Merge master into staging-next

2023-10-19 18:00:54 +00:00 · 2023-10-19 18:00:54 +00:00 · 0bcaa2f556
commit 0bcaa2f556
parent 25bcfa6c2f 3f84dd89b8
69 changed files with 895 additions and 376 deletions
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@ -101,6 +101,8 @@

 - [ferretdb](https://www.ferretdb.io/), an open-source proxy, converting the MongoDB 6.0+ wire protocol queries to PostgreSQL or SQLite. Available as [services.ferretdb](options.html#opt-services.ferretdb.enable).

+- [MicroBin](https://microbin.eu/), a feature rich, performant and secure text and file sharing web application, a "paste bin". Available as [services.microbin](#opt-services.microbin.enable).
+
 - [NNCP](http://www.nncpgo.org/). Added nncp-daemon and nncp-caller services. Configuration is set with [programs.nncp.settings](#opt-programs.nncp.settings) and the daemons are enabled at [services.nncp](#opt-services.nncp.caller.enable).

 - [tuxedo-rs](https://github.com/AaronErhardt/tuxedo-rs), Rust utilities for interacting with hardware from TUXEDO Computers.
--- a/nixos/lib/systemd-network-units.nix
+++ b/nixos/lib/systemd-network-units.nix
@ -65,6 +65,9 @@ in {
    '' + optionalString (def.vrfConfig != { }) ''
      [VRF]
      ${attrsToSection def.vrfConfig}
+    '' + optionalString (def.wlanConfig != { }) ''
+      [WLAN]
+      ${attrsToSection def.wlanConfig}
    '' + optionalString (def.batmanAdvancedConfig != { }) ''
      [BatmanAdvanced]
      ${attrsToSection def.batmanAdvancedConfig}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1267,6 +1267,7 @@
  ./services/web-apps/mattermost.nix
  ./services/web-apps/mediawiki.nix
  ./services/web-apps/meme-bingo-web.nix
+  ./services/web-apps/microbin.nix
  ./services/web-apps/miniflux.nix
  ./services/web-apps/monica.nix
  ./services/web-apps/moodle.nix
--- a/nixos/modules/services/networking/dae.nix
+++ b/nixos/modules/services/networking/dae.nix
@ -18,6 +18,7 @@ in

      package = mkPackageOptionMD pkgs "dae" { };

+
      assets = mkOption {
        type = with types;(listOf path);
        default = with pkgs; [ v2ray-geoip v2ray-domain-list-community ];
@ -47,7 +48,7 @@ in
          options = {
            enable = mkEnableOption "enable";
            port = mkOption {
-              type = types.int;
+              type = types.port;
              description = ''
                Port to be opened. Consist with field `tproxy_port` in config file.
              '';
@ -70,8 +71,8 @@ in
      };

      configFile = mkOption {
-        type = types.path;
-        default = "/etc/dae/config.dae";
+        type = with types; (nullOr path);
+        default = null;
        example = "/path/to/your/config.dae";
        description = mdDoc ''
          The path of dae config file, end with `.dae`.
@ -79,12 +80,10 @@ in
      };

      config = mkOption {
-        type = types.str;
-        default = ''
-          global{}
-          routing{}
-        '';
+        type = with types; (nullOr str);
+        default = null;
        description = mdDoc ''
+          WARNING: This option will expose store your config unencrypted world-readable in the nix store.
          Config text for dae.

          See <https://github.com/daeuniverse/dae/blob/main/example.dae>.
@ -103,11 +102,6 @@ in
      environment.systemPackages = [ cfg.package ];
      systemd.packages = [ cfg.package ];

-      environment.etc."dae/config.dae" = {
-        mode = "0400";
-        source = pkgs.writeText "config.dae" cfg.config;
-      };
-
      networking = lib.mkIf cfg.openFirewall.enable {
        firewall =
          let portToOpen = cfg.openFirewall.port;
@ -121,20 +115,27 @@ in
      systemd.services.dae =
        let
          daeBin = lib.getExe cfg.package;
-          TxChecksumIpGenericWorkaround = with lib;(getExe pkgs.writeShellApplication {
-            name = "disable-tx-checksum-ip-generic";
-            text = with pkgs; ''
-              iface=$(${iproute2}/bin/ip route | ${lib.getExe gawk} '/default/ {print $5}')
-              ${lib.getExe ethtool} -K "$iface" tx-checksum-ip-generic off
-            '';
-          });
+
+          configPath =
+            if cfg.configFile != null
+            then cfg.configFile else pkgs.writeText "config.dae" cfg.config;
+
+          TxChecksumIpGenericWorkaround = with lib;
+            (getExe pkgs.writeShellApplication {
+              name = "disable-tx-checksum-ip-generic";
+              text = with pkgs; ''
+                iface=$(${iproute2}/bin/ip route | ${lib.getExe gawk} '/default/ {print $5}')
+                ${lib.getExe ethtool} -K "$iface" tx-checksum-ip-generic off
+              '';
+            });
        in
        {
          wantedBy = [ "multi-user.target" ];
          serviceConfig = {
-            ExecStartPre = [ "" "${daeBin} validate -c ${cfg.configFile}" ]
+            LoadCredential = [ "config.dae:${configPath}" ];
+            ExecStartPre = [ "" "${daeBin} validate -c \${CREDENTIALS_DIRECTORY}/config.dae" ]
              ++ (with lib; optional cfg.disableTxChecksumIpGeneric TxChecksumIpGenericWorkaround);
-            ExecStart = [ "" "${daeBin} run --disable-timestamp -c ${cfg.configFile}" ];
+            ExecStart = [ "" "${daeBin} run --disable-timestamp -c \${CREDENTIALS_DIRECTORY}/config.dae" ];
            Environment = "DAE_LOCATION_ASSET=${cfg.assetsPath}";
          };
        };
@ -149,13 +150,21 @@ in
        }

        {
-          assertion = !((config.services.dae.config != "global{}\nrouting{}\n")
-            && (config.services.dae.configFile != "/etc/dae/config.dae"));
+          assertion = !((config.services.dae.config != null)
+            && (config.services.dae.configFile != null));
          message = ''
            Option `config` and `configFile` could not be set
            at the same time.
          '';
        }
+
+        {
+          assertion = !((config.services.dae.config == null)
+            && (config.services.dae.configFile == null));
+          message = ''
+            Either `config` or `configFile` should be set.
+          '';
+        }
      ];
    };
 }
--- a/nixos/modules/services/web-apps/microbin.nix
+++ b/nixos/modules/services/web-apps/microbin.nix
@ -0,0 +1,93 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.microbin;
+in
+{
+  options.services.microbin = {
+    enable = lib.mkEnableOption (lib.mdDoc "MicroBin is a super tiny, feature rich, configurable paste bin web application");
+
+    package = lib.mkPackageOption pkgs "microbin" { };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule { freeformType = with lib.types; attrsOf (oneOf [ bool int str ]); };
+      default = { };
+      example = {
+        MICROBIN_PORT = 8080;
+        MICROBIN_HIDE_LOGO = false;
+      };
+      description = lib.mdDoc ''
+        Additional configuration for MicroBin, see
+        <https://microbin.eu/docs/installation-and-configuration/configuration/>
+        for supported values.
+
+        For secrets use passwordFile option instead.
+      '';
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/microbin";
+      description = lib.mdDoc "Default data folder for MicroBin.";
+    };
+
+    passwordFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = "/run/secrets/microbin.env";
+      description = lib.mdDoc ''
+        Path to file containing environment variables.
+        Useful for passing down secrets.
+        Variables that can be considered secrets are:
+         - MICROBIN_BASIC_AUTH_USERNAME
+         - MICROBIN_BASIC_AUTH_PASSWORD
+         - MICROBIN_ADMIN_USERNAME
+         - MICROBIN_ADMIN_PASSWORD
+         - MICROBIN_UPLOADER_PASSWORD
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.microbin.settings = with lib; {
+      MICROBIN_BIND = mkDefault "0.0.0.0";
+      MICROBIN_DISABLE_TELEMETRY = mkDefault true;
+      MICROBIN_LIST_SERVER = mkDefault false;
+      MICROBIN_PORT = mkDefault "8080";
+    };
+
+    systemd.services.microbin = {
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = lib.mapAttrs (_: v: if lib.isBool v then lib.boolToString v else toString v) cfg.settings;
+      serviceConfig = {
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+        DevicePolicy = "closed";
+        DynamicUser = true;
+        EnvironmentFile = lib.optional (cfg.passwordFile != null) cfg.passwordFile;
+        ExecStart = "${cfg.package}/bin/microbin";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ReadWritePaths = cfg.dataDir;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        StateDirectory = "microbin";
+        SystemCallArchitectures = [ "native" ];
+        SystemCallFilter = [ "@system-service" ];
+        WorkingDirectory = cfg.dataDir;
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ surfaceflinger ];
+}
--- a/nixos/modules/services/web-servers/lighttpd/default.nix
+++ b/nixos/modules/services/web-servers/lighttpd/default.nix
@ -253,6 +253,7 @@ in
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig.ExecStart = "${cfg.package}/sbin/lighttpd -D -f ${configFile}";
+      serviceConfig.ExecReload = "${pkgs.coreutils}/bin/kill -SIGUSR1 $MAINPID";
      # SIGINT => graceful shutdown
      serviceConfig.KillSignal = "SIGINT";
    };
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -159,6 +159,7 @@ let
          "geneve"
          "l2tp"
          "macsec"
+          "wlan"
          "vrf"
          "vcan"
          "vxcan"
@ -468,6 +469,30 @@ let
        (assertMinimum "Table" 0)
      ];

+      sectionWLAN = checkUnitConfig "WLAN" [
+        (assertOnlyFields [
+          "PhysicalDevice"  # systemd supports both strings ("phy0") and indexes (0) here.
+          "Type"
+          "WDS"
+        ])
+        # See https://github.com/systemd/systemd/blob/main/src/basic/linux/nl80211.h#L3382
+        (assertValueOneOf "Type" [
+          "ad-hoc"
+          "station"
+          "ap"
+          "ap-vlan"
+          "wds"
+          "monitor"
+          "mesh-point"
+          "p2p-client"
+          "p2p-go"
+          "p2p-device"
+          "ocb"
+          "nan"
+        ])
+        (assertValueOneOf "WDS" boolValues)
+      ];
+
      sectionBatmanAdvanced = checkUnitConfig "BatmanAdvanced" [
        (assertOnlyFields [
          "GatewayMode"
@ -1779,6 +1804,16 @@ let
      '';
    };

