Merge master into staging-next

2022-12-01 18:01:25 +00:00 · 2022-12-01 18:01:25 +00:00 · 237453e7f7
commit 237453e7f7
parent 5d71fe0cdb 4c5c40f176
82 changed files with 645 additions and 423 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -15811,7 +15811,7 @@
  };
  portothree = {
    name = "Gustavo Porto";
-    email = "gustavoporto@ya.ru";
+    email = "gus@p8s.co";
    github = "portothree";
    githubId = 3718120;
  };
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@ -439,6 +439,16 @@
          instead.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>services.sourcehut.dispatch</literal> and the
+          corresponding package
+          (<literal>sourcehut.dispatchsrht</literal>) have been removed
+          due to
+          <link xlink:href="https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/">upstream
+          deprecation</link>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The <literal>p4</literal> package now only includes the
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@ -78,6 +78,13 @@
          relying on this should provide their own implementation.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <literal>nix.readOnlyStore</literal> option has been
+          renamed to <literal>boot.readOnlyNixStore</literal> to clarify
+          that it configures the NixOS boot process, not the Nix daemon.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-23.05-notable-changes">
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -124,6 +124,8 @@ In addition to numerous new and upgraded packages, this release includes the fol
 - `services.hbase` has been renamed to `services.hbase-standalone`.
  For production HBase clusters, use `services.hadoop.hbase` instead.

+- `services.sourcehut.dispatch` and the corresponding package (`sourcehut.dispatchsrht`) have been removed due to [upstream deprecation](https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/).
+
 - The `p4` package now only includes the open-source Perforce Helix Core command-line client and APIs. It no longer installs the unfree Helix Core Server binaries `p4d`, `p4broker`, and `p4p`. To install the Helix Core Server binaries, use the `p4d` package instead.

 - The OpenSSL extension for the PHP interpreter used by Nextcloud is built against OpenSSL 1.1 if
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -29,6 +29,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The EC2 image module previously detected and activated swap-formatted instance store devices and partitions in stage-1 (initramfs). This behaviour has been removed. Users relying on this should provide their own implementation.

+- The `nix.readOnlyStore` option has been renamed to `boot.readOnlyNixStore` to clarify that it configures the NixOS boot process, not the Nix daemon.
+
 ## Other Notable Changes {#sec-release-23.05-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@ -618,7 +618,7 @@ in {
    # Install all the user shells
    environment.systemPackages = systemShells;

-    environment.etc = (mapAttrs' (_: { packages, name, ... }: {
+    environment.etc = mapAttrs' (_: { packages, name, ... }: {
      name = "profiles/per-user/${name}";
      value.source = pkgs.buildEnv {
        name = "user-environment";
@ -626,7 +626,7 @@ in {
        inherit (config.environment) pathsToLink extraOutputsToInstall;
        inherit (config.system.path) ignoreCollisions postBuild;
      };
-    }) (filterAttrs (_: u: u.packages != []) cfg.users));
+    }) (filterAttrs (_: u: u.packages != []) cfg.users);

    environment.profiles = [
      "$HOME/.nix-profile"
--- a/nixos/modules/misc/man-db.nix
+++ b/nixos/modules/misc/man-db.nix
@ -52,9 +52,13 @@ in
    environment.systemPackages = [ cfg.package ];
    environment.etc."man_db.conf".text =
      let
+        mandbForBuild = if pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform then
+                          cfg.package
+                        else
+                          pkgs.buildPackages.man-db;
        manualCache = pkgs.runCommand "man-cache" { } ''
          echo "MANDB_MAP ${cfg.manualPages}/share/man $out" > man.conf
-          ${cfg.package}/bin/mandb -C man.conf -psc >/dev/null 2>&1
+          ${mandbForBuild}/bin/mandb -C man.conf -psc >/dev/null 2>&1
        '';
      in
      ''
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@ -23,12 +23,12 @@ let
    optionalAttrs (lhs ? packageOverrides) {
      packageOverrides = pkgs:
        optCall lhs.packageOverrides pkgs //
-        optCall (attrByPath ["packageOverrides"] ({}) rhs) pkgs;
+        optCall (attrByPath [ "packageOverrides" ] { } rhs) pkgs;
    } //
    optionalAttrs (lhs ? perlPackageOverrides) {
      perlPackageOverrides = pkgs:
        optCall lhs.perlPackageOverrides pkgs //
-        optCall (attrByPath ["perlPackageOverrides"] ({}) rhs) pkgs;
+        optCall (attrByPath [ "perlPackageOverrides" ] { } rhs) pkgs;
    };

  configType = mkOptionType {
@ -67,11 +67,6 @@ let
  # Context for messages
  hostPlatformLine = optionalString hasHostPlatform "${showOptionWithDefLocs opt.hostPlatform}";
  buildPlatformLine = optionalString hasBuildPlatform "${showOptionWithDefLocs opt.buildPlatform}";
-  platformLines = optionalString hasPlatform ''
-    Your system configuration configures nixpkgs with platform parameters:
-    ${hostPlatformLine
-    }${buildPlatformLine
-    }'';

  legacyOptionsDefined =
    optional (opt.localSystem.highestPrio < (mkDefault {}).priority) opt.system
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -46,6 +46,7 @@
  ./hardware/brillo.nix
  ./hardware/ckb-next.nix
  ./hardware/cpu/amd-microcode.nix
+  ./hardware/cpu/amd-sev.nix
  ./hardware/cpu/intel-microcode.nix
  ./hardware/cpu/intel-sgx.nix
  ./hardware/corectrl.nix
--- a/nixos/modules/profiles/all-hardware.nix
+++ b/nixos/modules/profiles/all-hardware.nix
@ -31,7 +31,7 @@ in
      "pata_winbond"

      # SCSI support (incomplete).
-      "3w-9xxx" "3w-xxxx" "aic79xx" "aic7xxx" "arcmsr"
+      "3w-9xxx" "3w-xxxx" "aic79xx" "aic7xxx" "arcmsr" "hpsa"

      # USB support, especially for booting from USB CD-ROM
      # drives.
--- a/nixos/modules/profiles/docker-container.nix
+++ b/nixos/modules/profiles/docker-container.nix
@ -1,13 +1,12 @@
 { config, lib, pkgs, ... }:

-with lib;
-
-let inherit (pkgs) writeScript; in
-
 let
- pkgs2storeContents = l : map (x: { object = x; symlink = "none"; }) l;
+  inherit (pkgs) writeScript;

-in {
+  pkgs2storeContents = map (x: { object = x; symlink = "none"; });
+in
+
+{
  # Docker image config.
  imports = [
    ../installer/cd-dvd/channel.nix
--- a/nixos/modules/services/cluster/hadoop/hbase.nix
+++ b/nixos/modules/services/cluster/hadoop/hbase.nix
@ -141,9 +141,9 @@ in

      services.hadoop.hbaseSiteInternal."hbase.rootdir" = cfg.hbase.rootdir;

-      networking.firewall.allowedTCPPorts = (mkIf cfg.hbase.master.openFirewall [
+      networking.firewall.allowedTCPPorts = mkIf cfg.hbase.master.openFirewall [
        16000 16010
-      ]);
+      ];

    })

@ -168,9 +168,9 @@ in
      services.hadoop.hbaseSiteInternal."hbase.rootdir" = cfg.hbase.rootdir;

      networking = {
-        firewall.allowedTCPPorts = (mkIf cfg.hbase.regionServer.openFirewall [
+        firewall.allowedTCPPorts = mkIf cfg.hbase.regionServer.openFirewall [
          16020 16030
-        ]);
+        ];
        hosts = mkIf cfg.hbase.regionServer.overrideHosts {
          "127.0.0.2" = mkForce [ ];
          "::1" = mkForce [ ];
--- a/nixos/modules/services/continuous-integration/buildbot/master.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/master.nix
@ -10,7 +10,7 @@ let

  python = cfg.package.pythonModule;

-  escapeStr = s: escape ["'"] s;
+  escapeStr = escape [ "'" ];

  defaultMasterCfg = pkgs.writeText "master.cfg" ''
    from buildbot.plugins import *
@ -245,9 +245,7 @@ in {
        description = "Buildbot User.";
        isNormalUser = true;
        createHome = true;
-        home = cfg.home;
-        group = cfg.group;
-        extraGroups = cfg.extraGroups;
+        inherit (cfg) home group extraGroups;
        useDefaultShell = true;
      };
    };
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@ -67,7 +67,7 @@ in {
      '');

      servers = mkOption {
-        type = with types; attrsOf (submodule ({config, name, ...}@args: {
+        type = with types; attrsOf (submodule ({ config, name, ... }: {
          options = {
            enable = mkEnableOption (lib.mdDoc ''
              Redis server.
@ -271,14 +271,11 @@ in {
          };
          config.settings = mkMerge [
            {
-              port = config.port;
+              inherit (config) port logfile databases maxclients appendOnly;
              daemonize = false;
              supervised = "systemd";
              loglevel = config.logLevel;
-              logfile = config.logfile;
              syslog-enabled = config.syslog;
-              databases = config.databases;
-              maxclients = config.maxclients;
              save = if config.save == []
                then ''""'' # Disable saving with `save = ""`
                else map
@ -286,12 +283,11 @@ in {
                  config.save;
              dbfilename = "dump.rdb";
              dir = "/var/lib/${redisName name}";
-              appendOnly = config.appendOnly;
              appendfsync = config.appendFsync;
              slowlog-log-slower-than = config.slowLogLogSlowerThan;
              slowlog-max-len = config.slowLogMaxLen;
            }
-            (mkIf (config.bind != null) { bind = config.bind; })
+            (mkIf (config.bind != null) { inherit (config) bind; })
            (mkIf (config.unixSocket != null) {
              unixsocket = config.unixSocket;
              unixsocketperm = toString config.unixSocketPerm;
--- a/nixos/modules/services/development/jupyter/default.nix
+++ b/nixos/modules/services/development/jupyter/default.nix
@ -119,7 +119,7 @@ in {

    kernels = mkOption {
      type = types.nullOr (types.attrsOf(types.submodule (import ./kernel-options.nix {
-        inherit lib;
+        inherit lib pkgs;
      })));

      default = null;
--- a/nixos/modules/services/development/jupyter/kernel-options.nix
+++ b/nixos/modules/services/development/jupyter/kernel-options.nix
@ -1,9 +1,11 @@
 # Options that can be used for creating a jupyter kernel.
-{lib }:
+{ lib, pkgs }:

 with lib;

 {
+  freeformType = (pkgs.formats.json { }).type;
+
  options = {

    displayName = mkOption {
@ -40,6 +42,15 @@ with lib;
      '';
    };

+    env = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+      example = { OMP_NUM_THREADS = "1"; };
+      description = lib.mdDoc ''
+        Environment variables to set for the kernel.
+      '';
+    };
+
    logo32 = mkOption {
      type = types.nullOr types.path;
      default = null;
--- a/nixos/modules/services/development/jupyterhub/default.nix
+++ b/nixos/modules/services/development/jupyterhub/default.nix
@ -119,7 +119,7 @@ in {

    kernels = mkOption {
      type = types.nullOr (types.attrsOf(types.submodule (import ../jupyter/kernel-options.nix {
-        inherit lib;
+        inherit lib pkgs;
      })));

      default = null;
--- a/nixos/modules/services/games/crossfire-server.nix
+++ b/nixos/modules/services/games/crossfire-server.nix
@ -131,9 +131,9 @@ in {
        exp_table = "";
        forbid = "";
        metaserver2 = "";
-        motd = (fileContents "${cfg.package}/etc/crossfire/motd");
-        news = (fileContents "${cfg.package}/etc/crossfire/news");
-        rules = (fileContents "${cfg.package}/etc/crossfire/rules");
+        motd = fileContents "${cfg.package}/etc/crossfire/motd";
+        news = fileContents "${cfg.package}/etc/crossfire/news";
+        rules = fileContents "${cfg.package}/etc/crossfire/rules";
        settings = "";
        stat_bonus = "";
      } // cfg.configFiles);
--- a/nixos/modules/services/hardware/sane.nix
+++ b/nixos/modules/services/hardware/sane.nix
@ -126,6 +126,15 @@ in
      '';
    };

+    hardware.sane.openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Open ports needed for discovery of scanners on the local network, e.g.
+        needed for Canon scanners (BJNP protocol).
+      '';
+    };
+
    services.saned.enable = mkOption {
      type = types.bool;
      default = false;
@ -163,6 +172,7 @@ in
      services.udev.packages = backends;

      users.groups.scanner.gid = config.ids.gids.scanner;
+      networking.firewall.allowedUDPPorts = mkIf config.hardware.sane.openFirewall [ 8612 ];
    })

    (mkIf config.services.saned.enable {
--- a/nixos/modules/services/misc/gammu-smsd.nix
+++ b/nixos/modules/services/misc/gammu-smsd.nix
@ -45,8 +45,8 @@ let
  initDBDir = "share/doc/gammu/examples/sql";

  gammuPackage = with cfg.backend; (pkgs.gammu.override {
-    dbiSupport = (service == "sql" && sql.driver == "sqlite");
-    postgresSupport = (service == "sql" && sql.driver == "native_pgsql");
+    dbiSupport = service == "sql" && sql.driver == "sqlite";
+    postgresSupport = service == "sql" && sql.driver == "native_pgsql";
  });

 in {
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@ -483,7 +483,7 @@ in
      description = "gitea";
      after = [ "network.target" ] ++ lib.optional usePostgresql "postgresql.service" ++ lib.optional useMysql "mysql.service";
      wantedBy = [ "multi-user.target" ];
-      path = [ gitea pkgs.git ];
+      path = [ gitea pkgs.git pkgs.gnupg ];

