Merge staging-next into staging

2023-10-10 18:01:26 +00:00 · 2023-10-10 18:01:26 +00:00 · 0cf0d9af7e
commit 0cf0d9af7e
parent c11cb00a1e b1ae965cda
78 changed files with 953 additions and 619 deletions
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@ -542,6 +542,36 @@ rec {
    attrs:
    map (name: f name attrs.${name}) (attrNames attrs);

+  /*
+    Deconstruct an attrset to a list of name-value pairs as expected by [`builtins.listToAttrs`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-listToAttrs).
+    Each element of the resulting list is an attribute set with these attributes:
+    - `name` (string): The name of the attribute
+    - `value` (any): The value of the attribute
+
+    The following is always true:
+    ```nix
+    builtins.listToAttrs (attrsToList attrs) == attrs
+    ```
+
+    :::{.warning}
+    The opposite is not always true. In general expect that
+    ```nix
+    attrsToList (builtins.listToAttrs list) != list
+    ```
+
+    This is because the `listToAttrs` removes duplicate names and doesn't preserve the order of the list.
+    :::
+
+    Example:
+      attrsToList { foo = 1; bar = "asdf"; }
+      => [ { name = "bar"; value = "asdf"; } { name = "foo"; value = 1; } ]
+
+    Type:
+      attrsToList :: AttrSet -> [ { name :: String; value :: Any; } ]
+
+  */
+  attrsToList = mapAttrsToList nameValuePair;
+

  /* Like `mapAttrs`, except that it recursively applies itself to
     the *leaf* attributes of a potentially-nested attribute set:
--- a/lib/default.nix
+++ b/lib/default.nix
@ -81,8 +81,8 @@ let
    inherit (self.attrsets) attrByPath hasAttrByPath setAttrByPath
      getAttrFromPath attrVals attrValues getAttrs catAttrs filterAttrs
      filterAttrsRecursive foldlAttrs foldAttrs collect nameValuePair mapAttrs
-      mapAttrs' mapAttrsToList concatMapAttrs mapAttrsRecursive mapAttrsRecursiveCond
-      genAttrs isDerivation toDerivation optionalAttrs
+      mapAttrs' mapAttrsToList attrsToList concatMapAttrs mapAttrsRecursive
+      mapAttrsRecursiveCond genAttrs isDerivation toDerivation optionalAttrs
      zipAttrsWithNames zipAttrsWith zipAttrs recursiveUpdateUntil
      recursiveUpdate matchAttrs overrideExisting showAttrPath getOutput getBin
      getLib getDev getMan chooseDevOutputs zipWithNames zip
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -20,6 +20,10 @@ let
    expr = (builtins.tryEval (builtins.seq expr "didn't throw"));
    expected = { success = false; value = false; };
  };
+  testingEval = expr: {
+    expr = (builtins.tryEval expr).success;
+    expected = true;
+  };
  testingDeepThrow = expr: testingThrow (builtins.deepSeq expr expr);

  testSanitizeDerivationName = { name, expected }:
@ -816,6 +820,26 @@ runTests {
    expected = { a = 1; b = 2; };
  };

+  testListAttrsReverse = let
+    exampleAttrs = {foo=1; bar="asdf"; baz = [1 3 3 7]; fnord=null;};
+    exampleSingletonList = [{name="foo"; value=1;}];
+  in {
+    expr = {
+      isReverseToListToAttrs = builtins.listToAttrs (attrsToList exampleAttrs) == exampleAttrs;
+      isReverseToAttrsToList = attrsToList (builtins.listToAttrs exampleSingletonList) == exampleSingletonList;
+      testDuplicatePruningBehaviour = attrsToList (builtins.listToAttrs [{name="a"; value=2;} {name="a"; value=1;}]);
+    };
+    expected = {
+      isReverseToAttrsToList = true;
+      isReverseToListToAttrs = true;
+      testDuplicatePruningBehaviour = [{name="a"; value=2;}];
+    };
+  };
+
+  testAttrsToListsCanDealWithFunctions = testingEval (
+    attrsToList { someFunc= a: a + 1;}
+  );
+
 # GENERATORS
 # these tests assume attributes are converted to lists
 # in alphabetical order
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@ -1,27 +1,25 @@
 #! @python3@/bin/python3 -B
 import argparse
-import shutil
-import os
-import sys
-import errno
-import subprocess
-import glob
-import tempfile
-import errno
-import warnings
 import ctypes
-libc = ctypes.CDLL("libc.so.6")
-import re
 import datetime
+import errno
 import glob
+import os
 import os.path
-from typing import NamedTuple, List, Optional
-from packaging import version
+import re
+import shutil
+import subprocess
+import sys
+import warnings
+from typing import NamedTuple
+
+
+libc = ctypes.CDLL("libc.so.6")

 class SystemIdentifier(NamedTuple):
-    profile: Optional[str]
+    profile: str | None
    generation: int
-    specialisation: Optional[str]
+    specialisation: str | None


 def copy_if_not_exists(source: str, dest: str) -> None:
@ -29,13 +27,13 @@ def copy_if_not_exists(source: str, dest: str) -> None:
        shutil.copyfile(source, dest)


-def generation_dir(profile: Optional[str], generation: int) -> str:
+def generation_dir(profile: str | None, generation: int) -> str:
    if profile:
        return "/nix/var/nix/profiles/system-profiles/%s-%d-link" % (profile, generation)
    else:
        return "/nix/var/nix/profiles/system-%d-link" % (generation)

-def system_dir(profile: Optional[str], generation: int, specialisation: Optional[str]) -> str:
+def system_dir(profile: str | None, generation: int, specialisation: str | None) -> str:
    d = generation_dir(profile, generation)
    if specialisation:
        return os.path.join(d, "specialisation", specialisation)
@ -49,7 +47,7 @@ initrd {initrd}
 options {kernel_params}
 """

-def generation_conf_filename(profile: Optional[str], generation: int, specialisation: Optional[str]) -> str:
+def generation_conf_filename(profile: str | None, generation: int, specialisation: str | None) -> str:
    pieces = [
        "nixos",
        profile or None,
@ -60,22 +58,24 @@ def generation_conf_filename(profile: Optional[str], generation: int, specialisa
    return "-".join(p for p in pieces if p) + ".conf"


-def write_loader_conf(profile: Optional[str], generation: int, specialisation: Optional[str]) -> None:
+def write_loader_conf(profile: str | None, generation: int, specialisation: str | None) -> None:
    with open("@efiSysMountPoint@/loader/loader.conf.tmp", 'w') as f:
        if "@timeout@" != "":
            f.write("timeout @timeout@\n")
        f.write("default %s\n" % generation_conf_filename(profile, generation, specialisation))
        if not @editor@:
-            f.write("editor 0\n");
-        f.write("console-mode @consoleMode@\n");
+            f.write("editor 0\n")
+        f.write("console-mode @consoleMode@\n")
+        f.flush()
+        os.fsync(f.fileno())
    os.rename("@efiSysMountPoint@/loader/loader.conf.tmp", "@efiSysMountPoint@/loader/loader.conf")


-def profile_path(profile: Optional[str], generation: int, specialisation: Optional[str], name: str) -> str:
+def profile_path(profile: str | None, generation: int, specialisation: str | None, name: str) -> str:
    return os.path.realpath("%s/%s" % (system_dir(profile, generation, specialisation), name))


-def copy_from_profile(profile: Optional[str], generation: int, specialisation: Optional[str], name: str, dry_run: bool = False) -> str:
+def copy_from_profile(profile: str | None, generation: int, specialisation: str | None, name: str, dry_run: bool = False) -> str:
    store_file_path = profile_path(profile, generation, specialisation, name)
    suffix = os.path.basename(store_file_path)
    store_dir = os.path.basename(os.path.dirname(store_file_path))
@ -85,7 +85,7 @@ def copy_from_profile(profile: Optional[str], generation: int, specialisation: O
    return efi_file_path


-def describe_generation(profile: Optional[str], generation: int, specialisation: Optional[str]) -> str:
+def describe_generation(profile: str | None, generation: int, specialisation: str | None) -> str:
    try:
        with open(profile_path(profile, generation, specialisation, "nixos-version")) as f:
            nixos_version = f.read()
@ -106,7 +106,7 @@ def describe_generation(profile: Optional[str], generation: int, specialisation:
    return description


-def write_entry(profile: Optional[str], generation: int, specialisation: Optional[str],
+def write_entry(profile: str | None, generation: int, specialisation: str | None,
                machine_id: str, current: bool) -> None:
    kernel = copy_from_profile(profile, generation, specialisation, "kernel")
    initrd = copy_from_profile(profile, generation, specialisation, "initrd")
@ -145,18 +145,12 @@ def write_entry(profile: Optional[str], generation: int, specialisation: Optiona
                    description=describe_generation(profile, generation, specialisation)))
        if machine_id is not None:
            f.write("machine-id %s\n" % machine_id)
+        f.flush()
+        os.fsync(f.fileno())
    os.rename(tmp_path, entry_file)


-def mkdir_p(path: str) -> None:
-    try:
-        os.makedirs(path)
-    except OSError as e:
-        if e.errno != errno.EEXIST or not os.path.isdir(path):
-            raise
-
-
-def get_generations(profile: Optional[str] = None) -> List[SystemIdentifier]:
+def get_generations(profile: str | None = None) -> list[SystemIdentifier]:
    gen_list = subprocess.check_output([
        "@nix@/bin/nix-env",
        "--list-generations",
@ -179,7 +173,7 @@ def get_generations(profile: Optional[str] = None) -> List[SystemIdentifier]:
    return configurations[-configurationLimit:]


-def get_specialisations(profile: Optional[str], generation: int, _: Optional[str]) -> List[SystemIdentifier]:
+def get_specialisations(profile: str | None, generation: int, _: str | None) -> list[SystemIdentifier]:
    specialisations_dir = os.path.join(
            system_dir(profile, generation, None), "specialisation")
    if not os.path.exists(specialisations_dir):
@ -187,9 +181,9 @@ def get_specialisations(profile: Optional[str], generation: int, _: Optional[str
    return [SystemIdentifier(profile, generation, spec) for spec in os.listdir(specialisations_dir)]


-def remove_old_entries(gens: List[SystemIdentifier]) -> None:
-    rex_profile = re.compile("^@efiSysMountPoint@/loader/entries/nixos-(.*)-generation-.*\.conf$")
-    rex_generation = re.compile("^@efiSysMountPoint@/loader/entries/nixos.*-generation-([0-9]+)(-specialisation-.*)?\.conf$")
+def remove_old_entries(gens: list[SystemIdentifier]) -> None:
+    rex_profile = re.compile(r"^@efiSysMountPoint@/loader/entries/nixos-(.*)-generation-.*\.conf$")
+    rex_generation = re.compile(r"^@efiSysMountPoint@/loader/entries/nixos.*-generation-([0-9]+)(-specialisation-.*)?\.conf$")
    known_paths = []
    for gen in gens:
        known_paths.append(copy_from_profile(*gen, "kernel", True))
@ -210,7 +204,7 @@ def remove_old_entries(gens: List[SystemIdentifier]) -> None:
            os.unlink(path)


-def get_profiles() -> List[str]:
+def get_profiles() -> list[str]:
    if os.path.isdir("/nix/var/nix/profiles/system-profiles/"):
        return [x
            for x in os.listdir("/nix/var/nix/profiles/system-profiles/")
@ -218,11 +212,7 @@ def get_profiles() -> List[str]:
    else:
        return []

-def main() -> None:
-    parser = argparse.ArgumentParser(description='Update @distroName@-related systemd-boot files')
-    parser.add_argument('default_config', metavar='DEFAULT-CONFIG', help='The default @distroName@ config to boot')
-    args = parser.parse_args()
-
+def install_bootloader(args: argparse.Namespace) -> None:
    try:
        with open("/etc/machine-id") as machine_file:
            machine_id = machine_file.readlines()[0]
@ -273,21 +263,15 @@ def main() -> None:
        if available_match is None:
            raise Exception("could not determine systemd-boot version")

-        installed_version = version.parse(installed_match.group(1))
-        available_version = version.parse(available_match.group(1))
+        installed_version = installed_match.group(1)
+        available_version = available_match.group(1)

-        # systemd 252 has a regression that leaves some machines unbootable, so we skip that update.
-        # The fix is in 252.2
-        # See https://github.com/systemd/systemd/issues/25363 and https://github.com/NixOS/nixpkgs/pull/201558#issuecomment-1348603263
        if installed_version < available_version:
-            if version.parse('252') <= available_version < version.parse('252.2'):
-                print("skipping systemd-boot update to %s because of known regression" % available_version)
-            else:
-                print("updating systemd-boot from %s to %s" % (installed_version, available_version))
-                subprocess.check_call(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@"] + bootctl_flags + ["update"])
+            print("updating systemd-boot from %s to %s" % (installed_version, available_version))
+            subprocess.check_call(["@systemd@/bin/bootctl", "--esp-path=@efiSysMountPoint@", "update"])

-    mkdir_p("@efiSysMountPoint@/efi/nixos")
-    mkdir_p("@efiSysMountPoint@/loader/entries")
+    os.makedirs("@efiSysMountPoint@/efi/nixos", exist_ok=True)
+    os.makedirs("@efiSysMountPoint@/loader/entries", exist_ok=True)

    gens = get_generations()
    for profile in get_profiles():
@ -324,17 +308,26 @@ def main() -> None:
            os.rmdir(actual_root)
        os.rmdir(root)

