644
 
 # Configure "min" to be the minimum number of threads to use to answer
 # requests and "max" the maximum.
-@@ -31,12 +27,12 @@ queue_requests false
+@@ -31,11 +27,11 @@ queue_requests false
 
 # Bind the server to "url". "tcp://", "unix://" and "ssl://" are the only
 # accepted protocols.
@ -81,14 +81,12 @@ index 9fc354a8fe8..2352ca9b58c 100644
 workers 3
 
 -require_relative "/home/git/gitlab/lib/gitlab/cluster/lifecycle_events"
-require_relative "/home/git/gitlab/lib/gitlab/cluster/puma_worker_killer_initializer"
 +require_relative ENV['GITLAB_PATH'] + "lib/gitlab/cluster/lifecycle_events"
-+require_relative ENV['GITLAB_PATH'] + "lib/gitlab/cluster/puma_worker_killer_initializer"
 
 on_restart do
   # Signal application hooks that we're about to restart
-@@ -80,7 +76,7 @@ if defined?(nakayoshi_fork)
- end
+@@ -74,7 +70,7 @@ worker_timeout 60
+ wait_for_less_busy_worker ENV.fetch('PUMA_WAIT_FOR_LESS_BUSY_WORKER', 0.001).to_f
 
 # Use json formatter
 -require_relative "/home/git/gitlab/lib/gitlab/puma_logging/json_formatter"
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@ -25,7 +25,7 @@ gem 'responders', '~> 3.0'

 gem 'sprockets', '~> 3.7.0'

-gem 'view_component', '~> 2.82.0'
+gem 'view_component', '~> 3.2.0'

 # Supported DBs
 gem 'pg', '~> 1.5.3'
@ -46,9 +46,9 @@ gem 'devise', '~> 4.8.1'
 gem 'devise-pbkdf2-encryptable', '~> 0.0.0', path: 'vendor/gems/devise-pbkdf2-encryptable'
 gem 'bcrypt', '~> 3.1', '>= 3.1.14'
 gem 'doorkeeper', '~> 5.6', '>= 5.6.6'
-gem 'doorkeeper-openid_connect', '~> 1.8', '>= 1.8.6'
+gem 'doorkeeper-openid_connect', '~> 1.8', '>= 1.8.7'
 gem 'rexml', '~> 3.2.5'
-gem 'ruby-saml', '~> 1.13.0'
+gem 'ruby-saml', '~> 1.15.0'
 gem 'omniauth', '~> 2.1.0'
 gem 'omniauth-auth0', '~> 3.1'
 gem 'omniauth-azure-activedirectory-v2', '~> 2.0'
@ -61,6 +61,7 @@ gem 'omniauth-gitlab', '~> 4.0.0', path: 'vendor/gems/omniauth-gitlab' # See ven
 gem 'omniauth-google-oauth2', '~> 1.1'
 gem 'omniauth-oauth2-generic', '~> 0.2.2'
 gem 'omniauth-saml', '~> 2.1.0'
+gem 'omniauth-shibboleth-redux', '~> 2.0'
 gem 'omniauth-twitter', '~> 1.4'
 gem 'omniauth_crowd', '~> 2.4.0', path: 'vendor/gems/omniauth_crowd' # See vendor/gems/omniauth_crowd/README.md
 gem 'omniauth_openid_connect', '~> 0.6.1'
@ -105,13 +106,13 @@ gem 'gpgme', '~> 2.0.22'
 # GitLab fork with several improvements to original library. For full list of changes
 # see https://github.com/intridea/omniauth-ldap/compare/master...gitlabhq:master
 gem 'gitlab_omniauth-ldap', '~> 2.2.0', require: 'omniauth-ldap'
-gem 'net-ldap', '~> 0.17.1'
+gem 'net-ldap', '~> 0.18.0'

 # API
-gem 'grape', '~> 1.5.2'
+gem 'grape', '~> 1.7.0'
 gem 'grape-entity', '~> 0.10.0'
 gem 'rack-cors', '~> 1.1.1', require: 'rack/cors'
-gem 'grape-swagger', '~>1.5.0', group: [:development, :test]
+gem 'grape-swagger', '~> 1.6.1', group: [:development, :test]
 gem 'grape-swagger-entity', '~> 0.5.1', group: [:development, :test]

 # GraphQL API
@ -172,9 +173,9 @@ gem 'seed-fu', '~> 2.3.7'
 gem 'elasticsearch-model', '~> 7.2'
 gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation'
 gem 'elasticsearch-api',   '7.13.3'
-gem 'aws-sdk-core', '~> 3.172.0'
+gem 'aws-sdk-core', '~> 3.175.0'
 gem 'aws-sdk-cloudformation', '~> 1'
-gem 'aws-sdk-s3', '~> 1.122.0'
+gem 'aws-sdk-s3', '~> 1.126.0'
 gem 'faraday_middleware-aws-sigv4', '~>0.3.0'
 gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive connections

@ -182,7 +183,7 @@ gem 'typhoeus', '~> 1.4.0' # Used with Elasticsearch to support http keep-alive
 gem 'html-pipeline', '~> 2.14.3'
 gem 'deckar01-task_list', '2.3.2'
 gem 'gitlab-markup', '~> 1.9.0', require: 'github/markup'
-gem 'commonmarker', '~> 0.23.6'
+gem 'commonmarker', '~> 0.23.9'
 gem 'kramdown', '~> 2.3.1'
 gem 'RedCloth', '~> 4.3.2'
 gem 'rdoc', '~> 6.3.2'
@ -193,9 +194,9 @@ gem 'asciidoctor', '~> 2.0.18'
 gem 'asciidoctor-include-ext', '~> 0.4.0', require: false
 gem 'asciidoctor-plantuml', '~> 0.0.16'
 gem 'asciidoctor-kroki', '~> 0.8.0', require: false
-gem 'rouge', '~> 4.1.0'
+gem 'rouge', '~> 4.1.2'
 gem 'truncato', '~> 0.7.12'
-gem 'nokogiri', '~> 1.14.3'
+gem 'nokogiri', '~> 1.15', '>= 1.15.2'

 # Calendar rendering
 gem 'icalendar'
@ -210,8 +211,7 @@ gem 'rack', '~> 2.2.7'
 gem 'rack-timeout', '~> 0.6.3', require: 'rack/timeout/base'

 group :puma do
-  gem 'puma', '~> 5.6.5', require: false
-  gem 'puma_worker_killer', '~> 0.3.1', require: false
+  gem 'puma', '~> 6.3', require: false
  gem 'sd_notify', '~> 0.1.0', require: false
 end

@ -288,10 +288,10 @@ gem 'circuitbox', '2.0.0'

 # Sanitize user input
 gem 'sanitize', '~> 6.0'
-gem 'babosa', '~> 1.0.4'
+gem 'babosa', '~> 2.0'

 # Sanitizes SVG input
-gem 'loofah', '~> 2.21.0'
+gem 'loofah', '~> 2.21.3'

 # Working with license
 # Detects the open source license the repository includes
@ -323,7 +323,7 @@ gem 'gon', '~> 6.4.0'
 gem 'request_store', '~> 1.5.1'
 gem 'base32', '~> 0.3.0'

-gem 'gitlab-license', '~> 2.2.1'
+gem 'gitlab-license', '~> 2.3'

 # Protect against bruteforcing
 gem 'rack-attack', '~> 6.6.1'
@ -336,11 +336,11 @@ gem 'sentry-sidekiq', '~> 5.8.0'

 # PostgreSQL query parsing
 #
-gem 'pg_query', '~> 2.2', '>= 2.2.1'
+gem 'pg_query', '~> 4.2.1'

 gem 'premailer-rails', '~> 1.10.3'

-gem 'gitlab-labkit', '~> 0.32.0'
+gem 'gitlab-labkit', '~> 0.33.0'
 gem 'thrift', '>= 0.16.0'

 # I18n
@ -363,12 +363,12 @@ gem 'snowplow-tracker', '~> 0.8.0'

 # Metrics
 gem 'webrick', '~> 1.8.1', require: false
-gem 'prometheus-client-mmap', '~> 0.23', require: 'prometheus/client'
+gem 'prometheus-client-mmap', '~> 0.25', require: 'prometheus/client'

 gem 'warning', '~> 1.3.0'

 group :development do
-  gem 'lefthook', '~> 1.3.13', require: false
+  gem 'lefthook', '~> 1.4.2', require: false
  gem 'rubocop'
  gem 'solargraph', '~> 0.47.2', require: false

@ -376,7 +376,7 @@ group :development do
  gem 'lookbook', '~> 2.0', '>= 2.0.1'

  # Better errors handler
-  gem 'better_errors', '~> 2.10.0'
+  gem 'better_errors', '~> 2.10.1'

  gem 'sprite-factory', '~> 1.7'

@ -386,6 +386,7 @@ end
 group :development, :test do
  gem 'deprecation_toolkit', '~> 1.5.1', require: false
  gem 'bullet', '~> 7.0.2'
+  gem 'parser', '~> 3.2', '>= 3.2.2.3'
  gem 'pry-byebug'
  gem 'pry-rails', '~> 0.3.9'
  gem 'pry-shell', '~> 0.6.1'
@ -453,7 +454,7 @@ group :test do
  gem 'rspec-benchmark', '~> 0.6.0'
  gem 'rspec-parameterized', '~> 1.0', require: false

-  gem 'capybara', '~> 3.39'
+  gem 'capybara', '~> 3.39', '>= 3.39.1'
  gem 'capybara-screenshot', '~> 1.0.26'
  # 4.9.1 drops Ruby 2.7 support. We can upgrade further after we drop Ruby 2.7 support.
  gem 'selenium-webdriver', '= 4.9.0'
@ -472,6 +473,8 @@ group :test do

  # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
  gem 'derailed_benchmarks', require: false
+
+  gem 'gitlab_quality-test_tooling', '~> 0.8.1', require: false
 end

 gem 'octokit', '~> 4.15'
@ -506,14 +509,14 @@ gem 'ssh_data', '~> 1.3'
 gem 'spamcheck', '~> 1.3.0'

 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 15.9.0-rc3'
+gem 'gitaly', '~> 16.1.0-rc2'

 # KAS GRPC protocol definitions
 gem 'kas-grpc', '~> 0.1.0'

 gem 'grpc', '~> 1.42.0'