      # In older versions the secret naming for JWT was kind of confusing.
      # The file jwt_secret hold the value for LFS_JWT_SECRET and JWT_SECRET
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@ -115,6 +115,7 @@ in
    (mkRenamedOptionModuleWith { sinceRelease = 2003; from = [ "nix" "useChroot" ]; to = [ "nix" "useSandbox" ]; })
    (mkRenamedOptionModuleWith { sinceRelease = 2003; from = [ "nix" "chrootDirs" ]; to = [ "nix" "sandboxPaths" ]; })
    (mkRenamedOptionModuleWith { sinceRelease = 2205; from = [ "nix" "daemonIONiceLevel" ]; to = [ "nix" "daemonIOSchedPriority" ]; })
+    (mkRenamedOptionModuleWith { sinceRelease = 2211; from = [ "nix" "readOnlyStore" ]; to = [ "boot" "readOnlyNixStore" ]; })
    (mkRemovedOptionModule [ "nix" "daemonNiceLevel" ] "Consider nix.daemonCPUSchedPolicy instead.")
  ] ++ mapAttrsToList (oldConf: newConf: mkRenamedOptionModuleWith { sinceRelease = 2205; from = [ "nix" oldConf ]; to = [ "nix" "settings" newConf ]; }) legacyConfMappings;

@ -366,17 +367,6 @@ in
        '';
      };

-      readOnlyStore = mkOption {
-        type = types.bool;
-        default = true;
-        description = lib.mdDoc ''
-          If set, NixOS will enforce the immutability of the Nix store
-          by making {file}`/nix/store` a read-only bind
-          mount.  Nix will automatically make the store writable when
-          needed.
-        '';
-      };
-
      nixPath = mkOption {
        type = types.listOf types.str;
        default = [
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@ -206,6 +206,57 @@ in
          description = lib.mdDoc "Create the database and database user locally.";
        };
      };
+
+      components = {
+        subversion = mkOption {
+          type = types.bool;
+          default = false;
+          description = lib.mdDoc "Subversion integration.";
+        };
+
+        mercurial = mkOption {
+          type = types.bool;
+          default = false;
+          description = lib.mdDoc "Mercurial integration.";
+        };
+
+        git = mkOption {
+          type = types.bool;
+          default = false;
+          description = lib.mdDoc "git integration.";
+        };
+
+        cvs = mkOption {
+          type = types.bool;
+          default = false;
+          description = lib.mdDoc "cvs integration.";
+        };
+
+        breezy = mkOption {
+          type = types.bool;
+          default = false;
+          description = lib.mdDoc "bazaar integration.";
+        };
+
+        imagemagick = mkOption {
+          type = types.bool;
+          default = false;
+          description = lib.mdDoc "Allows exporting Gant diagrams as PNG.";
+        };
+
+        ghostscript = mkOption {
+          type = types.bool;
+          default = false;
+          description = lib.mdDoc "Allows exporting Gant diagrams as PDF.";
+        };
+
+        minimagick_font_path = mkOption {
+          type = types.str;
+          default = "";
+          description = lib.mdDoc "MiniMagick font path";
+          example = "/run/current-system/sw/share/X11/fonts/LiberationSans-Regular.ttf";
+        };
+      };
    };
  };

@ -225,16 +276,21 @@ in
      { assertion = cfg.database.createLocally -> cfg.database.host == "localhost";
        message = "services.redmine.database.host must be set to localhost if services.redmine.database.createLocally is set to true";
      }
+      { assertion = cfg.components.imagemagick -> cfg.components.minimagick_font_path != "";
+        message = "services.redmine.components.minimagick_font_path must be configured with a path to a font file if services.redmine.components.imagemagick is set to true.";
+      }
    ];

    services.redmine.settings = {
      production = {
-        scm_subversion_command = "${pkgs.subversion}/bin/svn";
-        scm_mercurial_command = "${pkgs.mercurial}/bin/hg";
-        scm_git_command = "${pkgs.git}/bin/git";
-        scm_cvs_command = "${pkgs.cvs}/bin/cvs";
-        scm_bazaar_command = "${pkgs.breezy}/bin/bzr";
-        scm_darcs_command = "${pkgs.darcs}/bin/darcs";
+        scm_subversion_command = if cfg.components.subversion then "${pkgs.subversion}/bin/svn" else "";
+        scm_mercurial_command = if cfg.components.mercurial then "${pkgs.mercurial}/bin/hg" else "";
+        scm_git_command = if cfg.components.git then "${pkgs.git}/bin/git" else "";
+        scm_cvs_command = if cfg.components.cvs then "${pkgs.cvs}/bin/cvs" else "";
+        scm_bazaar_command = if cfg.components.breezy then "${pkgs.breezy}/bin/bzr" else "";
+        imagemagick_convert_command = if cfg.components.imagemagick then "${pkgs.imagemagick}/bin/convert" else "";
+        gs_command = if cfg.components.ghostscript then "${pkgs.ghostscript}/bin/gs" else "";
+        minimagick_font_path = "${cfg.components.minimagick_font_path}";
      };
    };

@ -296,14 +352,15 @@ in
      environment.REDMINE_LANG = "en";
      environment.SCHEMA = "${cfg.stateDir}/cache/schema.db";
      path = with pkgs; [
-        imagemagick
-        breezy
-        cvs
-        darcs
-        git
-        mercurial
-        subversion
-      ];
+      ]
+      ++ optional cfg.components.subversion subversion
+      ++ optional cfg.components.mercurial mercurial
+      ++ optional cfg.components.git git
+      ++ optional cfg.components.cvs cvs
+      ++ optional cfg.components.breezy breezy
+      ++ optional cfg.components.imagemagick imagemagick
+      ++ optional cfg.components.ghostscript ghostscript;
+
      preStart = ''
        rm -rf "${cfg.stateDir}/plugins/"*
        rm -rf "${cfg.stateDir}/public/themes/"*
--- a/nixos/modules/services/misc/sourcehut/default.nix
+++ b/nixos/modules/services/misc/sourcehut/default.nix
@ -88,7 +88,6 @@ let
    # Sourcehut services
    srht
    buildsrht
-    dispatchsrht
    gitsrht
    hgsrht
    hubsrht
@ -109,13 +108,13 @@ in
 {
  options.services.sourcehut = {
    enable = mkEnableOption (lib.mdDoc ''
-      sourcehut - git hosting, continuous integration, mailing list, ticket tracking,
-      task dispatching, wiki and account management services
+      sourcehut - git hosting, continuous integration, mailing list, ticket tracking, wiki
+      and account management services
    '');

    services = mkOption {
      type = with types; listOf (enum
-        [ "builds" "dispatch" "git" "hg" "hub" "lists" "man" "meta" "pages" "paste" "todo" ]);
+        [ "builds" "git" "hg" "hub" "lists" "man" "meta" "pages" "paste" "todo" ]);
      defaultText = "locally enabled services";
      description = lib.mdDoc ''
        Services that may be displayed as links in the title bar of the Web interface.
@ -301,32 +300,6 @@ in
          };
        };

-        options."dispatch.sr.ht" = commonServiceSettings "dispatch" // {
-        };
-        options."dispatch.sr.ht::github" = {
-          oauth-client-id = mkOptionNullOrStr "OAuth client id.";
-          oauth-client-secret = mkOptionNullOrStr "OAuth client secret.";
-        };
-        options."dispatch.sr.ht::gitlab" = {
-          enabled = mkEnableOption (lib.mdDoc "GitLab integration");
-          canonical-upstream = mkOption {
-            type = types.str;
-            description = lib.mdDoc "Canonical upstream.";
-            default = "gitlab.com";
-          };
-          repo-cache = mkOption {
-            type = types.str;
-            description = lib.mdDoc "Repository cache directory.";
-            default = "./repo-cache";
-          };
-          "gitlab.com" = mkOption {
-            type = with types; nullOr str;
-            description = lib.mdDoc "GitLab id and secret.";
-            default = null;
-            example = "GitLab:application id:secret";
-          };
-        };
-
        options."builds.sr.ht" = commonServiceSettings "builds" // {
          allow-free = mkEnableOption (lib.mdDoc "nonpaying users to submit builds");
          redis = mkOption {
@ -1021,11 +994,6 @@ in
      ];
    })

-    (import ./service.nix "dispatch" {
-      inherit configIniOfService;
-      port = 5005;
-    })
-
    (import ./service.nix "git" (let
      baseService = {
        path = [ cfg.git.package ];
@ -1416,6 +1384,10 @@ in
    (mkRenamedOptionModule [ "services" "sourcehut" "address" ]
                           [ "services" "sourcehut" "listenAddress" ])

+    (mkRemovedOptionModule [ "services" "sourcehut" "dispatch" ] ''
+        dispatch is deprecated. See https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/
+        for more information.
+    '')
  ];

  meta.doc = ./sourcehut.xml;
--- a/nixos/modules/services/networking/keepalived/default.nix
+++ b/nixos/modules/services/networking/keepalived/default.nix
@ -84,13 +84,11 @@ let
    ''
  ) vrrpInstances);

-  virtualIpLine = (ip:
-    ip.addr
+  virtualIpLine = ip: ip.addr
    + optionalString (notNullOrEmpty ip.brd) " brd ${ip.brd}"
    + optionalString (notNullOrEmpty ip.dev) " dev ${ip.dev}"
    + optionalString (notNullOrEmpty ip.scope) " scope ${ip.scope}"
-    + optionalString (notNullOrEmpty ip.label) " label ${ip.label}"
-  );
+    + optionalString (notNullOrEmpty ip.label) " label ${ip.label}";

  notNullOrEmpty = s: !(s == null || s == "");

--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@ -263,7 +263,7 @@ let
    if builtins.isString x then ''"${x}"''
    else if builtins.isBool x then boolToString x
    else if builtins.isInt x then toString x
-    else if builtins.isList x then ''{ ${lib.concatStringsSep ", " (map (n: toLua n) x) } }''
+    else if builtins.isList x then "{ ${lib.concatMapStringsSep ", " toLua x} }"
    else throw "Invalid Lua value";

  createSSLOptsStr = o: ''
--- a/nixos/modules/services/networking/softether.nix
+++ b/nixos/modules/services/networking/softether.nix
@ -5,7 +5,7 @@ with lib;
 let
  cfg = config.services.softether;

-  package = cfg.package.override { dataDir = cfg.dataDir; };
+  package = cfg.package.override { inherit (cfg) dataDir; };

 in
 {
@ -88,7 +88,7 @@ in
      };
    }

-    (mkIf (cfg.vpnserver.enable) {
+    (mkIf cfg.vpnserver.enable {
      systemd.services.vpnserver = {
        description = "SoftEther VPN Server";
        after = [ "softether-init.service" ];
@ -109,7 +109,7 @@ in
      };
    })

-    (mkIf (cfg.vpnbridge.enable) {
+    (mkIf cfg.vpnbridge.enable {
      systemd.services.vpnbridge = {
        description = "SoftEther VPN Bridge";
        after = [ "softether-init.service" ];
@ -130,7 +130,7 @@ in
      };
    })

-    (mkIf (cfg.vpnclient.enable) {
+    (mkIf cfg.vpnclient.enable {
      systemd.services.vpnclient = {
        description = "SoftEther VPN Client";
        after = [ "softether-init.service" ];
--- a/nixos/modules/services/security/physlock.nix
+++ b/nixos/modules/services/security/physlock.nix
@ -57,6 +57,14 @@ in
        '';
      };

+      muteKernelMessages = mkOption {
+        type = types.bool;
+        default = false;
+        description = lib.mdDoc ''
+          Disable kernel messages on console while physlock is running.
+        '';
+      };
+
      lockOn = {

        suspend = mkOption {
@ -116,7 +124,7 @@ in
                ++ cfg.lockOn.extraTargets;
        serviceConfig = {
          Type = "forking";
-          ExecStart = "${pkgs.physlock}/bin/physlock -d${optionalString cfg.disableSysRq "s"}${optionalString (cfg.lockMessage != "") " -p \"${cfg.lockMessage}\""}";
+          ExecStart = "${pkgs.physlock}/bin/physlock -d${optionalString cfg.muteKernelMessages "m"}${optionalString cfg.disableSysRq "s"}${optionalString (cfg.lockMessage != "") " -p \"${cfg.lockMessage}\""}";
        };
      };

--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@ -19,9 +19,9 @@ let
  # We only want to create a database if we're actually going to connect to it.
  databaseActuallyCreateLocally = cfg.database.createLocally && cfg.database.host == null;

-  tlsEnabled = (cfg.enableACME
+  tlsEnabled = cfg.enableACME
                || cfg.sslCertificate != null
-                || cfg.sslCertificateKey != null);
+                || cfg.sslCertificateKey != null;
 in
 {
  options = {
--- a/nixos/modules/services/web-apps/invoiceplane.nix
+++ b/nixos/modules/services/web-apps/invoiceplane.nix
@ -327,7 +327,7 @@ in
    )) eachSite;

    systemd.services =
-      (mapAttrs' (hostName: cfg: (
+      mapAttrs' (hostName: cfg: (
        nameValuePair "invoiceplane-cron-${hostName}" (mkIf cfg.cron.enable {
          serviceConfig = {
            Type = "oneshot";
@ -335,7 +335,7 @@ in
            ExecStart = "${pkgs.curl}/bin/curl --header 'Host: ${hostName}' http://localhost/invoices/cron/recur/${cfg.cron.key}";
          };
        })
-    )) eachSite);
+    )) eachSite;

  }

--- a/nixos/modules/services/web-apps/isso.nix
+++ b/nixos/modules/services/web-apps/isso.nix
@ -63,6 +63,28 @@ in {