+    wlanConfig = mkOption {
+      default = {};
+      example = { PhysicalDevice = 0; Type = "station"; };
+      type = types.addCheck (types.attrsOf unitOption) check.netdev.sectionWLAN;
+      description = lib.mdDoc ''
+        Each attribute in this set specifies an option in the `[WLAN]` section of the unit.
+        See {manpage}`systemd.netdev(5)` for details.
+      '';
+    };
+
    batmanAdvancedConfig = mkOption {
      default = {};
      example = {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -739,8 +739,8 @@ in {
  spark = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./spark {};
  sqlite3-to-mysql = handleTest ./sqlite3-to-mysql.nix {};
  sslh = handleTest ./sslh.nix {};
-  sssd = handleTestOn ["x86_64-linux"] ./sssd.nix {};
-  sssd-ldap = handleTestOn ["x86_64-linux"] ./sssd-ldap.nix {};
+  sssd = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd.nix {};
+  sssd-ldap = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./sssd-ldap.nix {};
  stalwart-mail = handleTest ./stalwart-mail.nix {};
  stargazer = runTest ./web-servers/stargazer.nix;
  starship = handleTest ./starship.nix {};
--- a/nixos/tests/dae.nix
+++ b/nixos/tests/dae.nix
@ -14,6 +14,10 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
    };
    services.dae = {
      enable = true;
+      config = ''
+        global{}
+        routing{}
+      '';
    };
  };

--- a/nixos/tests/lighttpd.nix
+++ b/nixos/tests/lighttpd.nix
@ -17,5 +17,6 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
    server.wait_for_unit("lighttpd.service")
    res = server.succeed("curl --fail http://localhost/file.txt")
    assert "hello nixos test" in res, f"bad server response: '{res}'"
+    server.succeed("systemctl reload lighttpd")
  '';
 })
--- a/nixos/tests/mysql/common.nix
+++ b/nixos/tests/mysql/common.nix
@ -3,5 +3,8 @@
  mysqlPackages = {
    inherit (pkgs) mysql80;
  };
+  perconaPackages = {
+    inherit (pkgs) percona-server_8_0;
+  };
  mkTestName = pkg: "mariadb_${builtins.replaceStrings ["."] [""] (lib.versions.majorMinor pkg.version)}";
 }
--- a/nixos/tests/mysql/mysql.nix
+++ b/nixos/tests/mysql/mysql.nix
@ -6,7 +6,7 @@
 }:

 let
-  inherit (import ./common.nix { inherit pkgs lib; }) mkTestName mariadbPackages mysqlPackages;
+  inherit (import ./common.nix { inherit pkgs lib; }) mkTestName mariadbPackages mysqlPackages perconaPackages;

  makeTest = import ./../make-test-python.nix;
  # Setup common users
@ -78,9 +78,6 @@ let
            };
          };
        };
-
-      mariadb =        {
-        };
    };

    testScript = ''
@ -147,3 +144,8 @@ in
  // (lib.mapAttrs (_: package: makeMySQLTest {
    inherit package;
  }) mariadbPackages)
+  // (lib.mapAttrs (_: package: makeMySQLTest {
+    inherit package;
+    name = "percona_8_0";
+    hasMroonga = false; useSocketAuth = false;
+  }) perconaPackages)
--- a/pkgs/applications/audio/youtube-music/default.nix
+++ b/pkgs/applications/audio/youtube-music/default.nix
@ -1,44 +1,87 @@
-{ lib, fetchurl, appimageTools, makeWrapper }:
+{ lib
+, fetchFromGitHub
+, buildNpmPackage
+, makeWrapper
+, electron_25
+, python3
+, copyDesktopItems
+, makeDesktopItem
+}:

 let
  pname = "youtube-music";
-  version = "1.20.0";
+  version = "2.1.0";

-  src = fetchurl {
-    url = "https://github.com/th-ch/youtube-music/releases/download/v${version}/YouTube-Music-${version}.AppImage";
-    hash = "sha256-eTPWLD9KUs2ZsLbYRkknnx5uDyrNSbFHPyv6gU+wL/c=";
+  src = fetchFromGitHub {
+    owner = "th-ch";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-aYEEUv+dybzcH0aNJlZ19XF++8cswFunrU0H+ZaKm4Y=";
  };

-  appimageContents = appimageTools.extract { inherit pname version src; };
+  electron = electron_25;
+
 in
-(appimageTools.wrapType2 rec {
+buildNpmPackage rec {
  inherit pname version src;
-  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs)
-    ++ [ pkgs.libappindicator ];

-  extraInstallCommands = ''
-    mv $out/bin/{${pname}-${version},${pname}}
-    wrapProgram "$out/bin/${pname}" \
-       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations}}"
+  nativeBuildInputs = [ makeWrapper python3 copyDesktopItems ];

-    install -m 444 \
-        -D ${appimageContents}/youtube-music.desktop \
-        -t $out/share/applications
-    substituteInPlace \
-        $out/share/applications/youtube-music.desktop \
-        --replace 'Exec=AppRun' 'Exec=${pname}'
-    cp -r ${appimageContents}/usr/share/icons $out/share
+  npmDepsHash = "sha256-XGV0mTywYYxpMitojzIILB/Eu/8dfk/aCvUxIkx4SDQ=";
+  makeCacheWritable = true;
+
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
+  };
+
+  postBuild = ''
+    npm exec electron-builder -- \
+      --dir \
+      -c.electronDist=${electron}/libexec/electron \
+      -c.electronVersion=${electron.version}
  '';

+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/share/lib/youtube-music"
+    cp -r pack/*-unpacked/{locales,resources{,.pak}} "$out/share/lib/youtube-music"
+
+    pushd assets/generated/icons/png
+    for file in *.png; do
+      install -Dm0644 $file $out/share/icons/hicolor/''${file//.png}/apps/youtube-music.png
+    done
+    popd
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper ${electron}/bin/electron $out/bin/youtube-music \
+      --add-flags $out/share/lib/youtube-music/resources/app.asar \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
+      --set-default ELECTRON_IS_DEV 0 \
+      --inherit-argv0
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "youtube-music";
+      exec = "youtube-music %u";
+      icon = "youtube-music";
+      desktopName = "Youtube Music";
+      startupWMClass = "Youtube Music";
+      categories = ["AudioVideo"];
+    })
+  ];
+
  meta = with lib; {
    description = "Electron wrapper around YouTube Music";
    homepage = "https://th-ch.github.io/youtube-music/";
    license = licenses.mit;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    platforms = platforms.linux;
+    inherit (electron.meta) platforms;
    maintainers = [ maintainers.aacebedo ];
    mainProgram = "youtube-music";
  };
-}).overrideAttrs ({ nativeBuildInputs ? [ ], ... }: {
-  nativeBuildInputs = nativeBuildInputs ++ [ makeWrapper ];
-})
+}
--- a/pkgs/applications/display-managers/emptty/default.nix
+++ b/pkgs/applications/display-managers/emptty/default.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "emptty";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "tvrzna";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-8JVF3XNNzmcaJCINnv8B6l2IB5c8q/AvGOzwAlIFYq8=";
+    hash = "sha256-nReExxLbqlbzx1F1vk8qftWafG8umH988egsalSUals=";
  };

  buildInputs = [ pam libX11 ];
--- a/pkgs/applications/gis/saga/default.nix
+++ b/pkgs/applications/gis/saga/default.nix
@ -31,11 +31,11 @@

 stdenv.mkDerivation rec {
  pname = "saga";
-  version = "9.1.1";
+  version = "9.2.0";

  src = fetchurl {
    url = "mirror://sourceforge/saga-gis/saga-${version}.tar.gz";
-    sha256 = "sha256-VXupgjoiexZZ1kLXAbbQMW7XQ7FWjd1ejZPeeTffUhM=";
+    sha256 = "sha256-jHZi1c1M5WQfqBmtIvI7S9mWNXmzGUsvgJICvXbSjVc=";
  };

  sourceRoot = "saga-${version}/saga-gis";
--- a/pkgs/applications/misc/openbangla-keyboard/Cargo.lock
+++ b/pkgs/applications/misc/openbangla-keyboard/Cargo.lock
@ -4,24 +4,23 @@ version = 3

 [[package]]
 name = "ahash"
-version = "0.3.8"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8fd72866655d1904d6b0997d0b07ba561047d070fbe29de039031c641b61217"
-
-[[package]]
-name = "aho-corasick"
-version = "0.7.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
+checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
 dependencies = [
- "memchr",
+ "getrandom",
+ "once_cell",
+ "version_check",
 ]

 [[package]]
-name = "autocfg"
-version = "1.1.0"
+name = "aho-corasick"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+checksum = "ea5d730647d4fadd988536d06fecce94b7b4f2a7efdae548f1cf4b63205518ab"
+dependencies = [
+ "memchr",
+]

 [[package]]
 name = "cfg-if"
@ -29,51 +28,6 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"

-[[package]]
-name = "crossbeam-channel"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c02a4d71819009c192cf4872265391563fd6a84c81ff2c0f2a7026ca4c1d85c"
-dependencies = [
- "cfg-if",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-deque"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6455c0ca19f0d2fbf751b908d5c55c1f5cbc65e03c4225427254b46890bdde1e"
-dependencies = [
- "cfg-if",
- "crossbeam-epoch",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07db9d94cbd326813772c968ccd25999e5f8ae22f4f8d1b11effa37ef6ce281d"
-dependencies = [
- "autocfg",
- "cfg-if",
- "crossbeam-utils",
- "memoffset",
- "once_cell",
- "scopeguard",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d82ee10ce34d7bc12c2122495e7593a9c41347ecdd64185af4ecf72cb1a7f83"
-dependencies = [
- "cfg-if",
- "once_cell",
-]
-
 [[package]]
 name = "edit-distance"
 version = "2.1.0"
@ -81,104 +35,189 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbbaaaf38131deb9ca518a274a45bfdb8771f139517b073b16c2d3d32ae5037b"

 [[package]]
-name = "either"
-version = "1.7.0"
+name = "emojicon"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f107b87b6afc2a64fd13cac55fe06d6c8859f12d4b14cbcdd2c67d0976781be"
+checksum = "349cbfb1ca5301d8492ff741487f98fed75957c5e8fee41485e3413359099ef9"

 [[package]]
-name = "hashbrown"
-version = "0.8.2"
+name = "getrandom"
+version = "0.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91b62f79061a0bc2e046024cb7ba44b08419ed238ecbd9adbd787434b9e8c25"
-dependencies = [
- "ahash",
- "autocfg",
- "rayon",
- "serde",
-]
-
-[[package]]
-name = "hermit-abi"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
 dependencies = [
+ "cfg-if",
 "libc",
+ "wasi",
 ]

 [[package]]
 name = "itoa"
-version = "1.0.2"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112c678d4050afce233f4f2852bb2eb519230b3cf12f33585275537d7e41578d"
+checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"

 [[package]]
 name = "libc"
-version = "0.2.126"
+version = "0.2.148"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "349d5a591cd28b49e1d1037471617a32ddcda5731b99419008085f72d5a53836"
+checksum = "9cdc71e17332e86d2e1d38c1f99edcb6288ee11b815fb1a4b049eaa2114d369b"
+
+[[package]]
+name = "matches"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"

 [[package]]
 name = "memchr"
-version = "2.5.0"
+version = "2.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+checksum = "8f232d6ef707e1956a43342693d2a31e72989554d58299d7a88738cc95b0d35c"