-    mkdir_p("@efiSysMountPoint@/efi/nixos/.extra-files")
+    os.makedirs("@efiSysMountPoint@/efi/nixos/.extra-files", exist_ok=True)

    subprocess.check_call("@copyExtraFiles@")

-    # Since fat32 provides little recovery facilities after a crash,
-    # it can leave the system in an unbootable state, when a crash/outage
-    # happens shortly after an update. To decrease the likelihood of this
-    # event sync the efi filesystem after each update.
-    rc = libc.syncfs(os.open("@efiSysMountPoint@", os.O_RDONLY))
-    if rc != 0:
-        print("could not sync @efiSysMountPoint@: {}".format(os.strerror(rc)), file=sys.stderr)
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description='Update @distroName@-related systemd-boot files')
+    parser.add_argument('default_config', metavar='DEFAULT-CONFIG', help='The default @distroName@ config to boot')
+    args = parser.parse_args()
+
+    try:
+        install_bootloader(args)
+    finally:
+        # Since fat32 provides little recovery facilities after a crash,
+        # it can leave the system in an unbootable state, when a crash/outage
+        # happens shortly after an update. To decrease the likelihood of this
+        # event sync the efi filesystem after each update.
+        rc = libc.syncfs(os.open("@efiSysMountPoint@", os.O_RDONLY))
+        if rc != 0:
+            print("could not sync @efiSysMountPoint@: {}".format(os.strerror(rc)), file=sys.stderr)


 if __name__ == '__main__':
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix
@ -7,14 +7,12 @@ let

  efi = config.boot.loader.efi;

-  python3 = pkgs.python3.withPackages (ps: [ ps.packaging ]);
-
  systemdBootBuilder = pkgs.substituteAll {
    src = ./systemd-boot-builder.py;

    isExecutable = true;

-    inherit python3;
+    inherit (pkgs) python3;

    systemd = config.systemd.package;

@ -52,7 +50,7 @@ let
  };

  checkedSystemdBootBuilder = pkgs.runCommand "systemd-boot" {
-    nativeBuildInputs = [ pkgs.mypy python3 ];
+    nativeBuildInputs = [ pkgs.mypy ];
  } ''
    install -m755 ${systemdBootBuilder} $out
    mypy \
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@ -107,7 +107,7 @@ in
      )

      output = machine.succeed("/run/current-system/bin/switch-to-configuration boot")
-      assert "updating systemd-boot from 000.0-1-notnixos to " in output
+      assert "updating systemd-boot from 000.0-1-notnixos to " in output, "Couldn't find systemd-boot update message"
    '';
  };

--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@ -1,164 +1,55 @@
-{ stdenv, lib, makeDesktopItem
-, unzip, libsecret, libXScrnSaver, libxshmfence, buildPackages
-, at-spi2-atk, autoPatchelfHook, alsa-lib, mesa, nss, nspr, xorg
-, systemd, fontconfig, libdbusmenu, glib, buildFHSEnv, wayland
-, libglvnd, libkrb5
+{ stdenv
+, lib
+, makeDesktopItem
+, unzip
+, libsecret
+, libXScrnSaver
+, libxshmfence
+, buildPackages
+, at-spi2-atk
+, autoPatchelfHook
+, alsa-lib
+, mesa
+, nss
+, nspr
+, xorg
+, systemd
+, fontconfig
+, libdbusmenu
+, glib
+, buildFHSEnv
+, wayland
+, libglvnd
+, libkrb5

-# Populate passthru.tests
+  # Populate passthru.tests
 , tests

-# needed to fix "Save as Root"
-, asar, bash
+  # needed to fix "Save as Root"
+, asar
+, bash

-# Attributes inherit from specific versions
-, version, src, meta, sourceRoot, commandLineArgs
-, executableName, longName, shortName, pname, updateScript
+  # Attributes inherit from specific versions
+, version
+, src
+, meta
+, sourceRoot
+, commandLineArgs
+, executableName
+, longName
+, shortName
+, pname
+, updateScript
 , dontFixup ? false
-, rev ? null, vscodeServer ? null
+, rev ? null
+, vscodeServer ? null
 , sourceExecutableName ? executableName
 , useVSCodeRipgrep ? false
 , ripgrep
 }:

+stdenv.mkDerivation (finalAttrs:
 let
-  unwrapped = stdenv.mkDerivation {
-
-    inherit pname version src sourceRoot dontFixup;
-
-    passthru = {
-      inherit executableName longName tests updateScript;
-      fhs = fhs {};
-      fhsWithPackages = f: fhs { additionalPkgs = f; };
-    } // lib.optionalAttrs (vscodeServer != null) {
-      inherit rev vscodeServer;
-    };
-
-    desktopItem = makeDesktopItem {
-      name = executableName;
-      desktopName = longName;
-      comment = "Code Editing. Redefined.";
-      genericName = "Text Editor";
-      exec = "${executableName} %F";
-      icon = "vs${executableName}";
-      startupNotify = true;
-      startupWMClass = shortName;
-      categories = [ "Utility" "TextEditor" "Development" "IDE" ];
-      mimeTypes = [ "text/plain" "inode/directory" ];
-      keywords = [ "vscode" ];
-      actions.new-empty-window = {
-        name = "New Empty Window";
-        exec = "${executableName} --new-window %F";
-        icon = "vs${executableName}";
-      };
-    };
-
-    urlHandlerDesktopItem = makeDesktopItem {
-      name = executableName + "-url-handler";
-      desktopName = longName + " - URL Handler";
-      comment = "Code Editing. Redefined.";
-      genericName = "Text Editor";
-      exec = executableName + " --open-url %U";
-      icon = "vs${executableName}";
-      startupNotify = true;
-      categories = [ "Utility" "TextEditor" "Development" "IDE" ];
-      mimeTypes = [ "x-scheme-handler/vscode" ];
-      keywords = [ "vscode" ];
-      noDisplay = true;
-    };
-
-    buildInputs = [ libsecret libXScrnSaver libxshmfence ]
-      ++ lib.optionals (!stdenv.isDarwin) [ alsa-lib at-spi2-atk libkrb5 mesa nss nspr systemd xorg.libxkbfile ];
-
-    runtimeDependencies = lib.optionals stdenv.isLinux [ (lib.getLib systemd) fontconfig.lib libdbusmenu wayland libsecret ];
-
-    nativeBuildInputs = [ unzip ]
-      ++ lib.optionals stdenv.isLinux [
-        autoPatchelfHook
-        asar
-        # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
-        (buildPackages.wrapGAppsHook.override { inherit (buildPackages) makeWrapper; })
-      ];
-
-    dontBuild = true;
-    dontConfigure = true;
-    noDumpEnvVars = true;
-
-    installPhase = ''
-      runHook preInstall
-    '' + (if stdenv.isDarwin then ''
-      mkdir -p "$out/Applications/${longName}.app" "$out/bin"
-      cp -r ./* "$out/Applications/${longName}.app"
-      ln -s "$out/Applications/${longName}.app/Contents/Resources/app/bin/${sourceExecutableName}" "$out/bin/${executableName}"
-    '' else ''
-      mkdir -p "$out/lib/vscode" "$out/bin"
-      cp -r ./* "$out/lib/vscode"
-
-      ln -s "$out/lib/vscode/bin/${sourceExecutableName}" "$out/bin/${executableName}"
-
-      mkdir -p "$out/share/applications"
-      ln -s "$desktopItem/share/applications/${executableName}.desktop" "$out/share/applications/${executableName}.desktop"
-      ln -s "$urlHandlerDesktopItem/share/applications/${executableName}-url-handler.desktop" "$out/share/applications/${executableName}-url-handler.desktop"
-
-      # These are named vscode.png, vscode-insiders.png, etc to match the name in upstream *.deb packages.
-      mkdir -p "$out/share/pixmaps"
-      cp "$out/lib/vscode/resources/app/resources/linux/code.png" "$out/share/pixmaps/vs${executableName}.png"
-
-      # Override the previously determined VSCODE_PATH with the one we know to be correct
-      sed -i "/ELECTRON=/iVSCODE_PATH='$out/lib/vscode'" "$out/bin/${executableName}"
-      grep -q "VSCODE_PATH='$out/lib/vscode'" "$out/bin/${executableName}" # check if sed succeeded
-
-      # Remove native encryption code, as it derives the key from the executable path which does not work for us.
-      # The credentials should be stored in a secure keychain already, so the benefit of this is questionable
-      # in the first place.
-      rm -rf $out/lib/vscode/resources/app/node_modules/vscode-encrypt
-    '') + ''
-      runHook postInstall
-    '';
-
-    preFixup = ''
-      gappsWrapperArgs+=(
-        # Add gio to PATH so that moving files to the trash works when not using a desktop environment
-        --prefix PATH : ${glib.bin}/bin
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
-        --add-flags ${lib.escapeShellArg commandLineArgs}
-      )
-    '';
-
-    # See https://github.com/NixOS/nixpkgs/issues/49643#issuecomment-873853897
-    # linux only because of https://github.com/NixOS/nixpkgs/issues/138729
-    postPatch = lib.optionalString stdenv.isLinux ''
-      # this is a fix for "save as root" functionality
-      packed="resources/app/node_modules.asar"
-      unpacked="resources/app/node_modules"
-      asar extract "$packed" "$unpacked"
-      substituteInPlace $unpacked/@vscode/sudo-prompt/index.js \
-        --replace "/usr/bin/pkexec" "/run/wrappers/bin/pkexec" \
-        --replace "/bin/bash" "${bash}/bin/bash"
-      rm -rf "$packed"
-
-      # without this symlink loading JsChardet, the library that is used for auto encoding detection when files.autoGuessEncoding is true,
-      # fails to load with: electron/js2c/renderer_init: Error: Cannot find module 'jschardet'
-      # and the window immediately closes which renders VSCode unusable
-      # see https://github.com/NixOS/nixpkgs/issues/152939 for full log
-      ln -rs "$unpacked" "$packed"
-    '' + (let
-      vscodeRipgrep = if stdenv.isDarwin then
-        "Contents/Resources/app/node_modules.asar.unpacked/@vscode/ripgrep/bin/rg"
-      else
-        "resources/app/node_modules/@vscode/ripgrep/bin/rg";
-    in if !useVSCodeRipgrep then ''
-      rm ${vscodeRipgrep}
-      ln -s ${ripgrep}/bin/rg ${vscodeRipgrep}
-    '' else ''
-      chmod +x ${vscodeRipgrep}
-    '');
-
-    postFixup = lib.optionalString stdenv.isLinux ''
-      patchelf --add-needed ${libglvnd}/lib/libGLESv2.so.2 $out/lib/vscode/${executableName}
-    '';
-
-    inherit meta;
-  };

  # Vscode and variants allow for users to download and use extensions
  # which often include the usage of pre-built binaries.
@ -169,7 +60,7 @@ let
  #
  # buildFHSEnv allows for users to use the existing vscode
  # extension tooling without significant pain.
-  fhs = { additionalPkgs ? pkgs: [] }: buildFHSEnv {
+  fhs = { additionalPkgs ? pkgs: [ ] }: buildFHSEnv {
    # also determines the name of the wrapped command
    name = executableName;

@ -197,10 +88,10 @@ let

    # symlink shared assets, including icons and desktop entries
    extraInstallCommands = ''
-      ln -s "${unwrapped}/share" "$out/"
+      ln -s "${finalAttrs.finalPackage}/share" "$out/"
    '';

-    runScript = "${unwrapped}/bin/${executableName}";
+    runScript = "${finalAttrs.finalPackage}/bin/${executableName}";