        Restart = "on-failure";
        RestartSec = 1;
+
+        # Hardening
+        CapabilityBoundingSet = [ "" ];
+        DeviceAllow = [ "" ];
+        LockPersonality = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+        UMask = "0077";
      };
    };
  };
--- a/nixos/modules/system/boot/stage-2-init.sh
+++ b/nixos/modules/system/boot/stage-2-init.sh
@ -68,7 +68,7 @@ fi
 # like squashfs.
 chown -f 0:30000 /nix/store
 chmod -f 1775 /nix/store
-if [ -n "@readOnlyStore@" ]; then
+if [ -n "@readOnlyNixStore@" ]; then
    if ! [[ "$(findmnt --noheadings --output OPTIONS /nix/store)" =~ ro(,|$) ]]; then
        if [ -z "$container" ]; then
            mount --bind /nix/store /nix/store
--- a/nixos/modules/system/boot/stage-2.nix
+++ b/nixos/modules/system/boot/stage-2.nix
@ -10,9 +10,8 @@ let
    src = ./stage-2-init.sh;
    shellDebug = "${pkgs.bashInteractive}/bin/bash";
    shell = "${pkgs.bash}/bin/bash";
-    inherit (config.boot) systemdExecutable extraSystemdUnitPaths;
+    inherit (config.boot) readOnlyNixStore systemdExecutable extraSystemdUnitPaths;
    isExecutable = true;
-    inherit (config.nix) readOnlyStore;
    inherit useHostResolvConf;
    inherit (config.system.build) earlyMountScript;
    path = lib.makeBinPath ([
@ -42,6 +41,17 @@ in
        '';
      };

+      readOnlyNixStore = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc ''
+          If set, NixOS will enforce the immutability of the Nix store
+          by making {file}`/nix/store` a read-only bind
+          mount.  Nix will automatically make the store writable when
+          needed.
+        '';
+      };
+
      systemdExecutable = mkOption {
        default = "/run/current-system/systemd/lib/systemd/systemd";
        type = types.str;
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -1411,9 +1411,10 @@ in
    # Set the host and domain names in the activation script.  Don't
    # clear it if it's not configured in the NixOS configuration,
    # since it may have been set by dhcpcd in the meantime.
-    system.activationScripts.hostname =
-      optionalString (cfg.hostName != "") ''
-        hostname "${cfg.hostName}"
+    system.activationScripts.hostname = let
+        effectiveHostname = config.boot.kernel.sysctl."kernel.hostname" or cfg.hostName;
+      in optionalString (effectiveHostname != "") ''
+        hostname "${effectiveHostname}"
      '';
    system.activationScripts.domain =
      optionalString (cfg.domain != null) ''
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -858,7 +858,8 @@ in
        # If the disk image appears to be empty, run mke2fs to
        # initialise.
        FSTYPE=$(blkid -o value -s TYPE ${cfg.bootDevice} || true)
-        if test -z "$FSTYPE"; then
+        PARTTYPE=$(blkid -o value -s PTTYPE ${cfg.bootDevice} || true)
+        if test -z "$FSTYPE" -a -z "$PARTTYPE"; then
            mke2fs -t ext4 ${cfg.bootDevice}
        fi
      '';
--- a/pkgs/applications/audio/hqplayer-desktop/default.nix
+++ b/pkgs/applications/audio/hqplayer-desktop/default.nix
@ -89,5 +89,7 @@ mkDerivation rec {
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    platforms = [ "x86_64-linux" ];
    maintainers = with maintainers; [ lovesegfault ];
+    # src link returns 403
+    broken = true;
  };
 }
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -57,8 +57,8 @@ final: prev:
    src = fetchFromGitHub {
      owner = "whonore";
      repo = "Coqtail";
-      rev = "157c43397c2dca382f7560c7f00ed930de5be186";
-      sha256 = "0pfv07j5ryr4i654w015ly73hzg4mb9xrnxnbm8l6s7dcd3zvdkp";
+      rev = "1704623395dbd6b42d999d378f14887aa6a8e704";
+      sha256 = "0bkvrhpbisrn5bvpy7aknzr0b8c4hppszv82iiqmag9y380gkxqp";
    };
    meta.homepage = "https://github.com/whonore/Coqtail/";
  };
@ -281,12 +281,12 @@ final: prev:

  SchemaStore-nvim = buildVimPluginFrom2Nix {
    pname = "SchemaStore.nvim";
-    version = "2022-11-25";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "b0o";
      repo = "SchemaStore.nvim";
-      rev = "c9824c37bef4ded4fea68ac5735aac69e02e393a";
-      sha256 = "02wzb31mixa2lvii9f7kq045yrksrjmdrk42kqh4n9cfalyhydsm";
+      rev = "39260e77f7471da2a14182f83ac58e1d2b1ff5be";
+      sha256 = "07jqpm7vhm10pjni0i4q0bjzf5mahi9rvz698cj66idzkmz2i89k";
    };
    meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
  };
@ -490,8 +490,8 @@ final: prev:
    src = fetchFromGitHub {
      owner = "stevearc";
      repo = "aerial.nvim";
-      rev = "e0f744c9c3c2b230a717ad9036a03a776c492be6";
-      sha256 = "0i5nsyb224cqifqpyd063z4ls6jni3jz7sm3hw5mlgsvf0wmpg7a";
+      rev = "38c6fe1c199b8f35918f7efc09cae3f8af56fd68";
+      sha256 = "0p5b05psbhm5aig4106vc6cd795zqwnc0blnngi3jb1snvzb22a5";
      fetchSubmodules = true;
    };
    meta.homepage = "https://github.com/stevearc/aerial.nvim/";
@ -811,12 +811,12 @@ final: prev:

  barbecue-nvim = buildVimPluginFrom2Nix {
    pname = "barbecue.nvim";
-    version = "2022-11-27";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "utilyre";
      repo = "barbecue.nvim";
-      rev = "8249ba25471384b74b1eacbfdfb735c73a7fe077";
-      sha256 = "0bf88bgpf5wcq2dddf2ppihf832fpk0a8zpsvrnzx3rmmxarzchm";
+      rev = "2a8bff5c47ae7ef3ee2d362634be2d143948dc38";
+      sha256 = "0ncqyb5a5mxhzj3mpsn11342mbl0m54jfqga90ds5430d02mm6fb";
    };
    meta.homepage = "https://github.com/utilyre/barbecue.nvim/";
  };
@ -1075,12 +1075,12 @@ final: prev:

  clang_complete = buildVimPluginFrom2Nix {
    pname = "clang_complete";
-    version = "2022-09-01";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "xavierd";
      repo = "clang_complete";
-      rev = "e25b6a54e5cf648eb36d5be5b82c1bbb22260fde";
-      sha256 = "0ik55akiyivq70a0jds35f8jqvs78mzxq3b302vhyq07w44mk7vx";
+      rev = "d866f31a6b1cfc725dd015293e0a275a6ae9beb0";
+      sha256 = "1fz1mjk049b2f31ymk4ph287km8q3yan9xm5ipj41mjwaavdmzi3";
    };
    meta.homepage = "https://github.com/xavierd/clang_complete/";
  };
@ -1687,12 +1687,12 @@ final: prev:

  coc-lua = buildVimPluginFrom2Nix {
    pname = "coc-lua";
-    version = "2022-11-08";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "josa42";
      repo = "coc-lua";
-      rev = "cdb82f176b13d4be5bed05c586ac1f141306a09a";
-      sha256 = "1cfxzrir827wa3mnbg3gjv4n0afk220r0v55ajqqy8r5aycd68w7";
+      rev = "13da36309878d1f3199877a33badeca0fdf7543e";
+      sha256 = "12p7qbqvqm3pj2pbvm3vg1q84kd15n1qhw720gd1nfxm0ybfxgfc";
    };
    meta.homepage = "https://github.com/josa42/coc-lua/";
  };
@ -1735,12 +1735,12 @@ final: prev:

  coc-nvim = buildVimPluginFrom2Nix {
    pname = "coc.nvim";
-    version = "2022-11-28";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "neoclide";
      repo = "coc.nvim";
-      rev = "d436220bd70346221b590419fbe2f2564c4bbb7f";
-      sha256 = "18v3z2vrgn09jwyaffcigx7g4bzx2ff8j6lwkvzyxqxbfrdzv0vq";
+      rev = "2c4d06e9fc712b259ae2320020818fbf4c533273";
+      sha256 = "0b5fq7p5ddydxk1zy1s2b93x019n5mxn7vma3ij4ry9lhc1sqxi3";
    };
    meta.homepage = "https://github.com/neoclide/coc.nvim/";
  };
@ -2023,24 +2023,24 @@ final: prev:

  coq-artifacts = buildVimPluginFrom2Nix {
    pname = "coq.artifacts";
-    version = "2022-11-29";
+    version = "2022-12-01";
    src = fetchFromGitHub {
      owner = "ms-jpq";
      repo = "coq.artifacts";
-      rev = "4a002ca2e61ef58f70677c661ecbf461cda79b71";
-      sha256 = "0wj5vgkf5yyl5qp5029m9xl5pwldllb1r40mpgk9wkqip4pnlckm";
+      rev = "eea760e43c5800bbcb8d6053f5502ada3774b860";
+      sha256 = "0n853wbpg02lw41lzs3c8yyq7ag363li0sslgrmli5h3fsd8d3j4";
    };
    meta.homepage = "https://github.com/ms-jpq/coq.artifacts/";
  };

  coq-thirdparty = buildVimPluginFrom2Nix {
    pname = "coq.thirdparty";
-    version = "2022-11-29";
+    version = "2022-12-01";
    src = fetchFromGitHub {
      owner = "ms-jpq";
      repo = "coq.thirdparty";
-      rev = "f204bc46f7db08e66a156d8c36799dd64aa69855";
-      sha256 = "0mlc546hy3fx45f2llgf4qh94gl7n9c123kg1xzgdrl3p9ch5hn9";
+      rev = "ed621364ec22289e912f680b9e5adc17be5af817";
+      sha256 = "1xwnv4agszdqj7izspgzy8qsyhdzg8ydamrpn51611aafxzz74vm";
    };
    meta.homepage = "https://github.com/ms-jpq/coq.thirdparty/";
  };
@ -2059,12 +2059,12 @@ final: prev:

  coq_nvim = buildVimPluginFrom2Nix {
    pname = "coq_nvim";
-    version = "2022-11-29";
+    version = "2022-12-01";
    src = fetchFromGitHub {
      owner = "ms-jpq";
      repo = "coq_nvim";
-      rev = "980daf72ee0c9999e88973733c5152d03dcf5171";
-      sha256 = "04z11xsi7jnji3psdznxrscmygf5f4wms3p4ps2n6zj65b4j6czb";
+      rev = "61ba300a71bf274af5c7a5069ab102729af79297";
+      sha256 = "0718b7fpl10hpsaw09c4ylkxw8dflb0s2b449q8b8dcwqpgssm51";
    };
    meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
  };
@ -2976,12 +2976,12 @@ final: prev:

  friendly-snippets = buildVimPluginFrom2Nix {
    pname = "friendly-snippets";
-    version = "2022-11-29";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "rafamadriz";
      repo = "friendly-snippets";
-      rev = "3e2a7d7f29b18d2bb29eedea3663856db55e752e";
-      sha256 = "04yn59c7f5553cvh04ybh5m2jk26aj1jwavk65jlkmbslw3wbcih";
+      rev = "b4f857a1d94d05e747951b1e8cb1a6c567396898";
+      sha256 = "1z4nkk846dh3c8rj7dliw42vz6fwhj7rf1gwjwa4s7nk8f6xq545";
    };
    meta.homepage = "https://github.com/rafamadriz/friendly-snippets/";
  };
@ -3084,12 +3084,12 @@ final: prev:

  fzf-lua = buildVimPluginFrom2Nix {
    pname = "fzf-lua";
-    version = "2022-11-29";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "ibhagwan";
      repo = "fzf-lua";
-      rev = "ff4abbf783875b64dd20aaaab1912ac917d23aa5";
-      sha256 = "0j9l7jvf4v24ygf3s6rnnb1d8qrjn465pfq4fb0j2kwx1nfq0zvk";
+      rev = "0c8b3389ec433089ebbe9d138c2ec20a6a542ce0";
+      sha256 = "1x70d6k7z9q1dnif67359xm86k9fhb8lbycm5rywh1a39c5skbg8";
    };
    meta.homepage = "https://github.com/ibhagwan/fzf-lua/";
  };
@ -3240,12 +3240,12 @@ final: prev:

  gitsigns-nvim = buildNeovimPluginFrom2Nix {
    pname = "gitsigns.nvim";
-    version = "2022-11-09";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "lewis6991";
      repo = "gitsigns.nvim";
-      rev = "9ff7dfb051e5104088ff80556203634fc8f8546d";
-      sha256 = "0cfssyyhcjndwr2xlk91rxzyir4ng5hk1f4fgij5hgrhhh3wgjdv";
+      rev = "d076301a634198e0ae3efee3b298fc63c055a871";
+      sha256 = "12990v2zcsas8575nf6ln1byw3zg473s5jpizk4g3v9ikfdvjbfr";
    };
    meta.homepage = "https://github.com/lewis6991/gitsigns.nvim/";
  };
@ -3276,12 +3276,12 @@ final: prev:

  glow-nvim = buildVimPluginFrom2Nix {
    pname = "glow.nvim";
-    version = "2022-10-07";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "ellisonleao";
      repo = "glow.nvim";
-      rev = "9038d7cdd76a930973b6158d800c8dbc02236a4b";
-      sha256 = "0x49l7g84m1328fqad501f4iqqy3imbl8r8rh4rxsi1zam46f2ba";
+      rev = "20d1cd087f8728f21a048a3b6259f6177237b39e";
+      sha256 = "0zklzx2k85zyxn866xbhd6rnifc885rn68bnv1x945z34pj4m3xc";
    };
    meta.homepage = "https://github.com/ellisonleao/glow.nvim/";
  };
@ -4007,12 +4007,12 @@ final: prev:

  lean-nvim = buildVimPluginFrom2Nix {
    pname = "lean.nvim";
-    version = "2022-11-29";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "Julian";
      repo = "lean.nvim";
-      rev = "ae598191de9fa8ff90b897893590234b84702cab";
-      sha256 = "17n108ipnajj9fvm3l15rndhxi3529w0g7pjrjpb6ljn0d73akvc";
+      rev = "9fad72569b54f067b6ad0bdafd47ce7b23578b79";
+      sha256 = "1cvj59v267av6lh2wzpmqd05pa7fjvfprbs2r7gql6gr992x2s59";
    };
    meta.homepage = "https://github.com/Julian/lean.nvim/";
  };
@ -4235,12 +4235,12 @@ final: prev:

  lir-nvim = buildVimPluginFrom2Nix {
    pname = "lir.nvim";
-    version = "2022-09-14";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "tamago324";
      repo = "lir.nvim";
-      rev = "c1aeb96fae55bb6cac3d01ce5123a843d7235396";
-      sha256 = "03fia0m7w2q20m9jvm4wdm6w5bfh976fm0d7h4n055hbqgy73qf9";
+      rev = "806651bc22cc1aa0053fba4385a18800f576cc6b";
+      sha256 = "1xi2l412637vkp79338p65xb4zm0licyzrp188s2rijjqf3g2mzb";
    };
    meta.homepage = "https://github.com/tamago324/lir.nvim/";
  };
@ -4414,12 +4414,12 @@ final: prev:

  lsp_signature-nvim = buildVimPluginFrom2Nix {
    pname = "lsp_signature.nvim";
-    version = "2022-11-28";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "ray-x";
      repo = "lsp_signature.nvim";
-      rev = "136d0eb5956c5a874c506007606f3ad022df64e2";
-      sha256 = "0hgf78gj252jxsrwpsc5gxy943k65x6l397win1jrcpkrmpmmq51";
+      rev = "2f3e5745ee7a0610ffde2b4331460151d4707724";
+      sha256 = "0c0ap6xkncbsvy08897ah4sw4f6s99q9m5jp0i3a0akvw3zpn21n";
    };
    meta.homepage = "https://github.com/ray-x/lsp_signature.nvim/";
  };
@ -4967,12 +4967,12 @@ final: prev:

  neoconf-nvim = buildVimPluginFrom2Nix {
    pname = "neoconf.nvim";
-    version = "2022-11-29";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "folke";
      repo = "neoconf.nvim";
-      rev = "875a412b17aa69ccf26a4c774b0300c06fc4c742";
-      sha256 = "14i5vwqk8azxwjzijpv6kapzbh4hwpc8rcs71k32w8azkgj6g61r";
+      rev = "681e89d58d46a7c63ee091fee32220373dda1072";
+      sha256 = "000inylrbyyfc1lg1ajmi1rb2jrcisglgc44gk3cf9iv7v1515dd";
    };
    meta.homepage = "https://github.com/folke/neoconf.nvim/";
  };
@ -5079,8 +5079,8 @@ final: prev:
    src = fetchFromGitHub {
      owner = "nvim-neorg";
      repo = "neorg";
-      rev = "5613ff3f471d148c9824daeb359dfdc61ddaf992";
-      sha256 = "0b0mrnvbmims22a4178vyj51s5m2qlgnf6z91389prjalzcnrhsc";
+      rev = "5a536bc033d2ac1ef49ec4c875fd9811cceccb68";
+      sha256 = "08gx5y34abpfmcmhhlmb44hi380cfyapbki32pv9xspq56ng8xpn";
    };
    meta.homepage = "https://github.com/nvim-neorg/neorg/";
  };
@ -5135,12 +5135,12 @@ final: prev:

  neotest = buildVimPluginFrom2Nix {
    pname = "neotest";
-    version = "2022-11-26";
+    version = "2022-12-01";
    src = fetchFromGitHub {
      owner = "nvim-neotest";
      repo = "neotest";
-      rev = "b449394aa36b05eef6719162356c2ae531460bd9";
-      sha256 = "12qmbkjivpf3yd3j8wsiw2s8rmdg9q8zqp4pdybgdqfywivf00km";
+      rev = "a2559f07be901638d555c0d29d8ea22c81553653";
+      sha256 = "177pf0ywxqmxr7472yvrmk579k5vgh5770d1j00r1d3k8yjsnqp4";
    };
    meta.homepage = "https://github.com/nvim-neotest/neotest/";
  };
@ -5327,12 +5327,12 @@ final: prev:

  noice-nvim = buildVimPluginFrom2Nix {
    pname = "noice.nvim";
-    version = "2022-11-24";
+    version = "2022-11-29";
    src = fetchFromGitHub {
      owner = "folke";
      repo = "noice.nvim";
-      rev = "fa21685e23cbb72bb573eecf48dd3644bc1513ba";
-      sha256 = "1vbm54fykn6xzndrrrb1bcymbwbmanifnsr693v5647k5hmsjc64";
+      rev = "5ca31af06078d6188de7db1369c2b40d1b606d58";
+      sha256 = "1a3n5341fcvjlkp3lv5x50a81z30zaxxw427dvkpjb7bp93rb8h4";
    };
    meta.homepage = "https://github.com/folke/noice.nvim/";
  };
@ -5399,12 +5399,12 @@ final: prev:

  null-ls-nvim = buildVimPluginFrom2Nix {
    pname = "null-ls.nvim";
-    version = "2022-11-23";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "jose-elias-alvarez";
      repo = "null-ls.nvim";
-      rev = "c51978f546a86a653f4a492b86313f4616412cec";
-      sha256 = "0wkk5dxdmcgmgh7rak85x99n11w1pygryv66vki13f46wwnbm3m6";
+      rev = "d4254b19e914e6278582d4555c57eb3d2abd9590";
+      sha256 = "03f7m0v5mgpwwvy1qgijiiyvrfzk5n75a1nj5snl0vl8ivancmcs";
    };
    meta.homepage = "https://github.com/jose-elias-alvarez/null-ls.nvim/";
  };
@ -5771,12 +5771,12 @@ final: prev:

  nvim-hlslens = buildVimPluginFrom2Nix {
    pname = "nvim-hlslens";
-    version = "2022-11-19";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "kevinhwang91";
      repo = "nvim-hlslens";
-      rev = "a48ddd710c6daf9a2e90646978c99e5db500dfd3";
-      sha256 = "0lk3gc8kicrz6xs57mpy1znxwi6wlc7zm44cg8q0yz7ka0f4520v";
+      rev = "cad6ce2e0d4f9c26467712791a70fae9d0b0b6cf";
+      sha256 = "122dkvvs7cgmba8l09vhnc6laabyv4qakm3931f4kscn6lb4kyzm";
    };
    meta.homepage = "https://github.com/kevinhwang91/nvim-hlslens/";
  };
@ -5795,12 +5795,12 @@ final: prev:

  nvim-jdtls = buildVimPluginFrom2Nix {
    pname = "nvim-jdtls";
-    version = "2022-11-01";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "mfussenegger";
      repo = "nvim-jdtls";
-      rev = "7bc572fc357d7dec8d3ca620b53e763776472582";
-      sha256 = "10rm01cxc1xnw7m886ssnmb5ihlsfjhp6sqm9dhmrkg4ywkbhj9m";
+      rev = "4ea8e66d61c9a7e40c40f4cc6051ebfbf4ce0d38";
+      sha256 = "0wbfy0p7n7s8zp154p06n3nmqc5vxrmzz6abasvlisd8s2khk3g1";
    };
    meta.homepage = "https://github.com/mfussenegger/nvim-jdtls/";
  };
@ -5855,12 +5855,12 @@ final: prev:

  nvim-lint = buildVimPluginFrom2Nix {
    pname = "nvim-lint";
-    version = "2022-11-22";
+    version = "2022-11-29";
    src = fetchFromGitHub {
      owner = "mfussenegger";
      repo = "nvim-lint";
-      rev = "ea8cae4a97b2127702d4b891c40c48d8230670e5";
-      sha256 = "05qm8zgmh5q98hwmp0zc27wwmxnyady6v04kqd4b72cx00xnx0dw";
+      rev = "2ef3b269546d751e4fc8c673ffddd6216421f4a1";
+      sha256 = "03vdbxqa6z8471l0s65xa55n5hf1c1s59zvx1rn1kgy4h070022w";
    };
    meta.homepage = "https://github.com/mfussenegger/nvim-lint/";
  };
@ -5879,12 +5879,12 @@ final: prev:

  nvim-lspconfig = buildVimPluginFrom2Nix {
    pname = "nvim-lspconfig";
-    version = "2022-11-29";
+    version = "2022-12-01";
    src = fetchFromGitHub {
      owner = "neovim";
      repo = "nvim-lspconfig";
-      rev = "faa011a24a6911332eeac6c253a0881c2e578628";
-      sha256 = "0p95s77w41p2a4k2j6nqjjfn2kfjw23pa047lwj4byfdxmdykbj6";
+      rev = "5e0bd39476d4e224dfe5ea6a6624ea3bb467a8bb";
+      sha256 = "11lsa35v6qb1mvnac94i3acc428r6s2zk88i6qp3xz25slmd5773";
    };
    meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
  };
@ -6119,12 +6119,12 @@ final: prev:

  nvim-treesitter = buildVimPluginFrom2Nix {
    pname = "nvim-treesitter";
-    version = "2022-11-29";
+    version = "2022-12-01";
    src = fetchFromGitHub {
      owner = "nvim-treesitter";
      repo = "nvim-treesitter";
-      rev = "d05be3742e04601ac1219f575d7c44a21f671622";
-      sha256 = "1ibr8g762v6qp44b068qd44sq9axnr0pmj73dadqhf3smma2g5l1";
+      rev = "768532453ac30cbf792b492248a6c3be19b80af1";
+      sha256 = "18lamsy039c90ycxh2gz1qi2ba4npkm1j4q2ibyzljml8kznhzg6";
    };
    meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
  };
@ -6419,12 +6419,12 @@ final: prev:

  orgmode = buildVimPluginFrom2Nix {
    pname = "orgmode";
-    version = "2022-11-29";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "nvim-orgmode";
      repo = "orgmode";
-      rev = "bc1c96a00a931044b776dfba73710725231ab616";
-      sha256 = "0lsanm40bwnn0va8ssl7jdjxx5s0g16dnq3r3mp660hwqdqlzv7w";
+      rev = "fc9bb0f5823d01e4008e4b86663772d4148aa9ce";
+      sha256 = "1vb0x89qr2kk5ma8syw4l56c6j2b7y2advyjykdli8psn6i7gsyf";
    };
    meta.homepage = "https://github.com/nvim-orgmode/orgmode/";
  };
@ -6877,12 +6877,12 @@ final: prev:

  rest-nvim = buildNeovimPluginFrom2Nix {
    pname = "rest.nvim";
-    version = "2022-11-25";
+    version = "2022-11-29";
    src = fetchFromGitHub {
      owner = "rest-nvim";
      repo = "rest.nvim";
-      rev = "ce7aed035f0b82b72b00d33cff6ab3e445a06db8";
-      sha256 = "1vcf9pf64gwinhqgha5vka939bigpa94vvghp5wx989lhs7l71gw";
+      rev = "966b4a32f47475908b0fe88ea7b99042da7e2d86";
+      sha256 = "1sv4zlmbrqxy04dm3v8x4xncz6kkgr51apcgv4lb16wj000bqvgp";
    };
    meta.homepage = "https://github.com/rest-nvim/rest.nvim/";
  };
@ -7009,12 +7009,12 @@ final: prev:

  satellite-nvim = buildVimPluginFrom2Nix {
    pname = "satellite.nvim";
-    version = "2022-11-27";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "lewis6991";
      repo = "satellite.nvim";
-      rev = "48cf0094018c0eb71c9a03c6b0a2bc46712f0526";
-      sha256 = "0ql022slljcjhcly2zpfsxs33hv9ha0gmpij7zm8sqw6wchzigbm";
+      rev = "3bcd90d5cf5e61b6f4a000aaad5b6aa79b9a8bc5";
+      sha256 = "1s22ciz284za50yll9avghdfvnfmf7kgv4vrfpzh28qqy11vyj1s";
    };
    meta.homepage = "https://github.com/lewis6991/satellite.nvim/";
  };
@ -7564,12 +7564,12 @@ final: prev:

  tabby-nvim = buildVimPluginFrom2Nix {
    pname = "tabby.nvim";
-    version = "2022-11-22";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "nanozuki";
      repo = "tabby.nvim";
-      rev = "a7710f38ded0cda5b07e38f10c55ed1940b35b19";
-      sha256 = "0vkh7v24j6fxc7v1fgk0xh3jlrcm8ps3zxms5lbsd2bgfbcm6p3n";
+      rev = "ad80d32ba42b0c7f3a06b5754b7f669bf71eadf0";
+      sha256 = "1pbbb8w164pzrlsglmc5pls8x1jp3zv97m74hxljpwkiqjzfzfjn";
    };
    meta.homepage = "https://github.com/nanozuki/tabby.nvim/";
  };
@ -7661,12 +7661,12 @@ final: prev:

  tagbar = buildVimPluginFrom2Nix {
    pname = "tagbar";
-    version = "2022-11-04";
+    version = "2022-11-29";
    src = fetchFromGitHub {
      owner = "preservim";
      repo = "tagbar";
-      rev = "6c3e15ea4a1ef9619c248c2b1eced56a47b61a9e";
-      sha256 = "1x47bxvxhw7c4g7ij86xs1zwmb61yr5wcrn3xm606x74c11ff650";
+      rev = "af3ce7c3cec81f2852bdb0a0651d2485fcd01214";
+      sha256 = "1r0vn0v74g8bgyz4ycc9z8clpkn6fdy5v65y7igizcrjzxd3nlpb";
    };
    meta.homepage = "https://github.com/preservim/tagbar/";
  };
@ -7769,12 +7769,12 @@ final: prev:

  telescope-file-browser-nvim = buildVimPluginFrom2Nix {
    pname = "telescope-file-browser.nvim";
-    version = "2022-10-16";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "nvim-telescope";
      repo = "telescope-file-browser.nvim";
-      rev = "2429ecfd2d76e3eb6c9f8d8ba2c6ce328975a95a";
-      sha256 = "1rmxz31rbb4xiisnmgsmcmrx3r1cjhdrj82l99sdjp09cqavd2bw";
+      rev = "8646e46b8545b9234e87083d124c0a4e4ed47735";
+      sha256 = "01q34wrk00yxy4jcr666qmkdkpfib80rjbn921dkqqv2d1nalx9b";
    };
    meta.homepage = "https://github.com/nvim-telescope/telescope-file-browser.nvim/";
  };
@ -7793,12 +7793,12 @@ final: prev:

  telescope-fzf-native-nvim = buildVimPluginFrom2Nix {
    pname = "telescope-fzf-native.nvim";
-    version = "2022-09-06";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "nvim-telescope";
      repo = "telescope-fzf-native.nvim";
-      rev = "65c0ee3d4bb9cb696e262bca1ea5e9af3938fc90";
-      sha256 = "0nyvhlalrgg6n793lp3yrxgszv5j0ln9sjbh45pxxg0wn15jxm45";
+      rev = "7447fe780fed23402a3e0c3a227b549d7506ed38";
+      sha256 = "101zcy6fjrpv19cghg464wrizh82b0ny7pc1mmqsfqw48hl37hwn";
    };
    meta.homepage = "https://github.com/nvim-telescope/telescope-fzf-native.nvim/";
  };
@ -8237,6 +8237,18 @@ final: prev:
    meta.homepage = "https://github.com/tjdevries/train.nvim/";
  };

+  treesj = buildVimPluginFrom2Nix {
+    pname = "treesj";
+    version = "2022-12-01";
+    src = fetchFromGitHub {
+      owner = "Wansmer";
+      repo = "treesj";
+      rev = "da296173b61330aebfd16129a5bf1263700014f1";
+      sha256 = "1wbbxdf2k1vfrnfllms0g5mnsf5bhsipacfwa546sfnc41j360v9";
+    };
+    meta.homepage = "https://github.com/Wansmer/treesj/";
+  };
+
  tremor-vim = buildVimPluginFrom2Nix {
    pname = "tremor-vim";
    version = "2021-09-07";
@ -10111,12 +10123,12 @@ final: prev:

  vim-go = buildVimPluginFrom2Nix {
    pname = "vim-go";
-    version = "2022-11-01";
+    version = "2022-12-01";
    src = fetchFromGitHub {
      owner = "fatih";
      repo = "vim-go";
-      rev = "0550762a69a2ef13d9f723c9478155dbc6ad7ddb";
-      sha256 = "185ysbbipqf6fivryi4pxjmdm4vfn319w1mgm3xpg2920scybwbq";
+      rev = "8d7677947e0be1eecfa1bcf2c1148804963ec4f6";
+      sha256 = "1f2xklijsxbc7f2y26ps6bwyhn5sxbmv8gwy66l7yhfbc0zvic0w";
    };
    meta.homepage = "https://github.com/fatih/vim-go/";
  };
@ -12166,12 +12178,12 @@ final: prev:

  vim-snippets = buildVimPluginFrom2Nix {
    pname = "vim-snippets";
-    version = "2022-11-22";
+    version = "2022-12-01";
    src = fetchFromGitHub {
      owner = "honza";
      repo = "vim-snippets";
-      rev = "b904e5a68aeda29a0b6e09a6f61305a462ae2627";
-      sha256 = "1dmfysd9vr2b6hf8nm95caw1fv16l1hvh0gb6a7nxnvvary1czs7";
+      rev = "6173350127d56dcc5664f50320b3f522951f56e9";
+      sha256 = "1a002y2pw76bh35q9z0rba3wnfcwgfmnii4gn3107wwfmfy50z55";
    };
    meta.homepage = "https://github.com/honza/vim-snippets/";
  };
@ -12611,12 +12623,12 @@ final: prev:

  vim-tridactyl = buildVimPluginFrom2Nix {
    pname = "vim-tridactyl";
-    version = "2022-02-10";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "tridactyl";
      repo = "vim-tridactyl";
-      rev = "f2eaa5d32614f6c35dad268dd4ed7ff33cae5070";
-      sha256 = "139kl89k5alh8bpa4wywsmvjnxlxzsdbhxn2w8rvclhwgrhkzvgd";
+      rev = "fdd069bde3a34c786abed4601b6d59a065590ad9";
+      sha256 = "07km8yp0vsipw2amkxd0rjp9qz18g0b7bvsb2vj9vgkr8wc0d780";
    };
    meta.homepage = "https://github.com/tridactyl/vim-tridactyl/";
  };
@ -12767,12 +12779,12 @@ final: prev:

  vim-vsnip = buildVimPluginFrom2Nix {
    pname = "vim-vsnip";
-    version = "2022-11-14";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "hrsh7th";
      repo = "vim-vsnip";
-      rev = "6f873418c4dc601d8ad019a5906eddff5088de9b";
-      sha256 = "0jw8580w0x515772gnyw6y922yp0hmxk84r67iw1mv50zbkmafgz";
+      rev = "e44026b5394fd79aa0f2118aaf41627ef9c354ee";
+      sha256 = "1a14msxri37xs29xq80fw9mh6g9ipmc9g4ik2p0x9r5h2pz2nsbq";
    };
    meta.homepage = "https://github.com/hrsh7th/vim-vsnip/";
  };
@ -13176,12 +13188,12 @@ final: prev:

  vista-vim = buildVimPluginFrom2Nix {
    pname = "vista.vim";
-    version = "2022-10-25";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "liuchengxu";
      repo = "vista.vim";
-      rev = "9ddb3707b066cb288aa1ac9c33477280e0ef95d3";
-      sha256 = "03qls1ggnjqv38xg8sk2ssl02pibd2r2k36g0hxanx7zqq3nvgn0";
+      rev = "33774aff5d8b224f24c2e4c6015c613c1a17bf74";
+      sha256 = "0c3255id5wzgb1v5zsga7ig1b8mqmrbklmz40x98av4j5dqghfw7";
    };
    meta.homepage = "https://github.com/liuchengxu/vista.vim/";
  };
@ -13477,12 +13489,12 @@ final: prev:

  catppuccin-nvim = buildVimPluginFrom2Nix {
    pname = "catppuccin-nvim";
-    version = "2022-11-29";
+    version = "2022-12-01";
    src = fetchFromGitHub {
      owner = "catppuccin";
      repo = "nvim";
-      rev = "0a166e60c41649596cc9831d31fcfc09b15f145a";
-      sha256 = "1m5v6jbzgsj88mzsj5krmdjdz9s8xhpxxk7fr2lslb4g905bv9x3";
+      rev = "4d2ed20bda0c07e9473c374826721ac16154698b";
+      sha256 = "0xdxfpqlm68s6629h8j3pmpw4p7kfnsxlvbk5k3ii6f2yw0b8fd4";
    };
    meta.homepage = "https://github.com/catppuccin/nvim/";
  };
@ -13501,24 +13513,24 @@ final: prev:

  chad = buildVimPluginFrom2Nix {
    pname = "chad";
-    version = "2022-11-29";
+    version = "2022-12-01";
    src = fetchFromGitHub {
      owner = "ms-jpq";
      repo = "chadtree";
-      rev = "c31f74ac908a07db943c683abaddbb01e4686ab3";
-      sha256 = "0vmj02wyy8y1fsrql1zgj0c0csmqr4zwl4paa2zygzxc7mz6nncf";
+      rev = "4c95882b5e3d67bf31f2b7ea996e0251966e43eb";
+      sha256 = "002r53w9rq13lca4sw34631b526h2wvaf5x9l87kqq0ddm2nwslh";
    };
    meta.homepage = "https://github.com/ms-jpq/chadtree/";
  };

  dracula-vim = buildVimPluginFrom2Nix {
    pname = "dracula-vim";
-    version = "2022-11-07";
+    version = "2022-11-30";
    src = fetchFromGitHub {
      owner = "dracula";
      repo = "vim";
-      rev = "b9f4f3a169266031d3744335595eee02a6e396c6";
-      sha256 = "1a9vxpdh6ry9760m69762s5annq4k52k5bk9gy3v0lr4zyvfcfgf";
+      rev = "947e5298766f30bdb813749bf867913b29a06eac";
+      sha256 = "0yvahswdzqphay5wak2rlaqjaf44kylsvmx697slwp8h1846xchw";
    };
    meta.homepage = "https://github.com/dracula/vim/";
  };
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@ -670,12 +670,12 @@
  };
  javascript = buildGrammar {
    language = "javascript";
-    version = "cefdcea";
+    version = "7a29d06";
    source = fetchFromGitHub {
      owner = "tree-sitter";
      repo = "tree-sitter-javascript";
-      rev = "cefdcea72a8cf86c1f10ca55e837397da07afdab";
-      hash = "sha256-o+th1Va11YtsHaA5IR9IAYRk3SDxTop0gxfSjR2u/o8=";
+      rev = "7a29d06274b7cf87d643212a433d970b73969016";
+      hash = "sha256-fMPCHdfHHyg7yNi9LDA35z+WFfPRbctrh38dZV5qZt4=";
    };
    meta.homepage = "https://github.com/tree-sitter/tree-sitter-javascript";
  };
@ -1291,12 +1291,12 @@
  };
  sql = buildGrammar {
    language = "sql";
-    version = "4f1b912";
+    version = "41f1de2";
    source = fetchFromGitHub {
      owner = "derekstride";
      repo = "tree-sitter-sql";
-      rev = "4f1b91246b43190e34957d9de9a0f3625879ba33";
-      hash = "sha256-g1dQ897JQwthConYMlGY25hsypr4weDsDCOWyafriw8=";
+      rev = "41f1de238b7b4a8cc9e118759881aad8585d36ad";
+      hash = "sha256-LORSWO5Ui/Nq1SReERSWZ+BEtxKEJ545LPpA6HbY8Z4=";
    };
    meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
  };
@ -1494,12 +1494,12 @@
  };
  vhs = buildGrammar {
    language = "vhs";
-    version = "2f87b9d";
+    version = "8a0df32";
    source = fetchFromGitHub {
      owner = "charmbracelet";
      repo = "tree-sitter-vhs";
-      rev = "2f87b9d973597e69552ecf6a4fe16470fbd8c44e";
-      hash = "sha256-G1ytXVBeGN1606aFrPdNFp3Khlg/BTFq2VS176Knb7k=";
+      rev = "8a0df32b72a8cf8d3e3e84f16c19e9ba46d3dba5";
+      hash = "sha256-bWI/MW7U5ht7jmL3BSm5HwD1BMDNGwkBShJIpRlhonI=";
    };
    meta.homepage = "https://github.com/charmbracelet/tree-sitter-vhs";
  };
@ -1527,12 +1527,12 @@
  };
  wgsl = buildGrammar {
    language = "wgsl";
-    version = "af16e7d";
+    version = "61d2604";
    source = fetchFromGitHub {
      owner = "szebniok";
      repo = "tree-sitter-wgsl";
-      rev = "af16e7d9e230004888fb52d33599ad38b4cf6052";
-      hash = "sha256-rp6SqiGVAxlAbrYhNLhwqawjpFXZd2R4A4cNQx6qFZs=";
+      rev = "61d2604525d47238ecbce8aa38f10cb81ba68fd3";
+      hash = "sha256-dSWQAJN9+EyqPbGZv9wTR8upsK56ZWu9jOpJkJtkabs=";
    };
    meta.homepage = "https://github.com/szebniok/tree-sitter-wgsl";
  };
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -690,6 +690,7 @@ https://github.com/akinsho/toggleterm.nvim/,,
 https://github.com/folke/tokyonight.nvim/,,
 https://github.com/markonm/traces.vim/,,
 https://github.com/tjdevries/train.nvim/,,
+https://github.com/Wansmer/treesj/,main,
 https://github.com/tremor-rs/tremor-vim/,,
 https://github.com/cappyzawa/trim.nvim/,,
 https://github.com/folke/trouble.nvim/,,
--- a/pkgs/applications/misc/visidata/default.nix
+++ b/pkgs/applications/misc/visidata/default.nix
@ -20,19 +20,22 @@
 , wcwidth
 , zstandard
 , setuptools
+, importlib-metadata
 , git
 , withPcap ? true, dpkt, dnslib
 , withXclip ? stdenv.isLinux, xclip
+, testers
+, visidata
 }:
 buildPythonApplication rec {
  pname = "visidata";
-  version = "2.9.1";
+  version = "2.10.2";

  src = fetchFromGitHub {
    owner = "saulpw";
    repo = "visidata";
    rev = "v${version}";
-    hash = "sha256-PKj+imTSAGMpF1tkN0WmE3l/4FmWkm/ktIDzF2ku48s=";
+    hash = "sha256-OKCrlUWHgbaLZJPVvs9lnw4cD27pRoO7F9oel1NzT6A=";
  };

  propagatedBuildInputs = [
@ -64,6 +67,7 @@ buildPythonApplication rec {
    zstandard
    odfpy
    setuptools
+    importlib-metadata
  ] ++ lib.optionals withPcap [ dpkt dnslib ]
  ++ lib.optional withXclip xclip;