 [[package]]
-name = "memoffset"
-version = "0.6.5"
+name = "okkhor"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "num_cpus"
-version = "1.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19e64526ebdee182341572e50e9ad03965aa510cd94427a4549448f285e957a1"
-dependencies = [
- "hermit-abi",
- "libc",
-]
+checksum = "e6ef452078c9fb34be8842a52484bf9271e01ac2795e3d15ee90357fb45c102f"

 [[package]]
 name = "once_cell"
-version = "1.13.0"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18a6dbe30758c9f83eb00cbea4ac95966305f5a7772f3f42ebfc7fc7eddbd8e1"
+checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"

 [[package]]
-name = "rayon"
-version = "1.5.3"
+name = "phf"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd99e5772ead8baa5215278c9b15bf92087709e9c1b2d1f97cdb5a183c933a7d"
+checksum = "fabbf1ead8a5bcbc20f5f8b939ee3f5b0f6f281b6ad3468b84656b658b455259"
 dependencies = [
- "autocfg",
- "crossbeam-deque",
- "either",
- "rayon-core",
+ "phf_macros",
+ "phf_shared",
+ "proc-macro-hack",
 ]

 [[package]]
-name = "rayon-core"
-version = "1.9.3"
+name = "phf_generator"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "258bcdb5ac6dad48491bb2992db6b7cf74878b0384908af124823d118c99683f"
+checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
 dependencies = [
- "crossbeam-channel",
- "crossbeam-deque",
- "crossbeam-utils",
- "num_cpus",
+ "phf_shared",
+ "rand",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58fdf3184dd560f160dd73922bea2d5cd6e8f064bf4b13110abd81b03697b4e0"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro-hack",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6796ad771acdc0123d2a88dc428b5e38ef24456743ddb1744ed628f9815c096"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "poriborton"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c081c9ef49e856f39ccd59e4943582b1e47225eb01b0debc1d388c4daa55b0dd"
+dependencies = [
+ "matches",
+ "phf",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+
+[[package]]
+name = "proc-macro-hack"
+version = "0.5.20+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.67"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d433d9f1a3e8c1263d9456598b16fec66f4acc9a74dacffd35c7bb09b3a1328"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
 ]

 [[package]]
 name = "regex"
-version = "1.6.0"
+version = "1.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+checksum = "ebee201405406dbf528b8b672104ae6d6d63e6d118cb10e4d51abbc7b58044ff"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59b23e92ee4318893fa3fe3e6fb365258efbfe6ac6ab30f090cdcbb7aa37efa9"
 dependencies = [
 "aho-corasick",
 "memchr",
@ -187,65 +226,109 @@ dependencies = [

 [[package]]
 name = "regex-syntax"
-version = "0.6.27"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
+checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"

 [[package]]
 name = "riti"
 version = "0.1.0"
 dependencies = [
+ "ahash",
 "edit-distance",
- "either",
- "hashbrown",
- "rayon",
+ "emojicon",
+ "okkhor",
+ "poriborton",
 "regex",
- "rupantor",
- "serde_json",
- "stringplus",
-]
-
-[[package]]
-name = "rupantor"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04eb802986005129b0946dbb4baa420bf14cea547c5ee6b57ba081d9e85f6a4b"
-dependencies = [
 "serde_json",
 "stringplus",
 ]

 [[package]]
 name = "ryu"
-version = "1.0.10"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3f6f92acf49d1b98f7a81226834412ada05458b7364277387724a237f062695"
-
-[[package]]
-name = "scopeguard"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"

 [[package]]
 name = "serde"
-version = "1.0.139"
+version = "1.0.188"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0171ebb889e45aa68b44aee0859b3eede84c6f5f5c228e6f140c0b2a0a46cad6"
+checksum = "cf9e0fcba69a370eed61bcf2b728575f726b50b55cba78064753d708ddc7549e"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.188"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.37",
+]

 [[package]]
 name = "serde_json"
-version = "1.0.82"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82c2c1fdcd807d1098552c5b9a36e425e42e9fbd7c6a37a8425f390f781f7fa7"
+checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
 dependencies = [
 "itoa",
 "ryu",
 "serde",
 ]

+[[package]]
+name = "siphasher"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
+
 [[package]]
 name = "stringplus"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9057d3b491a3eee749e52560657c4d93b0badc04fb3fa8dae3c942c5c066f222"
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7303ef2c05cd654186cb250d29049a24840ca25d2747c25c0381c8d9e2f582e8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
--- a/pkgs/applications/misc/openbangla-keyboard/default.nix
+++ b/pkgs/applications/misc/openbangla-keyboard/default.nix
@ -7,20 +7,25 @@
 , rustPlatform
 , rustc
 , wrapQtAppsHook
+, fcitx5
 , ibus
 , qtbase
 , zstd
+, withFcitx5Support ? false
+, withIbusSupport ? false
 }:

 stdenv.mkDerivation rec {
  pname = "openbangla-keyboard";
-  version = "2.0.0";
+  version = "unstable-2023-07-21";

  src = fetchFromGitHub {
    owner = "openbangla";
    repo = "openbangla-keyboard";
-    rev = version;
-    hash = "sha256-UoLiysaA0Wob/SLBqm36Txqb8k7bwoQ56h8ZufHR74I=";
+    # no upstream release in 3 years
+    # fcitx5 support was added over a year after the last release
+    rev = "780bd40eed16116222faff044bfeb61a07af158f";
+    hash = "sha256-4CR4lgHB51UvS/RLc0AEfIKJ7dyTCOfDrQdGLf9de8E=";
    fetchSubmodules = true;
  };

@ -33,8 +38,11 @@ stdenv.mkDerivation rec {
    wrapQtAppsHook
  ];

-  buildInputs = [
+  buildInputs = lib.optionals withFcitx5Support [
+    fcitx5
+  ] ++ lib.optionals withIbusSupport [
    ibus
+  ] ++ [
    qtbase
    zstd
  ];
@ -45,9 +53,15 @@ stdenv.mkDerivation rec {
      cp ${./Cargo.lock} Cargo.lock
    '';
    sourceRoot = "${src.name}/${cargoRoot}";
-    sha256 = "sha256-01MWuUUirsgpoprMArRp3qxKNayPHTkYWk31nXcIC34=";
+    hash = "sha256-XMleyP2h1aBhtjXhuGHyU0BN+tuL12CGoj+kLY5uye0=";
  };

+  cmakeFlags = lib.optionals withFcitx5Support [
+    "-DENABLE_FCITX=YES"
+  ] ++ lib.optionals withIbusSupport [
+    "-DENABLE_IBUS=YES"
+  ];
+
  cargoRoot = "src/engine/riti";
  postPatch = ''
    cp ${./Cargo.lock} ${cargoRoot}/Cargo.lock
@ -59,17 +73,13 @@ stdenv.mkDerivation rec {
      --replace "/usr" "$out"
  '';

-  postInstall = ''
-    mkdir -p $out/bin
-    ln -s $out/share/openbangla-keyboard/openbangla-gui $out/bin/openbangla-gui
-  '';
-
-  meta = with lib; {
+  meta = {
+    isIbusEngine = withIbusSupport;
    description = "An OpenSource, Unicode compliant Bengali Input Method";
    homepage = "https://openbangla.github.io/";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ hqurve ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ eclairevoyant hqurve ];
+    platforms = lib.platforms.linux;
    # never built on aarch64-linux since first introduction in nixpkgs
    broken = stdenv.isLinux && stdenv.isAarch64;
  };
--- a/pkgs/applications/misc/rsclock/default.nix
+++ b/pkgs/applications/misc/rsclock/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "rsClock";
-  version = "0.1.9";
+  version = "0.1.10";

  src = fetchFromGitHub {
    owner = "valebes";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-HsHFlM5PHUIF8FbLMJpleAvgsXHP6IZLuiH+umK1V4M=";
+    sha256 = "sha256-bxka9qTow5aL8ErYQudB+WRi2HecYn4/M3lBSxjd5/U=";
  };

-  cargoHash = "sha256-0bUKiKieIic+d3jEow887i7j2tp/ntYkXm6x08Df64M=";
+  cargoHash = "sha256-ESBeXLBkDAmuQkazcXYdo5VnMCTaxfZmzKP+d5V4lEo=";

  meta = with lib; {
    description = "A simple terminal clock written in Rust";
--- a/pkgs/applications/networking/cluster/roxctl/default.nix
+++ b/pkgs/applications/networking/cluster/roxctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "roxctl";
-  version = "4.2.0";
+  version = "4.2.1";

  src = fetchFromGitHub {
    owner = "stackrox";
    repo = "stackrox";
    rev = version;
-    sha256 = "sha256-GrqefNH3wLMMd+JfkugVJhUHFP5vvqroAMbWLan9ylU=";
+    sha256 = "sha256-6dj6thIjxoYdX4h7btK8bQcqfqbZ86E/rQOHkgIeaN4=";
  };

-  vendorHash = "sha256-y/ZoSK/lgqt8VZAb8NgCzyde/cwAhpu658/3mC/tI98=";
+  vendorHash = "sha256-SGhflDzTRix+kWgh9/0Rc5laQwGdEu+RawEDyHVI+3E=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/instant-messengers/iamb/default.nix
+++ b/pkgs/applications/networking/instant-messengers/iamb/default.nix
@ -1,6 +1,7 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
+, installShellFiles
 , darwin
 , stdenv
 }:
@ -18,10 +19,16 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-UbmeEcmUr3zx05Hk36tjsl0Y9ay7DNM1u/3lPqlXN2o=";

+  nativeBuildInputs = [ installShellFiles ];
  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk.frameworks.AppKit
  ];

+  postInstall = ''
+    OUT_DIR=$releaseDir/build/iamb-*/out
+    installManPage $OUT_DIR/iamb.{1,5}
+  '';
+
  meta = with lib; {
    description = "A Matrix client for Vim addicts";
    homepage = "https://github.com/ulyssa/iamb";
--- a/pkgs/applications/radio/csdr/default.nix
+++ b/pkgs/applications/radio/csdr/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "csdr";
-  version = "0.18.1";
+  version = "0.18.2";

  src = fetchFromGitHub {
    owner = "jketterl";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Cmms+kQzTP+CMDRXCbtWuizosFe9FywLobjBOUA79O0=";
+    sha256 = "sha256-LdVzeTTIvDQIXRdcz/vpQu/fUgtE8nx1kIEfoiwxrUg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/pkgs/applications/science/chemistry/openmolcas/default.nix
@ -43,14 +43,14 @@ let
 in
 stdenv.mkDerivation {
  pname = "openmolcas";
-  version = "23.06";
+  version = "23.10";

  src = fetchFromGitLab {
    owner = "Molcas";
    repo = "OpenMolcas";
    # The tag keeps moving, fix a hash instead
-    rev = "1cda3772686cbf99a4af695929a12d563c795ca2"; # 2023-06-12
-    sha256 = "sha256-DLRQsRy2jt8V8q2sKmv2hLuKCuMihp/+zcMY/3sg1Fk=";
+    rev = "c74317e68572d1da82fdce4210b005c2c1b1de53"; # 2023-09-25
+    hash = "sha256-wBrASZ6YFsWsu/TreEZ6Q+VxNQwCwMpyPC8AOqmNxos=";
  };

  patches = [
--- a/pkgs/applications/science/logic/alt-ergo/default.nix
+++ b/pkgs/applications/science/logic/alt-ergo/default.nix
@ -2,11 +2,11 @@

 let
  pname = "alt-ergo";
-  version = "2.5.1";
+  version = "2.5.2";

  src = fetchurl {
    url = "https://github.com/OCamlPro/alt-ergo/releases/download/v${version}/alt-ergo-${version}.tbz";
-    hash = "sha256-nPjWmg5FepObhquioYxhVPq6UdOHtCo2Hs5V0yndYB0=";
+    hash = "sha256-9GDBcBH49sheO5AjmDsznMEbw0JSrnSOcIIRN40/aJU=";
  };
 in