-gem 'google-protobuf', '~> 3.22', '>= 3.22.3'
+gem 'google-protobuf', '~> 3.23', '>= 3.23.3'

 gem 'toml-rb', '~> 2.2.0'

@ -587,7 +590,7 @@ gem 'cvss-suite', '~> 3.0.1', require: 'cvss_suite'
 gem 'arr-pm', '~> 0.0.12'

 # Remote Development
-gem 'devfile', '~> 0.0.17.pre.alpha1'
+gem 'devfile', '~> 0.0.19.pre.alpha1'

 # Apple plist parsing
 gem 'CFPropertyList', '~> 3.0.0'
@ -599,5 +602,8 @@ gem 'telesignenterprise', '~> 2.2'
 # BufferedIO patch
 # Updating this version will require updating scripts/allowed_warnings.txt
 gem 'net-protocol', '~> 0.1.3'
+# Lock this until we make DNS rebinding work with the updated net-http:
+# https://gitlab.com/gitlab-org/gitlab/-/issues/413528
+gem 'net-http', '= 0.1.1'

 gem 'duo_api', '~> 1.3'
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@ -203,7 +203,7 @@ GEM
    aws-sdk-cloudformation (1.41.0)
      aws-sdk-core (~> 3, >= 3.99.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-core (3.172.0)
+    aws-sdk-core (3.175.0)
      aws-eventstream (~> 1, >= 1.0.2)
      aws-partitions (~> 1, >= 1.651.0)
      aws-sigv4 (~> 1.5)
@ -211,8 +211,8 @@ GEM
    aws-sdk-kms (1.64.0)
      aws-sdk-core (~> 3, >= 3.165.0)
      aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.122.0)
-      aws-sdk-core (~> 3, >= 3.165.0)
+    aws-sdk-s3 (1.126.0)
+      aws-sdk-core (~> 3, >= 3.174.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.4)
    aws-sigv4 (1.5.1)
@ -236,7 +236,7 @@ GEM
      faraday_middleware (~> 1.0, >= 1.0.0.rc1)
      net-http-persistent (~> 4.0)
      nokogiri (~> 1, >= 1.10.8)
-    babosa (1.0.4)
+    babosa (2.0.0)
    backport (1.2.0)
    base32 (0.3.2)
    batch-loader (2.0.1)
@ -248,7 +248,7 @@ GEM
      memory_profiler (~> 1)
    benchmark-perf (0.6.0)
    benchmark-trend (0.4.0)
-    better_errors (2.10.0)
+    better_errors (2.10.1)
      erubi (>= 1.0.0)
      rack (>= 0.9.0)
      rouge (>= 1.0.0)
@ -266,7 +266,7 @@ GEM
      bundler (>= 1.2.0, < 3)
      thor (>= 0.18, < 2)
    byebug (11.1.3)
-    capybara (3.39.0)
+    capybara (3.39.1)
      addressable
      matrix
      mini_mime (>= 0.1.3)
@ -307,7 +307,7 @@ GEM
    coercible (1.0.0)
      descendants_tracker (~> 0.0.1)
    colored2 (3.1.2)
-    commonmarker (0.23.6)
+    commonmarker (0.23.9)
    concurrent-ruby (1.2.2)
    connection_pool (2.3.0)
    cork (0.3.0)
@ -367,7 +367,7 @@ GEM
      thor (>= 0.19, < 2)
    descendants_tracker (0.0.4)
      thread_safe (~> 0.3, >= 0.3.1)
-    devfile (0.0.17.pre.alpha1)
+    devfile (0.0.19.pre.alpha1)
    device_detector (1.0.0)
    devise (4.8.1)
      bcrypt (~> 3.0)
@ -393,30 +393,24 @@ GEM
      unf (>= 0.0.5, < 1.0.0)
    doorkeeper (5.6.6)
      railties (>= 5)
-    doorkeeper-openid_connect (1.8.6)
+    doorkeeper-openid_connect (1.8.7)
      doorkeeper (>= 5.5, < 5.7)
      jwt (>= 2.5)
    dotenv (2.7.6)
-    dry-configurable (0.12.0)
+    dry-core (1.0.0)
      concurrent-ruby (~> 1.0)
-      dry-core (~> 0.5, >= 0.5.0)
-    dry-container (0.7.2)
+      zeitwerk (~> 2.6)
+    dry-inflector (1.0.0)
+    dry-logic (1.5.0)
      concurrent-ruby (~> 1.0)
-      dry-configurable (~> 0.1, >= 0.1.3)
-    dry-core (0.5.0)
+      dry-core (~> 1.0, < 2)
+      zeitwerk (~> 2.6)
+    dry-types (1.7.1)
      concurrent-ruby (~> 1.0)
-    dry-equalizer (0.3.0)
-    dry-inflector (0.2.0)
-    dry-logic (1.1.0)
-      concurrent-ruby (~> 1.0)
-      dry-core (~> 0.5, >= 0.5)
-    dry-types (1.4.0)
-      concurrent-ruby (~> 1.0)
-      dry-container (~> 0.3)
-      dry-core (~> 0.4, >= 0.4.4)
-      dry-equalizer (~> 0.3)
-      dry-inflector (~> 0.1, >= 0.1.2)
-      dry-logic (~> 1.0, >= 1.0.2)
+      dry-core (~> 1.0)
+      dry-inflector (~> 1.0)
+      dry-logic (~> 1.4)
+      zeitwerk (~> 2.6)
    dumb_delegator (1.0.0)
    duo_api (1.3.0)
    e2mmap (0.1.0)
@ -581,7 +575,7 @@ GEM
      rails (>= 3.2.0)
    git (1.11.0)
      rchardet (~> 1.8)
-    gitaly (15.9.0.pre.rc3)
+    gitaly (16.1.0.pre.rc2)
      grpc (~> 1.0)
    gitlab (4.19.0)
      httparty (~> 0.20)
@ -602,15 +596,15 @@ GEM
      fog-json (~> 1.2.0)
      mime-types
      ms_rest_azure (~> 0.12.0)
-    gitlab-labkit (0.32.0)
+    gitlab-labkit (0.33.0)
      actionpack (>= 5.0.0, < 8.0.0)
      activesupport (>= 5.0.0, < 8.0.0)
      grpc (>= 1.37)
      jaeger-client (~> 1.1.0)
      opentracing (~> 0.4)
-      pg_query (~> 2.1)
+      pg_query (~> 4.2.1)
      redis (> 3.0.0, < 6.0.0)
-    gitlab-license (2.2.2)
+    gitlab-license (2.3.0)
    gitlab-mail_room (0.0.23)
      jwt (>= 2.0)
      net-imap (>= 0.2.1)
@ -630,6 +624,15 @@ GEM
      omniauth (>= 1.3, < 3)
      pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
      rubyntlm (~> 0.5)
+    gitlab_quality-test_tooling (0.8.1)
+      activesupport (>= 6.1, < 7.1)
+      gitlab (~> 4.19)
+      http (~> 5.0)
+      nokogiri (~> 1.10)
+      parallel (>= 1, < 2)
+      rainbow (>= 3, < 4)
+      table_print (= 1.5.7)
+      zeitwerk (>= 2, < 3)
    globalid (1.1.0)
      activesupport (>= 5.0)
    gon (6.4.0)
@ -691,7 +694,7 @@ GEM
      google-cloud-core (~> 1.6)
      googleauth (>= 0.16.2, < 2.a)
      mini_mime (~> 1.0)
-    google-protobuf (3.22.3)
+    google-protobuf (3.23.3)
    googleapis-common-protos (1.4.0)
      google-protobuf (~> 3.14)
      googleapis-common-protos-types (~> 1.2)
@ -707,7 +710,7 @@ GEM
      signet (>= 0.16, < 2.a)
    gpgme (2.0.22)
      mini_portile2 (~> 2.7)
-    grape (1.5.2)
+    grape (1.7.0)
      activesupport
      builder
      dry-types (>= 1.1)
@ -722,7 +725,7 @@ GEM
      grape (~> 1.3)
      rake (> 12)
      ruby2_keywords (~> 0.0.2)
-    grape-swagger (1.5.0)
+    grape-swagger (1.6.1)
      grape (~> 1.3)
    grape-swagger-entity (0.5.1)
      grape-entity (>= 0.6.0)
@ -878,7 +881,7 @@ GEM
      rest-client (~> 2.0)
    launchy (2.5.0)
      addressable (~> 2.7)
-    lefthook (1.3.13)
+    lefthook (1.4.2)
    letter_opener (1.7.0)
      launchy (~> 2.2)
    letter_opener_web (2.0.0)
@ -913,9 +916,9 @@ GEM
      activesupport (>= 4)
      railties (>= 4)
      request_store (~> 1.0)
-    loofah (2.21.0)
+    loofah (2.21.3)
      crass (~> 1.0.2)
-      nokogiri (>= 1.5.9)
+      nokogiri (>= 1.12.0)
    lookbook (2.0.1)
      activemodel
      css_parser
@ -949,7 +952,7 @@ GEM
    mini_histogram (0.3.1)
    mini_magick (4.10.1)
    mini_mime (1.1.2)
-    mini_portile2 (2.8.1)
+    mini_portile2 (2.8.2)
    minitest (5.11.3)
    mixlib-cli (2.1.8)
    mixlib-config (3.0.9)
@ -971,20 +974,23 @@ GEM
    multi_xml (0.6.0)
    multipart-post (2.2.3)
    murmurhash3 (0.1.7)
-    mustermann (1.1.1)
+    mustermann (3.0.0)
      ruby2_keywords (~> 0.0.1)
-    mustermann-grape (1.0.1)
+    mustermann-grape (1.0.2)
      mustermann (>= 1.0.0)
    nap (1.1.0)
    neighbor (0.2.3)
      activerecord (>= 5.2)
    nenv (0.3.0)
+    net-http (0.1.1)
+      net-protocol
+      uri
    net-http-persistent (4.0.1)
      connection_pool (~> 2.2)
    net-imap (0.3.4)
      date
      net-protocol
-    net-ldap (0.17.1)
+    net-ldap (0.18.0)
    net-ntp (2.1.3)
    net-pop (0.1.2)
      net-protocol
@ -998,8 +1004,8 @@ GEM
    netrc (0.11.0)
    nio4r (2.5.8)
    no_proxy_fix (0.1.2)
-    nokogiri (1.14.3)
-      mini_portile2 (~> 2.8.0)
+    nokogiri (1.15.2)
+      mini_portile2 (~> 2.8.2)
      racc (~> 1.4)
    notiffany (0.1.3)
      nenv (~> 0.1)
@ -1070,6 +1076,8 @@ GEM
    omniauth-saml (2.1.0)
      omniauth (~> 2.0)
      ruby-saml (~> 1.12)
+    omniauth-shibboleth-redux (2.0.0)