    # vscode likes to kill the parent so that the
    # gui application isn't attached to the terminal session
@ -208,7 +99,7 @@ let

    passthru = {
      inherit executableName;
-      inherit (unwrapped) pname version; # for home-manager module
+      inherit (finalAttrs.finalPackage) pname version; # for home-manager module
    };

    meta = meta // {
@ -219,4 +110,145 @@ let
    };
  };
 in
-  unwrapped
+{
+
+  inherit pname version src sourceRoot dontFixup;
+
+  passthru = {
+    inherit executableName longName tests updateScript;
+    fhs = fhs { };
+    fhsWithPackages = f: fhs { additionalPkgs = f; };
+  } // lib.optionalAttrs (vscodeServer != null) {
+    inherit rev vscodeServer;
+  };
+
+  desktopItem = makeDesktopItem {
+    name = executableName;
+    desktopName = longName;
+    comment = "Code Editing. Redefined.";
+    genericName = "Text Editor";
+    exec = "${executableName} %F";
+    icon = "vs${executableName}";
+    startupNotify = true;
+    startupWMClass = shortName;
+    categories = [ "Utility" "TextEditor" "Development" "IDE" ];
+    mimeTypes = [ "text/plain" "inode/directory" ];
+    keywords = [ "vscode" ];
+    actions.new-empty-window = {
+      name = "New Empty Window";
+      exec = "${executableName} --new-window %F";
+      icon = "vs${executableName}";
+    };
+  };
+
+  urlHandlerDesktopItem = makeDesktopItem {
+    name = executableName + "-url-handler";
+    desktopName = longName + " - URL Handler";
+    comment = "Code Editing. Redefined.";
+    genericName = "Text Editor";
+    exec = executableName + " --open-url %U";
+    icon = "vs${executableName}";
+    startupNotify = true;
+    categories = [ "Utility" "TextEditor" "Development" "IDE" ];
+    mimeTypes = [ "x-scheme-handler/vscode" ];
+    keywords = [ "vscode" ];
+    noDisplay = true;
+  };
+
+  buildInputs = [ libsecret libXScrnSaver libxshmfence ]
+    ++ lib.optionals (!stdenv.isDarwin) [ alsa-lib at-spi2-atk libkrb5 mesa nss nspr systemd xorg.libxkbfile ];
+
+  runtimeDependencies = lib.optionals stdenv.isLinux [ (lib.getLib systemd) fontconfig.lib libdbusmenu wayland libsecret ];
+
+  nativeBuildInputs = [ unzip ]
+    ++ lib.optionals stdenv.isLinux [
+    autoPatchelfHook
+    asar
+    # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
+    (buildPackages.wrapGAppsHook.override { inherit (buildPackages) makeWrapper; })
+  ];
+
+  dontBuild = true;
+  dontConfigure = true;
+  noDumpEnvVars = true;
+
+  installPhase = ''
+    runHook preInstall
+  '' + (if stdenv.isDarwin then ''
+    mkdir -p "$out/Applications/${longName}.app" "$out/bin"
+    cp -r ./* "$out/Applications/${longName}.app"
+    ln -s "$out/Applications/${longName}.app/Contents/Resources/app/bin/${sourceExecutableName}" "$out/bin/${executableName}"
+  '' else ''
+    mkdir -p "$out/lib/vscode" "$out/bin"
+    cp -r ./* "$out/lib/vscode"
+
+    ln -s "$out/lib/vscode/bin/${sourceExecutableName}" "$out/bin/${executableName}"
+
+    mkdir -p "$out/share/applications"
+    ln -s "$desktopItem/share/applications/${executableName}.desktop" "$out/share/applications/${executableName}.desktop"
+    ln -s "$urlHandlerDesktopItem/share/applications/${executableName}-url-handler.desktop" "$out/share/applications/${executableName}-url-handler.desktop"
+
+    # These are named vscode.png, vscode-insiders.png, etc to match the name in upstream *.deb packages.
+    mkdir -p "$out/share/pixmaps"
+    cp "$out/lib/vscode/resources/app/resources/linux/code.png" "$out/share/pixmaps/vs${executableName}.png"
+
+    # Override the previously determined VSCODE_PATH with the one we know to be correct
+    sed -i "/ELECTRON=/iVSCODE_PATH='$out/lib/vscode'" "$out/bin/${executableName}"
+    grep -q "VSCODE_PATH='$out/lib/vscode'" "$out/bin/${executableName}" # check if sed succeeded
+
+    # Remove native encryption code, as it derives the key from the executable path which does not work for us.
+    # The credentials should be stored in a secure keychain already, so the benefit of this is questionable
+    # in the first place.
+    rm -rf $out/lib/vscode/resources/app/node_modules/vscode-encrypt
+  '') + ''
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      # Add gio to PATH so that moving files to the trash works when not using a desktop environment
+      --prefix PATH : ${glib.bin}/bin
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags ${lib.escapeShellArg commandLineArgs}
+    )
+  '';
+
+  # See https://github.com/NixOS/nixpkgs/issues/49643#issuecomment-873853897
+  # linux only because of https://github.com/NixOS/nixpkgs/issues/138729
+  postPatch = lib.optionalString stdenv.isLinux ''
+    # this is a fix for "save as root" functionality
+    packed="resources/app/node_modules.asar"
+    unpacked="resources/app/node_modules"
+    asar extract "$packed" "$unpacked"
+    substituteInPlace $unpacked/@vscode/sudo-prompt/index.js \
+      --replace "/usr/bin/pkexec" "/run/wrappers/bin/pkexec" \
+      --replace "/bin/bash" "${bash}/bin/bash"
+    rm -rf "$packed"
+
+    # without this symlink loading JsChardet, the library that is used for auto encoding detection when files.autoGuessEncoding is true,
+    # fails to load with: electron/js2c/renderer_init: Error: Cannot find module 'jschardet'
+    # and the window immediately closes which renders VSCode unusable
+    # see https://github.com/NixOS/nixpkgs/issues/152939 for full log
+    ln -rs "$unpacked" "$packed"
+  '' + (
+    let
+      vscodeRipgrep =
+        if stdenv.isDarwin then
+          "Contents/Resources/app/node_modules.asar.unpacked/@vscode/ripgrep/bin/rg"
+        else
+          "resources/app/node_modules/@vscode/ripgrep/bin/rg";
+    in
+    if !useVSCodeRipgrep then ''
+      rm ${vscodeRipgrep}
+      ln -s ${ripgrep}/bin/rg ${vscodeRipgrep}
+    '' else ''
+      chmod +x ${vscodeRipgrep}
+    ''
+  );
+
+  postFixup = lib.optionalString stdenv.isLinux ''
+    patchelf --add-needed ${libglvnd}/lib/libGLESv2.so.2 $out/lib/vscode/${executableName}
+  '';
+
+  inherit meta;
+})
--- a/pkgs/applications/emulators/wineasio/default.nix
+++ b/pkgs/applications/emulators/wineasio/default.nix
@ -9,13 +9,13 @@

 multiStdenv.mkDerivation rec {
  pname = "wineasio";
-  version = "1.1.0";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-HEnJj9yfXe+NQuPATMpPvseFs+3TkiMLd1L+fIfQd+o=";
+    hash = "sha256-d5BGJAkaM5XZXyqm6K/UzFE4sD6QVHHGnLi1bcHxiaM=";
    fetchSubmodules = true;
  };

@ -36,10 +36,10 @@ multiStdenv.mkDerivation rec {

  installPhase = ''
    runHook preInstall
-    install -D build32/wineasio.dll $out/lib/wine/i386-windows/wineasio.dll
-    install -D build32/wineasio.dll.so $out/lib/wine/i386-unix/wineasio.dll.so
-    install -D build64/wineasio.dll $out/lib/wine/x86_64-windows/wineasio.dll
-    install -D build64/wineasio.dll.so $out/lib/wine/x86_64-unix/wineasio.dll.so
+    install -D build32/wineasio32.dll    $out/lib/wine/i386-windows/wineasio32.dll
+    install -D build32/wineasio32.dll.so $out/lib/wine/i386-unix/wineasio32.dll.so
+    install -D build64/wineasio64.dll    $out/lib/wine/x86_64-windows/wineasio64.dll
+    install -D build64/wineasio64.dll.so $out/lib/wine/x86_64-unix/wineasio64.dll.so
    runHook postInstall
  '';

--- a/pkgs/applications/misc/jotta-cli/default.nix
+++ b/pkgs/applications/misc/jotta-cli/default.nix
@ -5,10 +5,10 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "jotta-cli";
-  version = "0.15.89752";
+  version = "0.15.93226";
  src = fetchzip {
      url = "https://repo.jotta.us/archives/linux/${arch}/jotta-cli-${version}_linux_${arch}.tar.gz";
-      sha256 = "sha256-vYI9jbY2npPrmP0lMRSbLneVbQvQVsL0plM5jOvtdzA=";
+      sha256 = "sha256-RMN/OQHnHCx/xbi/J9LiK6m0TkPvd34GtmR6lr66pKs=";
      stripRoot = false;
    };

--- a/pkgs/applications/networking/calls/default.nix
+++ b/pkgs/applications/networking/calls/default.nix
@ -33,7 +33,7 @@

 stdenv.mkDerivation rec {
  pname = "calls";
-  version = "44.2";
+  version = "45.0";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
    repo = pname;
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-mdv/yDUi6tzYc3C7dtmkAWtk4IqzHvOZVO2CA3TP9TE=";
+    hash = "sha256-NIQFKVpZSxY2QOb73WfYsCzMQwB9XySoADCL7IlmGe8=";
  };

  outputs = [ "out" "devdoc" ];
--- a/pkgs/applications/networking/nload/default.nix
+++ b/pkgs/applications/networking/nload/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, ncurses }:
+{ lib, stdenv, fetchurl, fetchpatch, ncurses, autoreconfHook }:

 stdenv.mkDerivation rec {
  version = "0.7.4";
@ -20,8 +20,23 @@ stdenv.mkDerivation rec {
      name = "nload-0.7.4-Eliminate-flicker-on-some-terminals.patch";
      sha256 = "10yppy5l50wzpcvagsqkbyf1rcan6aj30am4rw8hmkgnbidf4zbq";
    })
+    # Patches configure.in file to make configure compile on macOS.
+    # Patch taken from MacPorts.
+    (fetchpatch {
+      url = "https://github.com/macports/macports-ports/raw/28814c34711e7545929fd391feb6ce079bd73fd4/net/nload/files/patch-configure.in.diff";
+      extraPrefix = "";
+      hash = "sha256-lGbBG5ZOgMVnrwlwXVFGbUZx6RkmQwYSVLB3oqkAWRs=";
+    })
+    # Fixes crash on F2 and garbage in adapter name.
+    # Patch taken from Homebrew.
+    (fetchpatch {
+      url = "https://sourceforge.net/p/nload/bugs/_discuss/thread/c9b68d8e/4a65/attachment/devreader-bsd.cpp.patch";
+      extraPrefix = "";
+      hash = "sha256-umRQDqcRUOGELOx5iB6CPFRkjaD8HXkMCWiKsYdaUa0=";
+    })
  ];

+  nativeBuildInputs = lib.optional stdenv.isDarwin autoreconfHook;
  buildInputs = [ ncurses ];

  meta = {
@ -34,7 +49,7 @@ stdenv.mkDerivation rec {
    '';
    homepage = "http://www.roland-riegel.de/nload/index.html";
    license = lib.licenses.gpl2;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
    maintainers = [ lib.maintainers.devhell ];
    mainProgram = "nload";
  };
--- a/pkgs/applications/science/logic/kissat/default.nix
+++ b/pkgs/applications/science/logic/kissat/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "kissat";
-  version = "3.1.0";
+  version = "3.1.1";

  src = fetchFromGitHub {
    owner = "arminbiere";
    repo = "kissat";
    rev = "rel-${version}";
-    sha256 = "sha256-AFUVkkD+toOfVEvIKfz3ncEdABLRxs9yQ8aJx6Q0ETM=";
+    sha256 = "sha256-zK20/vhbVihrxmd52DjByDUO99pBAr8SlJtQpX5fmwY=";
  };

  outputs = [ "out" "dev" "lib" ];
--- a/pkgs/applications/science/math/cntk/default.nix
+++ b/pkgs/applications/science/math/cntk/default.nix
@ -1,134 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, cmake
-, fetchpatch
-, openblas, blas, lapack, opencv3, libzip, boost, protobuf, mpi
-, onebitSGDSupport ? false
-, config
-, cudaSupport ? config.cudaSupport, cudaPackages ? { }, addOpenGLRunpath, cudatoolkit, nvidia_x11
-, cudnnSupport ? cudaSupport
-}:
-
-let
-  inherit (cudaPackages) cudatoolkit cudnn;
-in
-
-assert cudnnSupport -> cudaSupport;
-assert blas.implementation == "openblas" && lapack.implementation == "openblas";
-
-let
-  # Old specific version required for CNTK.
-  cub = fetchFromGitHub {
-    owner = "NVlabs";
-    repo = "cub";
-    rev = "1.7.4";
-    sha256 = "0ksd5n1lxqhm5l5cd2lps4cszhjkf6gmzahaycs7nxb06qci8c66";
-  };
-
-in stdenv.mkDerivation rec {
-  pname = "CNTK";
-  version = "2.7";
-
-  src = fetchFromGitHub {
-    owner = "Microsoft";
-    repo = "CNTK";
-    rev = "v${version}";
-    sha256 = "sha256-2rIrPJyvZhnM5EO6tNhF6ARTocfUHce4N0IZk/SZiaI=";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    # Fix build with protobuf 3.18+
-    # Remove with onnx submodule bump to 1.9+
-    (fetchpatch {
-      url = "https://github.com/onnx/onnx/commit/d3bc82770474761571f950347560d62a35d519d7.patch";
-      extraPrefix = "Source/CNTKv2LibraryDll/proto/onnx/onnx_repo/";
-      stripLen = 1;
-      sha256 = "00raqj8wx30b06ky6cdp5vvc1mrzs7hglyi6h58hchw5lhrwkzxp";
-    })
-  ];
-
-  postPatch = ''
-    # Fix build with protobuf 3.18+
-    substituteInPlace Source/CNTKv2LibraryDll/Serialization.cpp \
-      --replace 'SetTotalBytesLimit(INT_MAX, INT_MAX)' \
-                'SetTotalBytesLimit(INT_MAX)' \
-      --replace 'SetTotalBytesLimit(limit, limit)' \
-                'SetTotalBytesLimit(limit)'
-  '';
-
-  nativeBuildInputs = [ cmake ] ++ lib.optional cudaSupport addOpenGLRunpath;
-
-  # Force OpenMPI to use g++ in PATH.
-  OMPI_CXX = "g++";
-
-  # Uses some deprecated tensorflow functions
-  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
-
-  buildInputs = [ openblas opencv3 libzip boost protobuf mpi ]
-             ++ lib.optional cudaSupport cudatoolkit
-             ++ lib.optional cudnnSupport cudnn;
-
-  configureFlags = [
-    "--with-opencv=${opencv3}"
-    "--with-libzip=${libzip.dev}"
-    "--with-openblas=${openblas.dev}"
-    "--with-boost=${boost.dev}"
-    "--with-protobuf=${protobuf}"
-    "--with-mpi=${mpi}"
-    "--cuda=${if cudaSupport then "yes" else "no"}"
-    # FIXME
-    "--asgd=no"
-  ] ++ lib.optionals cudaSupport [
-    "--with-cuda=${cudatoolkit}"
-    "--with-gdk-include=${cudatoolkit}/include"
-    "--with-gdk-nvml-lib=${nvidia_x11}/lib"
-    "--with-cub=${cub}"
-  ] ++ lib.optional onebitSGDSupport "--1bitsgd=yes";
-
-  configurePhase = ''
-    sed -i \
-      -e 's,^GIT_STATUS=.*,GIT_STATUS=,' \
-      -e 's,^GIT_COMMIT=.*,GIT_COMMIT=v${version},' \
-      -e 's,^GIT_BRANCH=.*,GIT_BRANCH=v${version},' \
-      -e 's,^BUILDER=.*,BUILDER=nixbld,' \
-      -e 's,^BUILDMACHINE=.*,BUILDMACHINE=machine,' \
-      -e 's,^BUILDPATH=.*,BUILDPATH=/homeless-shelter,' \
-      -e '/git does not exist/d' \
-      Tools/generate_build_info
-
-    patchShebangs .
-    mkdir build
-    cd build
-    ${lib.optionalString cudnnSupport ''
-      mkdir cuda
-      ln -s ${cudnn}/include cuda
-      export configureFlags="$configureFlags --with-cudnn=$PWD"
-    ''}
-
-    ../configure $configureFlags
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    # Moving to make patchelf remove references later.
-    mv lib $out
-    cp bin/cntk $out/bin
-  '';
-
-  postFixup = lib.optionalString cudaSupport ''
-    for lib in $out/lib/*; do
-      addOpenGLRunpath "$lib"
-    done
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/Microsoft/CNTK";
-    description = "An open source deep-learning toolkit";
-    license = if onebitSGDSupport then licenses.unfreeRedistributable else licenses.mit;
-    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ abbradar ];
-    # Newer cub is included with cudatoolkit now and it breaks the build.
-    # https://github.com/Microsoft/CNTK/issues/3191
-    # broken = cudaSupport;
-    broken = true; # at 2022-11-23
-  };
-}
--- a/pkgs/applications/version-management/git-credential-oauth/default.nix
+++ b/pkgs/applications/version-management/git-credential-oauth/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "git-credential-oauth";
-  version = "0.10.1";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "hickford";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-0sgoBvNVQZI8mOfKI5XWVQ6+615gKi1pO/4DPI6/fKA=";
+    hash = "sha256-Zxdd4JhSoaAFx8neZqdOZSZEOTtupZHnX+5ziYxbw6s=";
  };