--- a/pkgs/applications/version-management/git-mit/default.nix
+++ b/pkgs/applications/version-management/git-mit/default.nix
@ -10,7 +10,7 @@
 }:

 let
-  version = "5.12.159";
+  version = "5.12.161";
 in
 rustPlatform.buildRustPackage {
  pname = "git-mit";
@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
    owner = "PurpleBooth";
    repo = "git-mit";
    rev = "v${version}";
-    hash = "sha256-6zifouzFYIMmdTySDFs9Q4MkZrDd1oaK479rEDk45r4=";
+    hash = "sha256-r0gRBOf/CC4HDh/N4Qi1/3DkPuuNlqfbvl4o5JqobKE=";
  };

-  cargoHash = "sha256-GBQ0GyKLrrPlHKbZDG0ZuiCVEqkFIT5FrYbojvP/je0=";
+  cargoHash = "sha256-LgiO/wPoPjmxymcXl9zQ8n/xOnFfpravwpqEsUctxxw=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@ -9,7 +9,6 @@
 , libseccomp
 , libselinux
 , makeWrapper
-, procps
 , nixosTests
 }:

@ -45,7 +44,6 @@ buildGoModule rec {
    install -Dm755 runc $out/bin/runc
    installManPage man/*/*.[1-9]
    wrapProgram $out/bin/runc \
-      --prefix PATH : ${lib.makeBinPath [ procps ]} \
      --prefix PATH : /run/current-system/systemd/bin
    runHook postInstall
  '';
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@ -311,6 +311,8 @@ rec {
    Similar to writeShellScriptBin and writeScriptBin.
    Writes an executable Shell script to /nix/store/<store path>/bin/<name> and
    checks its syntax with shellcheck and the shell's -n option.
+    Individual checks can be foregone by putting them in the excludeShellChecks
+    list, e.g. [ "SC2016" ].
    Automatically includes sane set of shellopts (errexit, nounset, pipefail)
    and handles creation of PATH based on runtimeInputs

@ -338,6 +340,7 @@ rec {
    , runtimeInputs ? [ ]
    , meta ? { }
    , checkPhase ? null
+    , excludeShellChecks ? [  ]
    }:
    writeTextFile {
      inherit name meta;
@ -363,10 +366,11 @@ rec {
        # but we still want to use writeShellApplication on those platforms
        let
          shellcheckSupported = lib.meta.availableOn stdenv.buildPlatform shellcheck.compiler;
+          excludeOption = lib.optionalString (excludeShellChecks != [  ]) "--exclude '${lib.concatStringsSep "," excludeShellChecks}'";
          shellcheckCommand = lib.optionalString shellcheckSupported ''
            # use shellcheck which does not include docs
            # pandoc takes long to build and documentation isn't needed for just running the cli
-            ${lib.getExe (haskell.lib.compose.justStaticExecutables shellcheck.unwrapped)} "$target"
+            ${lib.getExe (haskell.lib.compose.justStaticExecutables shellcheck.unwrapped)} ${excludeOption} "$target"
          '';
        in
        if checkPhase == null then ''
--- a/pkgs/build-support/trivial-builders/test/default.nix
+++ b/pkgs/build-support/trivial-builders/test/default.nix
@ -25,6 +25,7 @@ recurseIntoAttrs {
    then callPackage ./references.nix {}
    else null;
  writeCBin = callPackage ./writeCBin.nix {};
+  writeShellApplication = callPackage ./writeShellApplication.nix {};
  writeScriptBin = callPackage ./writeScriptBin.nix {};
  writeShellScript = callPackage ./write-shell-script.nix {};
  writeShellScriptBin = callPackage ./writeShellScriptBin.nix {};
--- a/pkgs/build-support/trivial-builders/test/writeShellApplication.nix
+++ b/pkgs/build-support/trivial-builders/test/writeShellApplication.nix
@ -0,0 +1,29 @@
+/*
+  Run with:
+
+      cd nixpkgs
+      nix-build -A tests.trivial-builders.writeShellApplication
+*/
+
+{ lib, writeShellApplication, runCommand }:
+let
+  pkg = writeShellApplication {
+    name = "test-script";
+    excludeShellChecks = [ "SC2016" ];
+    text = ''
+      echo -e '#!/usr/bin/env bash\n' \
+       'echo "$SHELL"' > /tmp/something.sh  # this line would normally
+                                            # ...cause shellcheck error
+    '';
+  };
+in
+  assert pkg.meta.mainProgram == "test-script";
+  runCommand "test-writeShellApplication" { } ''
+
+    echo Testing if writeShellApplication builds without shellcheck error...
+
+    target=${lib.getExe pkg}
+
+    touch $out
+  ''
+
--- a/pkgs/by-name/oc/octorpki/package.nix
+++ b/pkgs/by-name/oc/octorpki/package.nix
@ -37,7 +37,7 @@ buildGoModule rec {
    cp -R cmd/octorpki/tals $out/share/tals
  '';

-  vendorSha256 = null;
+  vendorHash = null;

  meta = with lib; {
    homepage = "https://github.com/cloudflare/cfrpki#octorpki";
--- a/pkgs/by-name/sh/shopware-cli/package.nix
+++ b/pkgs/by-name/sh/shopware-cli/package.nix
@ -9,12 +9,12 @@

 buildGoModule rec {
  pname = "shopware-cli";
-  version = "0.3.5";
+  version = "0.3.6";
  src = fetchFromGitHub {
    repo = "shopware-cli";
    owner = "FriendsOfShopware";
    rev = version;
-    hash = "sha256-xjeko2aFnz3vjQqqn/VimYGg9lZaz5trDX5HC8a+XgE=";
+    hash = "sha256-3Js44cLS6GLI6wFuT2wxgwyMF3beXaULVeaejfxxtA0=";
  };

  nativeBuildInputs = [ installShellFiles makeWrapper ];
--- a/pkgs/desktops/budgie/budgie-desktop/default.nix
+++ b/pkgs/desktops/budgie/budgie-desktop/default.nix
@ -35,16 +35,16 @@
 , wrapGAppsHook
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "budgie-desktop";
-  version = "10.8.1";
+  version = "10.8.2";

  src = fetchFromGitHub {
    owner = "BuddiesOfBudgie";
-    repo = pname;
-    rev = "v${version}";
+    repo = "budgie-desktop";
+    rev = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-KhCQ5v6R6sS5Vjl10QhSuAxAPTDDAvJ6uu6VKTdX7m4=";
+    hash = "sha256-K5XUYcFjDJCHhjb/UTO206+UT6lI2P7X1v3SqlYbwPM=";
  };

  patches = [
@ -97,11 +97,11 @@ stdenv.mkDerivation rec {
    "budgie-desktop"
  ];

-  meta = with lib; {
+  meta = {
    description = "A feature-rich, modern desktop designed to keep out the way of the user";
    homepage = "https://github.com/BuddiesOfBudgie/budgie-desktop";
-    platforms = platforms.linux;
-    maintainers = [ maintainers.federicoschonborn ];
-    license = with licenses; [ gpl2Plus lgpl21Plus cc-by-sa-30 ];
+    license = with lib.licenses; [ gpl2Plus lgpl21Plus cc-by-sa-30 ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ federicoschonborn ];
  };
-}
+})
--- a/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
@ -2,6 +2,8 @@
 , mkXfceDerivation
 , glib
 , gtk3
+, gtk-layer-shell
+, libX11
 , libxfce4ui
 , vte
 , xfconf
@ -15,9 +17,10 @@
 mkXfceDerivation {
  category = "apps";
  pname = "xfce4-terminal";
-  version = "1.1.0";
+  version = "1.1.1";
+  odd-unstable = false;

-  sha256 = "sha256-ilxiP1Org5/uSQOzfRgODmouH0BmK3CmCJj1kutNuII=";
+  sha256 = "sha256-LDfZTZ2EaboIYz+xQNC2NKpJiN8qqfead2XzpKVpL6c=";

  nativeBuildInputs = [
    libxslt
@ -28,6 +31,8 @@ mkXfceDerivation {
  buildInputs = [
    glib
    gtk3
+    gtk-layer-shell
+    libX11
    libxfce4ui
    vte
    xfconf
--- a/pkgs/desktops/xfce/core/xfce4-dev-tools/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-dev-tools/default.nix
@ -14,9 +14,9 @@
 mkXfceDerivation {
  category = "xfce";
  pname = "xfce4-dev-tools";
-  version = "4.18.0";
+  version = "4.18.1";

-  sha256 = "sha256-VgQiTRMPD1VeUkUnFkX78C2VrsrXFWCdmupL8PQc7+c=";
+  sha256 = "sha256-JUyFlifNVhSnIMaI9qmgCtGIgkpmzYybMfuhPgJiDOg=";

  nativeBuildInputs = [
    autoreconfHook
--- a/pkgs/development/libraries/sentry-native/default.nix
+++ b/pkgs/development/libraries/sentry-native/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "sentry-native";
-  version = "0.6.5";
+  version = "0.6.6";

  src = fetchFromGitHub {
    owner = "getsentry";
    repo = "sentry-native";
    rev = version;
-    hash = "sha256-x9xqcQQQS6hUcZaF8Ei8OmDXUP+y3prVyjlzwm4+4ko=";
+    hash = "sha256-mi9mEyb25fb3W6X07TX36fW6T2SOPOkDvpIXQn5sg8Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/zookeeper_mt/default.nix
+++ b/pkgs/development/libraries/zookeeper_mt/default.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://apache/zookeeper/${zookeeper.pname}-${version}/apache-${zookeeper.pname}-${version}.tar.gz";
-    hash = "sha512-ttYbATvfe+uRYhQWfeG1WGXl5GOztcrITfl/4EQierAzSaDvTmVxSb582hYQOdBpxw2QrVbIdnTm3/Xt4ifecg==";
+    hash = "sha512-V1SFPtSytFZMyiR/cgwLA9zPUK5xuarP3leQCQiSfelUHnYMB+R6ZQfSHMHD9t+URvLc+KRFSriLTzethspkpA==";
  };