+      omniauth (>= 2.0.0)
    omniauth-twitter (1.4.0)
      omniauth-oauth (~> 1.1)
      rack
@ -1120,16 +1128,17 @@ GEM
      expgen (~> 0.1)
      rainbow (~> 3.1.1)
    parallel (1.22.1)
-    parser (3.2.0.0)
+    parser (3.2.2.3)
      ast (~> 2.4.1)
+      racc
    parslet (1.8.2)
    pastel (0.8.0)
      tty-color (~> 0.5)
    peek (1.1.0)
      railties (>= 4.0.0)
    pg (1.5.3)
-    pg_query (2.2.1)
-      google-protobuf (>= 3.19.2)
+    pg_query (4.2.1)
+      google-protobuf (>= 3.22.3)
    plist (3.6.0)
    png_quantizator (0.2.1)
    po_to_json (1.0.1)
@ -1145,7 +1154,7 @@ GEM
      coderay
      parser
      unparser
-    prometheus-client-mmap (0.23.1)
+    prometheus-client-mmap (0.25.0)
      rb_sys (~> 0.9)
    pry (0.14.2)
      coderay (~> 1.1)
@ -1160,11 +1169,8 @@ GEM
      tty-markdown
      tty-prompt
    public_suffix (5.0.0)
-    puma (5.6.5)
+    puma (6.3.0)
      nio4r (~> 2.0)
-    puma_worker_killer (0.3.1)
-      get_process_mem (~> 0.2)
-      puma (>= 2.7)
    pyu-ruby-sasl (0.0.3.3)
    raabro (1.4.0)
    racc (1.6.2)
@ -1226,7 +1232,7 @@ GEM
    rb-fsevent (0.11.2)
    rb-inotify (0.10.1)
      ffi (~> 1.0)
-    rb_sys (0.9.75)
+    rb_sys (0.9.78)
    rbtrace (0.4.14)
      ffi (>= 1.0.6)
      msgpack (>= 0.4.3)
@ -1273,7 +1279,7 @@ GEM
    rexml (3.2.5)
    rinku (2.0.0)
    rotp (6.2.0)
-    rouge (4.1.0)
+    rouge (4.1.2)
    rqrcode (0.7.0)
      chunky_png
    rqrcode-rails3 (0.1.7)
@ -1358,8 +1364,8 @@ GEM
    ruby-openai (3.7.0)
      httparty (>= 0.18.1)
    ruby-progressbar (1.11.0)
-    ruby-saml (1.13.0)
-      nokogiri (>= 1.10.5)
+    ruby-saml (1.15.0)
+      nokogiri (>= 1.13.10)
      rexml
    ruby-statistics (3.0.0)
    ruby2_keywords (0.0.5)
@ -1503,6 +1509,7 @@ GEM
    sys-filesystem (1.4.3)
      ffi (~> 1.1)
    sysexits (1.2.0)
+    table_print (1.5.7)
    tanuki_emoji (0.6.0)
    telesign (2.2.4)
      net-http-persistent (>= 3.0.0, < 5.0)
@ -1585,6 +1592,7 @@ GEM
    unparser (0.6.7)
      diff-lcs (~> 1.3)
      parser (>= 3.2.0)
+    uri (0.12.1)
    uri_template (0.7.0)
    valid_email (0.1.3)
      activemodel
@ -1600,7 +1608,7 @@ GEM
      activesupport (>= 3.0)
    version_gem (1.1.0)
    version_sorter (2.3.0)
-    view_component (2.82.0)
+    view_component (3.2.0)
      activesupport (>= 5.2.0, < 8.0)
      concurrent-ruby (~> 1.0)
      method_source (~> 1.0)
@ -1672,28 +1680,28 @@ DEPENDENCIES
  autoprefixer-rails (= 10.2.5.1)
  awesome_print
  aws-sdk-cloudformation (~> 1)
-  aws-sdk-core (~> 3.172.0)
-  aws-sdk-s3 (~> 1.122.0)
+  aws-sdk-core (~> 3.175.0)
+  aws-sdk-s3 (~> 1.126.0)
  axe-core-rspec
-  babosa (~> 1.0.4)
+  babosa (~> 2.0)
  base32 (~> 0.3.0)
  batch-loader (~> 2.0.1)
  bcrypt (~> 3.1, >= 3.1.14)
  benchmark-ips (~> 2.11.0)
  benchmark-memory (~> 0.1)
-  better_errors (~> 2.10.0)
+  better_errors (~> 2.10.1)
  bootsnap (~> 1.16.0)
  browser (~> 5.3.1)
  bullet (~> 7.0.2)
  bundler-audit (~> 0.7.0.1)
  bundler-checksum (~> 0.1.0)!
-  capybara (~> 3.39)
+  capybara (~> 3.39, >= 3.39.1)
  capybara-screenshot (~> 1.0.26)
  carrierwave (~> 1.3)
  charlock_holmes (~> 0.7.7)
  circuitbox (= 2.0.0)
  cloud_profiler_agent (~> 0.0.0)!
-  commonmarker (~> 0.23.6)
+  commonmarker (~> 0.23.9)
  concurrent-ruby (~> 1.1)
  connection_pool (~> 2.0)
  countries (~> 4.0.0)
@ -1705,7 +1713,7 @@ DEPENDENCIES
  declarative_policy (~> 1.1.0)
  deprecation_toolkit (~> 1.5.1)
  derailed_benchmarks
-  devfile (~> 0.0.17.pre.alpha1)
+  devfile (~> 0.0.19.pre.alpha1)
  device_detector
  devise (~> 4.8.1)
  devise-pbkdf2-encryptable (~> 0.0.0)!
@ -1714,7 +1722,7 @@ DEPENDENCIES
  diffy (~> 3.4)
  discordrb-webhooks (~> 3.4)
  doorkeeper (~> 5.6, >= 5.6.6)
-  doorkeeper-openid_connect (~> 1.8, >= 1.8.6)
+  doorkeeper-openid_connect (~> 1.8, >= 1.8.7)
  duo_api (~> 1.3)
  ed25519 (~> 1.3.0)
  elasticsearch-api (= 7.13.3)
@ -1741,13 +1749,13 @@ DEPENDENCIES
  gettext (~> 3.3)
  gettext_i18n_rails (~> 1.8.0)
  gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 15.9.0.pre.rc3)
+  gitaly (~> 16.1.0.pre.rc2)
  gitlab-chronic (~> 0.10.5)
  gitlab-dangerfiles (~> 3.10.0)
  gitlab-experiment (~> 0.7.1)
  gitlab-fog-azure-rm (~> 1.7.0)
-  gitlab-labkit (~> 0.32.0)
-  gitlab-license (~> 2.2.1)
+  gitlab-labkit (~> 0.33.0)
+  gitlab-license (~> 2.3)
  gitlab-mail_room (~> 0.0.23)
  gitlab-markup (~> 1.9.0)
  gitlab-net-dns (~> 0.9.2)
@ -1755,6 +1763,7 @@ DEPENDENCIES
  gitlab-styles (~> 10.0.0)
  gitlab_chronic_duration (~> 0.10.6.2)
  gitlab_omniauth-ldap (~> 2.2.0)
+  gitlab_quality-test_tooling (~> 0.8.1)
  gon (~> 6.4.0)
  google-apis-androidpublisher_v3 (~> 0.34.0)
  google-apis-cloudbilling_v1 (~> 0.21.0)
@ -1767,12 +1776,12 @@ DEPENDENCIES
  google-apis-serviceusage_v1 (~> 0.28.0)
  google-apis-sqladmin_v1beta4 (~> 0.41.0)
  google-cloud-storage (~> 1.44.0)
-  google-protobuf (~> 3.22, >= 3.22.3)
+  google-protobuf (~> 3.23, >= 3.23.3)
  gpgme (~> 2.0.22)
-  grape (~> 1.5.2)
+  grape (~> 1.7.0)
  grape-entity (~> 0.10.0)
  grape-path-helpers (~> 1.7.1)
-  grape-swagger (~> 1.5.0)
+  grape-swagger (~> 1.6.1)
  grape-swagger-entity (~> 0.5.1)
  grape_logging (~> 1.8)
  graphiql-rails (~> 1.8)
@ -1806,14 +1815,14 @@ DEPENDENCIES
  knapsack (~> 1.21.1)
  kramdown (~> 2.3.1)
  kubeclient (~> 4.11.0)
-  lefthook (~> 1.3.13)
+  lefthook (~> 1.4.2)
  letter_opener_web (~> 2.0.0)
  license_finder (~> 7.0)
  licensee (~> 9.15)
  listen (~> 3.7)
  lockbox (~> 1.1.1)
  lograge (~> 0.5)
-  loofah (~> 2.21.0)
+  loofah (~> 2.21.3)
  lookbook (~> 2.0, >= 2.0.1)
  lru_redux
  mail (= 2.8.1)
@ -1825,10 +1834,11 @@ DEPENDENCIES
  minitest (~> 5.11.0)
  multi_json (~> 1.14.1)
  neighbor (~> 0.2.3)
-  net-ldap (~> 0.17.1)
+  net-http (= 0.1.1)
+  net-ldap (~> 0.18.0)
  net-ntp
  net-protocol (~> 0.1.3)
-  nokogiri (~> 1.14.3)
+  nokogiri (~> 1.15, >= 1.15.2)
  oauth2 (~> 2.0)
  octokit (~> 4.15)
  ohai (~> 17.9)
@ -1848,6 +1858,7 @@ DEPENDENCIES
  omniauth-oauth2-generic (~> 0.2.2)
  omniauth-salesforce (~> 1.0.5)!
  omniauth-saml (~> 2.1.0)
+  omniauth-shibboleth-redux (~> 2.0)
  omniauth-twitter (~> 1.4)
  omniauth_crowd (~> 2.4.0)!
  omniauth_openid_connect (~> 0.6.1)
@ -1856,18 +1867,18 @@ DEPENDENCIES
  org-ruby (~> 0.9.12)
  pact (~> 1.63)
  parallel (~> 1.19)
+  parser (~> 3.2, >= 3.2.2.3)
  parslet (~> 1.8)
  peek (~> 1.1)
  pg (~> 1.5.3)
-  pg_query (~> 2.2, >= 2.2.1)
+  pg_query (~> 4.2.1)
  png_quantizator (~> 0.2.1)
  premailer-rails (~> 1.10.3)
-  prometheus-client-mmap (~> 0.23)
+  prometheus-client-mmap (~> 0.25)
  pry-byebug
  pry-rails (~> 0.3.9)
  pry-shell (~> 0.6.1)
-  puma (~> 5.6.5)
-  puma_worker_killer (~> 0.3.1)
+  puma (~> 6.3)
  rack (~> 2.2.7)
  rack-attack (~> 6.6.1)
  rack-cors (~> 1.1.1)
@ -1889,7 +1900,7 @@ DEPENDENCIES
  responders (~> 3.0)
  retriable (~> 3.1.2)
  rexml (~> 3.2.5)
-  rouge (~> 4.1.0)
+  rouge (~> 4.1.2)
  rqrcode-rails3 (~> 0.1.7)
  rspec-benchmark (~> 0.6.0)
  rspec-parameterized (~> 1.0)
@ -1902,7 +1913,7 @@ DEPENDENCIES
  ruby-magic (~> 0.6)
  ruby-openai (~> 3.7)
  ruby-progressbar (~> 1.10)
-  ruby-saml (~> 1.13.0)
+  ruby-saml (~> 1.15.0)
  ruby_parser (~> 3.20)
  rubyzip (~> 2.3.2)
  rugged (~> 1.5)
@ -1952,7 +1963,7 @@ DEPENDENCIES
  valid_email (~> 0.1)
  validates_hostname (~> 1.0.11)
  version_sorter (~> 2.3)
-  view_component (~> 2.82.0)
+  view_component (~> 3.2.0)
  vmstat (~> 2.3.0)
  warning (~> 1.3.0)
  webauthn (~> 3.0)
@ -1962,4 +1973,4 @@ DEPENDENCIES
  yajl-ruby (~> 1.4.3)