  ldflags = [
@ -17,7 +17,7 @@ buildGoModule rec {
    "-X main.version=${version}"
  ];

-  vendorHash = "sha256-STwBiqdUwiyhTySPENqfJLUTMwxaq5nYtrAX6+pcKoc=";
+  vendorHash = "sha256-cCqbEv4kBnF6FWvfaXCOxadPVXR/AxXS3nXHf6WmsSs=";

  meta = {
    description = "Git credential helper that securely authenticates to GitHub, GitLab and BitBucket using OAuth";
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@ -11,13 +11,13 @@

 buildGoModule rec {
  pname = "containerd";
-  version = "1.7.5";
+  version = "1.7.7";

  src = fetchFromGitHub {
    owner = "containerd";
    repo = "containerd";
    rev = "v${version}";
-    hash = "sha256-g+1JfXO1k0ijPpVTo+WxmXro4p4MbRCIZdgtgy58M60=";
+    hash = "sha256-5Tw7xltrsp+yGrdJ0O4MoFUvIaEiCQpMip5X1kfV/iM=";
  };

  vendorHash = null;
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -446,7 +446,7 @@ rec {
      '';

      postMount = ''
-        mkdir -p mnt/{dev,proc,sys} mnt${storeDir}
+        mkdir -p mnt/{dev,proc,sys,tmp} mnt${storeDir}

        # Mount /dev, /sys and the nix store as shared folders.
        mount --rbind /dev mnt/dev
--- a/pkgs/by-name/_9/_9base/config-substitutions.patch
+++ b/pkgs/by-name/_9/_9base/config-substitutions.patch
@ -0,0 +1,56 @@
+diff --git a/config.mk b/config.mk
+index 1ebfd49..ec076b3 100644
+--- a/config.mk
+++ b/config.mk
+@@ -1,25 +1,17 @@
+ # Customize to fit your system
+
+ # paths
+-PREFIX      = /usr/local/plan9
+ MANPREFIX   = ${PREFIX}/share/man
+
+ VERSION     = 7
+-OBJTYPE     = 386
+-#OBJTYPE     = arm
+-#OBJTYPE     = x86_64
+-#OBJTYPE     = sun4u
+
+ # Linux/BSD
+ #CFLAGS      += -Wall -Wno-missing-braces -Wno-parentheses -Wno-switch -c -I. -DPREFIX="\"${PREFIX}\""
+ CFLAGS      += -c -I. -DPLAN9PORT -DPREFIX="\"${PREFIX}\""
+-LDFLAGS     += -static
+
+ # Solaris
+ #CFLAGS      = -fast -xtarget=ultra -D__sun__ -c -I. -DPREFIX="\"${PREFIX}\""
+ #LDFLAGS     = -dn
+
+ # compiler
+-AR          = ar rc
+-CC          = cc
+ YACC        = ../yacc/9yacc
+diff --git a/lib9/Makefile b/lib9/Makefile
+index b83ab2b..e3744a4 100644
+--- a/lib9/Makefile
+++ b/lib9/Makefile
+@@ -221,7 +221,7 @@ uninstall:
+
+ ${LIB}: ${OFILES}
+ 	@echo AR ${TARG}
+-	@${AR} ${LIB} ${OFILES}
+	@${AR} rc ${LIB} ${OFILES}
+
+ .c.o:
+ 	@echo CC $<
+diff --git a/troff/Makefile b/troff/Makefile
+index b4e3d88..3aac6bf 100644
+--- a/troff/Makefile
+++ b/troff/Makefile
+@@ -6,7 +6,7 @@ TARG      = troff
+ OFILES    = n1.o n2.o n3.o n4.o n5.o t6.o n6.o n7.o n8.o n9.o t10.o\
+             n10.o t11.o ni.o hytab.o suftab.o dwbinit.o mbwc.o
+ MANFILES  = troff.1
+-TROFFDIR  = ${PREFIX}/lib/troff
+TROFFDIR  = ${PREFIX_TROFF}/lib/troff
+
+ include ../std.mk
+
--- a/pkgs/by-name/_9/_9base/dont-strip.patch
+++ b/pkgs/by-name/_9/_9base/dont-strip.patch
@ -0,0 +1,12 @@
+diff --git a/sam/Makefile b/sam/Makefile
+index 17ada1f..1e9e9b8 100644
+--- a/sam/Makefile
+++ b/sam/Makefile
+@@ -10,7 +10,6 @@ MANFILES  = sam.1
+ include ../config.mk
+ 
+ all: ${TARG}
+-	@strip ${TARG}
+ 	@echo built ${TARG}
+ 
+ install: ${TARG}
--- a/pkgs/by-name/_9/_9base/getcallerpc-use-macro-or-stub.patch
+++ b/pkgs/by-name/_9/_9base/getcallerpc-use-macro-or-stub.patch
@ -0,0 +1,115 @@
+diff --git a/lib9/Makefile b/lib9/Makefile
+index b83ab2b..2836b38 100644
+--- a/lib9/Makefile
+++ b/lib9/Makefile
+@@ -145,7 +145,7 @@ LIB9OFILES=\
+ 	exitcode.o\
+ 	fcallfmt.o\
+ 	get9root.o\
+-	getcallerpc-$(OBJTYPE).o\
+	getcallerpc.o\
+ 	getenv.o\
+ 	getfields.o\
+ 	getnetconn.o\
+diff --git a/lib9/getcallerpc-386.c b/lib9/getcallerpc-386.c
+deleted file mode 100644
+index 1367370..0000000
+--- a/lib9/getcallerpc-386.c
+++ /dev/null
+@@ -1,7 +0,0 @@
+-#include <lib9.h>
+-
+-ulong
+-getcallerpc(void *x)
+-{
+-	return (((ulong*)(x))[-1]);
+-}
+diff --git a/lib9/getcallerpc-PowerMacintosh.c b/lib9/getcallerpc-PowerMacintosh.c
+deleted file mode 100644
+index 679a72c..0000000
+--- a/lib9/getcallerpc-PowerMacintosh.c
+++ /dev/null
+@@ -1,7 +0,0 @@
+-#include <lib9.h>
+-
+-ulong
+-getcallerpc(void *x)
+-{
+-	return (((ulong*)(x))[-4]);
+-}
+diff --git a/lib9/getcallerpc-arm.c b/lib9/getcallerpc-arm.c
+deleted file mode 100644
+index 9bb4a95..0000000
+--- a/lib9/getcallerpc-arm.c
+++ /dev/null
+@@ -1,8 +0,0 @@
+-#include <lib9.h>
+-
+-ulong
+-getcallerpc(void *x)
+-{
+-	return ((ulong*)x)[-2];
+-}
+-
+diff --git a/lib9/getcallerpc-power.c b/lib9/getcallerpc-power.c
+deleted file mode 100644
+index b4bf698..0000000
+--- a/lib9/getcallerpc-power.c
+++ /dev/null
+@@ -1,11 +0,0 @@
+-#include <lib9.h>
+-
+-ulong
+-getcallerpc(void *x)
+-{
+-	ulong *lp;
+-
+-	lp = x;
+-
+-	return lp[-1];
+-}
+diff --git a/lib9/getcallerpc-ppc.c b/lib9/getcallerpc-ppc.c
+deleted file mode 100644
+index 679a72c..0000000
+--- a/lib9/getcallerpc-ppc.c
+++ /dev/null
+@@ -1,7 +0,0 @@
+-#include <lib9.h>
+-
+-ulong
+-getcallerpc(void *x)
+-{
+-	return (((ulong*)(x))[-4]);
+-}
+diff --git a/lib9/getcallerpc-x86_64.c b/lib9/getcallerpc-x86_64.c
+deleted file mode 100644
+index 1367370..0000000
+--- a/lib9/getcallerpc-x86_64.c
+++ /dev/null
+@@ -1,7 +0,0 @@
+-#include <lib9.h>
+-
+-ulong
+-getcallerpc(void *x)
+-{
+-	return (((ulong*)(x))[-1]);
+-}
+diff --git a/lib9/getcallerpc.c b/lib9/getcallerpc.c
+new file mode 100644
+index 0000000..7d2cdd7
+--- /dev/null
+++ b/lib9/getcallerpc.c
+@@ -0,0 +1,12 @@
+#include <lib9.h>
+
+/*
+ * On gcc and clang, getcallerpc is a macro invoking a compiler builtin.
+ * If the macro in libc.h did not trigger, there's no implementation.
+ */
+#undef getcallerpc
+ulong
+getcallerpc(void *v)
+{
+	return 1;
+}
+\ No newline at end of file
--- a/pkgs/by-name/_9/_9base/package.nix
+++ b/pkgs/by-name/_9/_9base/package.nix
@ -0,0 +1,77 @@
+{ lib
+, stdenv
+, fetchgit
+, pkg-config
+, patches ? [ ]
+, pkgsBuildHost
+, enableStatic ? stdenv.hostPlatform.isStatic
+}:
+
+stdenv.mkDerivation {
+  pname = "9base";
+  version = "unstable-2019-09-11";
+
+  src = fetchgit {
+    url = "https://git.suckless.org/9base";
+    rev = "63916da7bd6d73d9a405ce83fc4ca34845667cce";
+    hash = "sha256-CNK7Ycmcl5vkmtA5VKwKxGZz8AoIG1JH/LTKoYmWSBI=";
+  };
+
+  patches = [
+    # expects to be used with getcallerpc macro or stub patch
+    # AR env var is now the location of `ar` not including the arg (`ar rc`)
+    ./config-substitutions.patch
+    ./dont-strip.patch
+    # plan9port dropped their own getcallerpc implementations
+    # in favour of using gcc/clang's macros or a stub
+    # we can do this here too to extend platform support
+    # https://github.com/9fans/plan9port/commit/540caa5873bcc3bc2a0e1896119f5b53a0e8e630
+    # https://github.com/9fans/plan9port/commit/323e1a8fac276f008e6d5146a83cbc88edeabc87
+    ./getcallerpc-use-macro-or-stub.patch
+  ] ++ patches;
+
+  # the 9yacc script needs to be executed to build other items
+  preBuild = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    substituteInPlace ./yacc/9yacc \
+      --replace "../yacc/yacc" "${lib.getExe' pkgsBuildHost._9base "yacc"}"
+  '';
+
+  enableParallelBuilding = true;
+  strictDeps = true;
+  nativeBuildInputs = [ pkg-config ];
+  NIX_CFLAGS_COMPILE = [
+    # workaround build failure on -fno-common toolchains like upstream
+    # gcc-10. Otherwise build fails as:
+    #   ld: diffio.o:(.bss+0x16): multiple definition of `bflag'; diffdir.o:(.bss+0x6): first defined here
+    "-fcommon"
+    # hide really common warning that floods the logs:
+    #   warning: #warning "_BSD_SOURCE and _SVID_SOURCE are deprecated, use _DEFAULT_SOURCE"
+    "-D_DEFAULT_SOURCE"
+  ];
+  LDFLAGS = lib.optionalString enableStatic "-static";
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ];
+  installFlags = [
+    "PREFIX_TROFF=${placeholder "troff"}"
+  ];
+
+  outputs = [ "out" "man" "troff" ];
+
+  meta = with lib; {
+    homepage = "https://tools.suckless.org/9base/";
+    description = "9base is a port of various original Plan 9 tools for Unix, based on plan9port";
+    longDescription = ''
+      9base is a port of various original Plan 9 tools for Unix, based on plan9port.
+      It also contains the Plan 9 libc, libbio, libregexp, libfmt and libutf.
+      The overall SLOC is about 66kSLOC, so this userland + all libs is much smaller than, e.g. bash.
+      9base can be used to run werc instead of the full blown plan9port.
+    '';
+    license = with licenses; [ mit /* and */ lpl-102 ];
+    maintainers = with maintainers; [ jk ];
+    platforms = platforms.unix;
+    # needs additional work to support aarch64-darwin
+    # due to usage of _DARWIN_NO_64_BIT_INODE
+    broken = stdenv.isAarch64 && stdenv.isDarwin;
+  };
+}
--- a/pkgs/by-name/cd/cdk/package.nix
+++ b/pkgs/by-name/cd/cdk/package.nix
@ -0,0 +1,30 @@
+{ lib
+, stdenv
+, fetchurl
+, ncurses
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cdk";
+  version = "5.0-20230201";
+
+  src = fetchurl {
+    url = "https://invisible-mirror.net/archives/cdk/cdk-${finalAttrs.version}.tgz";
+    hash = "sha256-oxJ7Wf5QX16Jjao90VsM9yShJ0zmgWW3eb4vKdTE8vY=";
+  };
+
+  buildInputs = [
+    ncurses
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "Curses development kit";
+    homepage = "https://invisible-island.net/cdk/";
+    changelog = "https://invisible-island.net/cdk/CHANGES.html";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ raskin AndersonTorres ];
+    inherit (ncurses.meta) platforms;
+  };
+})
--- a/pkgs/by-name/fo/fortune-kind/package.nix
+++ b/pkgs/by-name/fo/fortune-kind/package.nix
@ -0,0 +1,70 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, darwin
+, libiconv
+, makeBinaryWrapper
+, installShellFiles
+, fortuneAlias ? true
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "fortune-kind";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "cafkafk";
+    repo = "fortune-kind";
+    rev = "v${version}";
+    hash = "sha256-q4r1Qdyh2L1vTi+CKln+a9lKGgyRAhvg1aJRd0CIEJs=";
+  };
+
+  cargoHash = "sha256-ArVOGWaKbge8nxxGpAT8TttFZYJpuFF5u/tHYC9Qkeo=";
+
+  nativeBuildInputs = [ makeBinaryWrapper installShellFiles ];
+  buildInputs = lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.Security ];
+
+  buildNoDefaultFeatures = true;
+
+  MAN_OUT = "./man";
+
+  preBuild = ''
+    mkdir -p "./$MAN_OUT";
+  '';
+
+  preInstall = ''
+    installManPage man/fortune-kind.1
+    installShellCompletion \
+      --fish man/fortune-kind.fish \
+      --bash man/fortune-kind.bash \
+      --zsh  man/_fortune-kind
+    mkdir -p $out
+    cp -r $src/fortunes $out/fortunes;
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/fortune-kind \
+      --prefix FORTUNE_DIR : "$out/fortunes"
+  ''+ lib.optionalString fortuneAlias ''
+    ln -s fortune-kind $out/bin/fortune
+  '';
+
+  meta = with lib; {
+    description = "A kinder, curated fortune, written in rust";
+    longDescription = ''
+      Historically, contributions to fortune-mod have had a less-than ideal
+      quality control process, and as such, many of the fortunes that a user may
+      receive from the program read more like cryptic inside jokes, or at the
+      very worst, locker-room banter. One of the major goals of fortune-kind is
+      defining and applying a somewhat more rigorous moderation and editing
+      process to the fortune adoption workflow.
+    '';
+    homepage = "https://github.com/cafkafk/fortune-kind";
+    changelog = "https://github.com/cafkafk/fortune-kind/releases/tag/v${version}";
+    license = licenses.gpl3Only;
+    mainProgram = "fortune-kind";
+    maintainers = with maintainers; [ cafkafk ];
+    platforms = platforms.unix ++ platforms.windows;
+  };
+}
--- a/pkgs/by-name/sh/shopware-cli/package.nix
+++ b/pkgs/by-name/sh/shopware-cli/package.nix
@ -9,18 +9,18 @@