  sourceRoot = "apache-${zookeeper.pname}-${version}/zookeeper-client/zookeeper-client-c";
--- a/pkgs/development/python-modules/aiowithings/default.nix
+++ b/pkgs/development/python-modules/aiowithings/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "aiowithings";
-  version = "0.3.0";
+  version = "0.4.4";
  pyproject = true;

  disabled = pythonOlder "3.11";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "joostlek";
    repo = "python-withings";
    rev = "refs/tags/v${version}";
-    hash = "sha256-oIFgPO5gmg09QOs94TUTfMAslMI2kpvenyOxQ4SvC/4=";
+    hash = "sha256-YmTYwj3Udo1Pev25LLvY7757BR0h44aefqIe8b8FlTc=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/casbin/default.nix
+++ b/pkgs/development/python-modules/casbin/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "casbin";
-  version = "1.31.2";
+  version = "1.32.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = "pycasbin";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Asz91KG/sDlRTwgn7bP0Pa4yiXKt7Hgc1hzEKD8TfHM=";
+    hash = "sha256-voabnGdtYci6rV5aLSdEAD3sWEva1tjJSm0EwpjdTj8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/deezer-python/default.nix
+++ b/pkgs/development/python-modules/deezer-python/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "deezer-python";
-  version = "6.1.0";
+  version = "6.1.1";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "browniebroke";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-9uFKrr0C/RIklpW5KZj8pSv4oEibzSaAJWnTwYKyxD8=";
+    hash = "sha256-pzEXiWKMP2Wqme/pqfTMHxWH/4YcCS6u865wslHrUqI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/griffe/default.nix
+++ b/pkgs/development/python-modules/griffe/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "griffe";
-  version = "0.36.6";
+  version = "0.36.7";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "mkdocstrings";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-SSFTB/fVMxlOqtyv72YssJLc1KCGluMG68OabyMWWQU=";
+    hash = "sha256-sxj/avPVmS2qHD+s5nsTWpnXjAMQ1RuBA9Z52Rx/X8k=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/nbdev/default.nix
+++ b/pkgs/development/python-modules/nbdev/default.nix
@ -15,13 +15,14 @@

 buildPythonPackage rec {
  pname = "nbdev";
-  version = "2.3.12";
+  version = "2.3.13";
  format = "setuptools";
-  disabled = pythonOlder "3.6";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-AQWNqCq9IEWMKkkG5bw0pkvWtvIMKkBbAotfTRRTMCQ=";
+    hash = "sha256-Umkf3CcRRSS+pK3UKeTg+Ru3TW+qHNoQ2F6nUk8jQUU=";
  };

  propagatedBuildInputs = [
@ -38,11 +39,15 @@ buildPythonPackage rec {

  # no real tests
  doCheck = false;
-  pythonImportsCheck = [ "nbdev" ];
+
+  pythonImportsCheck = [
+    "nbdev"
+  ];

  meta = with lib; {
    homepage = "https://github.com/fastai/nbdev";
    description = "Create delightful software with Jupyter Notebooks";
+    changelog = "https://github.com/fastai/nbdev/blob/${version}/CHANGELOG.md";
    license = licenses.asl20;
    maintainers = with maintainers; [ rxiao ];
  };
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@ -31,7 +31,7 @@

 buildPythonPackage rec {
  pname = "ocrmypdf";
-  version = "15.1.0";
+  version = "15.2.0";

  disabled = pythonOlder "3.9";

@ -47,7 +47,7 @@ buildPythonPackage rec {
    postFetch = ''
      rm "$out/.git_archival.txt"
    '';
-    hash = "sha256-RyF4GZjYPIerlPP8RDsYg+wjAChlzAqqqEPHPr/gQLU=";
+    hash = "sha256-XeO/obDP2tv/HKZLa0Absv26m+oUIup/IBMFZP8/1VQ=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "opower";
-  version = "0.0.36";
+  version = "0.0.37";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "tronikos";
    repo = "opower";
    rev = "refs/tags/v${version}";
-    hash = "sha256-onfPTbfBWSoQ75w8g0ub7xwzcNKvHOdfAD5RyUAc5ss=";
+    hash = "sha256-hfHKn3A1Uo0GAHOwzCuOM2FlIyyGBUefQAKX9TJZzHw=";
  };

  pythonRemoveDeps = [
--- a/pkgs/development/python-modules/pyro5/default.nix
+++ b/pkgs/development/python-modules/pyro5/default.nix
@ -9,15 +9,15 @@

 buildPythonPackage rec {
  pname = "pyro5";
-  version = "5.14";
+  version = "5.15";
  format = "setuptools";

-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.8";

  src = fetchPypi {
    pname = "Pyro5";
    inherit version;
-    hash = "sha256-ZP3OE3sP5TLohhTSRrfJi74KT0JnhsUkU5rNxeaUCGo=";
+    hash = "sha256-gsPfyYYLSfiXso/yT+ZxbIQWcsYAr4/kDQ46f6yaP14=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@ -26,7 +26,7 @@

 buildPythonPackage rec {
  pname = "sagemaker";
-  version = "2.192.1";
+  version = "2.193.0";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -35,7 +35,7 @@ buildPythonPackage rec {
    owner = "aws";
    repo = "sagemaker-python-sdk";
    rev = "refs/tags/v${version}";
-    hash = "sha256-+1wb7O+fHhRE8aKlgAB/NRgx2J+LBkR7xuqfWnVYSKc=";
+    hash = "sha256-5wMLzZjHgHGuIBxG0GNOVj1t32kEJ9scrS6bA6IW4WY=";
  };

  nativeBuildInputs = [
@ -82,6 +82,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Library for training and deploying machine learning models on Amazon SageMaker";
    homepage = "https://github.com/aws/sagemaker-python-sdk/";
+    changelog = "https://github.com/aws/sagemaker-python-sdk/blob/v${version}/CHANGELOG.md";
    license = licenses.asl20;
    maintainers = with maintainers; [ nequissimus ];
  };
--- a/pkgs/development/python-modules/scikit-hep-testdata/default.nix
+++ b/pkgs/development/python-modules/scikit-hep-testdata/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "scikit-hep-testdata";
-  version = "0.4.33";
+  version = "0.4.34";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "scikit-hep";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-IAi1LS6LqcvMR3dqNcppuyoMNM/hRT1eH+LZbczWW/M=";
+    hash = "sha256-kHpJXqFQI3vtDJIcH2ebzbaReHecwItDh73/NcoPk9A=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -22,14 +22,14 @@ with py.pkgs;

 buildPythonApplication rec {
  pname = "checkov";
-  version = "2.5.13";
+  version = "2.5.14";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-s8FG7LgcMro7nUDpJWwyXaBqjgdvV8QVZvvHfMUbIEA=";
+    hash = "sha256-4F8cGcQJy8cbCE0wxM6B4qGjuc+SjeL7DMr6RdSkXBM=";
  };

  patches = [
--- a/pkgs/development/tools/build-managers/turtle-build/default.nix
+++ b/pkgs/development/tools/build-managers/turtle-build/default.nix
@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "turtle-build";
-  version = "0.4.6";
+  version = "0.4.7";

  src = fetchFromGitHub {
    owner = "raviqqe";
    repo = "turtle-build";
    rev = "v${version}";
-    hash = "sha256-7XorSt2LFWYNdvCot+I7Uh6S1mhRbD7PkWkvYdIbjKs=";
+    hash = "sha256-pyCswNJ4LuXViewQl+2o5g06uVjXVphxh2wXO9m5Mec=";
  };

-  cargoHash = "sha256-TebXKOgBdf/ZFITQu5OuusytDJKEkGzRD7fLhk1uh8Y=";
+  cargoHash = "sha256-ObPzzYh8Siu01DH/3pXk322H7NaD7sHYTYBUk0WvZUs=";