 BUNDLED WITH
-   2.4.13
+   2.4.14
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@ -401,10 +401,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "06scfn1qjfqvgr05ddrcbihlnfi7bffk8r0m5z536w4mm1s3gh6x";
+      sha256 = "1fbbzcszpdjy2yzxfvl5fzgn0jgznkwxvqpb46nxv69gqhv3dpsg";
      type = "gem";
    };
-    version = "3.172.0";
+    version = "3.175.0";
  };
  aws-sdk-kms = {
    dependencies = ["aws-sdk-core" "aws-sigv4"];
@ -423,10 +423,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "01cryf8kfkmlsxb327szcwcagsp7lss5gmk6zxlgap65lv8bc7rx";
+      sha256 = "17ya49rwjzimqhzsj6vlc4xfvj2sixy04kr4b6ddg3r6y0jrsixi";
      type = "gem";
    };
-    version = "1.122.0";
+    version = "1.126.0";
  };
  aws-sigv4 = {
    dependencies = ["aws-eventstream"];
@ -499,10 +499,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "16dwqn33kmxkqkv51cwiikdkbrdjfsymlnc0rgbjwilmym8a9phq";
+      sha256 = "19mqrnyizr1ipdp26vhrg0hwb851bwyvrs6xc29dk3ywljw8s8d6";
      type = "gem";
    };
-    version = "1.0.4";
+    version = "2.0.0";
  };
  backport = {
    groups = ["default" "development"];
@ -611,10 +611,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0fhi891k7c4l967bacahq2jhnxswfmbpmbsg1yapczwpm1ynmaz3";
+      sha256 = "0wqazisnn6hn1wsza412xribpw5wzx6b5z5p4mcpfgizr6xg367p";
      type = "gem";
    };
-    version = "2.10.0";
+    version = "2.10.1";
  };
  bindata = {
    groups = ["default"];
@ -720,10 +720,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "06b4nlhirsq8ny17s8zgz7qyvl9v41rixj1xkviiiwxlnjz982d3";
+      sha256 = "1qhg45jxxy5h90frmajrrh5sirmj29sbfhbf7q0qhjymc0w1p0r5";
      type = "gem";
    };
-    version = "3.39.0";
+    version = "3.39.1";
  };
  capybara-screenshot = {
    dependencies = ["capybara" "launchy"];
@ -911,10 +911,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0f3v6ffikj694h925zvfzgx995q6l1ixnqpph3qpnjdsyjpsmbn8";
+      sha256 = "074162raa8pc92q6833hgqdlfr3z5jgid9avdz5k25cnls2rqwrf";
      type = "gem";
    };
-    version = "0.23.6";
+    version = "0.23.9";
  };
  concurrent-ruby = {
    groups = ["default" "development" "test"];
@ -1163,10 +1163,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0v34ivsfpc4d291j89jyg2jz970h94jbz01hdm2jwcmq798yfm98";
+      sha256 = "1n4yxjijplg0klcnjdhk7kxmvlb0szchk1ad8flg5hb2j59c8a6r";
      type = "gem";
    };
-    version = "0.0.17.pre.alpha1";
+    version = "0.0.19.pre.alpha1";
  };
  device_detector = {
    groups = ["default"];
@ -1300,10 +1300,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "00z0n4ix21nvqk74hhz5ab811366pdjx99cn2i26yiwpwr1nbi4d";
+      sha256 = "11p7p3b0yb12xfdhxxsifc2mz0rj1hlgi8sbcwjzxvld24rszvbi";
      type = "gem";
    };
-    version = "1.8.6";
+    version = "1.8.7";
  };
  dotenv = {
    groups = ["default"];
@ -1315,80 +1315,48 @@ src:
    };
    version = "2.7.6";
  };
-  dry-configurable = {
-    dependencies = ["concurrent-ruby" "dry-core"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0rvwvxrvcygvgfc3xjrihvdvnr0dh2144s8x80zfgfnz0jd5gac7";
-      type = "gem";
-    };
-    version = "0.12.0";
-  };
-  dry-container = {
-    dependencies = ["concurrent-ruby" "dry-configurable"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1npnhs3x2xcwwijpys5c8rpcvymrlab0y8806nr4h425ld5q4wd0";
-      type = "gem";
-    };
-    version = "0.7.2";
-  };
  dry-core = {
-    dependencies = ["concurrent-ruby"];
-    groups = ["default"];
+    dependencies = ["concurrent-ruby" "zeitwerk"];
+    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "14s45hxcqpp2mbvwlwzn018i8qhcjzgkirigdrv31jd741rpgy9s";
+      sha256 = "01gks2hrp7nl3pzb487azvd25dlbrc40d5cpk4n0szwnf2c0k4ks";
      type = "gem";
    };
-    version = "0.5.0";
-  };
-  dry-equalizer = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0rsqpk0gjja6j6pjm0whx2px06cxr3h197vrwxp6k042p52r4v46";
-      type = "gem";
-    };
-    version = "0.3.0";
+    version = "1.0.0";
  };
  dry-inflector = {
-    groups = ["default"];
+    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "17mkdwglqsd9fg272y3zms7rixjgkb1km1xcb88ir5lxvk1jkky7";
+      sha256 = "09hnvna3lg2x36li63988kv664d0zvy7y0z33803yvrdr9hj7lka";
      type = "gem";
    };
-    version = "0.2.0";
+    version = "1.0.0";
  };
  dry-logic = {
-    dependencies = ["concurrent-ruby" "dry-core"];
-    groups = ["default"];
+    dependencies = ["concurrent-ruby" "dry-core" "zeitwerk"];
+    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "17dnc3g9y2nj42rdx2bdvsvvms10vgw4qzjb2iw2gln9hj8b797c";
+      sha256 = "05nldkc154r0qzlhss7n5klfiyyz05x2fkq08y13s34py6023vcr";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.5.0";
  };
  dry-types = {
-    dependencies = ["concurrent-ruby" "dry-container" "dry-core" "dry-equalizer" "dry-inflector" "dry-logic"];
-    groups = ["default"];
+    dependencies = ["concurrent-ruby" "dry-core" "dry-inflector" "dry-logic" "zeitwerk"];
+    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1px1r5khlf4lw32gsrnnnsx7dvl2d94axx3h0b6zwxrhvfq3n038";
+      sha256 = "1f6dz0hm67rhybh6xq2s3vvr700cp43kf50z2lids62s2i0mh5hj";
      type = "gem";
    };
-    version = "1.4.0";
+    version = "1.7.1";
  };
  dumb_delegator = {
    groups = ["default" "test"];
@ -2134,10 +2102,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1gja1b2zirv1clavlg6c0c3xc0z2si2xvxcp9cd165q4lwh47ika";
+      sha256 = "1bz3i05lr1nzm35xg11blaq78v96sg49aw1yh4hj7wfk3cbdn1q0";
      type = "gem";
    };
-    version = "15.9.0.pre.rc3";
+    version = "16.1.0.pre.rc2";
  };
  gitlab = {
    dependencies = ["httparty" "terminal-table"];
@ -2200,20 +2168,20 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0vl64blqz850d5vahwpwyrsvw4iarn578p8bzmcw11imqpnk62pk";
+      sha256 = "0nz0g5s65wkicsn9ianqxi7ys2w666n226gfblzllcfy1z9siyyi";
      type = "gem";
    };
-    version = "0.32.0";
+    version = "0.33.0";
  };
  gitlab-license = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07pdi9zcifiw8vjv5zz5jdv2gmaq3rkyxfdkn0j3a0cdh9iwgjrc";
+      sha256 = "0ms1kf5nmclsnmd2xa9k273asmb73ivaykwrb3g7sq263j3y7jk0";
      type = "gem";
    };
-    version = "2.2.2";
+    version = "2.3.0";
  };
  gitlab-mail_room = {
    dependencies = ["jwt" "net-imap" "oauth2"];
@ -2289,6 +2257,17 @@ src:
    };
    version = "2.2.0";
  };
+  gitlab_quality-test_tooling = {
+    dependencies = ["activesupport" "gitlab" "http" "nokogiri" "parallel" "rainbow" "table_print" "zeitwerk"];
+    groups = ["test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "02xwchhhfv8jkypap5pn1wjkdx92jxk4wsp71i2s0ymnqw98y401";
+      type = "gem";
+    };
+    version = "0.8.1";
+  };
  globalid = {
    dependencies = ["activesupport"];
    groups = ["default" "development" "test"];
@ -2535,10 +2514,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1xcg53yz44cqhcpb85w3ay80kvnniy0v441c9p08wb6zzia2mnq9";
+      sha256 = "1aczvz5jdslr1bfx08xrycp6ggdpaifdlh5hrdyd774mvcl0mg2d";
      type = "gem";
    };
-    version = "3.22.3";
+    version = "3.23.3";
  };
  googleapis-common-protos = {
    dependencies = ["google-protobuf" "googleapis-common-protos-types" "grpc"];
@ -2586,14 +2565,14 @@ src:
  };
  grape = {
    dependencies = ["activesupport" "builder" "dry-types" "mustermann-grape" "rack" "rack-accept"];
-    groups = ["default"];
+    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0adf01kihxbmh8q84r6zyfgdmpbyb0lwcar3fi8j6bl6qcsbgwqx";
+      sha256 = "0lbgysx2d64hsck11jajc4gwikj5nd82809bz0jibrnp4yb1lcw8";
      type = "gem";
    };
-    version = "1.5.2";
+    version = "1.7.0";
  };
  grape-entity = {
    dependencies = ["activesupport" "multi_json"];
@ -2623,10 +2602,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1zy84lxrnnslray9rmfgb7ri295wda3cxx3xryz4lr5hd8r5p24w";