@ -75,6 +79,7 @@ buildPythonApplication rec {
  doCheck = stdenv.buildPlatform == stdenv.hostPlatform;

  checkPhase = ''
+    runHook preCheck
    # disable some tests which require access to the network
    rm tests/load-http.vd            # http
    rm tests/graph-cursor-nosave.vd  # http
@ -87,13 +92,21 @@ buildPythonApplication rec {

    substituteInPlace dev/test.sh --replace "bin/vd" "$out/bin/vd"
    bash dev/test.sh
+    runHook postCheck
  '';

+  pythonImportsCheck = ["visidata"];
+
+  passthru.tests.version = testers.testVersion {
+    package = visidata;
+    version = "v${version}";
+  };
+
  meta = {
    description = "Interactive terminal multitool for tabular data";
    license = lib.licenses.gpl3;
    maintainers = with lib.maintainers; [ raskin markus1189 ];
-    homepage = "http://visidata.org/";
+    homepage = "https://visidata.org/";
    changelog = "https://github.com/saulpw/visidata/blob/v${version}/CHANGELOG.md";
  };
 }
--- a/pkgs/applications/misc/zathura/cb/default.nix
+++ b/pkgs/applications/misc/zathura/cb/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "zathura-cb";
-  version = "0.1.8";
+  version = "0.1.10";

  src = fetchurl {
    url = "https://pwmt.org/projects/${pname}/download/${pname}-${version}.tar.xz";
-    sha256 = "1i6cf0vks501cggwvfsl6qb7mdaf3sszdymphimfvnspw810faj5";
+    sha256 = "1j5v32f9ki35v1jc7a067anhlgqplzrp4fqvznlixfhcm0bwmc49";
  };

  nativeBuildInputs = [ meson ninja pkg-config gettext ];
--- a/pkgs/applications/misc/zathura/core/default.nix
+++ b/pkgs/applications/misc/zathura/core/default.nix
@ -10,11 +10,11 @@ with lib;

 stdenv.mkDerivation rec {
  pname = "zathura";
-  version = "0.4.9";
+  version = "0.5.2";

  src = fetchurl {
    url = "https://pwmt.org/projects/${pname}/download/${pname}-${version}.tar.xz";
-    sha256 = "0msy7s57mlx0wya99qpia4fpcy40pbj253kmx2y97nb0sqnc8c7w";
+    sha256 = "15314m9chmh5jkrd9vk2h2gwcwkcffv2kjcxkd4v3wmckz5sfjy6";
  };

  outputs = [ "bin" "man" "dev" "out" ];
@ -23,7 +23,6 @@ stdenv.mkDerivation rec {
  # https://github.com/pwmt/zathura/blob/master/meson_options.txt
  mesonFlags = [
    "-Dsqlite=enabled"
-    "-Dmagic=enabled"
    "-Dmanpages=enabled"
    "-Dconvert-icon=enabled"
    "-Dsynctex=enabled"
--- a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
+++ b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
@ -14,16 +14,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "0.3.8";
+  version = "0.4.0";
  pname = "zathura-pdf-mupdf";

  src = fetchurl {
    url = "https://pwmt.org/projects/${pname}/download/${pname}-${version}.tar.xz";
-    sha256 = "sha256-wgW0z1ANjP6ezqreVOX6jUzRKYzYXxem9QxkclkRYhc=";
+    sha256 = "0pcjxvlh4hls8mjhjghhhihyy2kza8l27wdx0yq4bkd1g1b5f74c";
  };

-  patches = [ ./fix-mupdf-1.20.patch ];
-
  nativeBuildInputs = [ meson ninja pkg-config ];

  buildInputs = [
--- a/pkgs/applications/misc/zathura/pdf-mupdf/fix-mupdf-1.20.patch
+++ b/pkgs/applications/misc/zathura/pdf-mupdf/fix-mupdf-1.20.patch
@ -1,24 +0,0 @@
-From 5a5bb2634812f4c0530f5688a06269aaa4cd11dd Mon Sep 17 00:00:00 2001
-From: Osama Rebach <osamarebach@gmail.com>
-Date: Fri, 19 Aug 2022 13:39:49 +0100
-Subject: [PATCH] fix fz_search_stext_page
-
---
- zathura-pdf-mupdf/search.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/zathura-pdf-mupdf/search.c b/zathura-pdf-mupdf/search.c
-index f84dea0..419e5f4 100644
--- a/zathura-pdf-mupdf/search.c
-+++ b/zathura-pdf-mupdf/search.c
-@@ -41,7 +41,7 @@ pdf_page_search_text(zathura_page_t* page, void* data, const char* text, zathura
- 
-   fz_quad* hit_bbox = fz_malloc_array(mupdf_page->ctx, N_SEARCH_RESULTS, fz_quad);
-   int num_results = fz_search_stext_page(mupdf_page->ctx, mupdf_page->text,
-      text, hit_bbox, N_SEARCH_RESULTS);
-+      text, NULL, hit_bbox, N_SEARCH_RESULTS);
- 
-   fz_rect r;
-   for (int i = 0; i < num_results; i++) {
-- 
-2.37.1
--- a/pkgs/applications/misc/zathura/pdf-poppler/default.nix
+++ b/pkgs/applications/misc/zathura/pdf-poppler/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "zathura-pdf-poppler";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchurl {
    url = "https://pwmt.org/projects/${pname}/download/${pname}-${version}.tar.xz";
-    sha256 = "1vfl4vkyy3rf39r1sqaa7y8113bgkh2bkfq3nn2inis9mrykmk6m";
+    sha256 = "12qhkshpp1wjfpjmjccsyi6wscqyqvaa19j85prjpyf65i9jg0gf";
  };

  nativeBuildInputs = [ meson ninja pkg-config zathura_core ];
--- a/pkgs/applications/misc/zathura/ps/default.nix
+++ b/pkgs/applications/misc/zathura/ps/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "zathura-ps";
-  version = "0.2.6";
+  version = "0.2.7";

  src = fetchurl {
    url = "https://pwmt.org/projects/${pname}/download/${pname}-${version}.tar.xz";
-    sha256 = "0wygq89nyjrjnsq7vbpidqdsirjm6iq4w2rijzwpk2f83ys8bc3y";
+    sha256 = "0ilf63wxn1yzis9m3qs8mxbk316yxdzwxrrv86wpiygm9hhgk5sq";
  };

  nativeBuildInputs = [ meson ninja pkg-config gettext ];
--- a/pkgs/applications/networking/cluster/clusterctl/default.nix
+++ b/pkgs/applications/networking/cluster/clusterctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "clusterctl";
-  version = "1.2.7";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "cluster-api";
    rev = "v${version}";
-    sha256 = "sha256-h8VZCCl28Vd2VB+enLY28t8rNbzdZo3Y4ybElNAkvKU=";
+    sha256 = "sha256-lqHHZtEtedU0Qtm6o6iy6JrQ1UiB9nSTZVyfq0cj0vI=";
  };

-  vendorSha256 = "sha256-hhs/q0x5Qd7S18jX4SPVFPo+fsDE9snJVkiqKD+Qp74=";
+  vendorSha256 = "sha256-7e2ZJa6MfzznOoaBq0xQIXrdmDAzPzKh9QFlRfbxYMM=";

  subPackages = [ "cmd/clusterctl" ];

--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -47,23 +47,23 @@ let
  # and often with different versions.  We write them on three lines
  # like this (rather than using {}) so that the updater script can
  # find where to edit them.
-  versions.aarch64-darwin = "5.12.3.11845";
-  versions.x86_64-darwin = "5.12.3.11845";
-  versions.x86_64-linux = "5.12.2.4816";
+  versions.aarch64-darwin = "5.12.9.13190";
+  versions.x86_64-darwin = "5.12.9.13190";
+  versions.x86_64-linux = "5.12.9.367";

  srcs = {
    aarch64-darwin = fetchurl {
      url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
      name = "zoomusInstallerFull.pkg";
-      hash = "sha256-iDLxqG7/cdo60V0mFE3tX/Msi0rRUjoM8X9yq2rlvf0=";
+      hash = "sha256-Htug/hmp0OjysUY4q8RO1oqjSsa2sgpqiAERr6ahBuw=";
    };
    x86_64-darwin = fetchurl {
      url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-+YOtdoh8S50+GHRLb6TPYCqDtry7SnnNqo7USzkDc7c=";
+      hash = "sha256-nl+hrAZECaC5uceK8OZ/em3rY9pK4VrtezT6qCNmbCA=";
    };
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-kgjooMqeZurzqIn3ADcgFjlqaC58dQNuIAHLx4M0S9I=";
+      hash = "sha256-7B9wS0myf6QkDq4ooqWen03s/36BeF7cSsOzjDdIw8g=";
    };
  };

--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,15 +1,15 @@
 {
-  "version": "15.6.0",
-  "repo_hash": "sha256-7Pjksu1l2QfhpYieEGB9coypSt/0iMfptCa69Iaoe3s=",
+  "version": "15.6.1",
+  "repo_hash": "sha256-cdwfljmJvApU2q0pmWSmcMnHkQH4hfN7+cld5oP880g=",
  "yarn_hash": "0lgl8rs9mlrwpzq75rywdbjbiib17wxvzlv1jibnx66iw1ym2rvh",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v15.6.0-ee",
+  "rev": "v15.6.1-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "15.6.0",
+    "GITALY_SERVER_VERSION": "15.6.1",
    "GITLAB_PAGES_VERSION": "1.63.0",
    "GITLAB_SHELL_VERSION": "14.13.0",
-    "GITLAB_WORKHORSE_VERSION": "15.6.0"
+    "GITLAB_WORKHORSE_VERSION": "15.6.1"
  },
  "vendored_gems": [
    "bundler-checksum",
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -11,7 +11,7 @@ let
    gemdir = ./.;
  };

-  version = "15.6.0";
+  version = "15.6.1";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@ -22,7 +22,7 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      sha256 = "sha256-MQFvDSQhmlCz+ox9TFFEd+q2beDUXYVhIyEWWnxn7r0=";
+      sha256 = "sha256-mzX+6kMXqdrxqMaUwN2tG5kJgKSRv0/tNN8ibHqBbzU=";
    };

    vendorSha256 = "sha256-SEPfso27PHHpvnQwdeMQYECw/CZIa/NdpMBSTRJEwIo=";
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "15.6.0";
+  version = "15.6.1";

  src = fetchFromGitLab {
    owner = data.owner;
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@ -500,7 +500,7 @@ gem 'ssh_data', '~> 1.3'
 gem 'spamcheck', '~> 1.0.0'

 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 15.5.0'
+gem 'gitaly', '~> 15.5.2'

 # KAS GRPC protocol definitions
 gem 'kas-grpc', '~> 0.0.2'
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@ -554,7 +554,7 @@ GEM
      rails (>= 3.2.0)
    git (1.11.0)
      rchardet (~> 1.8)
-    gitaly (15.5.0)
+    gitaly (15.5.2)
      grpc (~> 1.0)
    gitlab (4.16.1)
      httparty (~> 0.14, >= 0.14.0)
@ -1663,7 +1663,7 @@ DEPENDENCIES
  gettext (~> 3.3)
  gettext_i18n_rails (~> 1.8.0)
  gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 15.5.0)
+  gitaly (~> 15.5.2)
  gitlab-chronic (~> 0.10.5)
  gitlab-dangerfiles (~> 3.6.2)
  gitlab-experiment (~> 0.7.1)
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@ -2018,10 +2018,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0hpgljz05rhik15z081ghxw9pw83vz78p12wjdgxj3qz1a4x8pfq";
+      sha256 = "10bq1l9445b9ff921kyayrn5w1b0f7qm1sjia3wmnl54jq2vxfk2";
      type = "gem";
    };
-    version = "15.5.0";
+    version = "15.5.2";
  };
  gitlab = {
    dependencies = ["httparty" "terminal-table"];
--- a/pkgs/applications/version-management/sapling/default.nix
+++ b/pkgs/applications/version-management/sapling/default.nix
@ -1,7 +1,41 @@
-{ lib, stdenv, python3Packages, fetchFromGitHub, fetchurl, sd, curl, pkg-config, openssl, rustPlatform, fetchYarnDeps, yarn, nodejs, fixup_yarn_lock, glibcLocales }:
+{ lib
+, stdenv
+, python38Packages
+, fetchFromGitHub
+, fetchurl
+, sd
+, curl
+, pkg-config
+, openssl
+, rustPlatform
+, fetchYarnDeps
+, yarn
+, nodejs
+, fixup_yarn_lock
+, glibcLocales
+, libiconv
+, CoreFoundation
+, CoreServices
+, Security
+}:

 let
  inherit (lib.importJSON ./deps.json) links version versionHash;
+  # Sapling sets a Cargo config containing lines like so:
+  # [target.aarch64-apple-darwin]
+  # rustflags = ["-C", "link-args=-Wl,-undefined,dynamic_lookup"]
+  #
+  # The default cargo config that's set by the build hook will set
+  # unstable.host-config and unstable.target-applies-to-host which seems to
+  # result in the link arguments above being ignored and thus link failures.
+  # All it is there to do anyway is just to do stuff with musl and cross
+  # compilation, which doesn't work on macOS anyway so we can just stub it
+  # on macOS.
+  #
+  # See https://github.com/NixOS/nixpkgs/pull/198311#issuecomment-1326894295
+  myCargoSetupHook = rustPlatform.cargoSetupHook.overrideAttrs (old: {
+    cargoConfig = if stdenv.isDarwin then "" else old.cargoConfig;
+  });

  src = fetchFromGitHub {
    owner = "facebook";
@ -54,7 +88,11 @@ let
  };