  meta = with lib; {
    description = "Ninja-compatible build system for high-level programming languages written in Rust";
--- a/pkgs/development/tools/database/sqlfluff/default.nix
+++ b/pkgs/development/tools/database/sqlfluff/default.nix
@ -5,14 +5,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "sqlfluff";
-  version = "2.3.3";
+  version = "2.3.4";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-VCvlNR/0SX3bnGw+gSGkAoS+6zig5lrDv9/Gez+TIb4=";
+    hash = "sha256-kUdTQmNUvjWZ6IUnBndUF47DLFU+hT5rnmyY3LeLA0M=";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/development/tools/electron/info.json
+++ b/pkgs/development/tools/electron/info.json
@ -3,16 +3,16 @@
        "deps": {
            "src/electron": {
                "fetcher": "fetchFromGitHub",
-                "hash": "sha256-klH7DkP/wFUh0IxMMr//EPIsQRv5RzykAR3xC17k9jI=",
+                "hash": "sha256-TOsL+5sF65sOCSLx0yamXWC5olYbDUO/Np9HK5sT5DI=",
                "owner": "electron",
                "repo": "electron",
-                "rev": "v28.0.0-nightly.20231009"
+                "rev": "v28.0.0-alpha.3"
            },
            "src": {
                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-vXnKOAl9gG0VnYs02Lko2EsDi3eIdV9+nPSyzDFxIQQ=",
+                "hash": "sha256-5lIe6mjAee6DUOPDvPM43QJ7VKRQ960w7UqxbXPRPIA=",
                "url": "https://chromium.googlesource.com/chromium/src.git",
-                "rev": "119.0.6045.0",
+                "rev": "119.0.6045.21",
                "postFetch": "rm -r $out/third_party/blink/web_tests; rm -r $out/third_party/hunspell/tests; rm -r $out/content/test/data; rm -r $out/courgette/testdata; rm -r $out/extensions/test/data; rm -r $out/media/test/data; "
            },
            "src/third_party/clang-format/script": {
@ -77,9 +77,9 @@
            },
            "src/third_party/angle": {
                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-PpW7/iZWiMUhmGfAARnSAn3Sd29ngfz6Q9gY+A994LI=",
+                "hash": "sha256-2JvDcfRiwFDjiGWlzwsTq6HP/I6lq+NaI6S57ZrCLGY=",
                "url": "https://chromium.googlesource.com/angle/angle.git",
-                "rev": "3d5308aac229dabf751b9ebf8a7e81fa2b0477cd"
+                "rev": "5cff2421ef225d14d3a4253b81073389fc840024"
            },
            "src/third_party/angle/third_party/glmark2/src": {
                "fetcher": "fetchFromGitiles",
@ -257,9 +257,9 @@
            },
            "src/third_party/devtools-frontend/src": {
                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-p95bOkzo984NqbWNs0Ee7QUd6Iz+Zz1e+3ENUzbFELY=",
+                "hash": "sha256-OUmCxucDd8jXbEqqNyt9j0j+9zp2G9s3aaFliFkg45A=",
                "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-                "rev": "46268f4b777d9e3812ae478fd3254f82fea73f3a"
+                "rev": "fa727c5e31709a4447a79a2270157b7ba86414c4"
            },
            "src/third_party/dom_distiller_js/dist": {
                "fetcher": "fetchFromGitiles",
@ -593,9 +593,9 @@
            },
            "src/third_party/pdfium": {
                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-Uk9knKf3Ixep8h2vDZmCLjP4OJSqNPyUaHU8/5FR5B4=",
+                "hash": "sha256-iVOmMH0h0mbHy9m0vy86SzS5Oeyhgd4CC26LgPws9P4=",
                "url": "https://pdfium.googlesource.com/pdfium.git",
-                "rev": "8cf636e15ce21f4c8a574882c7cfd00629b59aba"
+                "rev": "2e2cfb0399db35fbe2e3ef0be62559fe01837ec5"
            },
            "src/third_party/perfetto": {
                "fetcher": "fetchFromGitiles",
@ -641,9 +641,9 @@
            },
            "src/third_party/skia": {
                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-0rjCxtgv+PuiBAIw82fw2NJw4G+fcuig4n1mYoP2pmQ=",
+                "hash": "sha256-qHJujO+LYJ41zmoP2xSYRd9K8vLp4bCztYcMO8MI9Lo=",
                "url": "https://skia.googlesource.com/skia.git",
-                "rev": "fcd1b7521805ab1cde2947be6118f329e4ace14d"
+                "rev": "ab212df482c8fd5b1c1fb302717876d542549624"
            },
            "src/third_party/smhasher/src": {
                "fetcher": "fetchFromGitiles",
@ -791,9 +791,9 @@
            },
            "src/third_party/webrtc": {
                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-AYiJ8pt56Wd54MHlnjPnHf5PhKSi9CYoNIk3ASMYQXw=",
+                "hash": "sha256-uRRtsEVMn85RfFgo1qzYnwA1eN6LvXRme+FUntvCuYA=",
                "url": "https://webrtc.googlesource.com/src.git",
-                "rev": "bce7ce7ba054ac0e79fed49b84ef52fb24c31778"
+                "rev": "71e3fbf5d750e84d181315a663eb5dbc29a5330c"
            },
            "src/third_party/wuffs/src": {
                "fetcher": "fetchFromGitiles",
@ -833,9 +833,9 @@
            },
            "src/v8": {
                "fetcher": "fetchFromGitiles",
-                "hash": "sha256-hJKPhOEF2MKmTsr4TpbTDFs7cTYcYkf0y7LXSAWMjOE=",
+                "hash": "sha256-qP5gRxEEKV+I3Q6wk0H94OTnKVAieo9SJZGLB9Ti5qw=",
                "url": "https://chromium.googlesource.com/v8/v8.git",
-                "rev": "3eb7d73cbd4266dcc250a7b4d0099d0946ec1138"
+                "rev": "f6ebdead2b58e457b923c8121a9267a5d80f59cf"
            },
            "src/third_party/nan": {
                "fetcher": "fetchFromGitHub",
@ -873,12 +873,12 @@
                "rev": "78d3966b3c331292ea29ec38661b25df0a245948"
            }
        },
-        "version": "28.0.0-nightly.20231009",
+        "version": "28.0.0-alpha.3",
        "modules": "119",
-        "chrome": "119.0.6045.0",
+        "chrome": "119.0.6045.21",
        "node": "18.18.0",
        "chromium": {
-            "version": "119.0.6045.0",
+            "version": "119.0.6045.21",
            "deps": {
                "gn": {
                    "version": "2023-09-12",
@ -888,8 +888,8 @@
                }
            }
        },
-        "chromium_npm_hash": "sha256-10OGEsA0BDrkbTeIbdXLYRyKNwVsb/tP2ryBBuhi+m8=",
-        "electron_yarn_hash": "1akq5cxcy7fpn4m5qk5kx94vy30z0ybx6ka5qp8an0p33yx9wg8z"
+        "electron_yarn_hash": "1akq5cxcy7fpn4m5qk5kx94vy30z0ybx6ka5qp8an0p33yx9wg8z",
+        "chromium_npm_hash": "sha256-10OGEsA0BDrkbTeIbdXLYRyKNwVsb/tP2ryBBuhi+m8="
    },
    "27": {
        "deps": {
@ -1787,10 +1787,10 @@
        "deps": {
            "src/electron": {
                "fetcher": "fetchFromGitHub",
-                "hash": "sha256-deYr/VWVnnkLmotT5aqMomz7GzJlhKdkuxZhzj8guT0=",
+                "hash": "sha256-sEhO5qSm4etyWEurTGSKtJcheG+JJkC78Fhl3c5WBOE=",
                "owner": "electron",
                "repo": "electron",
-                "rev": "v26.3.0"
+                "rev": "v26.4.0"
            },
            "src": {
                "fetcher": "fetchFromGitiles",
@ -2609,7 +2609,7 @@
                "rev": "78d3966b3c331292ea29ec38661b25df0a245948"
            }
        },
-        "version": "26.3.0",
+        "version": "26.4.0",
        "modules": "116",
        "chrome": "116.0.5845.228",
        "node": "18.16.1",
@ -2631,10 +2631,10 @@
        "deps": {
            "src/electron": {
                "fetcher": "fetchFromGitHub",
-                "hash": "sha256-OVPwnoHyiHcxwixTWu0W2sxkJNRtB7uiXqdEzbzi+Fc=",
+                "hash": "sha256-Yo/ZvOLOPIktV5gzZK80LKVZb3xMXrzGkdQw9u4djoI=",
                "owner": "electron",
                "repo": "electron",
-                "rev": "v25.9.0"
+                "rev": "v25.9.1"
            },
            "src": {
                "fetcher": "fetchFromGitiles",
@ -3429,7 +3429,7 @@
                "rev": "78d3966b3c331292ea29ec38661b25df0a245948"
            }
        },
-        "version": "25.9.0",
+        "version": "25.9.1",
        "modules": "116",
        "chrome": "114.0.5735.289",
        "node": "18.15.0",
--- a/pkgs/development/tools/kustomize/4.nix
+++ b/pkgs/development/tools/kustomize/4.nix
@ -0,0 +1,48 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "kustomize_4";
+  version = "4.5.7";
+
+  src = fetchFromGitHub {
+    owner = "kubernetes-sigs";
+    repo = "kustomize";
+    rev = "kustomize/v${version}";
+    hash = "sha256-AHDUwXcYkI04nOBY8jScf+OE6k9Z5OqzhtWExK1rrKg=";
+  };
+
+  # rev is the commit of the tag, mainly for kustomize version command output
+  rev = "56d82a8378dfc8dc3b3b1085e5a6e67b82966bd7";
+  ldflags = let t = "sigs.k8s.io/kustomize/api/provenance"; in
+    [
+      "-s"
+      "-X ${t}.version=${version}"
+      "-X ${t}.gitCommit=${rev}"
+    ];
+
+  # avoid finding test and development commands
+  modRoot = "kustomize";
+  proxyVendor = true;
+  vendorHash = "sha256-9+k0Me5alZDNC27Mx0Q6vp0B2SEa+Qy0FoLSr/Rahkc=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd kustomize \
+      --bash <($out/bin/kustomize completion bash) \
+      --fish <($out/bin/kustomize completion fish) \
+      --zsh <($out/bin/kustomize completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "Customization of kubernetes YAML configurations";
+    longDescription = ''
+      kustomize lets you customize raw, template-free YAML files for
+      multiple purposes, leaving the original YAML untouched and usable
+      as is.
+    '';
+    homepage = "https://github.com/kubernetes-sigs/kustomize";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ carlosdagos vdemeester periklis zaninime Chili-Man saschagrunert ];
+  };
+}
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@ -13,14 +13,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "rust-analyzer-unwrapped";
-  version = "2023-10-02";
-  cargoSha256 = "sha256-KCjdsvHWVr3vsyv+KhxwXTI3WJbAggb9HLyN/1ioek8=";
+  version = "2023-10-16";
+  cargoSha256 = "sha256-hs5Mn+BU1BszgAHOZaZBQdpjeBx39Lbm+3EWSucrzak=";

  src = fetchFromGitHub {
    owner = "rust-lang";
    repo = "rust-analyzer";
    rev = version;
-    sha256 = "sha256-2K3Aq4gjPZBDnkAMJaMA4ElE+BNbmrqtSBWtt9kPGaM=";
+    sha256 = "sha256-9ScvChrqG35GXwO6cFzZOgsq/5PdrUZDCTBRgkhoShk=";
  };

  cargoBuildFlags = [ "--bin" "rust-analyzer" "--bin" "rust-analyzer-proc-macro-srv" ];
--- a/pkgs/development/tools/sem/default.nix
+++ b/pkgs/development/tools/sem/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "sem";
-  version = "0.28.3";
+  version = "0.28.4";

  src = fetchFromGitHub {
    owner = "semaphoreci";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-g/OMkR3G3g6lp1lQn9L8QxOuUoQDsvxLBC7TYZ1Onsg=";
+    sha256 = "sha256-T7f/yfzNITlU03N059y1B/I1H77Pji34EK+x0Qs6XwQ=";
  };

-  vendorHash = "sha256-GAYCdq4eHTyxQ5JaNYLd3mQ2LvgLHdmYdz4RN+Hpe70=";
+  vendorHash = "sha256-CDjfhnnt4+ml8k/2QPGaSlJFpxDYWNjA5nzLXL2APX4=";
  subPackages = [ "." ];

  ldflags = [ "-X main.version=${version}" "-X main.buildSource=nix" ];
--- a/pkgs/development/tools/sentry-cli/default.nix
+++ b/pkgs/development/tools/sentry-cli/default.nix
@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "sentry-cli";
-  version = "2.21.1";
+  version = "2.21.2";

  src = fetchFromGitHub {
    owner = "getsentry";
    repo = "sentry-cli";
    rev = version;
-    sha256 = "sha256-GMK3fAmYYxwwlXXbCluDFu8YWId77F4mrdxXIIO+jc8=";
+    sha256 = "sha256-2CNV1y2/D2KrQylWqd5DDQYOAhR7pGeBFva1wysGZRw=";
  };
  doCheck = false;

@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration ];
  nativeBuildInputs = [ pkg-config ];