+      sha256 = "17y6smk7shplblgic4jvi5njhd0x91n1xrvds3l6cjsjfs2d7lhg";
      type = "gem";
    };
-    version = "1.5.0";
+    version = "1.6.1";
  };
  grape-swagger-entity = {
    dependencies = ["grape-entity" "grape-swagger"];
@ -3292,10 +3271,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0wnz60wh2yb7s5g7an64cw2brl9vvw960xnq4gs3q6drlgmbjl8g";
+      sha256 = "0hqffqr2krk6gcjapriwwmdrjz56dczshxafnwrkipyxi51vwgvh";
      type = "gem";
    };
-    version = "1.3.13";
+    version = "1.4.2";
  };
  letter_opener = {
    dependencies = ["launchy"];
@ -3410,10 +3389,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0nq23yca06rq8qxxymh4nfbx484k2yll54y780b4ilyvmcipyh7c";
+      sha256 = "1p744kjpb5zk2ihklbykzii77alycjc04vpnm2ch2f3cp65imlj3";
      type = "gem";
    };
-    version = "2.21.0";
+    version = "2.21.3";
  };
  lookbook = {
    dependencies = ["activemodel" "css_parser" "htmlbeautifier" "htmlentities" "marcel" "railties" "redcarpet" "rouge" "view_component" "yard" "zeitwerk"];
@ -3598,10 +3577,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1af4yarhbbx62f7qsmgg5fynrik0s36wjy3difkawy536xg343mp";
+      sha256 = "0z7f38iq37h376n9xbl4gajdrnwzq284c9v1py4imw3gri2d5cj6";
      type = "gem";
    };
-    version = "2.8.1";
+    version = "2.8.2";
  };
  minitest = {
    groups = ["development" "test"];
@ -3729,25 +3708,25 @@ src:
  };
  mustermann = {
    dependencies = ["ruby2_keywords"];
-    groups = ["default"];
+    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ccm54qgshr1lq3pr1dfh7gphkilc19dp63rw6fcx7460pjwy88a";
+      sha256 = "0rwbq20s2gdh8dljjsgj5s6wqqfmnbclhvv2c2608brv7jm6jdbd";
      type = "gem";
    };
-    version = "1.1.1";
+    version = "3.0.0";
  };
  mustermann-grape = {
    dependencies = ["mustermann"];
-    groups = ["default"];
+    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0djlbi7nh161a5mwjdm1ya4hc6lyzc493ah48gn37gk6vyri5kh0";
+      sha256 = "1zpmc099rcpxmlfxb71zd6l7f9fcsg1fhi6627r03y1qlgb0jlvg";
      type = "gem";
    };
-    version = "1.0.1";
+    version = "1.0.2";
  };
  nap = {
    groups = ["default" "development"];
@ -3780,6 +3759,17 @@ src:
    };
    version = "0.3.0";
  };
+  net-http = {
+    dependencies = ["net-protocol" "uri"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "11mymfxpsgpwr1qbv8vwj8av9kksqj0632p9s3x35bzrnq4y393m";
+      type = "gem";
+    };
+    version = "0.1.1";
+  };
  net-http-persistent = {
    dependencies = ["connection_pool"];
    groups = ["default"];
@ -3807,10 +3797,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ycw0qsw3hap8svakl0i30jkj0ffd4lpyrn17a1j0w8mz5ainmsj";
+      sha256 = "0xqcffn3c1564c4fizp10dzw2v5g2pabdzrcn25hq05bqhsckbar";
      type = "gem";
    };
-    version = "0.17.1";
+    version = "0.18.0";
  };
  net-ntp = {
    groups = ["default"];
@ -3912,10 +3902,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0fnw0z8zl8b5k35g9m5hhc1g4s6ajzjinhyxnqjrx7l7p07fw71v";
+      sha256 = "1mr2ibfk874ncv0qbdkynay738w2mfinlkhnbd5lyk5yiw5q1p10";
      type = "gem";
    };
-    version = "1.14.3";
+    version = "1.15.2";
  };
  notiffany = {
    dependencies = ["nenv" "shellany"];
@ -4175,6 +4165,17 @@ src:
    };
    version = "2.1.0";
  };
+  omniauth-shibboleth-redux = {
+    dependencies = ["omniauth"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1qgzp0xaka6vqpx69mw6nbqaqmyqrawi11cyak4gq19l23ym7cz9";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
  omniauth-twitter = {
    dependencies = ["omniauth-oauth" "rack"];
    groups = ["default"];
@ -4344,15 +4345,15 @@ src:
    version = "1.22.1";
  };
  parser = {
-    dependencies = ["ast"];
+    dependencies = ["ast" "racc"];
    groups = ["coverage" "default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0zk8mdyr0322r11d63rcp5jhz4lakxilhvyvdv0ql5dw4lb83623";
+      sha256 = "1swigds85jddb5gshll1g8lkmbcgbcp9bi1d4nigwvxki8smys0h";
      type = "gem";
    };
-    version = "3.2.0.0";
+    version = "3.2.2.3";
  };
  parslet = {
    groups = ["default" "development" "test"];
@ -4402,10 +4403,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1slcbzzqdv6104l5h8ql6kj43zmnm16g2dav8bc8dasfpwmrg1k0";
+      sha256 = "0cs8c0f903phs3yjjbrhlyaipvmvm95xids06a761hf0s6lj0j5h";
      type = "gem";
    };
-    version = "2.2.1";
+    version = "4.2.1";
  };
  plist = {
    groups = ["default"];
@ -4477,10 +4478,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0h4w0947zwwg6kbdnvg4vbmrsc8yf5ijb37sg758apks44imym28";
+      sha256 = "14m09ysq0l6kih9pdy1mmdabdyjk09hvx4rzqh6phgb34s1w4pfp";
      type = "gem";
    };
-    version = "0.23.1";
+    version = "0.25.0";
  };
  pry = {
    dependencies = ["coderay" "method_source"];
@ -4542,21 +4543,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0qzq0c791kacv68hgk9zqsd1p7zx1y1rr9j10rn9yphibb8jj436";
+      sha256 = "1v7fmv0n4bhdcwh60dgza44iqai5pg34f5pzm4vh4i5fwx7mpqxh";
      type = "gem";
    };
-    version = "5.6.5";
-  };
-  puma_worker_killer = {
-    dependencies = ["get_process_mem" "puma"];
-    groups = ["puma"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0jk1bhmx5px8y1ip4ky80cq5cwdaybdg4y55shd2vsdmjv938mcw";
-      type = "gem";
-    };
-    version = "0.3.1";
+    version = "6.3.0";
  };
  pyu-ruby-sasl = {
    groups = ["default"];
@ -4797,10 +4787,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1zx8v677r2gs050z4cdiflp14kp6nx5z285ynj2ach0w0z7jfm23";
+      sha256 = "09kszvsa9av8yb8pm9nz6p5jgshin3cqvknlvd1m927qfvdpalk3";
      type = "gem";
    };
-    version = "0.9.75";
+    version = "0.9.78";
  };
  rbtrace = {
    dependencies = ["ffi" "msgpack" "optimist"];
@ -5068,10 +5058,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "046xwhfhi2krmbaqmg9vshf01vzld8smczx6dwppinv61ndc2vqg";
+      sha256 = "0pym2zjwl6dwdfvbn7rbvmds32r70jx9qddhvvi6pqy6987ack1v";
      type = "gem";
    };
-    version = "4.1.0";
+    version = "4.1.2";
  };
  rqrcode = {
    dependencies = ["chunky_png"];
@ -5363,10 +5353,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1706dyk5jdma75bnl9rhmx8vgzjw12ixnj3y32inmpcgzgsvs76k";
+      sha256 = "18vnbzin5ypxrgcs9lllg7x311b69dyrdw2w1pwz84438hmxm79s";
      type = "gem";
    };
-    version = "1.13.0";
+    version = "1.15.0";
  };
  ruby-statistics = {
    groups = ["default" "test"];
@ -6022,6 +6012,16 @@ src:
    };
    version = "1.2.0";
  };
+  table_print = {
+    groups = ["default" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1jxmd1yg3h0g27wzfpvq1jnkkf7frwb5wy9m4f47nf4k3wl68rj3";
+      type = "gem";
+    };
+    version = "1.5.7";
+  };
  tanuki_emoji = {
    groups = ["default"];
    platforms = [];
@ -6463,6 +6463,16 @@ src:
    };
    version = "0.6.7";
  };
+  uri = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1vigw7nfszfqgikr6n574k9bfh0rvs74z8xq46rz2zsm8249l8cc";
+      type = "gem";
+    };
+    version = "0.12.1";
+  };
  uri_template = {
    groups = ["default"];
    platforms = [];
@ -6543,10 +6553,10 @@ src:
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1bwvpkv1iqa8g5cmmllx8fx0nprapzrzfvf1m15rr3wxw5hrbdn8";
+      sha256 = "08jc9k4qqazbf5frhdril5084adm90rs1lqbnqq3yfdm2dgaiyhx";
      type = "gem";
    };
-    version = "2.82.0";
+    version = "3.2.0";
  };
  virtus = {
    dependencies = ["axiom-types" "coercible" "descendants_tracker"];
--- a/pkgs/applications/version-management/gql/default.nix
+++ b/pkgs/applications/version-management/gql/default.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "gql";
-  version = "0.1.0";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "AmrDeveloper";
    repo = "GQL";
    rev = version;
-    hash = "sha256-UEfluWgoSuPnHGsoPcVLuAqmJsqCJL2B29UsQeZctuE=";
+    hash = "sha256-3x4ExSEs22wFP4Z5cY9+F8yyVc5voHAT1odnyzkSlhc=";
  };