 buildGoModule rec {
  pname = "shopware-cli";
-  version = "0.3.4";
+  version = "0.3.5";
  src = fetchFromGitHub {
    repo = "shopware-cli";
    owner = "FriendsOfShopware";
    rev = version;
-    hash = "sha256-1lOcr3XiQCh1T07iYRlGwMzsmQx1QYgkrStWlUM1XCo=";
+    hash = "sha256-xjeko2aFnz3vjQqqn/VimYGg9lZaz5trDX5HC8a+XgE=";
  };

  nativeBuildInputs = [ installShellFiles makeWrapper ];
  nativeCheckInputs = [ git dart-sass ];

-  vendorHash = "sha256-j133hlcfRKTkIcNdZQmGn5yiWfKHp/5UVwLAs1njNdM=";
+  vendorHash = "sha256-QZ/zU67oUW75T8DOzjQwmEAr6gjIg/6ZO4Vm/47Lc40=";

  postInstall = ''
    export HOME="$(mktemp -d)"
--- a/pkgs/by-name/ud/udev-gothic-nf/package.nix
+++ b/pkgs/by-name/ud/udev-gothic-nf/package.nix
@ -0,0 +1,25 @@
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "udev-gothic-nf";
+  version = "1.3.1";
+
+  src = fetchzip {
+    url = "https://github.com/yuru7/udev-gothic/releases/download/v${version}/UDEVGothic_NF_v${version}.zip";
+    hash = "sha256-4392vZX5CWg+tEpti1N+WQSx4ES5ZXoSiow6ufxqmsY=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm644 *.ttf -t $out/share/fonts/${pname}
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A programming font that combines BIZ UD Gothic, JetBrains Mono and nerd-fonts";
+    homepage = "https://github.com/yuru7/udev-gothic";
+    license = licenses.ofl;
+    maintainers = with maintainers; [ haruki7049 ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/by-name/ud/udev-gothic/package.nix
+++ b/pkgs/by-name/ud/udev-gothic/package.nix
@ -0,0 +1,25 @@
+{ lib, stdenvNoCC, fetchzip }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "udev-gothic";
+  version = "1.3.1";
+
+  src = fetchzip {
+    url = "https://github.com/yuru7/udev-gothic/releases/download/v${version}/UDEVGothic_v${version}.zip";
+    hash = "sha256-W1ekR3fWuS/ks1reCBAvZ5lR+aGh9qfaxn80Q2KlRM0=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm644 *.ttf -t $out/share/fonts/${pname}
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A programming font that combines BIZ UD Gothic and JetBrains Mono";
+    homepage = "https://github.com/yuru7/udev-gothic";
+    license = licenses.ofl;
+    maintainers = with maintainers; [ haruki7049 ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/data/fonts/iosevka/comfy.nix
+++ b/pkgs/data/fonts/iosevka/comfy.nix
@ -1,4 +1,4 @@
-{ lib, iosevka, fetchFromSourcehut, fetchFromGitHub, buildNpmPackage }:
+{ lib, iosevka, fetchFromGitHub, buildNpmPackage }:

 let
  sets = [
@ -20,17 +20,17 @@ let
    "comfy-wide-motion-fixed" # Slab   | Wide    | Monospaced | No        |
    "comfy-wide-motion-duo"   # Slab   | Wide    | Duospaced  | Yes       |
  ];
-  version = "1.3.0";
-  src = fetchFromSourcehut {
-    owner = "~protesilaos";
+  version = "1.4.0";
+  src = fetchFromGitHub {
+    owner = "protesilaos";
    repo = "iosevka-comfy";
    rev = version;
-    sha256 = "sha256-ajzUbobNf+Je8ls9htOCLPsB0OPSiqZzrc8bO6hQvio=";
+    sha256 = "sha256-kfEEJ6F1/dsG9CSLWcr0QOOnQxHPgPgb4QhgFrHTklE=";
  };
  privateBuildPlan = src.outPath + "/private-build-plans.toml";
  makeIosevkaFont = set:
    let superBuildNpmPackage = buildNpmPackage; in
-    (iosevka.override rec {
+    (iosevka.override {
      inherit set privateBuildPlan;
      buildNpmPackage = args: superBuildNpmPackage
        (args // {
@ -39,11 +39,11 @@ let
          src = fetchFromGitHub {
            owner = "be5invis";
            repo = "iosevka";
-            rev = "7ef24b8d87fe50793444f9f84b140767f7e47029";
-            hash = "sha256-RVBgJVMNyxV1KeNniwySsJUOmLDh6sFZju8szvzKlH4=";
+            rev = "f6e57fbf0b1242ad3069d45c815d79b9d68871a2";
+            hash = "sha256-cS3SCKzUjVXF+n0Rt5eBLzieATB7W+hwEbzh6OQrMo4=";
          };

-          npmDepsHash = "sha256-yogUBf+yfjfK8DE4gGgoGaTaYZagW8R1pCn7y0rEPt4=";
+          npmDepsHash = "sha256-c+ltdh5e3+idclYfqp0Xh9IUwoj7XYP1uzJG6+a5gFU=";

          meta = with lib; {
            inherit (src.meta) homepage;
--- a/pkgs/development/compilers/gcc-arm-embedded/12/default.nix
+++ b/pkgs/development/compilers/gcc-arm-embedded/12/default.nix
@ -9,7 +9,7 @@

 stdenv.mkDerivation rec {
  pname = "gcc-arm-embedded";
-  version = "12.2.rel1";
+  version = "12.3.rel1";

  platform = {
    aarch64-darwin = "darwin-arm64";
@ -21,10 +21,10 @@ stdenv.mkDerivation rec {
  src = fetchurl {
    url = "https://developer.arm.com/-/media/Files/downloads/gnu/${version}/binrel/arm-gnu-toolchain-${version}-${platform}-arm-none-eabi.tar.xz";
    sha256 = {
-      aarch64-darwin = "0j12n631bmbfvnfbmv4q7cfhmh4l7ka3vcjcvyw0vjqb4msyia91";
-      aarch64-linux  = "131ydgndff7dyhkivfchbk43lv3cv2p172knkqilx64aapvk5qvy";
-      x86_64-darwin  = "00i9gd1ny00681pwinh6ng9x45xsyrnwc6hm2vr348z9gasyxh00";
-      x86_64-linux   = "0rv8r5zh0a5621v0xygxi8f6932qgwinw2s9vnniasp9z7897gl4";
+      aarch64-darwin = "sha256-Oy7uC99xwbvrPDt0JPv3vZ1cPw9aOkp4FZyeOtIZ570=";
+      aarch64-linux  = "sha256-FMBIfVdT9gcdJOVoiB98fmf4DdgxZd7FFks3MTlK9DE=";
+      x86_64-darwin  = "sha256-5u2L+TD62c4z4SCrkLNpV7H3efzKpt5snKmliYLAQpE=";
+      x86_64-linux   = "sha256-EqKBVkQxjrzOr4S+q7Zl0JJLbnniEEhFLFMxpWMyswk=";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

--- a/pkgs/development/libraries/cdk/default.nix
+++ b/pkgs/development/libraries/cdk/default.nix
@ -1,29 +0,0 @@
-{ lib, stdenv, fetchurl, ncurses }:
-
-stdenv.mkDerivation rec {
-  pname = "cdk";
-  version = "5.0-20221025";
-
-  src = fetchurl {
-    urls = [
-      "ftp://ftp.invisible-island.net/cdk/cdk-${version}.tgz"
-      "https://invisible-mirror.net/archives/cdk/cdk-${version}.tgz"
-    ];
-    hash = "sha256-A8z6Icn8PWHd0P2hnaVFNZBVu+71ociC37n/SPN0avI=";
-  };
-
-  buildInputs = [
-    ncurses
-  ];
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "Curses development kit";
-    homepage = "https://invisible-island.net/cdk/";
-    changelog = "https://invisible-island.net/cdk/CHANGES";
-    license = licenses.mit;
-    maintainers = with maintainers; [ raskin ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/development/libraries/libcue/default.nix
+++ b/pkgs/development/libraries/libcue/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, bison, flex }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, bison, flex }:

 stdenv.mkDerivation rec {
  pname = "libcue";
@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
    sha256 = "1iqw4n01rv2jyk9lksagyxj8ml0kcfwk67n79zy1r6zv1xfp5ywm";
  };

+  patches = [
+    (fetchpatch {
+      name = "CVE-2023-43641.patch";
+      url = "https://github.com/lipnitsk/libcue/commit/fdf72c8bded8d24cfa0608b8e97f2eed210a920e.patch";
+      hash = "sha256-NjnSMUfman/SwLFWDIhtz2jCOLfpXGGGjO3QwRGURNg=";
+    })
+  ];
+
  nativeBuildInputs = [ cmake bison flex ];

  doCheck = false; # fails all the tests (ctest)
--- a/pkgs/development/ocaml-modules/pprint/default.nix
+++ b/pkgs/development/ocaml-modules/pprint/default.nix
@ -4,7 +4,7 @@ buildDunePackage rec {
  pname = "pprint";
  version = "20230830";