  # Builds the main `sl` binary and its Python extensions
-  sapling = python3Packages.buildPythonPackage {
+  #
+  # FIXME(lf-): when next updating this package, delete the python 3.8 override
+  # here, since the fix for https://github.com/facebook/sapling/issues/279 that
+  # required it will be in the next release.
+  sapling = python38Packages.buildPythonPackage {
    pname = "sapling-main";
    inherit src version;

@ -85,7 +123,7 @@ let
      sed -i "s|https://files.pythonhosted.org/packages/[[:alnum:]]*/[[:alnum:]]*/[[:alnum:]]*/|file://$NIX_BUILD_TOP/$sourceRoot/hack_pydeps/|g" $sourceRoot/setup.py
    '';

-    postFixup = ''
+    postFixup = lib.optionalString stdenv.isLinux ''
      wrapProgram $out/bin/sl \
        --set LOCALE_ARCHIVE "${glibcLocales}/lib/locale/locale-archive"
    '';
@ -94,13 +132,19 @@ let
      curl
      pkg-config
    ] ++ (with rustPlatform; [
-      cargoSetupHook
+      myCargoSetupHook
      rust.cargo
      rust.rustc
    ]);

    buildInputs = [
+      curl
      openssl
+    ] ++ lib.optionals stdenv.isDarwin [
+      libiconv
+      CoreFoundation
+      CoreServices
+      Security
    ];

    doCheck = false;
@ -124,7 +168,7 @@ stdenv.mkDerivation {

    cp -r ${sapling}/* $out

-    sitepackages=$out/lib/${python3Packages.python.libPrefix}/site-packages
+    sitepackages=$out/lib/${python38Packages.python.libPrefix}/site-packages
    chmod +w $sitepackages
    cp -r ${isl} $sitepackages/edenscm-isl

@ -145,7 +189,7 @@ stdenv.mkDerivation {
    homepage = "https://sapling-scm.com";
    license = licenses.gpl2Only;
    maintainers = with maintainers; [ pbar thoughtpolice ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    mainProgram = "sl";
  };
 }
--- a/pkgs/applications/version-management/sourcehut/default.nix
+++ b/pkgs/applications/version-management/sourcehut/default.nix
@ -15,7 +15,6 @@ let
      srht = self.callPackage ./core.nix { inherit fetchNodeModules; };

      buildsrht = self.callPackage ./builds.nix { };
-      dispatchsrht = self.callPackage ./dispatch.nix { };
      gitsrht = self.callPackage ./git.nix { };
      hgsrht = self.callPackage ./hg.nix { };
      hubsrht = self.callPackage ./hub.nix { };
@ -33,7 +32,8 @@ with python.pkgs; recurseIntoAttrs {
  inherit python;
  coresrht = toPythonApplication srht;
  buildsrht = toPythonApplication buildsrht;
-  dispatchsrht = toPythonApplication dispatchsrht;
+  # Added 2022-10-29
+  dispatchsrht = throw "dispatch is deprecated. See https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/ for more information.";
  gitsrht = toPythonApplication gitsrht;
  hgsrht = toPythonApplication hgsrht;
  hubsrht = toPythonApplication hubsrht;
--- a/pkgs/applications/version-management/sourcehut/dispatch.nix
+++ b/pkgs/applications/version-management/sourcehut/dispatch.nix
@ -1,40 +0,0 @@
-{ lib
-, fetchFromSourcehut
-, buildPythonPackage
-, srht
-, pyyaml
-, PyGithub
-, python
-}:
-
-buildPythonPackage rec {
-  pname = "dispatchsrht";
-  version = "0.15.34";
-
-  src = fetchFromSourcehut {
-    owner = "~sircmpwn";
-    repo = "dispatch.sr.ht";
-    rev = version;
-    sha256 = "sha256-bZ4ZKohMozZIyP0TUgxETOECib4XGUv29+Mg8ZsoMf8=";
-  };
-
-  propagatedBuildInputs = [
-    srht
-    pyyaml
-    PyGithub
-  ];
-
-  preBuild = ''
-    export PKGVER=${version}
-    export SRHT_PATH=${srht}/${python.sitePackages}/srht
-  '';
-
-  pythonImportsCheck = [ "dispatchsrht" ];
-
-  meta = with lib; {
-    homepage = "https://git.sr.ht/~sircmpwn/dispatch.sr.ht";
-    description = "Task dispatcher and service integration tool for the sr.ht network";
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ eadwu ];
-  };
-}
--- a/pkgs/applications/version-management/sourcehut/update.sh
+++ b/pkgs/applications/version-management/sourcehut/update.sh
@ -67,7 +67,7 @@ else
  # because the reported $oldHash to be changed
  # may not actually be in $default_nix
  # but in the file of one of its dependencies.
-  services=( "srht" "scmsrht" "buildsrht" "dispatchsrht" "gitsrht" "hgsrht" "hubsrht" "listssrht" "mansrht"
+  services=( "srht" "scmsrht" "buildsrht" "gitsrht" "hgsrht" "hubsrht" "listssrht" "mansrht"
             "metasrht" "pagessrht" "pastesrht" "todosrht" )
 fi

--- a/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-vkcapture.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-vkcapture";
-  version = "1.2.1";
+  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "nowrep";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-FOyUgsHQlsjVGCct+ky189alVImoG+paqDKmGvnHoXo=";
+    hash = "sha256-Ya4p0eXOTID1qmxokgSXdmBOd3nqzcOHM+pLqJi8LGg=";
  };

  cmakeFlags = lib.optionals stdenv.isi686 [
--- a/pkgs/development/compilers/gnostic/default.nix
+++ b/pkgs/development/compilers/gnostic/default.nix
@ -0,0 +1,26 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "gnostic";
+  version = "0.6.8";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-+/KZmwVV3pnbv3JNwNk9Q2gcTyDxV1tgsDzW5IYnnds=";
+  };
+
+  vendorHash = "sha256-OoI1/OPBgAy4AysPPSCXGmf0S4opzxO7ZrwBsQYImwU=";
+
+  # some tests are broken and others require network access
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/google/gnostic";
+    description = "A compiler for APIs described by the OpenAPI Specification with plugins for code generation and other API support tasks";
+    changelog = "https://github.com/google/gnostic/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ urandom ];
+  };
+}
--- a/pkgs/development/compilers/mono/generic.nix
+++ b/pkgs/development/compilers/mono/generic.nix
@ -1,4 +1,5 @@
-{ lib, stdenv, fetchurl, bison, pkg-config, glib, gettext, perl, libgdiplus, libX11, callPackage, ncurses, zlib, withLLVM ? false, cacert, Foundation, libobjc, python3, version, sha256, autoconf, libtool, automake, cmake, which
+{ lib, stdenv, fetchurl, bison, pkg-config, glib, gettext, perl, libgdiplus, libX11, callPackage, ncurses, zlib
+, withLLVM ? false, cacert, Foundation, libobjc, python3, version, sha256, autoconf, libtool, automake, cmake, which
 , gnumake42
 , enableParallelBuilding ? true
 , srcArchiveSuffix ? "tar.bz2"
@ -6,7 +7,7 @@
 }:

 let
-  llvm     = callPackage ./llvm.nix { };
+  llvm = callPackage ./llvm.nix { };
 in
 stdenv.mkDerivation rec {
  pname = "mono";
@ -18,23 +19,21 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ automake bison cmake pkg-config which gnumake42 ];
-  buildInputs =
-    [ glib gettext perl libgdiplus libX11 ncurses zlib python3 autoconf libtool
-    ]
-    ++ (lib.optionals stdenv.isDarwin [ Foundation libobjc ]);
+  buildInputs = [
+    glib gettext perl libgdiplus libX11 ncurses zlib python3 autoconf libtool
+  ] ++ lib.optionals stdenv.isDarwin [ Foundation libobjc ];

  configureFlags = [
    "--x-includes=${libX11.dev}/include"
    "--x-libraries=${libX11.out}/lib"
    "--with-libgdiplus=${libgdiplus}/lib/libgdiplus.so"
-  ]
-  ++ lib.optionals withLLVM [
+  ] ++ lib.optionals withLLVM [
    "--enable-llvm"
    "--with-llvm=${llvm}"
  ];

  configurePhase = ''
-    patchShebangs ./
+    patchShebangs autogen.sh mcs/build/start-compiler-server.sh
    ./autogen.sh --prefix $out $configureFlags
  '';

--- a/pkgs/development/interpreters/python/manylinux/default.nix
+++ b/pkgs/development/interpreters/python/manylinux/default.nix
@ -65,7 +65,7 @@ let
  manylinux1Libs = getLibOutputs(manylinux2010Libs // (with pkgs; {
    "libpanelw.so.5" = ncurses5;
    "libncursesw.so.5" = ncurses5;
-    "libcrypt.so.1" = glibc;
+    "libcrypt.so.1" = libxcrypt;
    }));

 in {
--- a/pkgs/development/java-modules/postgresql_jdbc/default.nix
+++ b/pkgs/development/java-modules/postgresql_jdbc/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "postgresql-jdbc";
-  version = "42.5.0";
+  version = "42.5.1";

  src = fetchMavenArtifact {
    artifactId = "postgresql";
    groupId = "org.postgresql";
-    sha256 = "sha256-pNGLWrGuuShaixezZfQk8mhEUinKv45BIRXbYVK33uM=";
+    sha256 = "sha256-iei/+os3uUh5RgEsaQzwTzEDlTBRwcGT2I7ja2jTZa4=";
    inherit version;
  };

--- a/pkgs/development/libraries/libdbi-drivers/default.nix
+++ b/pkgs/development/libraries/libdbi-drivers/default.nix
@ -1,10 +1,10 @@
 { lib, stdenv, fetchurl, libdbi
+# TODO: migrate away from overriding packages to null
 , libmysqlclient ? null
 , sqlite ? null
 , postgresql ? null
 }:

-with lib;
 stdenv.mkDerivation rec {
  pname = "libdbi-drivers";
  version = "0.9.0";
@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
    sha256 = "0m680h8cc4428xin4p733azysamzgzcmv4psjvraykrsaz6ymlj3";
  };

-  buildInputs = [ libdbi sqlite postgresql ] ++ optional (libmysqlclient != null) libmysqlclient;
+  buildInputs = [ libdbi sqlite postgresql ] ++ lib.optional (libmysqlclient != null) libmysqlclient;

  postPatch = ''
    sed -i '/SQLITE3_LIBS/ s/-lsqlite/-lsqlite3/' configure;
@ -27,15 +27,15 @@ stdenv.mkDerivation rec {
    "--enable-libdbi"
    "--with-dbi-incdir=${libdbi}/include"
    "--with-dbi-libdir=${libdbi}/lib"
-  ] ++ optionals (libmysqlclient != null) [
+  ] ++ lib.optionals (libmysqlclient != null) [
    "--with-mysql"
-    "--with-mysql-incdir=${getDev libmysqlclient}/include/mysql"
+    "--with-mysql-incdir=${lib.getDev libmysqlclient}/include/mysql"
    "--with-mysql-libdir=${libmysqlclient}/lib/mysql"
-  ] ++ optionals (sqlite != null) [
+  ] ++ lib.optionals (sqlite != null) [
    "--with-sqlite3"
    "--with-sqlite3-incdir=${sqlite.dev}/include/sqlite"
    "--with-sqlite3-libdir=${sqlite.out}/lib/sqlite"
-  ] ++ optionals (postgresql != null) [
+  ] ++ lib.optionals (postgresql != null) [
    "--with-pgsql"
    "--with-pgsql_incdir=${postgresql}/include"
    "--with-pgsql_libdir=${postgresql.lib}/lib"
@ -54,10 +54,11 @@ stdenv.mkDerivation rec {
    rm -rf $out/var
  '';

-  meta = {
+  meta = with lib; {
    homepage = "http://libdbi-drivers.sourceforge.net/";
    description = "Database drivers for libdbi";
    platforms = platforms.all;
    license = licenses.lgpl21;
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/libraries/spirv-headers/default.nix
+++ b/pkgs/development/libraries/spirv-headers/default.nix
@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
  '';

  meta = with lib; {
-    inherit (src.meta) homepage;
    description = "Machine-readable components of the Khronos SPIR-V Registry";
+    homepage = "https://github.com/KhronosGroup/SPIRV-Headers";
    license = licenses.mit;
    maintainers = [ maintainers.ralith ];
  };
--- a/pkgs/development/python-modules/openstacksdk/default.nix
+++ b/pkgs/development/python-modules/openstacksdk/default.nix
@ -19,14 +19,14 @@

 buildPythonPackage rec {
  pname = "openstacksdk";
-  version = "0.102.0";
+  version = "0.103.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-sqGP66eerCrDRpyNr+AdQAjIrDC+OkxrUydbTxxroq0=";
+    hash = "sha256-T58RiYZgOWdDXzl2s+BZlQpxvY5BqDFsyK+y2WaKB0E=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/openstacksdk/tests.nix
+++ b/pkgs/development/python-modules/openstacksdk/tests.nix
@ -13,9 +13,10 @@
 , testscenarios
 }:

-buildPythonPackage rec {
+buildPythonPackage {
  pname = "openstacksdk-tests";
  inherit (openstacksdk) version;
+  format = "other";

  src = openstacksdk.src;