-  cargoHash = "sha256-y49pnx1OkUu7yKnwTGpPGv3ULUPpj/Z4bOPVIO3nS0E=";
+  cargoHash = "sha256-Xmf64yRyWrqYO/ydxEblChVPKnR47Uc55FVAY3DU7no=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/video/flowblade/default.nix
+++ b/pkgs/applications/video/flowblade/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "flowblade";
-  version = "2.8.0.3";
+  version = "2.10.0.2";

  src = fetchFromGitHub {
    owner = "jliljebl";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-/EkI3qiceB5eKTVQnpG+z4e6yaE9hDtn6I+iN/J+h/g=";
+    sha256 = "sha256-lXMVtWsTyMaGIpEglHvnUgDSaFlnWtB3lSyg6ljNIdQ=";
  };

  buildInputs = [
@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
    makeWrapper $out/flowblade/flowblade $out/bin/flowblade \
      --set FREI0R_PATH ${frei0r}/lib/frei0r-1 \
      --set LADSPA_PATH ${ladspaPlugins}/lib/ladspa \
+      --prefix PATH : "${lib.makeBinPath [ ffmpeg ]}" \
      ''${gappsWrapperArgs[@]}

    runHook postInstall
--- a/pkgs/applications/video/kodi/addons/inputstreamhelper/default.nix
+++ b/pkgs/applications/video/kodi/addons/inputstreamhelper/default.nix
@ -2,11 +2,11 @@
 buildKodiAddon rec {
  pname = "inputstreamhelper";
  namespace = "script.module.inputstreamhelper";
-  version = "0.5.10+matrix.1";
+  version = "0.6.1+matrix.1";

  src = fetchzip {
    url = "https://mirrors.kodi.tv/addons/nexus/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-FcOktwtOT7kDM+3y9qPDk3xU1qVeCduyAdUzebtJzv4=";
+    sha256 = "sha256-v5fRikswmP+KVbxYibD0NbCK8leUnFbya5EtF1FmS0I=";
  };

  passthru = {
--- a/pkgs/applications/video/kodi/addons/libretro-2048/default.nix
+++ b/pkgs/applications/video/kodi/addons/libretro-2048/default.nix
@ -0,0 +1,31 @@
+{ lib, buildKodiBinaryAddon, fetchFromGitHub, libretro, twenty-fortyeight }:
+
+buildKodiBinaryAddon rec {
+  pname = "libretro-2048";
+  namespace = "game.libretro.2048";
+  version = "1.0.0.136";
+
+  src = fetchFromGitHub {
+    owner = "kodi-game";
+    repo = "game.libretro.2048";
+    rev = "${version}-Nexus";
+    hash = "sha256-cIo56ZGansBlAj6CFw51UOYJUivN9n1qhVTWAX9c5Tc=";
+  };
+
+  extraCMakeFlags = [
+    "-D2048_LIB=${twenty-fortyeight}/lib/retroarch/cores/2048_libretro.so"
+  ];
+
+  extraBuildInputs = [ twenty-fortyeight ];
+  propagatedBuildInputs = [
+    libretro
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/kodi-game/game.libretro.2048";
+    description = "2048 GameClient for Kodi";
+    platforms = platforms.all;
+    license = licenses.publicDomain;
+    maintainers = with maintainers; teams.kodi.members ++ [ kazenyuk ];
+  };
+}
--- a/pkgs/applications/video/kodi/addons/libretro-fuse/default.nix
+++ b/pkgs/applications/video/kodi/addons/libretro-fuse/default.nix
@ -0,0 +1,31 @@
+{ lib, buildKodiBinaryAddon, fetchFromGitHub, libretro, fuse }:
+
+buildKodiBinaryAddon rec {
+  pname = "libretro-fuse";
+  namespace = "game.libretro.fuse";
+  version = "1.6.0.34";
+
+  src = fetchFromGitHub {
+    owner = "kodi-game";
+    repo = "game.libretro.fuse";
+    rev = "${version}-Nexus";
+    hash = "sha256-MimwEV7YD6pMshxqbKTVbLDsPmMbqSy4HPnxwmKswpc=";
+  };
+
+  extraCMakeFlags = [
+    "-DFUSE_LIB=${fuse}/lib/retroarch/cores/fuse_libretro.so"
+  ];
+
+  extraBuildInputs = [ fuse ];
+  propagatedBuildInputs = [
+    libretro
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/kodi-game/game.libretro.fuse";
+    description = "Sinclair - ZX Spectrum (Fuse) GameClient for Kodi";
+    platforms = platforms.all;
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; teams.kodi.members ++ [ kazenyuk ];
+  };
+}
--- a/pkgs/applications/video/kodi/addons/vfs-rar/default.nix
+++ b/pkgs/applications/video/kodi/addons/vfs-rar/default.nix
@ -0,0 +1,22 @@
+{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, tinyxml }:
+buildKodiBinaryAddon rec {
+  pname = namespace;
+  namespace = "vfs.rar";
+  version = "20.1.0";
+
+  src = fetchFromGitHub {
+    owner = "xbmc";
+    repo = namespace;
+    rev = "${version}-${rel}";
+    sha256 = "sha256-8IEYA2gNchCa7O9kzrCbO5DxYWJqPzQN3SJIr9zCWc8=";
+  };
+
+  extraBuildInputs = [ tinyxml ];
+
+  meta = with lib; {
+    description = "RAR archive Virtual Filesystem add-on for Kodi";
+    license = licenses.gpl2Plus;
+    platforms = platforms.all;
+    maintainers = teams.kodi.members;
+  };
+}
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@ -56,6 +56,15 @@ stdenv.mkDerivation rec {
    sha256 = "t+kfFS5c8w+c9wxNh59nceFesfdMy8qvHlUqDbZAxkk=";
  };

+  patches = [
+    # Fix compatiblity with fmt 10.0. Remove with the next release
+    (fetchpatch {
+      url = "https://gitlab.com/mbunkus/mkvtoolnix/-/commit/24716ce95bf5b10d685611de23489045cf2ca5cc.patch";
+      hash = "sha256-vOm3FmXL3mHzs3RHCJ9gbTLSe3xhSXo8IfgA+s0cFjY=";
+      includes = [ "src/common/codec.h" ];
+    })
+  ];
+
  nativeBuildInputs = [
    autoreconfHook
    docbook_xsl
--- a/pkgs/applications/video/mpv/wrapper.nix
+++ b/pkgs/applications/video/mpv/wrapper.nix
@ -1,8 +1,11 @@
 # Arguments that this derivation gets when it is created with `callPackage`
 { stdenv
+, buildEnv
 , lib
 , makeWrapper
+, mpvScripts
 , symlinkJoin
+, writeTextDir
 , yt-dlp
 }:

@ -71,6 +74,20 @@ let

      passthru.unwrapped = mpv;

+      passthru.tests.mpv-scripts-should-not-collide = buildEnv {
+        name = "mpv-scripts-env";
+        paths = lib.pipe mpvScripts [
+          # filters "override" "overrideDerivation" "recurseForDerivations"
+          (lib.filterAttrs (key: script: lib.isDerivation script))
+          # replaces unfree and meta.broken scripts with decent placeholders
+          (lib.mapAttrsToList (key: script:
+            if (builtins.tryEval script.outPath).success
+            then script
+            else writeTextDir "share/mpv/scripts/${script.scriptName}" "placeholder of ${script.name}"
+          ))
+        ];
+      };
+
      postBuild = ''
        # wrapProgram can't operate on symlinks
        rm "$out/bin/mpv"
--- a/pkgs/build-support/node/fetch-yarn-deps/common.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/common.js
@ -0,0 +1,17 @@
+const path = require('path')
+
+// This has to match the logic in pkgs/development/tools/yarn2nix-moretea/yarn2nix/lib/urlToName.js
+// so that fixup_yarn_lock produces the same paths
+const urlToName = url => {
+	const isCodeloadGitTarballUrl = url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')
+
+	if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
+		return path.basename(url)
+	} else {
+		return url
+			.replace(/https:\/\/(.)*(.com)\//g, '') // prevents having long directory names
+			.replace(/[@/%:-]/g, '_') // replace @ and : and - and % characters with underscore
+	}
+}
+
+module.exports = { urlToName };
--- a/pkgs/build-support/node/fetch-yarn-deps/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/default.nix
@ -21,8 +21,8 @@ in {
      mkdir libexec
      tar --strip-components=1 -xf ${yarnpkg-lockfile-tar} package/index.js
      mv index.js libexec/yarnpkg-lockfile.js
-      cp ${./index.js} libexec/index.js
-      patchShebangs libexec/index.js
+      cp ${./.}/*.js libexec/
+      patchShebangs libexec

      runHook postBuild
    '';
@ -34,6 +34,7 @@ in {
      cp -r libexec $out
      makeWrapper $out/libexec/index.js $out/bin/prefetch-yarn-deps \
        --prefix PATH : ${lib.makeBinPath [ coreutils nix-prefetch-git nix ]}
+      makeWrapper $out/libexec/fixup.js $out/bin/fixup-yarn-lock