-  useDune2 = true;
+  minimalOCamlVersion = "4.03";

  src = fetchFromGitHub {
    owner = "fpottier";
--- a/pkgs/development/ocaml-modules/zelus-gtk/default.nix
+++ b/pkgs/development/ocaml-modules/zelus-gtk/default.nix
@ -7,7 +7,7 @@ buildDunePackage {
  pname = "zelus-gtk";
  inherit (zelus) version src postPatch;

-  minimalOCamlVersion = "4.08.1";
+  minimalOCamlVersion = "4.10";

  nativeBuildInputs = [
    zelus
--- a/pkgs/development/python-modules/cntk/default.nix
+++ b/pkgs/development/python-modules/cntk/default.nix
@ -1,61 +0,0 @@
-{ lib
-, buildPythonPackage
-, pkgs
-, numpy
-, scipy
-, mpi
-, enum34
-, protobuf
-, pip
-, python
-, swig
-}:
-
-let
-  cntk = pkgs.cntk;
-in
-buildPythonPackage {
-  inherit (cntk) name version src;
-
-  nativeBuildInputs = [ swig mpi ];
-  buildInputs = [ cntk mpi ];
-  propagatedBuildInputs = [ numpy scipy enum34 protobuf pip ];
-
-  CNTK_LIB_PATH = "${cntk}/lib";
-  CNTK_COMPONENT_VERSION = cntk.version;
-  CNTK_VERSION = cntk.version;
-  CNTK_VERSION_BANNER = cntk.version;
-
-  postPatch = ''
-    cd bindings/python
-    sed -i 's,"libmpi.so.12","${mpi}/lib/libmpi.so",g' cntk/train/distributed.py
-
-    # Remove distro and libs checks; they aren't compatible with NixOS and besides we guarantee
-    # compatibility by providing a package.
-    cat <<EOF > cntk/cntk_py_init.py
-    def cntk_check_distro_info():
-      pass
-    def cntk_check_libs():
-      pass
-    EOF
-  '';
-
-  postInstall = ''
-    rm -rf $out/${python.sitePackages}/cntk/libs
-    ln -s ${cntk}/lib $out/${python.sitePackages}/cntk/libs
-    # It's not installed for some reason.
-    cp cntk/cntk_py.py $out/${python.sitePackages}/cntk
-  '';
-
-  # Actual tests are broken.
-  checkPhase = ''
-    cd $NIX_BUILD_TOP
-    ${python.interpreter} -c "import cntk"
-  '';
-
-  meta = {
-    inherit (cntk.meta) homepage description license maintainers platforms;
-    # doesn't support Python 3.7
-    broken = lib.versionAtLeast python.version "3.7";
-  };
-}
--- a/pkgs/development/python-modules/idasen/default.nix
+++ b/pkgs/development/python-modules/idasen/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "idasen";
-  version = "0.10.2";
+  version = "0.10.3";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "newAM";
    repo = "idasen";
    rev = "refs/tags/v${version}";
-    hash = "sha256-aCAtZsHH1tkti2A7OWw9rV4vij1n6T+R8nMa/MRZuF8=";
+    hash = "sha256-mAczHrFEH1LEH1IEUc7ZXTWtaPBrvIdSvkUqOCupyRs=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/zipstream-ng/default.nix
+++ b/pkgs/development/python-modules/zipstream-ng/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "zipstream-ng";
-  version = "1.6.0";
+  version = "1.7.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "pR0Ps";
    repo = "zipstream-ng";
    rev = "refs/tags/v${version}";
-    hash = "sha256-mY0dbHho/K1nTmhlv8i8KPa4HW7epBhfEksX3E2df2M=";
+    hash = "sha256-BYQse+DlyLUH9CofRfGrPUZjP7E8AP/wpirvJmSRfow=";
  };

  pythonImportsCheck = [
--- a/pkgs/development/tools/dprint/default.nix
+++ b/pkgs/development/tools/dprint/default.nix
@ -2,14 +2,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "dprint";
-  version = "0.40.2";
+  version = "0.41.0";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-kkGBSyLirHlJOzNh8GtY6k8kxpgouqHRQQEM/eDU7TA=";
+    sha256 = "sha256-qPyHDQ6KcXwiWlys86L3cnLIxigEkXWD/IkB2+WtOcY=";
  };

-  cargoHash = "sha256-jImnU9ksYYmQOoaLBH+lMdoAsgo9ZFlu0tng61wrXXw=";
+  cargoHash = "sha256-DauLzn+QkqTCPubrtasAZmD3DrIXkHk7zd8g589TCCk=";

  buildInputs = lib.optionals stdenv.isDarwin [ Security ];

--- a/pkgs/development/tools/misc/strace/default.nix
+++ b/pkgs/development/tools/misc/strace/default.nix
@ -30,5 +30,6 @@ stdenv.mkDerivation rec {
    license =  with licenses; [ lgpl21Plus gpl2Plus ]; # gpl2Plus is for the test suite
    platforms = platforms.linux;
    maintainers = with maintainers; [ globin ma27 qyliss ];
+    mainProgram = "strace";
  };
 }
--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "terraform-ls";
-  version = "0.32.0";
+  version = "0.32.1";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-GZZUqTs0CXWYJs6R2Iy0TkAO1FJ/b60UTNVWq0n0bgo=";
+    hash = "sha256-8ffrS5iWFP35KAI80bsvpibuTLAa6vykeocyTm09cGM=";
  };

-  vendorHash = "sha256-z/7WQKoUNaugtDuvCjurUM6BgKYLt3nJMg8pnkj+Wsg=";
+  vendorHash = "sha256-umDiI84xGmJc0tl7X/6g0dLJzdudOR48wpr67ZEKz0s=";

  ldflags = [ "-s" "-w" ];

--- a/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/tree-sitter-typst.json
@ -1,10 +1,10 @@
 {
  "url": "https://github.com/uben0/tree-sitter-typst",
-  "rev": "b8f3ac3a00247b5be0da2123e6b2d79e3dca4aff",
-  "date": "2023-09-17T16:51:18+02:00",
-  "path": "/nix/store/k4sh7jiqrry4960ygjbs72qvi9amd3s8-tree-sitter-typst",
-  "sha256": "1qihml8jkc32ra1ijmrc1crjmqxspdq163k0hhy9rrq6sqgyh33w",
-  "hash": "sha256-fAzoH9YG55w8hGAOE3C7uuMqMwssVxmDymKwKRGtMOI=",
+  "rev": "791cac478226e3e78809b67ff856010bde709594",
+  "date": "2023-10-01T17:18:34+02:00",
+  "path": "/nix/store/fsdpsqf4g0maba3lqnq7237hvp443wn0-tree-sitter-typst-791cac4",
+  "sha256": "1mwj2qf1k1pfd892lkpw6jsd014209aiz6kdsyh5mhxgnb4893v0",
+  "hash": "sha256-YI+EyLKvw1qg122aH1UCggTQtDT8TioSau6GGRwWktc=",
  "fetchLFS": false,
  "fetchSubmodules": false,
  "deepClone": false,
--- a/pkgs/development/tools/typos/default.nix
+++ b/pkgs/development/tools/typos/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "typos";
-  version = "1.16.17";
+  version = "1.16.18";

  src = fetchFromGitHub {
    owner = "crate-ci";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-T7JekWWSGetaREhbYeh5LygXWaI5vwSSmMIFvzBtB3k=";
+    hash = "sha256-TUaEA8LE0cmOdt+jvpWzPbgBMACRR2wvZrLITpsQjuw=";
  };

-  cargoHash = "sha256-aYhdTNtvKfvgmt9Y1YTNEKYQy3m5bH9tsUbbL87crqw=";
+  cargoHash = "sha256-02ZtqGt3dDIcJGLYvoUVgGyaDNIuyeviHI29AZDl6Pc=";

  meta = with lib; {
    description = "Source code spell checker";
--- a/pkgs/development/web/insomnia/default.nix
+++ b/pkgs/development/web/insomnia/default.nix
@ -16,11 +16,11 @@ let
  ];
 in stdenv.mkDerivation rec {
  pname = "insomnia";
-  version = "2023.5.7";
+  version = "2023.5.8";

  src = fetchurl {
    url = "https://github.com/Kong/insomnia/releases/download/core%40${version}/Insomnia.Core-${version}.deb";
-    sha256 = "sha256-XB8ktjF6VWj57whbXC0iwH3WpuMkGnRZCCdx86Mj2ZI=";
+    sha256 = "sha256-x5DYS3DteYtq1EQuJ3EFV/d/YThPgnhhIj+GpEJsFDY=";
  };

  nativeBuildInputs = [
--- a/pkgs/servers/http/jetty/default.nix
+++ b/pkgs/servers/http/jetty/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  pname = "jetty";
-  version = "11.0.16";
+  version = "12.0.1";
  src = fetchurl {
    url = "mirror://maven/org/eclipse/jetty/jetty-home/${version}/jetty-home-${version}.tar.gz";
-    hash = "sha256-iL1s4o/1Hds0N/fzXgwOMriPtZNG7ei2t4frF1ImW+E=";
+    hash = "sha256-7nCai6S3eNly83aUQf0tiLTe+k3ih0cJnGqQvi143LI=";
  };

  dontBuild = true;
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@ -257,6 +257,8 @@ let
      withJIT = if jitSupport then this else jitToggle;
      withoutJIT = if jitSupport then jitToggle else this;

+      dlSuffix = if olderThan "16" then ".so" else stdenv.hostPlatform.extensions.sharedLibrary;
+
      pkgs = let
        scope = {
          postgresql = this;
--- a/pkgs/servers/sql/postgresql/ext/jsonb_deep_sum.nix
+++ b/pkgs/servers/sql/postgresql/ext/jsonb_deep_sum.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
  installPhase = ''
    mkdir -p $out/{lib,share/postgresql/extension}

-    cp *.so      $out/lib
+    cp *${postgresql.dlSuffix} $out/lib
    cp *.sql     $out/share/postgresql/extension
    cp *.control $out/share/postgresql/extension
  '';
--- a/pkgs/servers/sql/postgresql/ext/periods.nix
+++ b/pkgs/servers/sql/postgresql/ext/periods.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
  buildInputs = [ postgresql ];

  installPhase = ''
-    install -D -t $out/lib *.so
+    install -D -t $out/lib *${postgresql.dlSuffix}
    install -D -t $out/share/postgresql/extension *.sql
    install -D -t $out/share/postgresql/extension *.control
  '';
--- a/pkgs/servers/sql/postgresql/ext/pg_bigm.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_bigm.nix
@ -1,25 +1,32 @@
-{ lib, stdenv, fetchurl, postgresql }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, postgresql }:

 stdenv.mkDerivation rec {
  pname = "pg_bigm";
  version = "1.2-20200228";

-  src = fetchurl {
-    url = "mirror://osdn/pgbigm/72448/${pname}-${version}.tar.gz";
-    sha256 = "1hxn90prldwriqmqlf33ypgbxw5v54gkzx1305yzghryzfg7rhbl";
+  src = fetchFromGitHub {
+    owner = "pgbigm";
+    repo = "pg_bigm";
+    rev = "v${version}";
+    hash = "sha256-3lspEglVWzEUTiRIWqW0DpQe8gDn9R/RxsWuI9znYc8=";
  };

+  patches = [
+    # Fix compatiblity with PostgreSQL 16. Remove with the next release.
+    (fetchpatch {
+      url = "https://github.com/pgbigm/pg_bigm/commit/2a9d783c52a1d7a2eb414da6f091f6035da76edf.patch";
+      hash = "sha256-LuMpSUPnT8cPChQfA9sJEKP4aGpsbN5crfTKLnDzMN8=";
+    })
+  ];
+
  buildInputs = [ postgresql ];

  makeFlags = [ "USE_PGXS=1" ];

  installPhase = ''
-    mkdir -p $out/bin    # For buildEnv to setup proper symlinks. See #22653
-    mkdir -p $out/{lib,share/postgresql/extension}
-
-    cp *.so      $out/lib
-    cp *.sql     $out/share/postgresql/extension
-    cp *.control $out/share/postgresql/extension
+    install -D -t $out/lib pg_bigm${postgresql.dlSuffix}
+    install -D -t $out/share/postgresql/extension *.sql
+    install -D -t $out/share/postgresql/extension *.control
  '';

  meta = with lib; {
--- a/pkgs/servers/sql/postgresql/ext/pg_cron.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_cron.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
  installPhase = ''
    mkdir -p $out/{lib,share/postgresql/extension}

-    cp *.so      $out/lib
+    cp *${postgresql.dlSuffix} $out/lib
    cp *.sql     $out/share/postgresql/extension
    cp *.control $out/share/postgresql/extension
  '';
--- a/pkgs/servers/sql/postgresql/ext/pg_hint_plan.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_hint_plan.nix
@ -47,7 +47,7 @@ stdenv.mkDerivation {
  buildInputs = [ postgresql ];

  installPhase = ''
-    install -D -t $out/lib pg_hint_plan.so
+    install -D -t $out/lib pg_hint_plan${postgresql.dlSuffix}
    install -D -t $out/share/postgresql/extension *.sql
    install -D -t $out/share/postgresql/extension *.control
  '';
--- a/pkgs/servers/sql/postgresql/ext/pg_hll.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_hll.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "pg_hll";
-  version = "2.17";
+  version = "2.18";

  buildInputs = [ postgresql ];