--- a/pkgs/development/python-modules/pycfdns/default.nix
+++ b/pkgs/development/python-modules/pycfdns/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "pycfdns";
-  version = "2.0.0";
+  version = "2.0.1";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "ludeeus";
    repo = pname;
-    rev = version;
-    sha256 = "sha256-2vjeoI+IqvCIHb51BLkuTISbG0PxFGHlmpSiCaV+E0w=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-f6kxYX/dg16OWYpw29dH4Z26ncLZCYyHKGc4fzoCld0=";
  };

  propagatedBuildInputs = [
@ -32,6 +32,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python module for updating Cloudflare DNS A records";
    homepage = "https://github.com/ludeeus/pycfdns";
+    changelog = "https://github.com/ludeeus/pycfdns/releases/tag/${version}";
    license = with licenses; [ mit ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/pyoctoprintapi/default.nix
+++ b/pkgs/development/python-modules/pyoctoprintapi/default.nix
@ -12,7 +12,7 @@

 let
  pname = "pyoctoprintapi";
-  version = "0.1.9";
+  version = "0.1.10";
 in
 buildPythonPackage {
  inherit pname version;
@ -22,7 +22,7 @@ buildPythonPackage {
    owner = "rfleming71";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-kZMTHw0S12aUn/DYQuyjQa48QtiwLGYyY4gYKA5063A=";
+    hash = "sha256-aXT8BY7D7Tx3UG7Brfpk8yQv1opXQUsgJteNkBwHeYY=";
  };

  propagatedBuildInputs = [
@ -41,6 +41,7 @@ buildPythonPackage {
  meta = with lib; {
    description = "Simple async wrapper around the Octoprint API";
    homepage = "https://github.com/rfleming71/pyoctoprintapi";
+    changelog = "https://github.com/rfleming71/pyoctoprintapi/releases/tag/v${version}";
    license = licenses.mit;
    maintainers= with maintainers; [ hexa ];
  };
--- a/pkgs/development/tools/nil/default.nix
+++ b/pkgs/development/tools/nil/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "nil";
-  version = "2022-11-15";
+  version = "2022-12-01";

  src = fetchFromGitHub {
    owner = "oxalica";
    repo = pname;
    rev = version;
-    hash = "sha256-KzQmGCEaOACOqaE1LsVZsqn18XpjlUbGWztDEI+o++w=";
+    hash = "sha256-E/QGmoL7Q3GDR2/I5o2CAMHMcmPQEJAySke1s+nOaho=";
  };

-  cargoHash = "sha256-t5HfL7DKMcWJGod6x30NoHYYlAza++fEdEVvfvFWems=";
+  cargoHash = "sha256-T3i86L6cF6uFbSs7xtKHGzB6XrE9jn2RZghxFzDleXU=";

  CFG_DATE = version;
  CFG_REV = "release";
--- a/pkgs/development/tools/rust/cargo-apk/default.nix
+++ b/pkgs/development/tools/rust/cargo-apk/default.nix
@ -0,0 +1,24 @@
+{ lib
+, stdenv
+, rustPlatform
+, fetchCrate
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-apk";
+  version = "0.9.6";
+
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "sha256-1vCrM+0SNefd7FrRXnSjLhM3/MSVJfcL4k1qAstX+/A=";
+  };
+
+  cargoSha256 = "sha256-rGn3MKbqIRWayarsgedIOhuTTl8lyRsRxn7BN5Id97w=";
+
+  meta = with lib; {
+    description = "Tool for creating Android packages";
+    homepage = "https://github.com/rust-windowing/android-ndk-rs";
+    license = with licenses;[ mit asl20 ];
+    maintainers = with maintainers; [ nickcao ];
+  };
+}
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@ -38,8 +38,8 @@ stdenv.mkDerivation rec {
  '';

  meta = with lib; {
-    inherit (src.meta) homepage;
    description = "The SPIR-V Tools project provides an API and commands for processing SPIR-V modules";
+    homepage = "https://github.com/KhronosGroup/SPIRV-Tools";
    license = licenses.asl20;
    platforms = platforms.unix;
    maintainers = [ maintainers.ralith ];
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@ -17,15 +17,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "deno";
-  version = "1.28.2";
+  version = "1.28.3";

  src = fetchFromGitHub {
    owner = "denoland";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-gmDR8KNpx+M66Rv8fooTQOY42ekYl+KwIQ/5jDvYQho=";
+    sha256 = "sha256-Rkzr5Y50Z2A+TeWCrrC6GUvu8/x6IgDxvd8D6mKbIGE=";
  };
-  cargoSha256 = "sha256-emf6Q3WQM8W0yPvuNXPeuRC7FOt8QJ/+b5kMzyd3ZCU=";
+  cargoSha256 = "sha256-n2K0CghobLri69oMrs8nCNSwq/5eH3YlzLtC9JRriQ8=";

  postPatch = ''
    # upstream uses lld on aarch64-darwin for faster builds
--- a/pkgs/development/web/deno/librusty_v8.nix
+++ b/pkgs/development/web/deno/librusty_v8.nix
@ -11,11 +11,11 @@ let
  };
 in
 fetch_librusty_v8 {
-  version = "0.55.0";
+  version = "0.58.0";
  shas = {
-    x86_64-linux = "sha256-HztOb1r/9tWh0w4zQveBLOh3d6OfnSwQZkIx6drXJ7M=";
-    aarch64-linux = "sha256-rP0K875V4f4yHe7unUCpMCQbi7Fips6474gFZph73Ys=";
-    x86_64-darwin = "sha256-iiYttjs9h84YqZG8prxudTTi588BuoqA3zc2LkEks5E=";
-    aarch64-darwin = "sha256-RBA3fl3YdCqxb00xgl6KTYdbvl75U5Kgrux5N+dZg/g=";
+    x86_64-linux = "sha256-x4KLjexiLobbrLBvrE99XsVIw2LcUuu2Huk7nRBLRM4=";
+    aarch64-linux = "sha256-HSRLRF86nriU5ZkuZhQcqLFFMO4bstP8bR2tgF2XvbU=";
+    x86_64-darwin = "sha256-dHrotM/my1DQYGvHHQm726JgaLbC64IvwJGKgw9kZMM=";
+    aarch64-darwin = "sha256-QDBF/ssxXMIWEZHSv7e/E75XZVPx/MvGvGI/C45q2bE=";
  };
 }
--- a/pkgs/games/blobby/blobby.sh
+++ b/pkgs/games/blobby/blobby.sh
@ -7,4 +7,4 @@ test -d ~/.blobby || {
  ( cd ~/.blobby; for i in *.zip; do @unzip@/bin/unzip "$i"; done )
 }

-@out@/bin/blobby.bin
+exec @out@/bin/blobby.bin "$@"
--- a/pkgs/games/blobby/default.nix
+++ b/pkgs/games/blobby/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, SDL2, SDL2_image, libGLU, libGL, cmake, physfs, boost, zip, zlib, pkg-config }:
+{ lib, stdenv, fetchurl, SDL2, SDL2_image, libGLU, libGL, cmake, physfs, boost, zip, zlib, unzip, pkg-config }:

 stdenv.mkDerivation rec {
  pname = "blobby-volley";
@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
    sed -e '1i#include <iostream>' -i src/NetworkMessage.cpp
  '';

+  inherit unzip;
+
  postInstall = ''
    cp ../data/Icon.bmp "$out/share/blobby/"
    mv "$out/bin"/blobby{,.bin}
@ -28,7 +30,8 @@ stdenv.mkDerivation rec {
    license = licenses.bsd3;
    platforms = platforms.linux;
    maintainers = with maintainers; [ raskin ];
-    homepage = "http://blobby.sourceforge.net/";
+    homepage = "https://blobbyvolley.de/";
    downloadPage = "https://sourceforge.net/projects/blobby/files/Blobby%20Volley%202%20%28Linux%29/";
+    mainProgram = "blobby";
  };
 }
--- a/pkgs/servers/libreddit/default.nix
+++ b/pkgs/servers/libreddit/default.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "libreddit";
-  version = "0.24.1";
+  version = "0.24.2";

  src = fetchFromGitHub {
    owner = "libreddit";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-LS9yUjKv0GxK6wGo0f5jHAn7vyo+tvgHd3NWLYpAQOs=";
+    hash = "sha256-TT0DTD/X4cHIZGrwxyqOOFevAHwqYfmIJ13+oscQpws=";
  };

-  cargoSha256 = "sha256-14tJLhWITCz/e+XuCww2GVZ+sXy08LQe+DpL4tkLUzE=";
+  cargoSha256 = "sha256-RAToJZTaWVnxGdWSJdLSJ7JUPT+l5VfPzvNOhXgdneY=";

  buildInputs = lib.optional stdenv.isDarwin [
    Security
--- a/pkgs/servers/mpd/default.nix
+++ b/pkgs/servers/mpd/default.nix
@ -116,13 +116,13 @@ let

    in stdenv.mkDerivation rec {
      pname = "mpd";
-      version = "0.23.9";
+      version = "0.23.11";

      src = fetchFromGitHub {
        owner  = "MusicPlayerDaemon";
        repo   = "MPD";
        rev    = "v${version}";
-        sha256 = "sha256-eYP4+WDYwAw7TboS9V8ncdQoAC0vbjSaZxmru1Unejw=";
+        sha256 = "sha256-vgLH4kOluK9cOmTrvpBfR87Iunn0EzH9GmiUvsjsG4I=";
      };

      buildInputs = [
--- a/pkgs/servers/web-apps/dolibarr/default.nix
+++ b/pkgs/servers/web-apps/dolibarr/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "dolibarr";
-  version = "16.0.1";
+  version = "16.0.3";

  src = fetchFromGitHub {
    owner = "Dolibarr";
    repo = "dolibarr";
    rev = version;
-    sha256 = "sha256-67Ox0DP4vfiz8GgD3nfa4FyB6Qrqkc2zt1iMS584CWs=";
+    sha256 = "sha256-Zkjmm2DAaAGQc1IigMYDpE5b+YaYU8oFMHZSqBEBsRw=";
  };

  dontBuild = true;
--- a/pkgs/servers/zoneminder/default.nix
+++ b/pkgs/servers/zoneminder/default.nix
@ -122,7 +122,7 @@ in stdenv.mkDerivation rec {
  '';

  buildInputs = [
-    curl ffmpeg glib libjpeg libselinux libsepol mp4v2 libmysqlclient mariadb.client pcre perl polkit x264 zlib
+    curl ffmpeg glib libjpeg libselinux libsepol mp4v2 libmysqlclient mariadb pcre perl polkit x264 zlib
    util-linuxMinimal # for libmount
  ] ++ (with perlPackages; [
    # build-time dependencies
--- a/pkgs/tools/security/crowdsec/default.nix
+++ b/pkgs/tools/security/crowdsec/default.nix
@ -0,0 +1,60 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "crowdsec";
+  version = "1.4.2";
+
+  src = fetchFromGitHub {
+    owner = "crowdsecurity";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-hL3+hTOuwcbxiVZeq9oZjfKI1TJJt64g+74NolA3Drc=";
+  };
+
+  vendorHash = "sha256-FPsoufB9UDgBDIE3yUq4doBse3qgjP19ussYnMAxntk=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  subPackages = [
+    "cmd/crowdsec"
+    "cmd/crowdsec-cli"
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/crowdsecurity/crowdsec/pkg/cwversion.Version=v${version}"
+    "-X github.com/crowdsecurity/crowdsec/pkg/cwversion.BuildDate=1970-01-01_00:00:00"
+  ];
+
+  postBuild = "mv $GOPATH/bin/{crowdsec-cli,cscli}";
+
+  postInstall = ''
+    mkdir -p $out/share/crowdsec
+    cp -r ./config $out/share/crowdsec/
+
+    installShellCompletion --cmd cscli \
+      --bash <($out/bin/cscli completion bash) \
+      --fish <($out/bin/cscli completion fish) \
+      --zsh <($out/bin/cscli completion zsh)
+  '';
+
+  meta = with lib; {
+    homepage = "https://crowdsec.net/";
+    changelog = "https://github.com/crowdsecurity/crowdsec/releases/tag/v${version}";
+    description = "CrowdSec is a free, open-source and collaborative IPS";
+    longDescription = ''
+      CrowdSec is a free, modern & collaborative behavior detection engine,
+      coupled with a global IP reputation network. It stacks on fail2ban's
+      philosophy but is IPV6 compatible and 60x faster (Go vs Python), uses Grok
+      patterns to parse logs and YAML scenario to identify behaviors. CrowdSec
+      is engineered for modern Cloud/Containers/VM based infrastructures (by
+      decoupling detection and remediation). Once detected you can remedy
+      threats with various bouncers (firewall block, nginx http 403, Captchas,
+      etc.) while the aggressive IP can be sent to CrowdSec for curation before
+      being shared among all users to further improve everyone's security.
+    '';
+    license = licenses.mit;
+    maintainers = with maintainers; [ jk urandom ];
+  };
+}
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -4049,6 +4049,8 @@ with pkgs;

  crossplane = with python3Packages; toPythonApplication crossplane;

+  crowdsec = callPackage ../tools/security/crowdsec { };
+
  crunch = callPackage ../tools/security/crunch { };

  crudini = callPackage ../tools/misc/crudini { };
@ -14527,6 +14529,8 @@ with pkgs;

  glslang = callPackage ../development/compilers/glslang { };

+  gnostic = callPackage ../development/compilers/gnostic {};
+
  go-junit-report = callPackage ../development/tools/go-junit-report { };

  gobang = callPackage ../development/tools/database/gobang {
@ -15181,6 +15185,7 @@ with pkgs;

  cargo-about = callPackage ../development/tools/rust/cargo-about { };
  cargo-all-features = callPackage ../development/tools/rust/cargo-all-features { };
+  cargo-apk = callPackage ../development/tools/rust/cargo-apk { };
  cargo-audit = callPackage ../development/tools/rust/cargo-audit {
    inherit (darwin.apple_sdk.frameworks) Security;
  };
@ -30433,7 +30438,9 @@ with pkgs;
    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
  };

-  sapling = callPackage ../applications/version-management/sapling { };
+  sapling = callPackage ../applications/version-management/sapling {
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices Security;
+  };

  mercurialFull = mercurial.override { fullBuild = true; };