      runHook postInstall
    '';
--- a/pkgs/build-support/node/fetch-yarn-deps/fixup.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/fixup.js
@ -0,0 +1,74 @@
+#!/usr/bin/env node
+'use strict'
+
+const fs = require('fs')
+const process = require('process')
+const lockfile = require('./yarnpkg-lockfile.js')
+const { urlToName } = require('./common.js')
+
+const fixupYarnLock = async (lockContents, verbose) => {
+	const lockData = lockfile.parse(lockContents)
+
+	const fixedData = Object.fromEntries(
+		Object.entries(lockData.object)
+		.map(([dep, pkg]) => {
+			const [ url, hash ] = pkg.resolved.split("#", 2)
+
+			if (hash || url.startsWith("https://codeload.github.com")) {
+				if (verbose) console.log(`Removing integrity for git dependency ${dep}`)
+				delete pkg.integrity
+			}
+
+			if (verbose) console.log(`Rewriting URL ${url} for dependency ${dep}`)
+			pkg.resolved = urlToName(url)
+
+			return [dep, pkg]
+		})
+	)
+
+	if (verbose) console.log('Done')
+
+	return fixedData
+}
+
+const showUsage = async () => {
+	process.stderr.write(`
+syntax: fixup-yarn-lock [path to yarn.lock] [options]
+
+Options:
+  -h --help         Show this help
+  -v --verbose      Verbose output
+`)
+	process.exit(1)
+}
+
+const main = async () => {
+	const args = process.argv.slice(2)
+	let next, lockFile, verbose
+	while (next = args.shift()) {
+		if (next == '--verbose' || next == '-v') {
+			verbose = true
+		} else if (next == '--help' || next == '-h') {
+			showUsage()
+		} else if (!lockFile) {
+			lockFile = next
+		} else {
+			showUsage()
+		}
+	}
+	let lockContents
+	try {
+		lockContents = await fs.promises.readFile(lockFile || 'yarn.lock', 'utf-8')
+	} catch {
+		showUsage()
+	}
+
+	const fixedData = await fixupYarnLock(lockContents, verbose)
+	await fs.promises.writeFile(lockFile || 'yarn.lock', lockfile.stringify(fixedData))
+}
+
+main()
+	.catch(e => {
+		console.error(e)
+		process.exit(1)
+	})
--- a/pkgs/build-support/node/fetch-yarn-deps/index.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/index.js
@ -10,6 +10,7 @@ const path = require('path')
 const lockfile = require('./yarnpkg-lockfile.js')
 const { promisify } = require('util')
 const url = require('url')
+const { urlToName } = require('./common.js')

 const execFile = promisify(child_process.execFile)

@ -19,20 +20,6 @@ const exec = async (...args) => {
 	return res
 }

-// This has to match the logic in pkgs/development/tools/yarn2nix-moretea/yarn2nix/lib/urlToName.js
-// so that fixup_yarn_lock produces the same paths
-const urlToName = url => {
-	const isCodeloadGitTarballUrl = url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')
-
-	if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
-		return path.basename(url)
-	} else {
-		return url
-			.replace(/https:\/\/(.)*(.com)\//g, '') // prevents having long directory names
-			.replace(/[@/%:-]/g, '_') // replace @ and : and - and % characters with underscore
-	}
-}
-
 const downloadFileHttps = (fileName, url, expectedHash, hashType = 'sha1') => {
 	return new Promise((resolve, reject) => {
 		https.get(url, (res) => {
--- a/pkgs/data/misc/spdx-license-list-data/default.nix
+++ b/pkgs/data/misc/spdx-license-list-data/default.nix
@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "spdx-license-list-data";
-  version = "3.20";
+  version = "3.21";

  src = fetchFromGitHub {
    owner = "spdx";
    repo = "license-list-data";
    rev = "v${version}";
-    hash = "sha256-qMVUP1EpeeO+i5RfnAt/Idz+pR9dVyCT4Ss9lEJgj6k=";
+    hash = "sha256-dv8aC4giD0JqaYN19eCHzEbmwXhqX+ZrKrwit9tzf5Y=";
  };

  # List of file formats to package.
--- a/pkgs/desktops/cinnamon/cinnamon-common/default.nix
+++ b/pkgs/desktops/cinnamon/cinnamon-common/default.nix
@ -72,13 +72,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "cinnamon-common";
-  version = "5.8.2";
+  version = "5.8.3";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "cinnamon";
    rev = version;
-    hash = "sha256-KY5ctByMYKxigiZ0X/blaHJuyiAUNB6B2gpGtC/k100=";
+    hash = "sha256-PvU5lcoIDguWiLdI+uIiJHqS1ae436Xc7TfRVytR02k=";
  };

  patches = [
--- a/pkgs/desktops/cinnamon/folder-color-switcher/default.nix
+++ b/pkgs/desktops/cinnamon/folder-color-switcher/default.nix
@ -7,14 +7,14 @@

 stdenvNoCC.mkDerivation rec {
  pname = "folder-color-switcher";
-  version = "1.5.7";
+  version = "1.5.8";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    # They don't really do tags, this is just a named commit.
-    rev = "03311d62a62e2cd7d0592b241c287091161ec6b6";
-    sha256 = "sha256-HQv9vSpRSBjqbncGFv+O5XQtRJ+4Cq0aWZHoj5BhKYE=";
+    rev = "f167627cffaf8b34e27b0515153b669b980fd62e";
+    sha256 = "sha256-u8Lv0OTxKgjIp1q5WR0NXULhnwFfEDYGRlBpFMVHCBY=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/cinnamon/mint-themes/default.nix
+++ b/pkgs/desktops/cinnamon/mint-themes/default.nix
@ -8,13 +8,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "mint-themes";
-  version = "2.1.2";
+  version = "2.1.3";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    hash = "sha256-Y+KmSKuREn2E3FySsScjL+oSpSFnyEqhoXQfU++86JY=";
+    hash = "sha256-ouqhksy3999pi8v4f64W4X/h655ZVi8dR22g4LlYwMI=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/cinnamon/nemo/default.nix
+++ b/pkgs/desktops/cinnamon/nemo/default.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "nemo";
-  version = "5.8.2";
+  version = "5.8.3";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Be67TOA1gLwSYx8y2iyfvY0QCpWOFutpXMDaPiTRQGg=";
+    sha256 = "sha256-/GwtTklOkhCkbBMQLl4dKUnlZwN6FX2kqxN7cJVaVwE=";
  };

  patches = [
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/applications/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/applications/default.nix
@ -7,6 +7,7 @@
 , pkg-config
 , vala
 , libgee
+, libhandy
 , granite
 , gtk3
 , switchboard
@ -15,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "switchboard-plug-applications";
-  version = "6.0.1";
+  version = "7.0.0";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "18izmzhqp6x5ivha9yl8gyz9adyrsylw7w5p0cwm1bndgqbi7yh5";
+    sha256 = "sha256-M9JMrxhMiDC/qrrnPaBm6Kf3CAkxrhGWwJF8jVm2G5c=";
  };

  nativeBuildInputs = [
@ -36,6 +37,7 @@ stdenv.mkDerivation rec {
    granite
    gtk3
    libgee
+    libhandy
    switchboard
  ];

--- a/pkgs/desktops/pantheon/desktop/gala/default.nix
+++ b/pkgs/desktops/pantheon/desktop/gala/default.nix
@ -21,17 +21,18 @@
 , gnome-settings-daemon
 , wrapGAppsHook
 , gexiv2
+, systemd
 }:

 stdenv.mkDerivation rec {
  pname = "gala";
-  version = "7.0.3";
+  version = "7.1.0";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "sha256-RLKPYDWVqT2WfjLPXRFPCNNvcW+fJ0OUKjSLLgPBqdw=";
+    sha256 = "sha256-x0EIah/iTluJk7P3k0g23cQldx++W58FbjnHNlF31AQ=";
  };

  patches = [
@ -63,12 +64,7 @@ stdenv.mkDerivation rec {
    libgee
    mesa # for libEGL
    mutter
-  ];
-
-  mesonFlags = [
-    # TODO: enable this and remove --builtin flag from session-settings
-    # https://github.com/NixOS/nixpkgs/pull/140429
-    "-Dsystemd=false"
+    systemd
  ];

  postPatch = ''
--- a/pkgs/desktops/pantheon/services/xdg-desktop-portal-pantheon/default.nix
+++ b/pkgs/desktops/pantheon/services/xdg-desktop-portal-pantheon/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "xdg-desktop-portal-pantheon";
-  version = "7.0.0";
+  version = "7.1.0";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "portals";
    rev = version;
-    sha256 = "sha256-Rfo9Z5rCJgk36Db3ce8dYBJswy8owjvRMrJVB/RfwyI=";
+    sha256 = "sha256-uy/etQiJuaROw8bWg2PUdptNr4I8uqqUZ8BWK6D2bog=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/clasp/default.nix
+++ b/pkgs/development/compilers/clasp/default.nix
@ -55,7 +55,7 @@ in llvmPackages_15.stdenv.mkDerivation {
    sbcl
    git
    pkg-config
-    fmt
+    fmt_9
    gmpxx
    libelf
    boost
--- a/pkgs/development/compilers/halide/default.nix
+++ b/pkgs/development/compilers/halide/default.nix
@ -3,9 +3,11 @@
 , lib
 , fetchFromGitHub
 , cmake
+, libffi
 , libpng
 , libjpeg
 , mesa
+, libGL
 , eigen
 , openblas
 , blas
@ -43,11 +45,14 @@ stdenv.mkDerivation rec {
    llvmPackages.lld
    llvmPackages.openmp
    llvmPackages.libclang
+    libffi
    libpng
    libjpeg
-    mesa
    eigen
    openblas
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    mesa
+    libGL
  ];

  nativeBuildInputs = [ cmake ];
@ -57,6 +62,6 @@ stdenv.mkDerivation rec {
    homepage = "https://halide-lang.org";
    license = licenses.mit;
    platforms = platforms.all;
-    maintainers = with maintainers; [ ck3d atila ];
+    maintainers = with maintainers; [ ck3d atila twesterhout ];
  };
 }
--- a/pkgs/development/compilers/ispc/default.nix
+++ b/pkgs/development/compilers/ispc/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch
-, cmake, which, m4, python3, bison, flex, llvmPackages, ncurses
+, cmake, which, m4, python3, bison, flex, llvmPackages, ncurses, xcode