-  cargoHash = "sha256-wUQ9HbBNNB66394RPHaoGJkFrL28xW5CIXDzGnMIPKY=";
+  cargoHash = "sha256-jZUL2/iLOITIfonXzJS/K6wRSPPb2aY9ASbq1KTf+kM=";

  meta = with lib; {
    homepage = "https://docs.sentry.io/cli/";
--- a/pkgs/os-specific/linux/rt-tests/default.nix
+++ b/pkgs/os-specific/linux/rt-tests/default.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation rec {
  pname = "rt-tests";
-  version = "2.5";
+  version = "2.6";

  src = fetchurl {
    url = "https://git.kernel.org/pub/scm/utils/rt-tests/rt-tests.git/snapshot/${pname}-${version}.tar.gz";
-    sha256 = "sha256-LzN3YB3Lb7tjyEplrFaNYtiGwHUUTztZBsMrUndd2cU=";
+    sha256 = "sha256-apRJwRqcyzfmyGCCv5BDN92pKP3Nafa9SkxlZ+Bxrm0=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/os-specific/linux/ryzenadj/default.nix
+++ b/pkgs/os-specific/linux/ryzenadj/default.nix
@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, pciutils, cmake }:
 stdenv.mkDerivation rec {
  pname = "ryzenadj";
-  version = "0.13.0";
+  version = "0.14.0";

  src = fetchFromGitHub {
    owner = "FlyGoat";
    repo = "RyzenAdj";
    rev = "v${version}";
-    sha256 = "sha256-n/LHFv14aDLbobeamOgDYBml1DgSGJmfmg/qff78i4c=";
+    sha256 = "sha256-Lqq4LNRmqQyeIJfr/+tYdKMEk+P54VnwZAQZcE0ev8Y=";
  };

  nativeBuildInputs = [ pciutils cmake ];
--- a/pkgs/os-specific/linux/sssd/default.nix
+++ b/pkgs/os-specific/linux/sssd/default.nix
@ -5,21 +5,21 @@
  libuuid, systemd, nspr, check, cmocka, uid_wrapper, p11-kit,
  nss_wrapper, ncurses, Po4a, http-parser, jansson, jose,
  docbook_xsl, docbook_xml_dtd_44,
-  nixosTests,
+  testers, nix-update-script, nixosTests,
  withSudo ? false }:

 let
  docbookFiles = "${docbook_xsl}/share/xml/docbook-xsl/catalog.xml:${docbook_xml_dtd_44}/xml/dtd/docbook/catalog.xml";
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "sssd";
-  version = "2.9.1";
+  version = "2.9.2";

  src = fetchFromGitHub {
    owner = "SSSD";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-OafSo28MN92py33foE8oMkPUmV9WUUOkKWJgm0i7MJU=";
+    repo = "sssd";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-CxkEyx9X14x8x9tSSN9d0TBTPKJB2Ip7HTL98uqO0J4=";
  };

  postPatch = ''
@ -96,14 +96,23 @@ stdenv.mkDerivation rec {
    done
  '';

-  passthru.tests = { inherit (nixosTests) sssd sssd-ldap; };
+  passthru = {
+    tests = {
+      inherit (nixosTests) sssd sssd-ldap;
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        command = "sssd --version";
+      };
+    };
+    updateScript = nix-update-script { };
+  };

  meta = with lib; {
    description = "System Security Services Daemon";
    homepage = "https://sssd.io/";
-    changelog = "https://sssd.io/release-notes/sssd-${version}.html";
+    changelog = "https://sssd.io/release-notes/sssd-${finalAttrs.version}.html";
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
    maintainers = with maintainers; [ illustris ];
  };
-}
+})
--- a/pkgs/servers/miniflux/default.nix
+++ b/pkgs/servers/miniflux/default.nix
@ -1,20 +1,20 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles, nixosTests }:
+{ lib, buildGo121Module, fetchFromGitHub, installShellFiles, nixosTests }:

 let
  pname = "miniflux";
-  version = "2.0.48";
+  version = "2.0.49";

-in buildGoModule {
+in buildGo121Module {
  inherit pname version;

  src = fetchFromGitHub {
    owner = pname;
    repo = "v2";
    rev = version;
-    sha256 = "sha256-g2Cnkf022aU/kUkb6N8huB+SFY60uNxyI9BVEycl37c=";
+    sha256 = "sha256-MGKQSlpTLqQPmvhACl9fbQkz2Uil8V8btjTwJIcY7g0=";
  };

-  vendorHash = "sha256-d4/oDvMRZtetZ7RyCHVnPqA78yPVFyw4UhjfPD1XuMo=";
+  vendorHash = "sha256-J3WHFfmjgE71hK58WP3dq+Px4XxLbluJSGv+eJiIB0E=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/servers/sql/percona-server/8.0.x.nix
+++ b/pkgs/servers/sql/percona-server/8.0.x.nix
@ -0,0 +1,96 @@
+{ lib, stdenv, fetchurl, bison, cmake, pkg-config
+, boost, icu, libedit, libevent, lz4, ncurses, openssl, perl, protobuf, re2, readline, zlib, zstd, libfido2
+, numactl, cctools, CoreServices, developer_cmds, libtirpc, rpcsvc-proto, curl, DarwinTools, nixosTests
+# Percona-specific deps
+, coreutils, cyrus_sasl, gnumake, openldap
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "percona-server";
+  version = "8.0.34-26";
+
+  src = fetchurl {
+    url = "https://www.percona.com/downloads/Percona-Server-8.0/Percona-Server-${finalAttrs.version}/source/tarball/percona-server-${finalAttrs.version}.tar.gz";
+    sha256 = "sha256-xOaXfnh/lg/TutanwGt+EmxG4UA8oTPdil2nvU3NZXQ=";
+  };
+
+  nativeBuildInputs = [ bison cmake pkg-config ]
+    ++ lib.optionals (!stdenv.isDarwin) [ rpcsvc-proto ];
+
+  patches = [
+    ./no-force-outline-atomics.patch # Do not force compilers to turn on -moutline-atomics switch
+  ];
+
+  ## NOTE: MySQL upstream frequently twiddles the invocations of libtool. When updating, you might proactively grep for libtool references.
+  postPatch = ''
+    substituteInPlace cmake/libutils.cmake --replace /usr/bin/libtool libtool
+    substituteInPlace cmake/os/Darwin.cmake --replace /usr/bin/libtool libtool
+    # The rocksdb setup script is called with `env -i` and cannot find anything in PATH.
+    patchShebangs storage/rocksdb/get_rocksdb_files.sh
+    substituteInPlace storage/rocksdb/get_rocksdb_files.sh --replace mktemp ${coreutils}/bin/mktemp
+    substituteInPlace storage/rocksdb/get_rocksdb_files.sh --replace "rm $MKFILE" "${coreutils}/bin/rm $MKFILE"
+    substituteInPlace storage/rocksdb/get_rocksdb_files.sh --replace "make --" "${gnumake}/bin/make --"
+  '';
+
+  buildInputs = [
+    boost (curl.override { inherit openssl; }) icu libedit libevent lz4 ncurses openssl protobuf re2 readline zlib
+    zstd libfido2 openldap perl cyrus_sasl
+  ] ++ lib.optionals stdenv.isLinux [
+    numactl libtirpc
+  ] ++ lib.optionals stdenv.isDarwin [
+    cctools CoreServices developer_cmds DarwinTools
+  ];
+
+  outputs = [ "out" "static" ];
+
+  cmakeFlags = [
+    # Percona-specific flags.
+    "-DPORTABLE=1"
+    "-DWITH_LDAP=system"
+    "-DROCKSDB_DISABLE_AVX2=1"
+    "-DROCKSDB_DISABLE_MARCH_NATIVE=1"
+
+    # Flags taken from mysql package.
+    "-DFORCE_UNSUPPORTED_COMPILER=1" # To configure on Darwin.
+    "-DWITH_ROUTER=OFF" # It may be packaged separately.
+    "-DWITH_SYSTEM_LIBS=ON"
+    "-DWITH_UNIT_TESTS=OFF"
+    "-DMYSQL_UNIX_ADDR=/run/mysqld/mysqld.sock"
+    "-DMYSQL_DATADIR=/var/lib/mysql"
+    "-DINSTALL_INFODIR=share/mysql/docs"
+    "-DINSTALL_MANDIR=share/man"
+    "-DINSTALL_PLUGINDIR=lib/mysql/plugin"
+    "-DINSTALL_INCLUDEDIR=include/mysql"
+    "-DINSTALL_DOCREADMEDIR=share/mysql"
+    "-DINSTALL_SUPPORTFILESDIR=share/mysql"
+    "-DINSTALL_MYSQLSHAREDIR=share/mysql"
+    "-DINSTALL_MYSQLTESTDIR="
+    "-DINSTALL_DOCDIR=share/mysql/docs"
+    "-DINSTALL_SHAREDIR=share/mysql"
+  ];
+
+  postInstall = ''
+    moveToOutput "lib/*.a" $static
+    so=${stdenv.hostPlatform.extensions.sharedLibrary}
+    ln -s libmysqlclient$so $out/lib/libmysqlclient_r$so
+  '';
+
+  passthru = {
+    client = finalAttrs.finalPackage;
+    connector-c = finalAttrs.finalPackage;
+    server = finalAttrs.finalPackage;
+    mysqlVersion = lib.versions.majorMinor finalAttrs.version;
+    tests = nixosTests.mysql.percona-server_8_0;
+  };
+
+  meta = with lib; {
+    homepage = "https://www.percona.com/software/mysql-database/percona-server";
+    description = ''
+      A free, fully compatible, enhanced, open source drop-in replacement for
+      MySQL® that provides superior performance, scalability and instrumentation.
+    '';
+    license = licenses.gpl2;
+    maintainers = teams.flyingcircus.members;
+    platforms = platforms.unix;
+  };
+})
--- a/pkgs/servers/sql/percona-server/no-force-outline-atomics.patch
+++ b/pkgs/servers/sql/percona-server/no-force-outline-atomics.patch
@ -0,0 +1,24 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 727d66011f9..acae1aada57 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -1338,19 +1338,6 @@ IF(UNIX AND MY_COMPILER_IS_GNU_OR_CLANG
+   ENDIF()
+ ENDIF()
+ 
+-# For aarch64 some sub-architectures support LSE atomics and some don't. Thus,
+-# compiling for the common denominator (-march=armv8-a) means LSE is not used.
+-# The -moutline-atomics switch enables run-time detection of LSE support.
+-# There are compilers (gcc 9.3.1 for example) which support this switch, but
+-# do not enable it by default, even though it seems to help. So, we force it.
+-IF(CMAKE_SYSTEM_PROCESSOR STREQUAL "aarch64")
+-  MY_CHECK_CXX_COMPILER_FLAG( "-moutline-atomics" HAVE_OUTLINE_ATOMICS)
+-  IF(HAVE_OUTLINE_ATOMICS)
+-    STRING_APPEND(CMAKE_C_FLAGS   " -moutline-atomics")
+-    STRING_APPEND(CMAKE_CXX_FLAGS " -moutline-atomics")
+-  ENDIF()
+-ENDIF()
+-
+ IF(LINUX)
+   OPTION(LINK_RANDOMIZE "Randomize the order of all symbols in the binary" OFF)
+   SET(LINK_RANDOMIZE_SEED "mysql"
--- a/pkgs/servers/zookeeper/default.nix
+++ b/pkgs/servers/zookeeper/default.nix
@ -1,16 +1,16 @@
 { lib, stdenv, fetchurl, jdk11_headless, makeWrapper, nixosTests, bash, coreutils }:
 let
-  # Latest supported LTS JDK for Zookeeper 3.6:
-  # https://zookeeper.apache.org/doc/r3.6.3/zookeeperAdmin.html#sc_requiredSoftware
+  # Latest supported LTS JDK for Zookeeper 3.7:
+  # https://zookeeper.apache.org/doc/r3.7.2/zookeeperAdmin.html#sc_requiredSoftware
  jre = jdk11_headless;
 in
 stdenv.mkDerivation rec {
  pname = "zookeeper";
-  version = "3.7.1";
+  version = "3.7.2";

  src = fetchurl {
    url = "mirror://apache/zookeeper/${pname}-${version}/apache-${pname}-${version}-bin.tar.gz";
-    hash = "sha512-kQNiilB0X6GiibymZv2kqcCOwXxVzxPmaIfnunbpPbrmCh8f/WwQeYvjoWBpNE7LwAzrspvwPZzXCWzNCY7QEQ==";
+    hash = "sha512-avv8GvyLk3AoG9mGLzfbscuV7FS7LtQ3GDGqXA8Iz+53UFC9V85fwINuYa8n7tnwB29UuYmX3Q4VFZGWBW5S6g==";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/tools/misc/fclones/default.nix
+++ b/pkgs/tools/misc/fclones/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "fclones";
-  version = "0.32.1";
+  version = "0.32.2";

  src = fetchFromGitHub {
    owner = "pkolaczk";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-aNTmx94fWuwwlMckjZMOoU1hqSW+yUTKjobvRTxJX4s=";
+    hash = "sha256-LDbunewSGqIxuy9Z87Aij85xovERuj4W2Jbf2lv2KVM=";
  };