@ -10,21 +10,19 @@ stdenv.mkDerivation rec {
    owner  = "citusdata";
    repo   = "postgresql-hll";
    rev    = "refs/tags/v${version}";
-    sha256 = "sha256-KYpyidy7t7v9puNjjmif16uz383zlo521luZpH3w/1I=";
+    hash   = "sha256-Latdxph1Ura8yKEokEjalJ+/GY+pAKOT3GXjuLprj6c=";
  };

  installPhase = ''
-    mkdir -p $out/{lib,share/postgresql/extension}
-
-    cp *.so      $out/lib
-    cp *.sql     $out/share/postgresql/extension
-    cp *.control $out/share/postgresql/extension
-  '';
+    install -D -t $out/lib hll${postgresql.dlSuffix}
+    install -D -t $out/share/postgresql/extension *.sql
+    install -D -t $out/share/postgresql/extension *.control
+ '';

  meta = with lib; {
    description = "HyperLogLog for PostgreSQL";
    homepage    = "https://github.com/citusdata/postgresql-hll";
-    changelog   = "https://github.com/citusdata/postgresql-hll/raw/v${version}/CHANGELOG.md";
+    changelog   = "https://github.com/citusdata/postgresql-hll/blob/v${version}/CHANGELOG.md";
    maintainers = with maintainers; [ thoughtpolice ];
    platforms   = postgresql.meta.platforms;
    license     = licenses.asl20;
--- a/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
@ -2,19 +2,19 @@

 stdenv.mkDerivation rec {
  pname = "pg_ivm";
-  version = "1.6";
+  version = "1.7";

  src = fetchFromGitHub {
    owner = "sraoss";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-MAZsEPQu1AqI53h01M5bErc/MUJRauNPO9Hizig+2dc=";
+    hash = "sha256-uSYhNUfd4mw7mGGAcP43X/0v/bNp6SdZjPzktGONgaQ=";
  };

  buildInputs = [ postgresql ];

  installPhase = ''
-    install -D -t $out/lib *.so
+    install -D -t $out/lib pg_ivm${postgresql.dlSuffix}
    install -D -t $out/share/postgresql/extension *.sql
    install -D -t $out/share/postgresql/extension *.control
  '';
@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Materialized views with IVM (Incremental View Maintenance) for PostgreSQL";
    homepage = "https://github.com/sraoss/pg_ivm";
+    changelog = "https://github.com/sraoss/pg_ivm/releases/tag/v${version}";
    maintainers = with maintainers; [ ivan ];
    platforms = postgresql.meta.platforms;
    license = licenses.postgresql;
--- a/pkgs/servers/sql/postgresql/ext/pg_net.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_net.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "pg_net";
-  version = "0.7.2";
+  version = "0.7.3";

  buildInputs = [ curl postgresql ];

@ -10,13 +10,13 @@ stdenv.mkDerivation rec {
    owner  = "supabase";
    repo   = pname;
    rev    = "refs/tags/v${version}";
-    hash   = "sha256-9Ki3fyinHTYrfckxAY0fCTlzJd9l+n7QRUV7mIWrqmc=";
+    hash   = "sha256-j5qLgn/i4ljysuwgT46579N+9VpGr483vQEX/3lUYFA=";
  };

  installPhase = ''
    mkdir -p $out/{lib,share/postgresql/extension}

-    cp *.so      $out/lib
+    cp *${postgresql.dlSuffix} $out/lib
    cp sql/*.sql $out/share/postgresql/extension
    cp *.control $out/share/postgresql/extension
  '';
@ -24,8 +24,10 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Async networking for Postgres";
    homepage    = "https://github.com/supabase/pg_net";
+    changelog   = "https://github.com/supabase/pg_net/releases/tag/v${version}";
    maintainers = with maintainers; [ thoughtpolice ];
    platforms   = postgresql.meta.platforms;
    license     = licenses.postgresql;
+    broken      = versionOlder postgresql.version "12";
  };
 }
--- a/pkgs/servers/sql/postgresql/ext/pg_partman.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_partman.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "pg_partman";
-  version = "4.7.4";
+  version = "5.0.0";

  buildInputs = [ postgresql ];

@ -10,13 +10,13 @@ stdenv.mkDerivation rec {
    owner  = "pgpartman";
    repo   = pname;
    rev    = "refs/tags/v${version}";
-    sha256 = "sha256-DdE/hqCrju678Xk3xXGVFhKQM3x9skQQKolNJ2/3gbs=";
+    sha256 = "sha256-T7+cPi8LIftWVwI9mi0LAwWCTxp/r6iyKT1wKO/Ztbk=";
  };

  installPhase = ''
    mkdir -p $out/{lib,share/postgresql/extension}

-    cp src/*.so      $out/lib
+    cp src/*${postgresql.dlSuffix} $out/lib
    cp updates/*     $out/share/postgresql/extension
    cp -r sql/*      $out/share/postgresql/extension
    cp *.control     $out/share/postgresql/extension
@ -25,9 +25,10 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Partition management extension for PostgreSQL";
    homepage    = "https://github.com/pgpartman/pg_partman";
-    changelog   = "https://github.com/pgpartman/pg_partman/raw/v${version}/CHANGELOG.txt";
+    changelog   = "https://github.com/pgpartman/pg_partman/blob/v${version}/CHANGELOG.md";
    maintainers = with maintainers; [ ggpeti ];
    platforms   = postgresql.meta.platforms;
    license     = licenses.postgresql;
+    broken      = versionOlder postgresql.version "14";
  };
 }
--- a/pkgs/servers/sql/postgresql/ext/pg_rational.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_rational.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {

    mkdir -p $out/{lib,share/postgresql/extension}

-    cp *.so      $out/lib
+    cp *${postgresql.dlSuffix} $out/lib
    cp *.sql     $out/share/postgresql/extension
    cp *.control $out/share/postgresql/extension

--- a/pkgs/servers/sql/postgresql/ext/pg_relusage.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_relusage.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
  };

  installPhase = ''
-    install -D -t $out/lib *.so
+    install -D -t $out/lib *${postgresql.dlSuffix}
    install -D -t $out/share/postgresql/extension *.sql
    install -D -t $out/share/postgresql/extension *.control
  '';
--- a/pkgs/servers/sql/postgresql/ext/pg_repack.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_repack.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {

  installPhase = ''
    install -D bin/pg_repack -t $out/bin/
-    install -D lib/pg_repack.so -t $out/lib/
+    install -D lib/pg_repack${postgresql.dlSuffix} -t $out/lib/
    install -D lib/{pg_repack--${version}.sql,pg_repack.control} -t $out/share/postgresql/extension
  '';

--- a/pkgs/servers/sql/postgresql/ext/pg_safeupdate.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_safeupdate.nix
@ -14,8 +14,7 @@ stdenv.mkDerivation rec {
  };

  installPhase = ''
-    mkdir -p $out/bin # for buildEnv, see https://github.com/NixOS/nixpkgs/issues/22653
-    install -D safeupdate.so -t $out/lib
+    install -D safeupdate${postgresql.dlSuffix} -t $out/lib
  '';

  meta = with lib; {
--- a/pkgs/servers/sql/postgresql/ext/pg_similarity.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_similarity.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation {
  buildInputs = [ postgresql gcc ];
  buildPhase = "USE_PGXS=1 make";
  installPhase = ''
-    install -D pg_similarity.so -t $out/lib/
+    install -D pg_similarity${postgresql.dlSuffix} -t $out/lib/
    install -D ./{pg_similarity--unpackaged--1.0.sql,pg_similarity--1.0.sql,pg_similarity.control} -t $out/share/postgresql/extension
  '';

--- a/pkgs/servers/sql/postgresql/ext/pg_topn.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_topn.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "pg_topn";
-  version = "2.5.0";
+  version = "2.6.0";

  buildInputs = [ postgresql ];

@ -10,13 +10,13 @@ stdenv.mkDerivation rec {
    owner  = "citusdata";
    repo   = "postgresql-topn";
    rev    = "refs/tags/v${version}";
-    sha256 = "sha256-BqOPnIReV6HnMQkqAGxB3PI10gh9ZEn4IN3A+g1h7/M=";
+    sha256 = "sha256-kq3P+a9NWLKN/CsISGHfInbeL4ex4KIeDhTKyyN7FVE=";
  };

  installPhase = ''
    mkdir -p $out/{lib,share/postgresql/extension}

-    cp *.so      $out/lib
+    cp *${postgresql.dlSuffix} $out/lib
    cp *.sql     $out/share/postgresql/extension
    cp *.control $out/share/postgresql/extension
  '';
--- a/pkgs/servers/sql/postgresql/ext/pgaudit.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgaudit.nix
@ -1,14 +1,42 @@
 { lib, stdenv, fetchFromGitHub, libkrb5, openssl, postgresql }:

-stdenv.mkDerivation rec {
+let
+  source = {
+    "16" = {
+      version = "16.0";
+      hash = "sha256-8+tGOl1U5y9Zgu+9O5UDDE4bec4B0JC/BQ6GLhHzQzc=";
+    };
+    "15" = {
+      version = "1.7.0";
+      hash = "sha256-8pShPr4HJaJQPjW1iPJIpj3CutTx8Tgr+rOqoXtgCcw=";
+    };
+    "14" = {
+      version = "1.6.2";
+      hash = "sha256-Bl7Jk2B0deZUDiI391vk4nilwuVGHd1wuaQRSCoA3Mk=";
+    };
+    "13" = {
+      version = "1.5.2";
+      hash = "sha256-fyf2Ym0fAAXjc28iFCGDEftPAyDLXmEgi/0DaTJJiIg=";
+    };
+    "12" = {
+      version = "1.4.3";
+      hash = "sha256-c8/xUFIHalu2bMCs57DeylK0oW0VnQwmUCpdp+tYqk4=";
+    };
+    "11" = {
+      version = "1.3.4";
+      hash = "sha256-UEnwD36ejeYWyKRHZ4mPt6/Ru76Gy8s/rgIvmgermiM=";
+    };
+  }.${lib.versions.major postgresql.version} or (throw "Source for pgaudit is not available for ${postgresql.version}");
+in
+stdenv.mkDerivation {
  pname = "pgaudit";
-  version = "1.7.0";
+  inherit (source) version;

  src = fetchFromGitHub {
    owner = "pgaudit";
    repo = "pgaudit";
-    rev = version;
-    hash = "sha256-8pShPr4HJaJQPjW1iPJIpj3CutTx8Tgr+rOqoXtgCcw=";
+    rev = source.version;
+    hash = source.hash;
  };

  buildInputs = [ libkrb5 openssl postgresql ];
@ -16,7 +44,7 @@ stdenv.mkDerivation rec {
  makeFlags = [ "USE_PGXS=1" ];

  installPhase = ''
-    install -D -t $out/lib *.so
+    install -D -t $out/lib pgaudit${postgresql.dlSuffix}
    install -D -t $out/share/postgresql/extension *.sql
    install -D -t $out/share/postgresql/extension *.control
  '';
@ -24,6 +52,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Open Source PostgreSQL Audit Logging";
    homepage = "https://github.com/pgaudit/pgaudit";
+    changelog = "https://github.com/pgaudit/pgaudit/releases/tag/${source.version}";
    maintainers = with maintainers; [ idontgetoutmuch ];
    platforms = postgresql.meta.platforms;
    license = licenses.postgresql;
--- a/pkgs/servers/sql/postgresql/ext/pgroonga.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgroonga.nix
@ -18,11 +18,11 @@ stdenv.mkDerivation rec {
  ];

  installPhase = ''
-    install -D pgroonga.so -t $out/lib/
+    install -D pgroonga${postgresql.dlSuffix} -t $out/lib/
    install -D pgroonga.control -t $out/share/postgresql/extension
    install -D data/pgroonga-*.sql -t $out/share/postgresql/extension

-    install -D pgroonga_database.so -t $out/lib/
+    install -D pgroonga_database${postgresql.dlSuffix} -t $out/lib/
    install -D pgroonga_database.control -t $out/share/postgresql/extension
    install -D data/pgroonga_database-*.sql -t $out/share/postgresql/extension
  '';
--- a/pkgs/servers/sql/postgresql/ext/pgrouting.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgrouting.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "pgrouting";
-  version = "3.5.0";
+  version = "3.5.1";

  nativeBuildInputs = [ cmake perl ];
  buildInputs = [ postgresql boost ];
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
    owner  = "pgRouting";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "sha256-6ckNKfun2A4WARhN6/hxPWAi8o+qGlrdYSDVQC9sKR0=";
+    sha256 = "sha256-X7ZXGPUkhPDBB2QpUGfqDTgOairkYZF78Ol0XEAmxD8=";
  };

  installPhase = ''
--- a/pkgs/servers/sql/postgresql/ext/pgsql-http.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgsql-http.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
  buildInputs = [ curl postgresql ];

  installPhase = ''
-    install -D -t $out/lib *.so
+    install -D -t $out/lib *${postgresql.dlSuffix}
    install -D -t $out/share/postgresql/extension *.sql
    install -D -t $out/share/postgresql/extension *.control
  '';
--- a/pkgs/servers/sql/postgresql/ext/pgtap.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgtap.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "pgtap";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "theory";
    repo = "pgtap";
    rev = "v${version}";
-    sha256 = "sha256-RaafUnrMRbvyf2m2Z+tK6XxVXDGnaOkYkSMxIJLnf6A=";
+    sha256 = "sha256-HOgCb1CCfsfbMbMMWuzFJ4B8CfVm9b0sI2zBY3/kqyI=";
  };

  nativeBuildInputs = [ postgresql perl perlPackages.TAPParserSourceHandlerpgTAP which ];
--- a/pkgs/servers/sql/postgresql/ext/pgvector.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgvector.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
  buildInputs = [ postgresql ];

  installPhase = ''
-    install -D -t $out/lib vector.so
+    install -D -t $out/lib vector${postgresql.dlSuffix}
    install -D -t $out/share/postgresql/extension sql/vector-*.sql
    install -D -t $out/share/postgresql/extension vector.control
  '';
--- a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
+++ b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
@ -2,19 +2,19 @@

 stdenv.mkDerivation rec {
  pname = "plpgsql_check";
-  version = "2.5.1";
+  version = "2.5.3";

  src = fetchFromGitHub {
    owner = "okbob";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-4J4uKcQ/jRKKgrpUUed9MXDmOJaYKYDzznt1DItr6T0=";
+    hash = "sha256-IR1x1duROt3IHYQx8CYXqUxTmFgB1sbia93k3oBfEkw=";
  };

  buildInputs = [ postgresql ];

  installPhase = ''
-    install -D -t $out/lib *.so
+    install -D -t $out/lib *${postgresql.dlSuffix}
    install -D -t $out/share/postgresql/extension *.sql
    install -D -t $out/share/postgresql/extension *.control
  '';
--- a/pkgs/servers/sql/postgresql/ext/plr.nix
+++ b/pkgs/servers/sql/postgresql/ext/plr.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    export USE_PGXS=1
  '';
  installPhase = ''
-    install -D plr.so -t $out/lib/
+    install -D plr${postgresql.dlSuffix} -t $out/lib/
    install -D {plr--*.sql,plr.control} -t $out/share/postgresql/extension
  '';