  # the default test target is sse4, but that is not supported by all Hydra agents
 , testedTargets ? if stdenv.isAarch64 || stdenv.isAarch32 then [ "neon-i32x4" ] else [ "sse2-i32x4" ]
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-WBAVgjQjW4x9JGx6xotPoTVOePsPjBJEyBYA7TCTBvc=";
  };

-  nativeBuildInputs = [ cmake which m4 bison flex python3 llvmPackages.libllvm.dev ];
+  nativeBuildInputs = [ cmake which m4 bison flex python3 llvmPackages.libllvm.dev ] ++ lib.lists.optionals stdenv.isDarwin [ xcode ];
  buildInputs = with llvmPackages; [
    libllvm libclang openmp ncurses
  ];
@ -30,8 +30,7 @@ stdenv.mkDerivation rec {

  inherit testedTargets;

-  # needs 'transcendentals' executable, which is only on linux
-  doCheck = stdenv.isLinux;
+  doCheck = true;

  # the compiler enforces -Werror, and -fno-strict-overflow makes it mad.
  # hilariously this is something of a double negative: 'disable' the
@ -60,6 +59,8 @@ stdenv.mkDerivation rec {
    "-DISPC_INCLUDE_UTILS=OFF"
    ("-DARM_ENABLED=" + (if stdenv.isAarch64 || stdenv.isAarch32 then "TRUE" else "FALSE"))
    ("-DX86_ENABLED=" + (if stdenv.isx86_64 || stdenv.isx86_32 then "TRUE" else "FALSE"))
+  ] ++ lib.lists.optionals stdenv.isDarwin [
+    "-DISPC_MACOS_SDK_PATH=${xcode}/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk"
  ];

  meta = with lib; {
--- a/pkgs/development/compilers/odin/default.nix
+++ b/pkgs/development/compilers/odin/default.nix
@ -1,31 +1,43 @@
 { lib
 , fetchFromGitHub
-, llvmPackages
+, llvmPackages_13
 , makeWrapper
 , libiconv
+, MacOSX-SDK
+, which
 }:

 let
+  llvmPackages = llvmPackages_13;
  inherit (llvmPackages) stdenv;
 in stdenv.mkDerivation rec {
  pname = "odin";
-  version = "0.13.0";
+  version = "dev-2023-05";

  src = fetchFromGitHub {
    owner = "odin-lang";
    repo = "Odin";
-    rev = "v${version}";
-    sha256 = "ke2HPxVtF/Lh74Tv6XbpM9iLBuXLdH1+IE78MAacfYY=";
+    rev = version;
+    sha256 = "sha256-qEewo2h4dpivJ7D4RxxBZbtrsiMJ7AgqJcucmanbgxY=";
  };

  nativeBuildInputs = [
-    makeWrapper
+    makeWrapper which
  ];

  buildInputs = lib.optional stdenv.isDarwin libiconv;

-  postPatch = ''
-    sed -i 's/^GIT_SHA=.*$/GIT_SHA=/' Makefile
+  LLVM_CONFIG = "${llvmPackages.llvm.dev}/bin/llvm-config";
+
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    sed -i src/main.cpp \
+      -e 's|-syslibroot /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk|-syslibroot ${MacOSX-SDK}|'
+  '' + ''
+    sed -i build_odin.sh \
+      -e 's/^GIT_SHA=.*$/GIT_SHA=/' \
+      -e 's/LLVM-C/LLVM/' \
+      -e 's/framework System/lSystem/'
+    patchShebangs build_odin.sh
  '';

  dontConfigure = true;
@ -37,21 +49,26 @@ in stdenv.mkDerivation rec {
  installPhase = ''
    mkdir -p $out/bin
    cp odin $out/bin/odin
-    cp -r core $out/bin/core

-    wrapProgram $out/bin/odin --prefix PATH : ${lib.makeBinPath (with llvmPackages; [
-      bintools
-      llvm
-      clang
-      lld
-    ])}
+    mkdir -p $out/share
+    cp -r core $out/share/core
+    cp -r vendor $out/share/vendor
+
+    wrapProgram $out/bin/odin \
+      --prefix PATH : ${lib.makeBinPath (with llvmPackages; [
+        bintools
+        llvm
+        clang
+        lld
+      ])} \
+      --set-default ODIN_ROOT $out/share
  '';

  meta = with lib; {
    description = "A fast, concise, readable, pragmatic and open sourced programming language";
    homepage = "https://odin-lang.org/";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [ luc65r ];
-    platforms = platforms.x86_64;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ luc65r astavie ];
+    platforms = platforms.x86_64 ++ [ "aarch64-darwin" ];
  };
 }
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -1696,6 +1696,8 @@ self: super: {
        sha256 = "sha256-J8N4+HUQ6vlJBCwCyxv8Fv5HSbtiim64Qh1n9CaRe1o=";
        stripLen = 1;
      })
+      # https://github.com/hercules-ci/hercules-ci-agent/pull/526
+      ./patches/hercules-ci-agent-cachix-1.6.patch
    ])
    (self.generateOptparseApplicativeCompletions [ "hercules-ci-agent" ])
  ];
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@ -1047,29 +1047,29 @@ self: super: builtins.intersectAttrs super {
  domaindriven-core = dontCheck super.domaindriven-core;

  cachix-api = overrideCabal (drv: {
-    version = "1.5";
+    version = "1.6";
    src = pkgs.fetchFromGitHub {
      owner = "cachix";
      repo = "cachix";
-      rev = "v1.5";
-      sha256 = "sha256-bt8FFtDSJpBckx3dIjW5Xdvj8aVCm78R3VTpjK5F3Ac=";
+      rev = "v1.6";
+      sha256 = "sha256-54ujAZYNigAn1oJAfupUtZHa0WRQbCQGLEfLmkw8iFc=";
    };
    postUnpack = "sourceRoot=$sourceRoot/cachix-api";
    postPatch = ''
-      sed -i 's/1.4.2/1.5/' cachix-api.cabal
+      sed -i 's/1.5/1.6/' cachix-api.cabal
    '';
  }) super.cachix-api;
  cachix = overrideCabal (drv: {
-    version = "1.5";
+    version = "1.6";
    src = pkgs.fetchFromGitHub {
      owner = "cachix";
      repo = "cachix";
-      rev = "v1.5";
-      sha256 = "sha256-bt8FFtDSJpBckx3dIjW5Xdvj8aVCm78R3VTpjK5F3Ac=";
+      rev = "v1.6";
+      sha256 = "sha256-54ujAZYNigAn1oJAfupUtZHa0WRQbCQGLEfLmkw8iFc=";
    };
    postUnpack = "sourceRoot=$sourceRoot/cachix";
    postPatch = ''
-      sed -i 's/1.4.2/1.5/' cachix.cabal
+      sed -i 's/1.5/1.6/' cachix.cabal
    '';
  }) (lib.pipe
        (super.cachix.override {
@ -1080,8 +1080,7 @@ self: super: builtins.intersectAttrs super {
        [
         (addBuildTool self.hercules-ci-cnix-store.nixPackage)
         (addBuildTool pkgs.pkg-config)
-         (addBuildDepend self.inline-c-cpp)
-         (addBuildDepend self.hercules-ci-cnix-store)
+         (addBuildDepend self.ascii-progress)
        ]
  );

--- a/pkgs/development/haskell-modules/patches/hercules-ci-agent-cachix-1.6.patch
+++ b/pkgs/development/haskell-modules/patches/hercules-ci-agent-cachix-1.6.patch
@ -0,0 +1,32 @@
+diff --git a/hercules-ci-agent/hercules-ci-agent/Hercules/Agent/Cachix.hs b/hercules-ci-agent/hercules-ci-agent/Hercules/Agent/Cachix.hs
+index 849d9bc..972bc90 100644
+--- hercules-ci-agent/hercules-ci-agent/Hercules/Agent/Cachix.hs
+++ hercules-ci-agent/hercules-ci-agent/Hercules/Agent/Cachix.hs
+@@ -17,6 +17,7 @@ import Hercules.Agent.Log
+ import Hercules.CNix.Store (StorePath)
+ import Hercules.Error
+ import qualified Hercules.Formats.CachixCache as CachixCache
+import qualified Data.Conduit as Conduit
+ import Protolude
+ 
+ push :: Text -> [StorePath] -> Int -> App ()
+@@ -36,6 +37,9 @@ push cache paths workers = withNamedContext "cache" cache $ do
+         Cachix.Push.PushParams
+           { pushParamsName = Agent.Cachix.pushCacheName pushCache,
+             pushParamsSecret = Agent.Cachix.pushCacheSecret pushCache,
+#if MIN_VERSION_cachix(1,6,0)
+            pushOnClosureAttempt = \_ missing -> return missing,
+#endif
+             pushParamsStore = nixStore,
+             pushParamsClientEnv = clientEnv,
+             pushParamsStrategy = \storePath ->
+@@ -59,6 +63,9 @@ push cache paths workers = withNamedContext "cache" cache $ do
+                       compressionLevel = 2,
+ #else
+                       withXzipCompressor = Cachix.Push.defaultWithXzipCompressor,
+#endif
+#if MIN_VERSION_cachix(1,6,0)
+                      onUncompressedNARStream = \_ _ -> Conduit.awaitForever Conduit.yield,
+ #endif
+                       omitDeriver = False
+                     }
--- a/pkgs/development/interpreters/racket/default.nix
+++ b/pkgs/development/interpreters/racket/default.nix
@ -9,7 +9,6 @@
 , libGL
 , libGLU
 , libjpeg
-, xorg
 , ncurses
 , libpng, libtool, mpfr, openssl, pango, poppler
 , readline, sqlite
@ -25,7 +24,7 @@ let
    fontDirectories = [ freefont_ttf ];
  };

-  libPath = lib.makeLibraryPath [
+  libPath = lib.makeLibraryPath ([
    cairo
    fontconfig
    glib
@ -33,8 +32,6 @@ let
    gtk3
    gsettings-desktop-schemas
    libedit
-    libGL
-    libGLU
    libjpeg
    libpng
    mpfr
@ -44,7 +41,10 @@ let
    poppler
    readline
    sqlite
-  ];
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    libGL
+    libGLU
+  ]);

 in

--- a/Show More
+++ b/Show More