-  cargoHash = "sha256-MGqQImBEH210IVvjyh/aceQr001T1cMHQfyQI1ZyVw8=";
+  cargoHash = "sha256-uKpQ7K8e9bq/7yQdCPlfQnjvOlTRnEUcW9HWE2Vy/lY=";

  buildInputs = lib.optionals stdenv.isDarwin [
    darwin.apple_sdk_11_0.frameworks.AppKit
--- a/pkgs/tools/misc/svtplay-dl/default.nix
+++ b/pkgs/tools/misc/svtplay-dl/default.nix
@ -15,7 +15,7 @@ let
    python pytest nose cryptography pyyaml requests mock requests-mock
    python-dateutil setuptools;

-  version = "4.25";
+  version = "4.28.1";

 in

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    owner = "spaam";
    repo = "svtplay-dl";
    rev = version;
-    hash = "sha256-vYcBK7jgoBEC7dZ+5osJ/Q85wSNLXO02wcv9GHaa0Ds=";
+    hash = "sha256-z9DFtKTvnivY5D2EUHfrmndlUBTfico8o9G3J017f90=";
  };

  pythonPaths = [ cryptography pyyaml requests ];
--- a/pkgs/tools/misc/wasm-tools/default.nix
+++ b/pkgs/tools/misc/wasm-tools/default.nix
@ -5,17 +5,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "wasm-tools";
-  version = "1.0.45";
+  version = "1.0.48";

  src = fetchFromGitHub {
    owner = "bytecodealliance";
    repo = pname;
    rev = "${pname}-${version}";
-    hash = "sha256-8iIYExnWK9W9gVTV66ygY2gu3N1pwylUeOf6LOz51qA=";
+    hash = "sha256-7LAmU5Ay8Zf8wdKAj7am6cGmWtD5L+lUyxeiv1yv/A4=";
    fetchSubmodules = true;
  };

-  cargoHash = "sha256-KwtlgBcijeYRQ5Yfrqd6GirHkbZqAVd2/yP6aJT3pWM=";
+  # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
+  auditable = false;
+  cargoHash = "sha256-QWWz5c+D2UH+CWGJTaTEuAqHVIW4hu1cM7LWKO7K98Q=";
  cargoBuildFlags = [ "--package" "wasm-tools" ];
  cargoTestFlags = [ "--all" ];

--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@ -112,13 +112,6 @@ let
    hash = "sha256-s1ybRFCjQaSGj7LKu0Z5g7UiHqdJGeD+iPoQL0vaiS0=";
  };

-  patch-fix-aarch64-darwin-static = fetchpatch {
-    # https://github.com/NixOS/nix/pull/8068
-    name = "fix-aarch64-darwin-static.patch";
-    url = "https://github.com/NixOS/nix/commit/220aa8e0ac9d17de2c9f356a68be43b673d851a1.patch";
-    hash = "sha256-YrmFkVpwPreiig1/BsP+DInpTdQrPmS7bEY0WUGpw+c=";
-  };
-
 in lib.makeExtensible (self: ({
  nix_2_3 = (common rec {
    version = "2.3.16";
@ -164,11 +157,8 @@ in lib.makeExtensible (self: ({
  };

  nix_2_13 = common {
-    version = "2.13.5";
-    hash = "sha256-yHZMgMs/6/aQUwfMwmPUQov17JMGS7squLJsjmucnLc=";
-    patches = [
-      patch-fix-aarch64-darwin-static
-    ];
+    version = "2.13.6";
+    hash = "sha256-pd2yGmHWn4njfbrSP6cMJx8qL+yeGieqcbLNICzcRFs=";
  };

  nix_2_14 = common {
@ -215,7 +205,7 @@ in lib.makeExtensible (self: ({

  stable = self.nix_2_17;

-  unstable = self.stable;
+  unstable = self.nix_2_18;
 } // lib.optionalAttrs config.allowAliases {
  nix_2_4 = throw "nixVersions.nix_2_4 has been removed";

--- a/pkgs/tools/security/pass/rofi-pass.nix
+++ b/pkgs/tools/security/pass/rofi-pass.nix
@ -29,13 +29,13 @@ assert lib.assertOneOf "backend" backend [ "x11" "wayland" ];

 stdenv.mkDerivation {
  pname = "rofi-pass";
-  version = "unstable-2023-07-04";
+  version = "unstable-2023-07-07";

  src = fetchFromGitHub {
    owner = "carnager";
    repo = "rofi-pass";
-    rev = "fa16c0211d898d337e76397d22de4f92e2405ede";
-    hash = "sha256-GGa8ZNHZZD/sU+oL5ekHXxAe3bpX/42x6zO2LJuypNw=";
+    rev = "e77cbdbe0e885f0b1daba3a0b6bae793cc2b1ba3";
+    hash = "sha256-zmNuFE+++tf4pKTXSTc7s8R9rvI+XwgWl8mCEPaaIRM=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "trufflehog";
-  version = "3.60.0";
+  version = "3.60.1";

  src = fetchFromGitHub {
    owner = "trufflesecurity";
    repo = "trufflehog";
    rev = "refs/tags/v${version}";
-    hash = "sha256-43KKw9/EdXoD4nzWEvll2LhgI6Ipt3PYN6EpiD8fhQc=";
+    hash = "sha256-aZA/nIntTiYXvZE6sAjYyWfkm842+O6pwPFUKfnDrY4=";
  };

  vendorHash = "sha256-axB0JcvGeiqz1dBKHknNqW3XzQWaLCHk6gsB9QV3PN8=";
--- a/pkgs/tools/virtualization/kubevirt/default.nix
+++ b/pkgs/tools/virtualization/kubevirt/default.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "kubevirt";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "kubevirt";
    repo = "kubevirt";
    rev = "v${version}";
-    sha256 = "sha256-1Idfz2cMiIivroEkdRAA1x4v0BVACLoNCKSBS5o+wr4=";
+    sha256 = "sha256-L+spWtYuXq0bPYmE1eGnzTfCAh8Q3j5DUS+k6dNGdOU=";
  };

  vendorHash = null;
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -626,6 +626,7 @@ mapAliases ({
  opa = throw "opa has been removed from nixpkgs as upstream has abandoned the project"; # Added 2023-03-21
  opam_1_2 = throw "'opam_1_2' has been renamed to/replaced by 'opam'"; # Added 2023-03-08
  openafs_1_8 = openafs; # Added 2022-08-22
+  openbangla-keyboard = throw "openbangla-keyboard has been replaced by ibus-engines.openbangla-keyboard and fcitx5-openbangla-keyboard"; # added 2023-10-10
  opencascade = throw "'opencascade' has been removed as it is unmaintained; consider opencascade-occt instead'"; # Added 2023-09-18
  openconnect_head = openconnect_unstable; # Added 2022-03-29
  openconnect_gnutls = openconnect; # Added 2022-03-29
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -7053,6 +7053,8 @@ with pkgs;
      protobuf = pkgs.protobuf3_21.overrideDerivation (_: { stdenv = clangStdenv; });
    };

+    openbangla-keyboard = libsForQt5.callPackage ../applications/misc/openbangla-keyboard { withIbusSupport = true; };
+
    rime = callPackage ../tools/inputmethods/ibus-engines/ibus-rime { };

    table = callPackage ../tools/inputmethods/ibus-engines/ibus-table { };
@ -8114,6 +8116,8 @@ with pkgs;

  fcitx5-m17n = callPackage ../tools/inputmethods/fcitx5/fcitx5-m17n.nix { };

+  fcitx5-openbangla-keyboard = libsForQt5.callPackage ../applications/misc/openbangla-keyboard { withFcitx5Support = true; };
+
  fcitx5-gtk = callPackage ../tools/inputmethods/fcitx5/fcitx5-gtk.nix { };

  fcitx5-hangul = callPackage ../tools/inputmethods/fcitx5/fcitx5-hangul.nix { };
@ -11547,8 +11551,6 @@ with pkgs;
  openapi-generator-cli = callPackage ../tools/networking/openapi-generator-cli { jre = pkgs.jre_headless; };
  openapi-generator-cli-unstable = callPackage ../tools/networking/openapi-generator-cli/unstable.nix { jre = pkgs.jre_headless; };

-  openbangla-keyboard = libsForQt5.callPackage ../applications/misc/openbangla-keyboard { };
-
  openboard = libsForQt5.callPackage ../applications/graphics/openboard { };

  opencc = callPackage ../tools/text/opencc { };
@ -11886,6 +11888,13 @@ with pkgs;

  perceptualdiff = callPackage ../tools/graphics/perceptualdiff { };

+  percona-server_8_0 = callPackage ../servers/sql/percona-server/8.0.x.nix {
+    inherit (darwin) cctools developer_cmds DarwinTools;
+    inherit (darwin.apple_sdk.frameworks) CoreServices;
+    boost = boost177; # Configure checks for specific version.
+    icu = icu69;
+    protobuf = protobuf3_21;
+  };
  percona-xtrabackup = percona-xtrabackup_8_0;
  percona-xtrabackup_8_0 = callPackage ../tools/backup/percona-xtrabackup/8_0.nix {
    boost = boost177;
@ -19548,6 +19557,8 @@ with pkgs;

  kustomize_3 = callPackage ../development/tools/kustomize/3.nix { };

+  kustomize_4 = callPackage ../development/tools/kustomize/4.nix { };
+
  kustomize-sops = callPackage ../development/tools/kustomize/kustomize-sops.nix { };

  ktlint = callPackage ../development/tools/ktlint { };
@ -27478,9 +27489,7 @@ with pkgs;

  zookeeper = callPackage ../servers/zookeeper { };

-  zookeeper_mt = callPackage ../development/libraries/zookeeper_mt {
-    openssl = openssl_1_1;
-  };
+  zookeeper_mt = callPackage ../development/libraries/zookeeper_mt { };

  xqilla = callPackage ../development/tools/xqilla { stdenv = gcc10StdenvCompat; };