--- a/pkgs/servers/sql/postgresql/ext/repmgr.nix
+++ b/pkgs/servers/sql/postgresql/ext/repmgr.nix
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
    mkdir -p $out/{bin,lib,share/postgresql/extension}

    cp repmgr{,d} $out/bin
-    cp *.so       $out/lib
+    cp *${postgresql.dlSuffix} $out/lib
    cp *.sql      $out/share/postgresql/extension
    cp *.control  $out/share/postgresql/extension
  '';
--- a/pkgs/servers/sql/postgresql/ext/rum.nix
+++ b/pkgs/servers/sql/postgresql/ext/rum.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
  makeFlags = [ "USE_PGXS=1" ];

  installPhase = ''
-    install -D -t $out/lib *.so
+    install -D -t $out/lib *${postgresql.dlSuffix}
    install -D -t $out/share/postgresql/extension *.control
    install -D -t $out/share/postgresql/extension *.sql
  '';
--- a/pkgs/servers/sql/postgresql/ext/tds_fdw.nix
+++ b/pkgs/servers/sql/postgresql/ext/tds_fdw.nix
@ -1,26 +1,28 @@
-{ lib, stdenv, fetchFromGitHub, postgresql, freetds }:
+{ lib, stdenv, fetchFromGitHub, postgresql, freetds, unstableGitUpdater }:

 stdenv.mkDerivation rec {
  pname = "tds_fdw";
  # Move to stable version when it's released.
-  version = "unstable-2021-12-14";
+  version = "unstable-2023-07-20";

  buildInputs = [ postgresql freetds ];

  src = fetchFromGitHub {
    owner  = "tds-fdw";
-    repo   =  pname;
-    rev    = "1611a2805f85d84f463ae50c4e0765cb9bed72dc";
-    sha256 = "sha256-SYHo/o9fJjB1yzN4vLJB0RrF3HEJ4MzmEO44/Jih/20=";
+    repo   = "tds_fdw";
+    rev    = "2323efe2007d012b043fe91ea97a736b85eddce3";
+    hash   = "sha256-QdIQVQvOIY8dPi5KcbPQ/9crtD59hXstKOkHRfM1kNI=";
  };

  installPhase = ''
    version="$(sed -En "s,^default_version *= *'([^']*)'.*,\1,p" tds_fdw.control)"
-    install -D tds_fdw.so      -t $out/lib
+    install -D tds_fdw${postgresql.dlSuffix} -t $out/lib
    install -D sql/tds_fdw.sql    "$out/share/postgresql/extension/tds_fdw--$version.sql"
    install -D tds_fdw.control -t $out/share/postgresql/extension
  '';

+  passthru.updateScript = unstableGitUpdater { };
+
  meta = with lib; {
    description = "A PostgreSQL foreign data wrapper to connect to TDS databases (Sybase and Microsoft SQL Server)";
    homepage    = "https://github.com/tds-fdw/tds_fdw";
--- a/pkgs/servers/sql/postgresql/ext/temporal_tables.nix
+++ b/pkgs/servers/sql/postgresql/ext/temporal_tables.nix
@ -2,28 +2,26 @@

 stdenv.mkDerivation rec {
  pname = "temporal_tables";
-  version = "unstable-2021-02-20";
+  version = "1.2.2";

  buildInputs = [ postgresql ];

  src = fetchFromGitHub {
    owner  = "arkhipov";
-    repo   = pname;
-    rev    = "3ce22da51f2549e8f8b8fbf2850c63eb3a2f1fbb";
-    sha256 = "sha256-kmcl6vVHRZj2G5GijEyaZgDpZBDcdIUKzXv0rYYqUu4=";
+    repo   = "temporal_tables";
+    rev    = "v${version}";
+    sha256 = "sha256-7+DCSPAPhsokWDq/5IXNhd7jY6FfzxxUjlsg/VJeD3k=";
  };

  installPhase = ''
-    mkdir -p $out/{lib,share/postgresql/extension}
-
-    cp *.so      $out/lib
-    cp *.sql     $out/share/postgresql/extension
-    cp *.control $out/share/postgresql/extension
-  '';
+    install -D -t $out/lib temporal_tables${postgresql.dlSuffix}
+    install -D -t $out/share/postgresql/extension *.sql
+    install -D -t $out/share/postgresql/extension *.control
+ '';

  meta = with lib; {
-    description = "Temporal Tables PostgreSQL Extension ";
-    homepage    = "https://github.com/mlt/temporal_tables";
+    description = "Temporal Tables PostgreSQL Extension";
+    homepage    = "https://github.com/arkhipov/temporal_tables";
    maintainers = with maintainers; [ ggpeti ];
    platforms   = postgresql.meta.platforms;
    license     = licenses.bsd2;
--- a/pkgs/servers/sql/postgresql/ext/tsearch_extras.nix
+++ b/pkgs/servers/sql/postgresql/ext/tsearch_extras.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation {
  buildInputs = [ postgresql ];

  installPhase = ''
-    install -D tsearch_extras.so -t $out/lib/
+    install -D tsearch_extras${postgresql.dlSuffix} -t $out/lib/
    install -D ./{tsearch_extras--1.0.sql,tsearch_extras.control} -t $out/share/postgresql/extension
  '';

--- a/pkgs/servers/sql/postgresql/ext/wal2json.nix
+++ b/pkgs/servers/sql/postgresql/ext/wal2json.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
  makeFlags = [ "USE_PGXS=1" ];

  installPhase = ''
-    install -D -t $out/lib *.so
+    install -D -t $out/lib *${postgresql.dlSuffix}
    install -D -t $out/share/postgresql/extension sql/*.sql
  '';

--- a/pkgs/tools/admin/clair/default.nix
+++ b/pkgs/tools/admin/clair/default.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "clair";
-  version = "4.7.1";
+  version = "4.7.2";

  src = fetchFromGitHub {
    owner = "quay";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-+ABZafDc2nmHHnJGXj4iCSheuWoksPwDblmdIusUJuo=";
+    hash = "sha256-qnZLVt9pIrfZSCK0blNp5JHbaC4A8m6YicvL4hs2554=";
  };

-  vendorHash = "sha256-ptgHU/PrLqRG4h3C5x+XUy4+38Yu6h4gTeziaPJ2iWE=";
+  vendorHash = "sha256-mzrMiycW+kWtooCMWGLOHXPYJQ+y3wLMB2V+f4u4wtY=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/tools/misc/nix-direnv/default.nix
+++ b/pkgs/tools/misc/nix-direnv/default.nix
@ -3,24 +3,23 @@
 , fetchFromGitHub
 , gnugrep
 , nix
-, enableFlakes ? null # deprecated
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs:{
  pname = "nix-direnv";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "nix-community";
    repo = "nix-direnv";
-    rev = version;
-    sha256 = "sha256-Y9Yf/RJvfoFKS4ptVhPc9X0tQUPWSSxkS11r7wGge+8=";
+    rev = finalAttrs.version;
+    hash = "sha256-h49uz+/YDRwbusiVx6I3HP9P3UZROIOlwjlYYqRjesE=";
  };

  # Substitute instead of wrapping because the resulting file is
  # getting sourced, not executed:
  postPatch = ''
    sed -i "1a NIX_BIN_PREFIX=${nix}/bin/" direnvrc
-    substituteInPlace direnvrc --replace "grep" "${gnugrep}/bin/grep"
+    substituteInPlace direnvrc --replace "grep" "${lib.getExe gnugrep}"
  '';

  installPhase = ''
@ -29,11 +28,11 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

-  meta = with lib; {
+  meta = {
    description = "A fast, persistent use_nix implementation for direnv";
    homepage    = "https://github.com/nix-community/nix-direnv";
-    license     = licenses.mit;
-    platforms   = platforms.unix;
-    maintainers = with maintainers; [ mic92 bbenne10 ];
+    license     = lib.licenses.mit;
+    platforms   = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ mic92 bbenne10 ];
  };
-}
+})
--- a/pkgs/tools/security/nitrokey-app2/default.nix
+++ b/pkgs/tools/security/nitrokey-app2/default.nix
@ -8,7 +8,9 @@
 python3.pkgs.buildPythonApplication rec {
  pname = "nitrokey-app2";
  version = "2.1.2";
-  format = "flit";
+  pyproject = true;
+
+  disabled = python3.pythonOlder "3.9";

  src = fetchFromGitHub {
    owner = "Nitrokey";
@ -17,11 +19,22 @@ python3.pkgs.buildPythonApplication rec {
    hash = "sha256-VyhIFNXxH/FohgjhBeZXoQYppP7PEz+ei0qzsWz1xhk=";
  };

+  # https://github.com/Nitrokey/nitrokey-app2/issues/152
+  #
+  # pythonRelaxDepsHook does not work here, because it runs in postBuild and
+  # only modifies the dependencies in the built distribution.
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace "pynitrokey ==" "pynitrokey >="
+  '';
+
+  # The pyproject.toml file seems to be incomplete and does not generate
+  # resources (i.e. run pyrcc5 and pyuic5) but the Makefile does.
  preBuild = ''
    make build-ui
  '';

  nativeBuildInputs = with python3.pkgs; [
+    flit-core
    pyqt5
    wrapQtAppsHook
  ];
@ -41,9 +54,14 @@ python3.pkgs.buildPythonApplication rec {
      --set-default CRYPTOGRAPHY_OPENSSL_NO_LEGACY 1
  '';

+  pythonImportsCheck = [
+    "nitrokeyapp"
+  ];
+
  meta = with lib; {
    description = "This application allows to manage Nitrokey 3 devices";
    homepage = "https://github.com/Nitrokey/nitrokey-app2";
+    changelog = "https://github.com/Nitrokey/nitrokey-app2/releases/tag/v${version}";
    license = licenses.asl20;
    maintainers = with maintainers; [ _999eagle ];
    mainProgram = "nitrokeyapp";
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -135,6 +135,7 @@ mapAliases ({
  crispyDoom = crispy-doom; # Added 2023-05-01
  clasp = clingo; # added 2022-12-22
  claws-mail-gtk3 = claws-mail; # Added 2021-07-10
+  cntk = throw "'cntk' has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2023-10-09
  codimd = hedgedoc; # Added 2020-11-29
  inherit (libsForQt5.mauiPackages) communicator; # added 2022-05-17
  compton = throw "'compton' has been renamed to/replaced by 'picom'"; # Converted to throw 2023-09-10
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -20992,8 +20992,6 @@ with pkgs;

  cddlib = callPackage ../development/libraries/cddlib { };

-  cdk = callPackage ../development/libraries/cdk { };
-
  cdk-go = callPackage ../tools/security/cdk-go { };

  cdo = callPackage ../development/libraries/cdo { };
@ -40071,13 +40069,6 @@ with pkgs;

  caffeine-ng = callPackage ../tools/X11/caffeine-ng { };

-  cntk = callPackage ../applications/science/math/cntk {
-    stdenv = gcc7Stdenv;
-    inherit (linuxPackages) nvidia_x11;
-    opencv3 = opencv3WithoutCuda; # Used only for image loading.
-    inherit (config) cudaSupport;
-  };
-
  dap = callPackage ../applications/science/math/dap { };

  ecm = callPackage ../applications/science/math/ecm { };
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@ -74,6 +74,7 @@ mapAliases ({
  carrot = throw "carrot has been removed, as its development was discontinued in 2012"; # added 2022-01-18
  cchardet = faust-cchardet; # added 2023-03-02
  class-registry = phx-class-registry; # added 2021-10-05
+  cntk = throw "cntk has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2023-10-09
  codespell = throw "codespell has been promoted to a top-level attribute"; # Added 2022-10-02
  ColanderAlchemy = colanderalchemy; # added 2023-02-19
  CommonMark = commonmark; # added 2023-02-1
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -2149,8 +2149,6 @@ self: super: with self; {

  cmsis-svd = callPackage ../development/python-modules/cmsis-svd { };

-  cntk = callPackage ../development/python-modules/cntk { };
-
  cnvkit = callPackage ../development/python-modules/cnvkit { };

  co2signal = callPackage ../development/python-modules/co2signal { };